Analysis
- max time kernel
148s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
02/08/2026, 18:12
General
- Target 2026-08-02_6b7751ad4afefbe08b06f2eeafef8acc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 722KB
- Sample260802-wth77adh33
- SHA256 613505b6c38b3a0b753f75896fabd3cf0b1b41f83383cab6f6a680c843586c4f
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 41 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 19 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 19 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_6b7751ad4afefbe08b06f2eeafef8acc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_6b7751ad4afefbe08b06f2eeafef8acc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\cavsqkifaysqkica.exeC:\Temp\cavsqkifaysqkica.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fcavsnlfda.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\fcavsnlfda.exeC:\Temp\fcavsnlfda.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fcavsnlfda.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_fcavsnlfda.exeC:\Temp\i_fcavsnlfda.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pkhfzxusmk.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\pkhfzxusmk.exeC:\Temp\pkhfzxusmk.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pkhfzxusmk.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_pkhfzxusmk.exeC:\Temp\i_pkhfzxusmk.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hczxrpkecw.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\hczxrpkecw.exeC:\Temp\hczxrpkecw.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hczxrpkecw.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_hczxrpkecw.exeC:\Temp\i_hczxrpkecw.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\upezwuomge.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\upezwuomge.exeC:\Temp\upezwuomge.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_upezwuomge.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_upezwuomge.exeC:\Temp\i_upezwuomge.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\geywrojhbz.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\geywrojhbz.exeC:\Temp\geywrojhbz.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_geywrojhbz.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_geywrojhbz.exeC:\Temp\i_geywrojhbz.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jgbztrljdb.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\jgbztrljdb.exeC:\Temp\jgbztrljdb.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jgbztrljdb.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_jgbztrljdb.exeC:\Temp\i_jgbztrljdb.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\dyvqoljday.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\dyvqoljday.exeC:\Temp\dyvqoljday.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_dyvqoljday.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_dyvqoljday.exeC:\Temp\i_dyvqoljday.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\idaxvqkida.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\idaxvqkida.exeC:\Temp\idaxvqkida.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_idaxvqkida.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_idaxvqkida.exeC:\Temp\i_idaxvqkida.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vqnlfcayvq.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\vqnlfcayvq.exeC:\Temp\vqnlfcayvq.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vqnlfcayvq.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_vqnlfcayvq.exeC:\Temp\i_vqnlfcayvq.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\icxvpnhfzx.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\icxvpnhfzx.exeC:\Temp\icxvpnhfzx.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_icxvpnhfzx.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_icxvpnhfzx.exeC:\Temp\i_icxvpnhfzx.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zxupmkhfzx.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\zxupmkhfzx.exeC:\Temp\zxupmkhfzx.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zxupmkhfzx.exe ups_ins3⤵
-
C:\Temp\i_zxupmkhfzx.exeC:\Temp\i_zxupmkhfzx.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mkezwrpjhe.exe ups_run3⤵
-
C:\Temp\mkezwrpjhe.exeC:\Temp\mkezwrpjhe.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mkezwrpjhe.exe ups_ins3⤵
-
C:\Temp\i_mkezwrpjhe.exeC:\Temp\i_mkezwrpjhe.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wtrpjhecwu.exe ups_run3⤵
-
C:\Temp\wtrpjhecwu.exeC:\Temp\wtrpjhecwu.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wtrpjhecwu.exe ups_ins3⤵
-
C:\Temp\i_wtrpjhecwu.exeC:\Temp\i_wtrpjhecwu.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ljhbztrljd.exe ups_run3⤵
-
C:\Temp\ljhbztrljd.exeC:\Temp\ljhbztrljd.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ljhbztrljd.exe ups_ins3⤵
-
C:\Temp\i_ljhbztrljd.exeC:\Temp\i_ljhbztrljd.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bvtrligeyw.exe ups_run3⤵
