Analysis
- max time kernel
148s - max time network
160s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
02/06/2026, 12:21
General
- Target 2026-06-02_70ad51914f661cd81fe278f0424fb4cc_amadey_darkgate_elex_smoke-loader_stop.exe
- Size 384KB
- Sample260602-pjfwraet2l
- SHA256 39da2aff21e749bffa37d9f82c411059cad8d67d7c680fcb305bf157dd6e1998
Score
10/10
Malware Config
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 41 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 19 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 29 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 3 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_70ad51914f661cd81fe278f0424fb4cc_amadey_darkgate_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-02_70ad51914f661cd81fe278f0424fb4cc_amadey_darkgate_elex_smoke-loader_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\xrpjhczusmkecwup.exeC:\Temp\xrpjhczusmkecwup.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ecxupmhfzx.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\ecxupmhfzx.exeC:\Temp\ecxupmhfzx.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ecxupmhfzx.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ecxupmhfzx.exeC:\Temp\i_ecxupmhfzx.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\upmhezxrpj.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\upmhezxrpj.exeC:\Temp\upmhezxrpj.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_upmhezxrpj.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_upmhezxrpj.exeC:\Temp\i_upmhezxrpj.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mgeztrljeb.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\mgeztrljeb.exeC:\Temp\mgeztrljeb.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mgeztrljeb.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_mgeztrljeb.exeC:\Temp\i_mgeztrljeb.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ywqoigbytr.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ywqoigbytr.exeC:\Temp\ywqoigbytr.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ywqoigbytr.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ywqoigbytr.exeC:\Temp\i_ywqoigbytr.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qoigaytqli.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\qoigaytqli.exeC:\Temp\qoigaytqli.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qoigaytqli.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_qoigaytqli.exeC:\Temp\i_qoigaytqli.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fdyvqnigay.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\fdyvqnigay.exeC:\Temp\fdyvqnigay.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fdyvqnigay.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_fdyvqnigay.exeC:\Temp\i_fdyvqnigay.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vsnkidavsn.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\vsnkidavsn.exeC:\Temp\vsnkidavsn.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vsnkidavsn.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_vsnkidavsn.exeC:\Temp\i_vsnkidavsn.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\khfzxspkic.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\khfzxspkic.exeC:\Temp\khfzxspkic.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_khfzxspkic.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_khfzxspkic.exeC:\Temp\i_khfzxspkic.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hfzxrpkhca.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\hfzxrpkhca.exeC:\Temp\hfzxrpkhca.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hfzxrpkhca.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_hfzxrpkhca.exeC:\Temp\i_hfzxrpkhca.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\usmkecxrpm.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\usmkecxrpm.exeC:\Temp\usmkecxrpm.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_usmkecxrpm.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_usmkecxrpm.exeC:\Temp\i_usmkecxrpm.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mgezwrpjhb.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\mgezwrpjhb.exeC:\Temp\mgezwrpjhb.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mgezwrpjhb.exe ups_ins3⤵
-
C:\Temp\i_mgezwrpjhb.exeC:\Temp\i_mgezwrpjhb.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gbwtolgeyw.exe ups_run3⤵
-
C:\Temp\gbwtolgeyw.exeC:\Temp\gbwtolgeyw.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gbwtolgeyw.exe ups_ins3⤵
-
C:\Temp\i_gbwtolgeyw.exeC:\Temp\i_gbwtolgeyw.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\tojgbytrlj.exe ups_run3⤵
-
C:\Temp\tojgbytrlj.exeC:\Temp\tojgbytrlj.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_tojgbytrlj.exe ups_ins3⤵
-
