Analysis
- max time kernel
149s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
24/07/2026, 22:27
General
- Target 2026-07-24_2de357f47ea07697ac51adb1552c73a3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 722KB
- Sample260724-2dkzqsvbmd
- SHA256 a3e4423108b7b189bc07e3b5f52726874ee43cee04c7ad8e1eaf9e311af95a7e
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 41 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 19 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-24_2de357f47ea07697ac51adb1552c73a3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-24_2de357f47ea07697ac51adb1552c73a3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\nhfzxspkhcausmkf.exeC:\Temp\nhfzxspkhcausmkf.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zxrpkhczus.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\zxrpkhczus.exeC:\Temp\zxrpkhczus.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zxrpkhczus.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_zxrpkhczus.exeC:\Temp\i_zxrpkhczus.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hczupecwuo.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\hczupecwuo.exeC:\Temp\hczupecwuo.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hczupecwuo.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_hczupecwuo.exeC:\Temp\i_hczupecwuo.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\omgezwromg.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\omgezwromg.exeC:\Temp\omgezwromg.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_omgezwromg.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_omgezwromg.exeC:\Temp\i_omgezwromg.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bztroigeyw.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\bztroigeyw.exeC:\Temp\bztroigeyw.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bztroigeyw.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_bztroigeyw.exeC:\Temp\i_bztroigeyw.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\oigbysqlig.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\oigbysqlig.exeC:\Temp\oigbysqlig.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_oigbysqlig.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_oigbysqlig.exeC:\Temp\i_oigbysqlig.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\daysqliday.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\daysqliday.exeC:\Temp\daysqliday.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_daysqliday.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_daysqliday.exeC:\Temp\i_daysqliday.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ifaysqnifa.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ifaysqnifa.exeC:\Temp\ifaysqnifa.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ifaysqnifa.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ifaysqnifa.exeC:\Temp\i_ifaysqnifa.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vpnhfzxspk.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\vpnhfzxspk.exeC:\Temp\vpnhfzxspk.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vpnhfzxspk.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_vpnhfzxspk.exeC:\Temp\i_vpnhfzxspk.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pmkecauspk.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\pmkecauspk.exeC:\Temp\pmkecauspk.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pmkecauspk.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_pmkecauspk.exeC:\Temp\i_pmkecauspk.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mherpmhezx.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\mherpmhezx.exeC:\Temp\mherpmhezx.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mherpmhezx.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_mherpmhezx.exeC:\Temp\i_mherpmhezx.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hbzurojgec.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\hbzurojgec.exeC:\Temp\hbzurojgec.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hbzurojgec.exe ups_ins3⤵
-
C:\Temp\i_hbzurojgec.exeC:\Temp\i_hbzurojgec.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ywqojgbywq.exe ups_run3⤵
-
C:\Temp\ywqojgbywq.exeC:\Temp\ywqojgbywq.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ywqojgbywq.exe ups_ins3⤵
-
C:\Temp\i_ywqojgbywq.exeC:\Temp\i_ywqojgbywq.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bvtrljdbvt.exe ups_run3⤵
-
C:\Temp\bvtrljdbvt.exeC:\Temp\bvtrljdbvt.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bvtrljdbvt.exe ups_ins3⤵
-
C:\Temp\i_bvtrljdbvt.exeC:\Temp\i_bvtrljdbvt.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\davtqliday.exe ups_run3⤵
-
C:\Temp\davtqliday.exeC:\Temp\davtqliday.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_davtqliday.exe ups_ins3⤵
-
C:\Temp\i_davtqliday.exeC:\Temp\i_davtqliday.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\avtnifaysq.exe ups_run3⤵
-
C:\Temp\avtnifaysq.exeC:\Temp\avtnifaysq.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_avtnifaysq.exe ups_ins3⤵
