Analysis
- max time kernel
148s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
09/08/2026, 15:56
General
- Target 2026-08-09_cefc5731beac05f83b7bfcc93459f6c4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 722KB
- Sample260809-tdtmwa1dnf
- SHA256 76732017f5e09d887e43a2caa9b91a6991b6eed8ae3df20ccba8882dba3de091
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 41 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 19 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_cefc5731beac05f83b7bfcc93459f6c4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_cefc5731beac05f83b7bfcc93459f6c4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\jecwuomgezwrojhb.exeC:\Temp\jecwuomgezwrojhb.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hbywrojhez.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\hbywrojhez.exeC:\Temp\hbywrojhez.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hbywrojhez.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_hbywrojhez.exeC:\Temp\i_hbywrojhez.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vtrojgbytr.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\vtrojgbytr.exeC:\Temp\vtrojgbytr.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vtrojgbytr.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_vtrojgbytr.exeC:\Temp\i_vtrojgbytr.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\yvtqoigdby.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\yvtqoigdby.exeC:\Temp\yvtqoigdby.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_yvtqoigdby.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_yvtqoigdby.exeC:\Temp\i_yvtqoigdby.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nkidavsqlf.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\nkidavsqlf.exeC:\Temp\nkidavsqlf.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nkidavsqlf.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_nkidavsqlf.exeC:\Temp\i_nkidavsqlf.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vsnkicavsq.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\vsnkicavsq.exeC:\Temp\vsnkicavsq.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vsnkicavsq.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_vsnkicavsq.exeC:\Temp\i_vsnkicavsq.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zxspkhczxs.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\zxspkhczxs.exeC:\Temp\zxspkhczxs.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zxspkhczxs.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_zxspkhczxs.exeC:\Temp\i_zxspkhczxs.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hcaurpmkec.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\hcaurpmkec.exeC:\Temp\hcaurpmkec.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hcaurpmkec.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_hcaurpmkec.exeC:\Temp\i_hcaurpmkec.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hbztrmjecw.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\hbztrmjecw.exeC:\Temp\hbztrmjecw.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hbztrmjecw.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_hbztrmjecw.exeC:\Temp\i_hbztrmjecw.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\trljheywuo.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\trljheywuo.exeC:\Temp\trljheywuo.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_trljheywuo.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_trljheywuo.exeC:\Temp\i_trljheywuo.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\trljebwuom.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\trljebwuom.exeC:\Temp\trljebwuom.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_trljebwuom.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_trljebwuom.exeC:\Temp\i_trljebwuom.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jdbvtqolgd.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\jdbvtqolgd.exeC:\Temp\jdbvtqolgd.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jdbvtqolgd.exe ups_ins3⤵
-
C:\Temp\i_jdbvtqolgd.exeC:\Temp\i_jdbvtqolgd.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\daysqliday.exe ups_run3⤵
-
C:\Temp\daysqliday.exeC:\Temp\daysqliday.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_daysqliday.exe ups_ins3⤵
-
C:\Temp\i_daysqliday.exeC:\Temp\i_daysqliday.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vsnkfdxvpn.exe ups_run3⤵
-
C:\Temp\vsnkfdxvpn.exeC:\Temp\vsnkfdxvpn.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vsnkfdxvpn.exe ups_ins3⤵
-
C:\Temp\i_vsnkfdxvpn.exeC:\Temp\i_vsnkfdxvpn.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vsqkhfdxus.exe ups_run3⤵
-
