Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
17/05/2026, 11:19
General
- Target 2026-05-17_c39546a5ae4c2874cdca24df1f0e5735_amadey_darkgate_elex_smoke-loader_stop.exe
- Size 384KB
- Sample260517-nfbbesbt9p
- SHA256 67be3384da22e8ba6f2a6755d9c830b5bf6c7ac2a6c019b055aade4738e50b12
Score
10/10
Malware Config
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 41 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 19 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 29 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 3 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-17_c39546a5ae4c2874cdca24df1f0e5735_amadey_darkgate_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-17_c39546a5ae4c2874cdca24df1f0e5735_amadey_darkgate_elex_smoke-loader_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\ecwuomhezxrpjhbz.exeC:\Temp\ecwuomhezxrpjhbz.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\omhezwrpjh.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\omhezwrpjh.exeC:\Temp\omhezwrpjh.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_omhezwrpjh.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_omhezwrpjh.exeC:\Temp\i_omhezwrpjh.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wrojhbztrm.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\wrojhbztrm.exeC:\Temp\wrojhbztrm.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wrojhbztrm.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_wrojhbztrm.exeC:\Temp\i_wrojhbztrm.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\geywrobztr.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\geywrobztr.exeC:\Temp\geywrobztr.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_geywrobztr.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_geywrobztr.exeC:\Temp\i_geywrobztr.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\igbytrlgey.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\igbytrlgey.exeC:\Temp\igbytrlgey.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_igbytrlgey.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_igbytrlgey.exeC:\Temp\i_igbytrlgey.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\tnlfdyvqoi.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\tnlfdyvqoi.exeC:\Temp\tnlfdyvqoi.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_tnlfdyvqoi.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_tnlfdyvqoi.exeC:\Temp\i_tnlfdyvqoi.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\yvpkicavsn.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\yvpkicavsn.exeC:\Temp\yvpkicavsn.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_yvpkicavsn.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_yvpkicavsn.exeC:\Temp\i_yvpkicavsn.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fcxvpnhfzx.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\fcxvpnhfzx.exeC:\Temp\fcxvpnhfzx.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fcxvpnhfzx.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_fcxvpnhfzx.exeC:\Temp\i_fcxvpnhfzx.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\auspkifzxs.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\auspkifzxs.exeC:\Temp\auspkifzxs.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_auspkifzxs.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_auspkifzxs.exeC:\Temp\i_auspkifzxs.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mhezxrpjhc.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\mhezxrpjhc.exeC:\Temp\mhezxrpjhc.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mhezxrpjhc.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_mhezxrpjhc.exeC:\Temp\i_mhezxrpjhc.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ztrpjhbzur.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ztrpjhbzur.exeC:\Temp\ztrpjhbzur.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ztrpjhbzur.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ztrpjhbzur.exeC:\Temp\i_ztrpjhbzur.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gbytrljebw.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\gbytrljebw.exeC:\Temp\gbytrljebw.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gbytrljebw.exe ups_ins3⤵
-
C:\Temp\i_gbytrljebw.exeC:\Temp\i_gbytrljebw.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\eywqoigbyt.exe ups_run3⤵
-
C:\Temp\eywqoigbyt.exeC:\Temp\eywqoigbyt.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_eywqoigbyt.exe ups_ins3⤵
-
C:\Temp\i_eywqoigbyt.exeC:\Temp\i_eywqoigbyt.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qoigaytqlf.exe ups_run3⤵
-
C:\Temp\qoigaytqlf.exeC:\Temp\qoigaytqlf.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qoigaytqlf.exe ups_ins3⤵
