Analysis
- max time kernel
149s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
03/08/2026, 09:21
General
- Target 2026-08-03_3e4767b39e66e75a946d8d19b7b690c9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 722KB
- Sample260803-lbbqaavyhy
- SHA256 57e47d8d248c0349a58a89769d26b1adbf3f7b5d0cd59b3a9b7826af7d5cf613
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 41 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 19 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_3e4767b39e66e75a946d8d19b7b690c9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-03_3e4767b39e66e75a946d8d19b7b690c9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\trljdbwtomgeywtr.exeC:\Temp\trljdbwtomgeywtr.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zwqojgeywr.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\zwqojgeywr.exeC:\Temp\zwqojgeywr.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zwqojgeywr.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_zwqojgeywr.exeC:\Temp\i_zwqojgeywr.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gbywqoljdb.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\gbywqoljdb.exeC:\Temp\gbywqoljdb.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gbywqoljdb.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_gbywqoljdb.exeC:\Temp\i_gbywqoljdb.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\daysqnidav.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\daysqnidav.exeC:\Temp\daysqnidav.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_daysqnidav.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_daysqnidav.exeC:\Temp\i_daysqnidav.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\avsqnhfaxv.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\avsqnhfaxv.exeC:\Temp\avsqnhfaxv.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_avsqnhfaxv.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_avsqnhfaxv.exeC:\Temp\i_avsqnhfaxv.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vsnkfcxusq.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\vsnkfcxusq.exeC:\Temp\vsnkfcxusq.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vsnkfcxusq.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_vsnkfcxusq.exeC:\Temp\i_vsnkfcxusq.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hfzxspkhca.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\hfzxspkhca.exeC:\Temp\hfzxspkhca.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hfzxspkhca.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_hfzxspkhca.exeC:\Temp\i_hfzxspkhca.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zxrpjhczur.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\zxrpjhczur.exeC:\Temp\zxrpjhczur.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zxrpjhczur.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_zxrpjhczur.exeC:\Temp\i_zxrpjhczur.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\urmjhbywuo.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\urmjhbywuo.exeC:\Temp\urmjhbywuo.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_urmjhbywuo.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_urmjhbywuo.exeC:\Temp\i_urmjhbywuo.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wrojhbztrl.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\wrojhbztrl.exeC:\Temp\wrojhbztrl.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wrojhbztrl.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_wrojhbztrl.exeC:\Temp\i_wrojhbztrl.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\igeywtolge.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\igeywtolge.exeC:\Temp\igeywtolge.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_igeywtolge.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_igeywtolge.exeC:\Temp\i_igeywtolge.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ysqoigaysq.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ysqoigaysq.exeC:\Temp\ysqoigaysq.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ysqoigaysq.exe ups_ins3⤵
-
C:\Temp\i_ysqoigaysq.exeC:\Temp\i_ysqoigaysq.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pnlidayvqn.exe ups_run3⤵
-
C:\Temp\pnlidayvqn.exeC:\Temp\pnlidayvqn.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pnlidayvqn.exe ups_ins3⤵
-
C:\Temp\i_pnlidayvqn.exeC:\Temp\i_pnlidayvqn.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qkicausnkf.exe ups_run3⤵
-
C:\Temp\qkicausnkf.exeC:\Temp\qkicausnkf.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qkicausnkf.exe ups_ins3⤵
-
C:\Temp\i_qkicausnkf.exeC:\Temp\i_qkicausnkf.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\causpkhfcx.exe ups_run3⤵
-
C:\Temp\causpkhfcx.exeC:\Temp\causpkhfcx.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_causpkhfcx.exe ups_ins3⤵
-
C:\Temp\i_causpkhfcx.exeC:\Temp\i_causpkhfcx.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zurpjhczus.exe ups_run3⤵
-