C:\Temp\vsqkhfdxus.exeC:\Temp\vsqkhfdxus.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vsqkhfdxus.exe ups_ins3⤵
-
C:\Temp\i_vsqkhfdxus.exeC:\Temp\i_vsqkhfdxus.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zxupnhfzxs.exe ups_run3⤵
-
C:\Temp\zxupnhfzxs.exeC:\Temp\zxupnhfzxs.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zxupnhfzxs.exe ups_ins3⤵
-
C:\Temp\i_zxupnhfzxs.exeC:\Temp\i_zxupnhfzxs.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zxrpjhbzur.exe ups_run3⤵
-
C:\Temp\zxrpjhbzur.exeC:\Temp\zxrpjhbzur.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zxrpjhbzur.exe ups_ins3⤵
-
C:\Temp\i_zxrpjhbzur.exeC:\Temp\i_zxrpjhbzur.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zurmcwuomg.exe ups_run3⤵
-
C:\Temp\zurmcwuomg.exeC:\Temp\zurmcwuomg.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zurmcwuomg.exe ups_ins3⤵
-
C:\Temp\i_zurmcwuomg.exeC:\Temp\i_zurmcwuomg.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\omjebwrojh.exe ups_run3⤵
-
C:\Temp\omjebwrojh.exeC:\Temp\omjebwrojh.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_omjebwrojh.exe ups_ins3⤵
-
C:\Temp\i_omjebwrojh.exeC:\Temp\i_omjebwrojh.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bytrljdbyt.exe ups_run3⤵
-
C:\Temp\bytrljdbyt.exeC:\Temp\bytrljdbyt.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bytrljdbyt.exe ups_ins3⤵
-
C:\Temp\i_bytrljdbyt.exeC:\Temp\i_bytrljdbyt.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x348,0x7ff9d710c188,0x7ff9d710c194,0x7ff9d710c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1700,i,5822482962634987077,12871258131576594868,262144 --field-trial-handle=2292,i,9680437924039501858,8242063104801696462,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1976,i,3031088568207378335,5870094322819356420,524288 --field-trial-handle=2292,i,9680437924039501858,8242063104801696462,262144 --variations-seed-version --mojo-platform-channel-handle=3116 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2524,i,6729446136471640780,17850292661356463390,524288 --field-trial-handle=2292,i,9680437924039501858,8242063104801696462,262144 --variations-seed-version --mojo-platform-channel-handle=3300 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3532,i,8140573903299303125,11419930600053705525,2097152 --field-trial-handle=2292,i,9680437924039501858,8242063104801696462,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3556,i,1031157999352531807,7165176093024562121,2097152 --field-trial-handle=2292,i,9680437924039501858,8242063104801696462,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4204,i,6649780056082024053,13244531650500734171,2097152 --field-trial-handle=2292,i,9680437924039501858,8242063104801696462,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4240,i,12654578644450355929,16956089518014507427,2097152 --field-trial-handle=2292,i,9680437924039501858,8242063104801696462,262144 --variations-seed-version --mojo-platform-channel-handle=4780 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5080,i,3409034337260917782,9506665482434842097,524288 --field-trial-handle=2292,i,9680437924039501858,8242063104801696462,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5416,i,1281205110737820283,3189328267018587259,524288 --field-trial-handle=2292,i,9680437924039501858,8242063104801696462,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5412,i,6668768850850433351,5382572336586166041,524288 --field-trial-handle=2292,i,9680437924039501858,8242063104801696462,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,11629056663590310604,6503897999647006121,524288 --field-trial-handle=2292,i,9680437924039501858,8242063104801696462,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,11629056663590310604,6503897999647006121,524288 --field-trial-handle=2292,i,9680437924039501858,8242063104801696462,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,8159377314162144418,5181649985980376557,524288 --field-trial-handle=2292,i,9680437924039501858,8242063104801696462,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6432,i,14852193336883149144,14267869635415676702,524288 --field-trial-handle=2292,i,9680437924039501858,8242063104801696462,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6784,i,10858830648375182412,12589791674584425429,524288 --field-trial-handle=2292,i,9680437924039501858,8242063104801696462,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6796,i,16295976730433056020,3149453860799060528,524288 --field-trial-handle=2292,i,9680437924039501858,8242063104801696462,262144 --variations-seed-version --mojo-platform-channel-handle=6788 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4800,i,17201476908427439294,6364841378510700874,524288 --field-trial-handle=2292,i,9680437924039501858,8242063104801696462,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4240,i,14939679376077362,7214250278195866524,524288 --field-trial-handle=2292,i,9680437924039501858,8242063104801696462,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5224,i,3244411186546127022,444701300974444913,524288 --field-trial-handle=2292,i,9680437924039501858,8242063104801696462,262144 --variations-seed-version --mojo-platform-channel-handle=7012 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5680,i,11334653118244204418,13563484882263115128,524288 --field-trial-handle=2292,i,9680437924039501858,8242063104801696462,262144 --variations-seed-version --mojo-platform-channel-handle=3152 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6472,i,4670940635596106065,16118948377840848549,262144 --field-trial-handle=2292,i,9680437924039501858,8242063104801696462,262144 --variations-seed-version --mojo-platform-channel-handle=6920 /prefetch:104⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\jecwuomgezwrojhb.sysC:\Temp\jecwuomgezwrojhb.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Temp\eywqomgeyw.sysC:\Temp\eywqomgeyw.sys1⤵
- Executes dropped EXE
-
C:\Temp\bvtnlgdbys.sysC:\Temp\bvtnlgdbys.sys1⤵
- Executes dropped EXE
-
C:\Temp\vqnifaysqk.sysC:\Temp\vqnifaysqk.sys1⤵
- Executes dropped EXE
-
C:\Temp\faxvpnifdx.sysC:\Temp\faxvpnifdx.sys1⤵
- Executes dropped EXE
-
C:\Temp\cxspkicaus.sysC:\Temp\cxspkicaus.sys1⤵
- Executes dropped EXE
-
C:\Temp\jhczusmkec.sysC:\Temp\jhczusmkec.sys1⤵
- Executes dropped EXE
-
C:\Temp\heczurmjec.sysC:\Temp\heczurmjec.sys1⤵
- Executes dropped EXE
-
C:\Temp\jhbzurmkeb.sysC:\Temp\jhbzurmkeb.sys1⤵
- Executes dropped EXE
-
C:\Temp\trljebwtom.sysC:\Temp\trljebwtom.sys1⤵
- Executes dropped EXE
-
C:\Temp\jdbvtolgdb.sysC:\Temp\jdbvtolgdb.sys1⤵
- Executes dropped EXE
-
C:\Temp\igaysqoigd.sysC:\Temp\igaysqoigd.sys1⤵
-
C:\Temp\kidavsnlfd.sysC:\Temp\kidavsnlfd.sys1⤵
-
C:\Temp\vpnkfcaxvp.sysC:\Temp\vpnkfcaxvp.sys1⤵
-
C:\Temp\causmkecxu.sysC:\Temp\causmkecxu.sys1⤵
-
C:\Temp\hczujhczxu.sysC:\Temp\hczujhczxu.sys1⤵
-
C:\Temp\ezxrpjhbzu.sysC:\Temp\ezxrpjhbzu.sys1⤵
-
C:\Temp\uomgezwuom.sysC:\Temp\uomgezwuom.sys1⤵
-
C:\Temp\bvtromgeyw.sysC:\Temp\bvtromgeyw.sys1⤵
-
C:\Temp\lgeywqgayt.sysC:\Temp\lgeywqgayt.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
bvtnlgdbys.sys
cxspkicaus.sys
eywqomgeyw.sys
faxvpnifdx.sys
hbywrojhez.exe
i_hbywrojhez.exe
i_nkidavsqlf.exe
i_vsnkicavsq.exe
i_vtrojgbytr.exe
i_yvtqoigdby.exe
jecwuomgezwrojhb.exe
jecwuomgezwrojhb.sys
nkidavsqlf.exe
vqnifaysqk.sys
vsnkicavsq.exe
vtrojgbytr.exe
yvtqoigdby.exe
zxspkhczxs.exe
settings.dat
settings.dat
BookmarkMergedSurfaceOrdering
the-real-index
the-real-index~RFe599dcd.TMP
SiteList-Enterprise.json
Edge Profile.ico
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Preferences
Preferences
Preferences
Secure Preferences
sync_diagnostic.log
1e88597a-9af3-4c52-8baa-6da3619dd32b.tmp
Local State
Local State
Local State
Local State
Local State
Local State
299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
metadata.json
metadata.json
2ae728bc-3eb0-48ee-a5e6-2a1ac4a1a3cd.tmp
content_new.js
CreateProcess.exe
memory/200-653-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/972-645-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1044-548-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1044-554-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1496-423-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1812-498-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1828-64-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2204-635-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2264-640-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3424-573-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3576-610-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3764-552-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3764-570-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3964-598-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4592-623-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5256-568-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5476-470-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5476-504-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5576-627-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5580-545-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5580-511-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5656-649-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5680-524-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5700-631-0x0000000000010000-0x00000000000AB000-memory.dmp