-
C:\Temp\i_avtnifaysq.exeC:\Temp\i_avtnifaysq.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nhfaxvsnki.exe ups_run3⤵
-
C:\Temp\nhfaxvsnki.exeC:\Temp\nhfaxvsnki.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nhfaxvsnki.exe ups_ins3⤵
-
C:\Temp\i_nhfaxvsnki.exeC:\Temp\i_nhfaxvsnki.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\czxspkicau.exe ups_run3⤵
-
C:\Temp\czxspkicau.exeC:\Temp\czxspkicau.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_czxspkicau.exe ups_ins3⤵
-
C:\Temp\i_czxspkicau.exeC:\Temp\i_czxspkicau.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ezxrpjhbzu.exe ups_run3⤵
-
C:\Temp\ezxrpjhbzu.exeC:\Temp\ezxrpjhbzu.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ezxrpjhbzu.exe ups_ins3⤵
-
C:\Temp\i_ezxrpjhbzu.exeC:\Temp\i_ezxrpjhbzu.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\eczurmkecw.exe ups_run3⤵
-
C:\Temp\eczurmkecw.exeC:\Temp\eczurmkecw.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_eczurmkecw.exe ups_ins3⤵
-
C:\Temp\i_eczurmkecw.exeC:\Temp\i_eczurmkecw.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x368,0x7ff87555c188,0x7ff87555c194,0x7ff87555c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,2755135132983219887,14057185545165937463,262144 --field-trial-handle=2356,i,2987095276591263859,18412119214812109751,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1888,i,10898675417274678535,288944410661496966,524288 --field-trial-handle=2356,i,2987095276591263859,18412119214812109751,262144 --variations-seed-version --mojo-platform-channel-handle=2796 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2376,i,18091650223165285623,11466070146921877252,524288 --field-trial-handle=2356,i,2987095276591263859,18412119214812109751,262144 --variations-seed-version --mojo-platform-channel-handle=3168 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3516,i,1559299781431678639,8237589093799424900,2097152 --field-trial-handle=2356,i,2987095276591263859,18412119214812109751,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3524,i,7385528087415008491,11733785571299098839,2097152 --field-trial-handle=2356,i,2987095276591263859,18412119214812109751,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4176,i,2268323957956903953,13839632193487971166,2097152 --field-trial-handle=2356,i,2987095276591263859,18412119214812109751,262144 --variations-seed-version --mojo-platform-channel-handle=4684 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4184,i,11961521361706282535,14009521932155643591,2097152 --field-trial-handle=2356,i,2987095276591263859,18412119214812109751,262144 --variations-seed-version --mojo-platform-channel-handle=4688 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5208,i,15440903021042869281,15197097643988598310,524288 --field-trial-handle=2356,i,2987095276591263859,18412119214812109751,262144 --variations-seed-version --mojo-platform-channel-handle=4976 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5376,i,6749009546830830950,672163638013934024,524288 --field-trial-handle=2356,i,2987095276591263859,18412119214812109751,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5364,i,450133897750381918,4517102223857326788,524288 --field-trial-handle=2356,i,2987095276591263859,18412119214812109751,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,18399709662646973322,7242568261684296697,524288 --field-trial-handle=2356,i,2987095276591263859,18412119214812109751,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,18399709662646973322,7242568261684296697,524288 --field-trial-handle=2356,i,2987095276591263859,18412119214812109751,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6184,i,4234708800689599631,11903718828959365503,524288 --field-trial-handle=2356,i,2987095276591263859,18412119214812109751,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6364,i,1743128035834713527,9491316233118917781,524288 --field-trial-handle=2356,i,2987095276591263859,18412119214812109751,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6504,i,15979014314192447826,18165427097737722848,524288 --field-trial-handle=2356,i,2987095276591263859,18412119214812109751,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6448,i,13832298572727610421,8285069668920788540,524288 --field-trial-handle=2356,i,2987095276591263859,18412119214812109751,262144 --variations-seed-version --mojo-platform-channel-handle=6532 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4708,i,11801914190362804196,2400880173728111053,524288 --field-trial-handle=2356,i,2987095276591263859,18412119214812109751,262144 --variations-seed-version --mojo-platform-channel-handle=4704 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4712,i,7006914861116787794,12485346432210795568,524288 --field-trial-handle=2356,i,2987095276591263859,18412119214812109751,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4180,i,9271553479805591773,6849543227367034866,524288 --field-trial-handle=2356,i,2987095276591263859,18412119214812109751,262144 --variations-seed-version --mojo-platform-channel-handle=4948 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6580,i,16479876088399900342,3172449224315515851,524288 --field-trial-handle=2356,i,2987095276591263859,18412119214812109751,262144 --variations-seed-version --mojo-platform-channel-handle=5640 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6184,i,13720288719924765434,11369213091311585326,524288 --field-trial-handle=2356,i,2987095276591263859,18412119214812109751,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=944,i,9044331269904712813,5576481780674355439,524288 --field-trial-handle=2356,i,2987095276591263859,18412119214812109751,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6328,i,4937360512229999865,11561738765350777093,524288 --field-trial-handle=2356,i,2987095276591263859,18412119214812109751,262144 --variations-seed-version --mojo-platform-channel-handle=6724 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6488,i,11370188070961905758,9969724286936915155,262144 --field-trial-handle=2356,i,2987095276591263859,18412119214812109751,262144 --variations-seed-version --mojo-platform-channel-handle=6468 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3416,i,17077224977531392722,4075654098066016950,524288 --field-trial-handle=2356,i,2987095276591263859,18412119214812109751,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\nhfzxspkhcausmkf.sysC:\Temp\nhfzxspkhcausmkf.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Temp\jhczusmkec.sysC:\Temp\jhczusmkec.sys1⤵
- Executes dropped EXE
-
C:\Temp\uomgebwuom.sysC:\Temp\uomgebwuom.sys1⤵
- Executes dropped EXE
-
C:\Temp\dztroigebz.sysC:\Temp\dztroigebz.sys1⤵
- Executes dropped EXE
-
C:\Temp\toigaytqlg.sysC:\Temp\toigaytqlg.sys1⤵
- Executes dropped EXE
-
C:\Temp\vqlidbvtql.sysC:\Temp\vqlidbvtql.sys1⤵
- Executes dropped EXE
-
C:\Temp\idaysqkica.sysC:\Temp\idaysqkica.sys1⤵
- Executes dropped EXE
-
C:\Temp\pnhfzxvpnh.sysC:\Temp\pnhfzxvpnh.sys1⤵
- Executes dropped EXE
-
C:\Temp\xupfcauspn.sysC:\Temp\xupfcauspn.sys1⤵
- Executes dropped EXE
-
C:\Temp\smkhczusmh.sysC:\Temp\smkhczusmh.sys1⤵
- Executes dropped EXE
-
C:\Temp\gebzurmjhb.sysC:\Temp\gebzurmjhb.sys1⤵
- Executes dropped EXE
-
C:\Temp\ezwqojgbzw.sysC:\Temp\ezwqojgbzw.sys1⤵
-
C:\Temp\gebwtrojyw.sysC:\Temp\gebwtrojyw.sys1⤵
-
C:\Temp\tolgeywqoi.sysC:\Temp\tolgeywqoi.sys1⤵
-
C:\Temp\davsqligay.sysC:\Temp\davsqligay.sys1⤵
-
C:\Temp\usnkfdxvpn.sysC:\Temp\usnkfdxvpn.sys1⤵
-
C:\Temp\ifaxspkhfc.sysC:\Temp\ifaxspkhfc.sys1⤵
-
C:\Temp\khcausmkhc.sysC:\Temp\khcausmkhc.sys1⤵
-
C:\Temp\hczurmjhbz.sysC:\Temp\hczurmjhbz.sys1⤵
-
C:\Temp\jebztrmjeb.sysC:\Temp\jebztrmjeb.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
bztroigeyw.exe
daysqliday.exe
dztroigebz.sys
hczupecwuo.exe
i_bztroigeyw.exe
i_hczupecwuo.exe
i_oigbysqlig.exe
i_omgezwromg.exe
i_zxrpkhczus.exe
jhczusmkec.sys
nhfzxspkhcausmkf.exe
nhfzxspkhcausmkf.sys
oigbysqlig.exe
omgezwromg.exe
toigaytqlg.sys
uomgebwuom.sys
vqlidbvtql.sys
zxrpkhczus.exe
settings.dat
settings.dat
BookmarkMergedSurfaceOrdering
the-real-index
the-real-index~RFe5957ea.TMP
SiteList-Enterprise.json
Edge Profile.ico
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Preferences
Preferences
Preferences
Secure Preferences
sync_diagnostic.log
OperationConfig
OperationConfig~RFe59f207.TMP
Local State
Local State
Local State
Local State
Local State
metadata.json
metadata.json
metadata.json
299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
3226f709-1b79-4838-8cc9-d6e58fb9dea9.tmp
metadata.json~RFe592ed6.TMP
940b2144-00b8-4990-8eac-364eb459bd5a.tmp
content_new.js
CreateProcess.exe
memory/1044-598-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1080-725-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1920-470-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1996-618-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2312-569-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2852-511-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2852-498-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2972-565-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3012-539-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3312-423-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3520-729-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3696-510-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4084-550-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4144-674-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4164-72-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4788-546-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5036-695-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5072-663-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5092-658-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5216-708-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5904-659-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5904-638-0x0000000000010000-0x00000000000AB000-memory.dmp