C:\Temp\i_tojgbytrlj.exeC:\Temp\i_tojgbytrlj.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\igaytqljdb.exe ups_run3⤵
-
C:\Temp\igaytqljdb.exeC:\Temp\igaytqljdb.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_igaytqljdb.exe ups_ins3⤵
-
C:\Temp\i_igaytqljdb.exeC:\Temp\i_igaytqljdb.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vqkidxvqni.exe ups_run3⤵
-
C:\Temp\vqkidxvqni.exeC:\Temp\vqkidxvqni.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vqkidxvqni.exe ups_ins3⤵
-
C:\Temp\i_vqkidxvqni.exeC:\Temp\i_vqkidxvqni.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nhfzxspkic.exe ups_run3⤵
-
C:\Temp\nhfzxspkic.exeC:\Temp\nhfzxspkic.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nhfzxspkic.exe ups_ins3⤵
-
C:\Temp\i_nhfzxspkic.exeC:\Temp\i_nhfzxspkic.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\cxvpnhfxvp.exe ups_run3⤵
-
C:\Temp\cxvpnhfxvp.exeC:\Temp\cxvpnhfxvp.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_cxvpnhfxvp.exe ups_ins3⤵
-
C:\Temp\i_cxvpnhfxvp.exeC:\Temp\i_cxvpnhfxvp.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pjhczusmke.exe ups_run3⤵
-
C:\Temp\pjhczusmke.exeC:\Temp\pjhczusmke.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pjhczusmke.exe ups_ins3⤵
-
C:\Temp\i_pjhczusmke.exeC:\Temp\i_pjhczusmke.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bztrmjecwu.exe ups_run3⤵
-
C:\Temp\bztrmjecwu.exeC:\Temp\bztrmjecwu.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bztrmjecwu.exe ups_ins3⤵
-
C:\Temp\i_bztrmjecwu.exeC:\Temp\i_bztrmjecwu.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x338,0x7fff8e10c188,0x7fff8e10c194,0x7fff8e10c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1844,i,14035010785655451331,14109497238042531512,524288 --field-trial-handle=2180,i,16147093505191953108,13229344188713223736,262144 --variations-seed-version --mojo-platform-channel-handle=2208 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1688,i,11431015063009755281,11436966210964162555,262144 --field-trial-handle=2180,i,16147093505191953108,13229344188713223736,262144 --variations-seed-version --mojo-platform-channel-handle=2176 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2580,i,13758818491683309397,4620247995522131541,524288 --field-trial-handle=2180,i,16147093505191953108,13229344188713223736,262144 --variations-seed-version --mojo-platform-channel-handle=2744 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3492,i,18196364729555589908,8092853948722866660,2097152 --field-trial-handle=2180,i,16147093505191953108,13229344188713223736,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3516,i,9120875660075541829,10997524714795363615,2097152 --field-trial-handle=2180,i,16147093505191953108,13229344188713223736,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4856,i,8319950410651109174,981413391769837775,524288 --field-trial-handle=2180,i,16147093505191953108,13229344188713223736,262144 --variations-seed-version --mojo-platform-channel-handle=4892 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4868,i,16486460605149031331,17071626354896775600,524288 --field-trial-handle=2180,i,16147093505191953108,13229344188713223736,262144 --variations-seed-version --mojo-platform-channel-handle=4952 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5720,i,6291666870061154524,14283460740162518061,524288 --field-trial-handle=2180,i,16147093505191953108,13229344188713223736,262144 --variations-seed-version --mojo-platform-channel-handle=5740 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5720,i,6291666870061154524,14283460740162518061,524288 --field-trial-handle=2180,i,16147093505191953108,13229344188713223736,262144 --variations-seed-version --mojo-platform-channel-handle=5740 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5792,i,15851747071575851095,7902801713604465178,524288 --field-trial-handle=2180,i,16147093505191953108,13229344188713223736,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:144⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.execookie_exporter.exe --cookie-json=11325⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5836,i,8313550866739216552,6258048406570824933,524288 --field-trial-handle=2180,i,16147093505191953108,13229344188713223736,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5816,i,18078385637579338034,11609558107198577920,524288 --field-trial-handle=2180,i,16147093505191953108,13229344188713223736,262144 --variations-seed-version --mojo-platform-channel-handle=728 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5840,i,2629540339008082157,8978615355508958891,524288 --field-trial-handle=2180,i,16147093505191953108,13229344188713223736,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6236,i,14634946434509032162,4589096718751326345,524288 --field-trial-handle=2180,i,16147093505191953108,13229344188713223736,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5840,i,15926838308850994033,15701682258479667674,524288 --field-trial-handle=2180,i,16147093505191953108,13229344188713223736,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,11558270902965028582,9722759396182002818,524288 --field-trial-handle=2180,i,16147093505191953108,13229344188713223736,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5460,i,6136688900138843163,6830139356637267925,524288 --field-trial-handle=2180,i,16147093505191953108,13229344188713223736,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6480,i,17334268498783977954,7267535189102023123,524288 --field-trial-handle=2180,i,16147093505191953108,13229344188713223736,262144 --variations-seed-version --mojo-platform-channel-handle=6520 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6512,i,11780635602266720422,15889867060763176240,262144 --field-trial-handle=2180,i,16147093505191953108,13229344188713223736,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6484,i,17047344978325906016,14521113935237782090,524288 --field-trial-handle=2180,i,16147093505191953108,13229344188713223736,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\xrpjhczusmkecwup.sysC:\Temp\xrpjhczusmkecwup.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Temp\cwupmhezwr.sysC:\Temp\cwupmhezwr.sys1⤵
- Executes dropped EXE
-
C:\Temp\uojhbztrmj.sysC:\Temp\uojhbztrmj.sys1⤵
- Executes dropped EXE
-
C:\Temp\rojhbztrlj.sysC:\Temp\rojhbztrlj.sys1⤵
- Executes dropped EXE
-
C:\Temp\bytrljdbvt.sysC:\Temp\bytrljdbvt.sys1⤵
- Executes dropped EXE
-
C:\Temp\qoigaytqli.sysC:\Temp\qoigaytqli.sys1⤵
- Executes dropped EXE
-
C:\Temp\faxsqkicav.sysC:\Temp\faxsqkicav.sys1⤵
- Executes dropped EXE
-
C:\Temp\faysqkicxv.sysC:\Temp\faysqkicxv.sys1⤵
- Executes dropped EXE
-
C:\Temp\upnhfausmk.sysC:\Temp\upnhfausmk.sys1⤵
- Executes dropped EXE
-
C:\Temp\fzxrpjhczu.sysC:\Temp\fzxrpjhczu.sys1⤵
- Executes dropped EXE
-
C:\Temp\uomhezwrpj.sysC:\Temp\uomhezwrpj.sys1⤵
- Executes dropped EXE
-
C:\Temp\wrojhbztrl.sysC:\Temp\wrojhbztrl.sys1⤵
-
C:\Temp\dbwtomgeyt.sysC:\Temp\dbwtomgeyt.sys1⤵
-
C:\Temp\vtolgdywqo.sysC:\Temp\vtolgdywqo.sys1⤵
-
C:\Temp\dyvqnigays.sysC:\Temp\dyvqnigays.sys1⤵
-
C:\Temp\caysqkidav.sysC:\Temp\caysqkidav.sys1⤵
-
C:\Temp\nhfzxspkic.sysC:\Temp\nhfzxspkic.sys1⤵
-
C:\Temp\zxrpkecwup.sysC:\Temp\zxrpkecwup.sys1⤵
-
C:\Temp\mhezxrpjhb.sysC:\Temp\mhezxrpjhb.sys1⤵
-
C:\Temp\jecwuomhez.sysC:\Temp\jecwuomhez.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CreateProcess.exe
bytrljdbvt.sys
cwupmhezwr.sys
ecxupmhfzx.exe
fdyvqnigay.exe
i_ecxupmhfzx.exe
i_fdyvqnigay.exe
i_mgeztrljeb.exe
i_qoigaytqli.exe
i_upmhezxrpj.exe
i_ywqoigbytr.exe
mgeztrljeb.exe
qoigaytqli.exe
qoigaytqli.sys
rojhbztrlj.sys
uojhbztrmj.sys
upmhezxrpj.exe
xrpjhczusmkecwup.exe
xrpjhczusmkecwup.sys
ywqoigbytr.exe
settings.dat
settings.dat
BookmarkMergedSurfaceOrdering
BrowsingTopicsState
SiteList-Enterprise.json
HubApps
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Preferences
Preferences
Secure Preferences
sync_diagnostic.log
Local State
Local State
Local State
Local State
Local State
Local State
typosquatting_list.pb
metadata.json
metadata.json
metadata.json
d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
metadata.json
manifest.json
manifest.json
data.txt
manifest.json
memory/1072-631-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1300-572-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1300-601-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1612-60-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2240-613-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2348-752-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2388-665-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2388-686-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2504-548-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2604-504-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2960-699-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3448-764-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4364-560-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4568-536-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4840-248-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4840-732-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4960-227-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5276-172-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5436-653-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5532-685-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5860-207-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5936-589-0x0000000000010000-0x00000000000AB000-memory.dmp