Analysis
- max time kernel
149s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
23/08/2026, 04:37
General
- Target 2026-08-22_957e5f84011287ec30b67524fdaa1a5d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 361KB
- Sample260823-e8ttsssgkb
- SHA256 efb3d056c540341c9fa906894a2253bdab77ebf68fd51696ff773fed6c233fcd
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba
-
http://xytets.com:2345/t.asp?os=home
-
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-22_957e5f84011287ec30b67524fdaa1a5d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-22_957e5f84011287ec30b67524fdaa1a5d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\ausnkfcauspnhfax.exeC:\Temp\ausnkfcauspnhfax.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\icxvpkfxpn.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\icxvpkfxpn.exeC:\Temp\icxvpkfxpn.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_icxvpkfxpn.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_icxvpkfxpn.exeC:\Temp\i_icxvpkfxpn.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mkecwupmke.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\mkecwupmke.exeC:\Temp\mkecwupmke.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mkecwupmke.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_mkecwupmke.exeC:\Temp\i_mkecwupmke.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bztrpjhbzx.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\bztrpjhbzx.exeC:\Temp\bztrpjhbzx.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bztrpjhbzx.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_bztrpjhbzx.exeC:\Temp\i_bztrpjhbzx.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ebzwromjhb.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ebzwromjhb.exeC:\Temp\ebzwromjhb.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ebzwromjhb.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ebzwromjhb.exeC:\Temp\i_ebzwromjhb.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gewtoljdbw.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\gewtoljdbw.exeC:\Temp\gewtoljdbw.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gewtoljdbw.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_gewtoljdbw.exeC:\Temp\i_gewtoljdbw.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\lgdyvtqoig.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\lgdyvtqoig.exeC:\Temp\lgdyvtqoig.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_lgdyvtqoig.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_lgdyvtqoig.exeC:\Temp\i_lgdyvtqoig.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\lidayvqnid.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\lidayvqnid.exeC:\Temp\lidayvqnid.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_lidayvqnid.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_lidayvqnid.exeC:\Temp\i_lidayvqnid.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vpnifaxsqk.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\vpnifaxsqk.exeC:\Temp\vpnifaxsqk.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vpnifaxsqk.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_vpnifaxsqk.exeC:\Temp\i_vpnifaxsqk.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\axspkicsmk.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\axspkicsmk.exeC:\Temp\axspkicsmk.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_axspkicsmk.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_axspkicsmk.exeC:\Temp\i_axspkicsmk.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\usmkecxrpk.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\usmkecxrpk.exeC:\Temp\usmkecxrpk.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_usmkecxrpk.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_usmkecxrpk.exeC:\Temp\i_usmkecxrpk.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rpjhbzurpj.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\rpjhbzurpj.exeC:\Temp\rpjhbzurpj.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rpjhbzurpj.exe ups_ins3⤵
-
C:\Temp\i_rpjhbzurpj.exeC:\Temp\i_rpjhbzurpj.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wuomjecwtr.exe ups_run3⤵
-
C:\Temp\wuomjecwtr.exeC:\Temp\wuomjecwtr.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wuomjecwtr.exe ups_ins3⤵
-
C:\Temp\i_wuomjecwtr.exeC:\Temp\i_wuomjecwtr.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hezwtoljey.exe ups_run3⤵
-
C:\Temp\hezwtoljey.exeC:\Temp\hezwtoljey.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hezwtoljey.exe ups_ins3⤵
-
C:\Temp\i_hezwtoljey.exeC:\Temp\i_hezwtoljey.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gdywqoigay.exe ups_run3⤵
-
C:\Temp\gdywqoigay.exeC:\Temp\gdywqoigay.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gdywqoigay.exe ups_ins3⤵
-
C:\Temp\i_gdywqoigay.exeC:\Temp\i_gdywqoigay.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\lfdbvtqnig.exe ups_run3⤵
-
C:\Temp\lfdbvtqnig.exeC:\Temp\lfdbvtqnig.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_lfdbvtqnig.exe ups_ins3⤵