-
C:\Temp\bvtrligeyw.exeC:\Temp\bvtrligeyw.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bvtrligeyw.exe ups_ins3⤵
-
C:\Temp\i_bvtrligeyw.exeC:\Temp\i_bvtrligeyw.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nlfdbvtnlf.exe ups_run3⤵
-
C:\Temp\nlfdbvtnlf.exeC:\Temp\nlfdbvtnlf.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nlfdbvtnlf.exe ups_ins3⤵
-
C:\Temp\i_nlfdbvtnlf.exeC:\Temp\i_nlfdbvtnlf.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\sqkidavtnl.exe ups_run3⤵
-
C:\Temp\sqkidavtnl.exeC:\Temp\sqkidavtnl.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_sqkidavtnl.exe ups_ins3⤵
-
C:\Temp\i_sqkidavtnl.exeC:\Temp\i_sqkidavtnl.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\kicausnhfa.exe ups_run3⤵
-
C:\Temp\kicausnhfa.exeC:\Temp\kicausnhfa.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_kicausnhfa.exe ups_ins3⤵
-
C:\Temp\i_kicausnhfa.exeC:\Temp\i_kicausnhfa.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mkfcxuspkh.exe ups_run3⤵
-
C:\Temp\mkfcxuspkh.exeC:\Temp\mkfcxuspkh.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mkfcxuspkh.exe ups_ins3⤵
-
C:\Temp\i_mkfcxuspkh.exeC:\Temp\i_mkfcxuspkh.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2cc,0x2f4,0x2f8,0x2c8,0x394,0x7ff8eaa5c188,0x7ff8eaa5c194,0x7ff8eaa5c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1912,i,18429405550973496155,2945238693611282708,524288 --field-trial-handle=2600,i,10960079995453013023,1284456059728079090,262144 --variations-seed-version --mojo-platform-channel-handle=2624 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1692,i,449971667593591396,5251530924675786619,262144 --field-trial-handle=2600,i,10960079995453013023,1284456059728079090,262144 --variations-seed-version --mojo-platform-channel-handle=2596 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2348,i,4690894170696885460,17160522986193233569,524288 --field-trial-handle=2600,i,10960079995453013023,1284456059728079090,262144 --variations-seed-version --mojo-platform-channel-handle=3244 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3592,i,12572582827051706556,8831842562256834237,2097152 --field-trial-handle=2600,i,10960079995453013023,1284456059728079090,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3612,i,12539565287148092618,4395519195973346660,2097152 --field-trial-handle=2600,i,10960079995453013023,1284456059728079090,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4276,i,3081501186524952244,15141161494076008720,2097152 --field-trial-handle=2600,i,10960079995453013023,1284456059728079090,262144 --variations-seed-version --mojo-platform-channel-handle=4812 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4288,i,426901079718272641,1391351645699875798,2097152 --field-trial-handle=2600,i,10960079995453013023,1284456059728079090,262144 --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4280,i,9985465546566302882,2663312859836378679,524288 --field-trial-handle=2600,i,10960079995453013023,1284456059728079090,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5516,i,12673435582433388646,5776356339314559427,524288 --field-trial-handle=2600,i,10960079995453013023,1284456059728079090,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5512,i,6591659754080203110,1962479900850138266,524288 --field-trial-handle=2600,i,10960079995453013023,1284456059728079090,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6008,i,7076717745122254582,5699165189699191391,524288 --field-trial-handle=2600,i,10960079995453013023,1284456059728079090,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6008,i,7076717745122254582,5699165189699191391,524288 --field-trial-handle=2600,i,10960079995453013023,1284456059728079090,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6232,i,16787942365370228349,12311673320971584117,524288 --field-trial-handle=2600,i,10960079995453013023,1284456059728079090,262144 --variations-seed-version --mojo-platform-channel-handle=4872 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6392,i,15633574044234328417,12436142996606642422,524288 --field-trial-handle=2600,i,10960079995453013023,1284456059728079090,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6764,i,1553710066107100460,15098896105649029724,524288 --field-trial-handle=2600,i,10960079995453013023,1284456059728079090,262144 --variations-seed-version --mojo-platform-channel-handle=6768 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6936,i,15217015716849943804,5043369197412105566,524288 --field-trial-handle=2600,i,10960079995453013023,1284456059728079090,262144 --variations-seed-version --mojo-platform-channel-handle=6744 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5100,i,16501456529051899039,5258583973972378436,524288 --field-trial-handle=2600,i,10960079995453013023,1284456059728079090,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,10412614812327586388,13913243885227974874,524288 --field-trial-handle=2600,i,10960079995453013023,1284456059728079090,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5088,i,5176297917545463790,11302236559326582681,524288 --field-trial-handle=2600,i,10960079995453013023,1284456059728079090,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5544,i,6971842490917289350,8977093912127822980,524288 --field-trial-handle=2600,i,10960079995453013023,1284456059728079090,262144 --variations-seed-version --mojo-platform-channel-handle=2800 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5796,i,7643777549512615090,17982945665577841286,524288 --field-trial-handle=2600,i,10960079995453013023,1284456059728079090,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5272,i,6888890494499319897,10721637799277229482,524288 --field-trial-handle=2600,i,10960079995453013023,1284456059728079090,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6152,i,4597789436289195595,8055701121959401648,262144 --field-trial-handle=2600,i,10960079995453013023,1284456059728079090,262144 --variations-seed-version --mojo-platform-channel-handle=912 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5272,i,17792591597493351180,4522637300973227228,524288 --field-trial-handle=2600,i,10960079995453013023,1284456059728079090,262144 --variations-seed-version --mojo-platform-channel-handle=5088 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\cavsqkifaysqkica.sysC:\Temp\cavsqkifaysqkica.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Temp\axspnicaus.sysC:\Temp\axspnicaus.sys1⤵
- Executes dropped EXE
-
C:\Temp\upmhfzxmke.sysC:\Temp\upmhfzxmke.sys1⤵
- Executes dropped EXE
-
C:\Temp\urmkhbzxrp.sysC:\Temp\urmkhbzxrp.sys1⤵
- Executes dropped EXE
-
C:\Temp\mjebwuomge.sysC:\Temp\mjebwuomge.sys1⤵
- Executes dropped EXE
-
C:\Temp\igebztrljd.sysC:\Temp\igebztrljd.sys1⤵
- Executes dropped EXE
-
C:\Temp\dytqlidayw.sysC:\Temp\dytqlidayw.sys1⤵
- Executes dropped EXE
-
C:\Temp\tqljdbvsql.sysC:\Temp\tqljdbvsql.sys1⤵
- Executes dropped EXE
-
C:\Temp\vsnlfdxvsq.sysC:\Temp\vsnlfdxvsq.sys1⤵
- Executes dropped EXE
-
C:\Temp\nkfcxvpnhf.sysC:\Temp\nkfcxvpnhf.sys1⤵
- Executes dropped EXE
-
C:\Temp\cwupmhecau.sysC:\Temp\cwupmhecau.sys1⤵
- Executes dropped EXE
-
C:\Temp\zusmkeczur.sysC:\Temp\zusmkeczur.sys1⤵
-
C:\Temp\zurpjhbzwu.sysC:\Temp\zurpjhbzwu.sys1⤵
-
C:\Temp\qomjebwuom.sysC:\Temp\qomjebwuom.sys1⤵
-
C:\Temp\dywqoljdby.sysC:\Temp\dywqoljdby.sys1⤵
-
C:\Temp\dbvtnljdbv.sysC:\Temp\dbvtnljdbv.sys1⤵
-
C:\Temp\bvtnlfdxvq.sysC:\Temp\bvtnlfdxvq.sys1⤵
-
C:\Temp\qnifaxsqki.sysC:\Temp\qnifaxsqki.sys1⤵
-
C:\Temp\mkfcxusmki.sysC:\Temp\mkfcxusmki.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
axspnicaus.sys
cavsqkifaysqkica.exe
cavsqkifaysqkica.sys
fcavsnlfda.exe
geywrojhbz.exe
hczxrpkecw.exe
i_fcavsnlfda.exe
i_geywrojhbz.exe
i_hczxrpkecw.exe
i_pkhfzxusmk.exe
i_upezwuomge.exe
igebztrljd.sys
jgbztrljdb.exe
mjebwuomge.sys
pkhfzxusmk.exe
upezwuomge.exe
upmhfzxmke.sys
urmkhbzxrp.sys
blocklist
settings.dat
settings.dat
BookmarkMergedSurfaceOrdering
the-real-index
the-real-index~RFe5919e7.TMP
SiteList-Enterprise.json
Edge Profile.ico
Network Persistent State
SCT Auditing Pending Reports
be0b53f5-8a96-4532-bb27-378867877171.tmp
Preferences
Preferences
Preferences
Secure Preferences
sync_diagnostic.log
b2113ccc-fc3b-4a59-b1fc-36ea05d73135.tmp
Local State
Local State
Local State
Local State
Local State
metadata.json
metadata.json
metadata.json
299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
metadata.json
metadata.json
8d428041-de0b-4dc5-afaa-8c5e16fe454b.tmp
content_new.js
CreateProcess.exe
memory/816-645-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/908-713-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1120-547-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1340-681-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1488-592-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1492-613-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1812-669-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2548-634-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2560-541-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2560-548-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3312-567-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3412-64-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4632-513-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5088-709-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5328-473-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5528-597-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5600-428-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5948-649-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/6036-594-0x0000025AF2650000-0x0000025AF26F7000-memory.dmp
memory/6096-501-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/6100-552-0x0000000000010000-0x00000000000AB000-memory.dmp