-
C:\Temp\i_qoigaytqlf.exeC:\Temp\i_qoigaytqlf.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\icavsnlfdx.exe ups_run3⤵
-
C:\Temp\icavsnlfdx.exeC:\Temp\icavsnlfdx.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_icavsnlfdx.exe ups_ins3⤵
-
C:\Temp\i_icavsnlfdx.exeC:\Temp\i_icavsnlfdx.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\snhfaxsqki.exe ups_run3⤵
-
C:\Temp\snhfaxsqki.exeC:\Temp\snhfaxsqki.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_snhfaxsqki.exe ups_ins3⤵
-
C:\Temp\i_snhfaxsqki.exeC:\Temp\i_snhfaxsqki.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\kfdxvpnhfa.exe ups_run3⤵
-
C:\Temp\kfdxvpnhfa.exeC:\Temp\kfdxvpnhfa.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_kfdxvpnhfa.exe ups_ins3⤵
-
C:\Temp\i_kfdxvpnhfa.exeC:\Temp\i_kfdxvpnhfa.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pmhfzxupjh.exe ups_run3⤵
-
C:\Temp\pmhfzxupjh.exeC:\Temp\pmhfzxupjh.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pmhfzxupjh.exe ups_ins3⤵
-
C:\Temp\i_pmhfzxupjh.exeC:\Temp\i_pmhfzxupjh.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zwrpjhbztr.exe ups_run3⤵
-
C:\Temp\zwrpjhbztr.exeC:\Temp\zwrpjhbztr.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zwrpjhbztr.exe ups_ins3⤵
-
C:\Temp\i_zwrpjhbztr.exeC:\Temp\i_zwrpjhbztr.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rljebwuomg.exe ups_run3⤵
-
C:\Temp\rljebwuomg.exeC:\Temp\rljebwuomg.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rljebwuomg.exe ups_ins3⤵
-
C:\Temp\i_rljebwuomg.exeC:\Temp\i_rljebwuomg.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x338,0x7ff9fceec188,0x7ff9fceec194,0x7ff9fceec1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1760,i,10071239005286242853,11194679343290029428,524288 --field-trial-handle=2344,i,1244157829688085832,15742014698458051510,262144 --variations-seed-version --mojo-platform-channel-handle=2384 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1620,i,806747619251982322,3850091218593466764,262144 --field-trial-handle=2344,i,1244157829688085832,15742014698458051510,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2356,i,8709174170365733506,1231638059314851142,524288 --field-trial-handle=2344,i,1244157829688085832,15742014698458051510,262144 --variations-seed-version --mojo-platform-channel-handle=2508 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3504,i,12111109629865070313,16131892443362551650,2097152 --field-trial-handle=2344,i,1244157829688085832,15742014698458051510,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3508,i,6294859795230312083,8995356776520208323,2097152 --field-trial-handle=2344,i,1244157829688085832,15742014698458051510,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4884,i,10471933111988033566,15474070532062286324,524288 --field-trial-handle=2344,i,1244157829688085832,15742014698458051510,262144 --variations-seed-version --mojo-platform-channel-handle=4928 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4896,i,8271426882323576422,18167924329598515360,524288 --field-trial-handle=2344,i,1244157829688085832,15742014698458051510,262144 --variations-seed-version --mojo-platform-channel-handle=4948 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5756,i,10098560533919669473,17955716322446146424,524288 --field-trial-handle=2344,i,1244157829688085832,15742014698458051510,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,15970574159620033589,3492323584502590266,524288 --field-trial-handle=2344,i,1244157829688085832,15742014698458051510,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:144⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.execookie_exporter.exe --cookie-json=11005⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5756,i,10098560533919669473,17955716322446146424,524288 --field-trial-handle=2344,i,1244157829688085832,15742014698458051510,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5788,i,13535513561581401503,6675199955306394822,524288 --field-trial-handle=2344,i,1244157829688085832,15742014698458051510,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5792,i,13446855733068382632,17427355638087885867,524288 --field-trial-handle=2344,i,1244157829688085832,15742014698458051510,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,6364863672819516209,1988479410157439501,524288 --field-trial-handle=2344,i,1244157829688085832,15742014698458051510,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5096,i,3082726124812450288,16215720134502722100,524288 --field-trial-handle=2344,i,1244157829688085832,15742014698458051510,262144 --variations-seed-version --mojo-platform-channel-handle=4976 