-
C:\Temp\i_lfdbvtqnig.exeC:\Temp\i_lfdbvtqnig.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fdxvsnkidx.exe ups_run3⤵
-
C:\Temp\fdxvsnkidx.exeC:\Temp\fdxvsnkidx.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fdxvsnkidx.exe ups_ins3⤵
-
C:\Temp\i_fdxvsnkidx.exeC:\Temp\i_fdxvsnkidx.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\kfdxvsnkfd.exe ups_run3⤵
-
C:\Temp\kfdxvsnkfd.exeC:\Temp\kfdxvsnkfd.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_kfdxvsnkfd.exe ups_ins3⤵
-
C:\Temp\i_kfdxvsnkfd.exeC:\Temp\i_kfdxvsnkfd.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\kicauspnhf.exe ups_run3⤵
-
C:\Temp\kicauspnhf.exeC:\Temp\kicauspnhf.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_kicauspnhf.exe ups_ins3⤵
-
C:\Temp\i_kicauspnhf.exeC:\Temp\i_kicauspnhf.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\kecwupmhez.exe ups_run3⤵
-
C:\Temp\kecwupmhez.exeC:\Temp\kecwupmhez.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_kecwupmhez.exe ups_ins3⤵
-
C:\Temp\i_kecwupmhez.exeC:\Temp\i_kecwupmhez.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\cwurmjebzw.exe ups_run3⤵
-
C:\Temp\cwurmjebzw.exeC:\Temp\cwurmjebzw.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x268,0x300,0x7ffdbb2ac188,0x7ffdbb2ac194,0x7ffdbb2ac1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,12278116756457079130,9864685499452237796,262144 --field-trial-handle=2792,i,17377723262071514404,6508630714214341719,262144 --variations-seed-version --mojo-platform-channel-handle=2788 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1852,i,14714147164817465331,17750174477802795705,524288 --field-trial-handle=2792,i,17377723262071514404,6508630714214341719,262144 --variations-seed-version --mojo-platform-channel-handle=2884 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2288,i,12110975838196845712,11904152679460456139,524288 --field-trial-handle=2792,i,17377723262071514404,6508630714214341719,262144 --variations-seed-version --mojo-platform-channel-handle=3040 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3584,i,2860342636743180124,17971410130937009521,2097152 --field-trial-handle=2792,i,17377723262071514404,6508630714214341719,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3588,i,1522434356208802883,9973402147997033713,2097152 --field-trial-handle=2792,i,17377723262071514404,6508630714214341719,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4224,i,12385405821571603034,14270382642759157725,2097152 --field-trial-handle=2792,i,17377723262071514404,6508630714214341719,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4300,i,11385571687880257806,10995215701421201108,2097152 --field-trial-handle=2792,i,17377723262071514404,6508630714214341719,262144 --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3740,i,13101907914017945229,18267669867966816388,524288 --field-trial-handle=2792,i,17377723262071514404,6508630714214341719,262144 --variations-seed-version --mojo-platform-channel-handle=3748 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5424,i,204441958266459518,2668975192014764251,524288 --field-trial-handle=2792,i,17377723262071514404,6508630714214341719,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5412,i,13822424933676678440,685829292904429237,524288 --field-trial-handle=2792,i,17377723262071514404,6508630714214341719,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5824,i,470198279801070063,5456937178627570086,524288 --field-trial-handle=2792,i,17377723262071514404,6508630714214341719,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5824,i,470198279801070063,5456937178627570086,524288 --field-trial-handle=2792,i,17377723262071514404,6508630714214341719,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,8854965656853635685,5379829180650101976,524288 --field-trial-handle=2792,i,17377723262071514404,6508630714214341719,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6444,i,11247336801658123065,6567675355232890342,524288 --field-trial-handle=2792,i,17377723262071514404,6508630714214341719,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6456,i,34862515002324400,533907986606751112,524288 --field-trial-handle=2792,i,17377723262071514404,6508630714214341719,262144 --variations-seed-version --mojo-platform-channel-handle=6584 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6348,i,6758194854821285657,5544558847455237143,524288 --field-trial-handle=2792,i,17377723262071514404,6508630714214341719,262144 --variations-seed-version --mojo-platform-channel-handle=6596 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5384,i,2580737581820604364,4989849285691467503,524288 --field-trial-handle=2792,i,17377723262071514404,6508630714214341719,262144 --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5368,i,16926320305687832617,15617845083179419117,524288 --field-trial-handle=2792,i,17377723262071514404,6508630714214341719,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5364,i,1590468201964689250,14993329923940695057,524288 --field-trial-handle=2792,i,17377723262071514404,6508630714214341719,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4952,i,12717306686667856449,17298079115276550085,524288 --field-trial-handle=2792,i,17377723262071514404,6508630714214341719,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6324,i,6797160218181906188,7677495696594285666,524288 --field-trial-handle=2792,i,17377723262071514404,6508630714214341719,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4100,i,8600419593099992644,14818392044383822200,524288 --field-trial-handle=2792,i,17377723262071514404,6508630714214341719,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6584,i,1959457340284243871,218434882140126898,524288 --field-trial-handle=2792,i,17377723262071514404,6508630714214341719,262144 --variations-seed-version --mojo-platform-channel-handle=6816 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6044,i,1843917110081488309,13924028829700146689,262144 --field-trial-handle=2792,i,17377723262071514404,6508630714214341719,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6768,i,10148853159852247872,5017807750054238718,524288 --field-trial-handle=2792,i,17377723262071514404,6508630714214341719,262144 --variations-seed-version --mojo-platform-channel-handle=6764 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\ausnkfcauspnhfax.sysC:\Temp\ausnkfcauspnhfax.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Temp\xusmkecxup.sysC:\Temp\xusmkecxup.sys1⤵
- Executes dropped EXE
-
C:\Temp\ecwrpjhbzx.sysC:\Temp\ecwrpjhbzx.sys1⤵
- Executes dropped EXE
-
C:\Temp\jecwurpmge.sysC:\Temp\jecwurpmge.sys1⤵
- Executes dropped EXE
-
C:\Temp\rljebwuomg.sysC:\Temp\rljebwuomg.sys1⤵
- Executes dropped EXE
-
C:\Temp\jgbytqljge.sysC:\Temp\jgbytqljge.sys1⤵
- Executes dropped EXE
-
C:\Temp\lidaytqolf.sysC:\Temp\lidaytqolf.sys1⤵
- Executes dropped EXE
-
C:\Temp\ifdxvtndxv.sysC:\Temp\ifdxvtndxv.sys1⤵
- Executes dropped EXE
-
C:\Temp\kicausnkic.sysC:\Temp\kicausnkic.sys1⤵
- Executes dropped EXE
-
C:\Temp\uspkhczxus.sysC:\Temp\uspkhczxus.sys1⤵
- Executes dropped EXE
-
C:\Temp\pmheczusmk.sysC:\Temp\pmheczusmk.sys1⤵
- Executes dropped EXE
-
C:\Temp\ecwupjhbzw.sysC:\Temp\ecwupjhbzw.sys1⤵
-
C:\Temp\ebztromgeb.sysC:\Temp\ebztromgeb.sys1⤵
-
C:\Temp\geywqoigby.sysC:\Temp\geywqoigby.sys1⤵
-
C:\Temp\nlfdyvqoig.sysC:\Temp\nlfdyvqoig.sys1⤵
-
C:\Temp\sqlidavsqo.sysC:\Temp\sqlidavsqo.sys1⤵
-
C:\Temp\nlfdxvqnif.sysC:\Temp\nlfdxvqnif.sys1⤵
-
C:\Temp\nkfdxvpnhf.sysC:\Temp\nkfdxvpnhf.sys1⤵
-
C:\Temp\khcwusmkec.sysC:\Temp\khcwusmkec.sys1⤵
-
C:\Temp\mjhczurmkh.sysC:\Temp\mjhczurmkh.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CreateProcess.exe
ausnkfcauspnhfax.exe
ausnkfcauspnhfax.sys
bztrpjhbzx.exe
ebzwromjhb.exe
ecwrpjhbzx.sys
gewtoljdbw.exe
i_bztrpjhbzx.exe
i_ebzwromjhb.exe
i_gewtoljdbw.exe
i_icxvpkfxpn.exe
i_mkecwupmke.exe
icxvpkfxpn.exe
jecwurpmge.sys
jgbytqljge.sys
lgdyvtqoig.exe
mkecwupmke.exe
rljebwuomg.sys
xusmkecxup.sys
settings.dat
settings.dat
the-real-index
the-real-index~RFe5a3838.TMP
SiteList-Enterprise.json
Edge Profile.ico
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Preferences
Preferences
Preferences
Secure Preferences
OperationConfig
OperationConfig~RFe5ad524.TMP
Local State
Local State
Local State
Local State
Local State
metadata.json
metadata.json
metadata.json
edc29a8e-00f7-4e5c-8f9a-90638c10d03b.tmp
38258e43-1cce-4485-aaa9-919fe1f7c23c.tmp
e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
metadata.json~RFe5a0fef.TMP
dbb1cd06-5894-4ec8-9a6e-26824e9828fd.tmp
content_new.js
memory/828-665-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1624-572-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1732-724-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1880-510-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2060-621-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2204-66-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2576-470-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3008-566-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3008-523-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3116-547-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3124-720-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3124-702-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3384-423-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3860-645-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4324-641-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4452-681-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4576-498-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4576-511-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5072-676-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5656-551-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5704-706-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5704-726-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5744-601-0x0000000000010000-0x00000000000AB000-memory.dmp