C:\Temp\zurpjhczus.exeC:\Temp\zurpjhczus.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zurpjhczus.exe ups_ins3⤵
-
C:\Temp\i_zurpjhczus.exeC:\Temp\i_zurpjhczus.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\kebztrpmhe.exe ups_run3⤵
-
C:\Temp\kebztrpmhe.exeC:\Temp\kebztrpmhe.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_kebztrpmhe.exe ups_ins3⤵
-
C:\Temp\i_kebztrpmhe.exeC:\Temp\i_kebztrpmhe.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\uomgezwuom.exe ups_run3⤵
-
C:\Temp\uomgezwuom.exeC:\Temp\uomgezwuom.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_uomgezwuom.exe ups_ins3⤵
-
C:\Temp\i_uomgezwuom.exeC:\Temp\i_uomgezwuom.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\oljdbvtolg.exe ups_run3⤵
-
C:\Temp\oljdbvtolg.exeC:\Temp\oljdbvtolg.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_oljdbvtolg.exe ups_ins3⤵
-
C:\Temp\i_oljdbvtolg.exeC:\Temp\i_oljdbvtolg.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\lidbvtnlfd.exe ups_run3⤵
-
C:\Temp\lidbvtnlfd.exeC:\Temp\lidbvtnlfd.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_lidbvtnlfd.exe ups_ins3⤵
-
C:\Temp\i_lidbvtnlfd.exeC:\Temp\i_lidbvtnlfd.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ffe34f7c188,0x7ffe34f7c194,0x7ffe34f7c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1620,i,7675342400927438533,14902804130426299394,262144 --field-trial-handle=2292,i,12019316543247050926,18148438054884793536,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1908,i,10581486987083244731,5626393364884755062,524288 --field-trial-handle=2292,i,12019316543247050926,18148438054884793536,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2480,i,10913791630991670162,4263605709153788327,524288 --field-trial-handle=2292,i,12019316543247050926,18148438054884793536,262144 --variations-seed-version --mojo-platform-channel-handle=3068 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3548,i,9718454432634518133,4136021647967334251,2097152 --field-trial-handle=2292,i,12019316543247050926,18148438054884793536,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3552,i,3115647045155192384,7726365839503137180,2097152 --field-trial-handle=2292,i,12019316543247050926,18148438054884793536,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4236,i,13632664429439049809,7963730523808042474,2097152 --field-trial-handle=2292,i,12019316543247050926,18148438054884793536,262144 --variations-seed-version --mojo-platform-channel-handle=4436 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4288,i,5369851348011164234,1343357295357284217,2097152 --field-trial-handle=2292,i,12019316543247050926,18148438054884793536,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5340,i,6061592343766081408,7548417166871198752,524288 --field-trial-handle=2292,i,12019316543247050926,18148438054884793536,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5396,i,18015126235624316831,5841172114403711878,524288 --field-trial-handle=2292,i,12019316543247050926,18148438054884793536,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5288,i,17871500289312134386,13018670228871921860,524288 --field-trial-handle=2292,i,12019316543247050926,18148438054884793536,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6048,i,5171914415377255382,329073719467111936,524288 --field-trial-handle=2292,i,12019316543247050926,18148438054884793536,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6048,i,5171914415377255382,329073719467111936,524288 --field-trial-handle=2292,i,12019316543247050926,18148438054884793536,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6300,i,9189297250922605734,13630865768798731592,524288 --field-trial-handle=2292,i,12019316543247050926,18148438054884793536,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6304,i,12175931254696915992,10847493598809877160,524288 --field-trial-handle=2292,i,12019316543247050926,18148438054884793536,262144 --variations-seed-version --mojo-platform-channel-handle=6456 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6500,i,8718758449302642347,3300008816001180404,524288 --field-trial-handle=2292,i,12019316543247050926,18148438054884793536,262144 --variations-seed-version --mojo-platform-channel-handle=6504 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6496,i,1448929715341777532,9978313881547086415,524288 --field-trial-handle=2292,i,12019316543247050926,18148438054884793536,262144 --variations-seed-version --mojo-platform-channel-handle=6520 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4912,i,9318510443923362818,17519545367368446340,524288 --field-trial-handle=2292,i,12019316543247050926,18148438054884793536,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4908,i,14034309316654515859,3866815539975793915,524288 --field-trial-handle=2292,i,12019316543247050926,18148438054884793536,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4896,i,15400970239592887146,15432167444466916923,524288 --field-trial-handle=2292,i,12019316543247050926,18148438054884793536,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2528,i,12428776173872870342,16353462813459359881,524288 --field-trial-handle=2292,i,12019316543247050926,18148438054884793536,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6120,i,2703345242782713195,13434550559270949223,524288 --field-trial-handle=2292,i,12019316543247050926,18148438054884793536,262144 --variations-seed-version --mojo-platform-channel-handle=6756 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3180,i,6492078554158195341,17938614731468437178,524288 --field-trial-handle=2292,i,12019316543247050926,18148438054884793536,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5068,i,17513872126117372077,18105982412207283426,524288 --field-trial-handle=2292,i,12019316543247050926,18148438054884793536,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6168,i,18427414210121988225,8468847178501347965,262144 --field-trial-handle=2292,i,12019316543247050926,18148438054884793536,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,15006061986247006104,18012760414407240175,524288 --field-trial-handle=2292,i,12019316543247050926,18148438054884793536,262144 --variations-seed-version --mojo-platform-channel-handle=2928 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\trljdbwtomgeywtr.sysC:\Temp\trljdbwtomgeywtr.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Temp\gaytqoigey.sysC:\Temp\gaytqoigey.sys1⤵
- Executes dropped EXE
-
C:\Temp\dbvsqligay.sysC:\Temp\dbvsqligay.sys1⤵
- Executes dropped EXE
-
C:\Temp\nidaysqnif.sysC:\Temp\nidaysqnif.sys1⤵
- Executes dropped EXE
-
C:\Temp\axsqkidxvp.sysC:\Temp\axsqkidxvp.sys1⤵
- Executes dropped EXE
-
C:\Temp\hfzxrpnhfc.sysC:\Temp\hfzxrpnhfc.sys1⤵
- Executes dropped EXE
-
C:\Temp\czxrpjhbzu.sysC:\Temp\czxrpjhbzu.sys1⤵
- Executes dropped EXE
-
C:\Temp\zxromheczt.sysC:\Temp\zxromheczt.sys1⤵
- Executes dropped EXE
-
C:\Temp\bzwrojhbzt.sysC:\Temp\bzwrojhbzt.sys1⤵
- Executes dropped EXE
-
C:\Temp\jgbytqlige.sysC:\Temp\jgbytqlige.sys1⤵
- Executes dropped EXE
-
C:\Temp\dbvtqljdbv.sysC:\Temp\dbvtqljdbv.sys1⤵
- Executes dropped EXE
-
C:\Temp\vsqlidayvq.sysC:\Temp\vsqlidayvq.sys1⤵
-
C:\Temp\ysqkicaxsq.sysC:\Temp\ysqkicaxsq.sys1⤵
-
C:\Temp\icauspkhfd.sysC:\Temp\icauspkhfd.sys1⤵
-
C:\Temp\ausmkecwup.sysC:\Temp\ausmkecwup.sys1⤵
-
C:\Temp\zusmkecwuo.sysC:\Temp\zusmkecwuo.sys1⤵
-
C:\Temp\trojebztrm.sysC:\Temp\trojebztrm.sys1⤵
-
C:\Temp\ljebwtqomg.sysC:\Temp\ljebwtqomg.sys1⤵
-
C:\Temp\gdbvtolgdy.sysC:\Temp\gdbvtolgdy.sys1⤵
-
C:\Temp\dayvtnlfdb.sysC:\Temp\dayvtnlfdb.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
avsqnhfaxv.exe
axsqkidxvp.sys
daysqnidav.exe
dbvsqligay.sys
gaytqoigey.sys
gbywqoljdb.exe
hfzxrpnhfc.sys
hfzxspkhca.exe
i_avsqnhfaxv.exe
i_daysqnidav.exe
i_gbywqoljdb.exe
i_vsnkfcxusq.exe
i_zwqojgeywr.exe
nidaysqnif.sys
trljdbwtomgeywtr.exe
trljdbwtomgeywtr.sys
vsnkfcxusq.exe
zwqojgeywr.exe
settings.dat
settings.dat
the-real-index
the-real-index~RFe5aa9af.TMP
SiteList-Enterprise.json
Edge Profile.ico
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Preferences
Preferences
Preferences
Secure Preferences
8c7353d9-a4ff-4ced-a997-b9ac4ea10575.tmp
Local State
Local State
Local State
Local State
Local State
62c3d08e-3779-45ae-8f3c-378bdcc7c5fb.tmp
metadata.json
metadata.json
299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
f41f4e29-f3ed-42d6-9a7f-eb30504f6249.tmp
metadata.json~RFe5a80da.TMP
d3175a38-cd94-479d-99c8-7e2d74e9caf6.tmp
content_new.js
CreateProcess.exe
memory/1300-515-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1300-548-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1424-556-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2236-669-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2856-437-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3148-649-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3288-625-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3348-605-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3508-472-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3548-645-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3564-680-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3992-727-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4252-571-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4912-723-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5720-701-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5876-592-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5980-500-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5984-551-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/6032-706-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/6044-66-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/6112-543-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/6112-553-0x0000000000010000-0x00000000000AB000-memory.dmp