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5108,i,3917275263800482878,310722170503759045,524288 --field-trial-handle=2344,i,1244157829688085832,15742014698458051510,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3068,i,16627053144152929423,11880884250164826613,524288 --field-trial-handle=2344,i,1244157829688085832,15742014698458051510,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4912,i,5764200656447735820,4219538714096076030,262144 --field-trial-handle=2344,i,1244157829688085832,15742014698458051510,262144 --variations-seed-version --mojo-platform-channel-handle=1932 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4912,i,13522460222831938846,232375662499761730,524288 --field-trial-handle=2344,i,1244157829688085832,15742014698458051510,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\ecwuomhezxrpjhbz.sysC:\Temp\ecwuomhezxrpjhbz.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Temp\pjhbzurmje.sysC:\Temp\pjhbzurmje.sys1⤵
- Executes dropped EXE
-
C:\Temp\uomgezwroj.sysC:\Temp\uomgezwroj.sys1⤵
- Executes dropped EXE
-
C:\Temp\tolgeywqoi.sysC:\Temp\tolgeywqoi.sys1⤵
- Executes dropped EXE
-
C:\Temp\dyvqoigays.sysC:\Temp\dyvqoigays.sys1⤵
- Executes dropped EXE
-
C:\Temp\icavsnlfdx.sysC:\Temp\icavsnlfdx.sys1⤵
- Executes dropped EXE
-
C:\Temp\avpnifaysq.sysC:\Temp\avpnifaysq.sys1⤵
- Executes dropped EXE
-
C:\Temp\hfzxvpnhfa.sysC:\Temp\hfzxvpnhfa.sys1⤵
- Executes dropped EXE
-
C:\Temp\upmhfzxrpk.sysC:\Temp\upmhfzxrpk.sys1⤵
- Executes dropped EXE
-
C:\Temp\gezwrojhbz.sysC:\Temp\gezwrojhbz.sys1⤵
- Executes dropped EXE
-
C:\Temp\ztrmjebwuo.sysC:\Temp\ztrmjebwuo.sys1⤵
- Executes dropped EXE
-
C:\Temp\ojgbztrljd.sysC:\Temp\ojgbztrljd.sys1⤵
-
C:\Temp\bysqoidbvt.sysC:\Temp\bysqoidbvt.sys1⤵
-
C:\Temp\sqkidavsnl.sysC:\Temp\sqkidavsnl.sys1⤵
-
C:\Temp\nifaysqkfd.sysC:\Temp\nifaysqkfd.sys1⤵
-
C:\Temp\vpnhfaxspk.sysC:\Temp\vpnhfaxspk.sys1⤵
-
C:\Temp\ecxupnhcau.sysC:\Temp\ecxupnhcau.sys1⤵
-
C:\Temp\mhezurmkec.sysC:\Temp\mhezurmkec.sys1⤵
-
C:\Temp\jecwuomgez.sysC:\Temp\jecwuomgez.sys1⤵
-
C:\Temp\ztrljgbztr.sysC:\Temp\ztrljgbztr.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CreateProcess.exe
avpnifaysq.sys
dyvqoigays.sys
ecwuomhezxrpjhbz.exe
ecwuomhezxrpjhbz.sys
fcxvpnhfzx.exe
geywrobztr.exe
i_geywrobztr.exe
i_igbytrlgey.exe
i_omhezwrpjh.exe
i_tnlfdyvqoi.exe
i_wrojhbztrm.exe
i_yvpkicavsn.exe
icavsnlfdx.sys
igbytrlgey.exe
omhezwrpjh.exe
pjhbzurmje.sys
tnlfdyvqoi.exe
tolgeywqoi.sys
uomgezwroj.sys
wrojhbztrm.exe
yvpkicavsn.exe
settings.dat
settings.dat
BookmarkMergedSurfaceOrdering
BrowsingTopicsState
SiteList-Enterprise.json
HubApps
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Preferences
Preferences
Secure Preferences
sync_diagnostic.log
wallet-checkout-eligible-sites.json
wallet-notification-config.json
wallet-stable.json
wallet-tokenization-config.json
Local State
Local State
Local State
Local State
Local State
typosquatting_list.pb
metadata.json
metadata.json
metadata.json
notification_fast.bundle.js.LICENSE.txt
tokenized-card.bundle.js.LICENSE.txt
strings.json
manifest.json
manifest.json
data.txt
manifest.json
memory/1616-365-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1704-438-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1944-465-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2096-227-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3044-62-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3064-410-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3064-439-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3084-1299-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3816-370-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3888-173-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3984-1319-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4004-1331-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4008-290-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4488-240-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4588-443-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4588-467-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4592-317-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4656-208-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4676-461-0x0000000000C50000-0x0000000000CB0000-memory.dmp
memory/4992-396-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5068-299-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5068-262-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5188-366-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5188-329-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5472-305-0x0000000000010000-0x00000000000AB000-memory.dmp