Analysis
- max time kernel
150s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
13/08/2026, 01:48
General
- Target 2026-08-12_131d7afc481ff5f5a558ed5bc2ac9259_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 722KB
- Sample260813-b8kpcazarg
- SHA256 996f53a3a728edc5dc0c8bb730bfbb595eafe15a1e5496db6069cdadbae37d74
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-12_131d7afc481ff5f5a558ed5bc2ac9259_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-12_131d7afc481ff5f5a558ed5bc2ac9259_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\mhezxrpjhbzurmke.exeC:\Temp\mhezxrpjhbzurmke.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hecwrpjhzu.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\hecwrpjhzu.exeC:\Temp\hecwrpjhzu.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hecwrpjhzu.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_hecwrpjhzu.exeC:\Temp\i_hecwrpjhzu.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wrojgezwro.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\wrojgezwro.exeC:\Temp\wrojgezwro.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wrojgezwro.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_wrojgezwro.exeC:\Temp\i_wrojgezwro.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\trojgebwtr.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\trojgebwtr.exeC:\Temp\trojgebwtr.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_trojgebwtr.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_trojgebwtr.exeC:\Temp\i_trojgebwtr.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ztrljdbwlg.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ztrljdbwlg.exeC:\Temp\ztrljdbwlg.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ztrljdbwlg.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ztrljdbwlg.exeC:\Temp\i_ztrljdbwlg.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\idyvqoigay.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\idyvqoigay.exeC:\Temp\idyvqoigay.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_idyvqoigay.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_idyvqoigay.exeC:\Temp\i_idyvqoigay.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\lfdxvpnlfd.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\lfdxvpnlfd.exeC:\Temp\lfdxvpnlfd.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_lfdxvpnlfd.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_lfdxvpnlfd.exeC:\Temp\i_lfdxvpnlfd.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\kicausnkfc.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\kicausnkfc.exeC:\Temp\kicausnkfc.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_kicausnkfc.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_kicausnkfc.exeC:\Temp\i_kicausnkfc.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\axspnkfcxu.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\axspnkfcxu.exeC:\Temp\axspnkfcxu.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_axspnkfcxu.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_axspnkfcxu.exeC:\Temp\i_axspnkfcxu.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ausmkeczup.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ausmkeczup.exeC:\Temp\ausmkeczup.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ausmkeczup.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ausmkeczup.exeC:\Temp\i_ausmkeczup.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wurmhbztrm.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\wurmhbztrm.exeC:\Temp\wurmhbztrm.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wurmhbztrm.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_wurmhbztrm.exeC:\Temp\i_wurmhbztrm.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ojgbztrlje.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ojgbztrlje.exeC:\Temp\ojgbztrlje.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ojgbztrlje.exe ups_ins3⤵
-
C:\Temp\i_ojgbztrlje.exeC:\Temp\i_ojgbztrlje.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\trljdbwtrl.exe ups_run3⤵
-
C:\Temp\trljdbwtrl.exeC:\Temp\trljdbwtrl.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_trljdbwtrl.exe ups_ins3⤵
-
C:\Temp\i_trljdbwtrl.exeC:\Temp\i_trljdbwtrl.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jdbvtnlgdy.exe ups_run3⤵
-
C:\Temp\jdbvtnlgdy.exeC:\Temp\jdbvtnlgdy.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jdbvtnlgdy.exe ups_ins3⤵
-
C:\Temp\i_jdbvtnlgdy.exeC:\Temp\i_jdbvtnlgdy.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bvtnlidavt.exe ups_run3⤵
-
C:\Temp\bvtnlidavt.exeC:\Temp\bvtnlidavt.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bvtnlidavt.exe ups_ins3⤵
-
C:\Temp\i_bvtnlidavt.exeC:\Temp\i_bvtnlidavt.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qnifdxvpni.exe ups_run3⤵
-
C:\Temp\qnifdxvpni.exeC:\Temp\qnifdxvpni.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qnifdxvpni.exe ups_ins3⤵
-
C:\Temp\i_qnifdxvpni.exeC:\Temp\i_qnifdxvpni.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\kfdxvpnifa.exe ups_run3⤵
-
C:\Temp\kfdxvpnifa.exeC:\Temp\kfdxvpnifa.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_kfdxvpnifa.exe ups_ins3⤵
-
C:\Temp\i_kfdxvpnifa.exeC:\Temp\i_kfdxvpnifa.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fcausmkfzx.exe ups_run3⤵
-
C:\Temp\fcausmkfzx.exeC:\Temp\fcausmkfzx.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fcausmkfzx.exe ups_ins3⤵
-
C:\Temp\i_fcausmkfzx.exeC:\Temp\i_fcausmkfzx.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ecwupmhezx.exe ups_run3⤵
-
C:\Temp\ecwupmhezx.exeC:\Temp\ecwupmhezx.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ecwupmhezx.exe ups_ins3⤵
-
C:\Temp\i_ecwupmhezx.exeC:\Temp\i_ecwupmhezx.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ztromgeywr.exe ups_run3⤵
-
C:\Temp\ztromgeywr.exeC:\Temp\ztromgeywr.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ztromgeywr.exe ups_ins3⤵
-
C:\Temp\i_ztromgeywr.exeC:\Temp\i_ztromgeywr.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\geywrojgey.exe ups_run3⤵
-
C:\Temp\geywrojgey.exeC:\Temp\geywrojgey.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7fffddbac188,0x7fffddbac194,0x7fffddbac1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1576,i,17369530297294706114,13052243235495367896,262144 --field-trial-handle=2168,i,13241872116536714860,13674861741672601511,262144 --variations-seed-version --mojo-platform-channel-handle=2160 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1880,i,14533525953249783704,15441327434736220314,524288 --field-trial-handle=2168,i,13241872116536714860,13674861741672601511,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2532,i,14095321470990160423,6929704327199852116,524288 --field-trial-handle=2168,i,13241872116536714860,13674861741672601511,262144 --variations-seed-version --mojo-platform-channel-handle=2728 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3552,i,16108484469024841087,15956629731470651642,2097152 --field-trial-handle=2168,i,13241872116536714860,13674861741672601511,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3556,i,17449675649713179110,12327809890792446166,2097152 --field-trial-handle=2168,i,13241872116536714860,13674861741672601511,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4300,i,9787726947695614762,18203864797811186767,2097152 --field-trial-handle=2168,i,13241872116536714860,13674861741672601511,262144 --variations-seed-version --mojo-platform-channel-handle=4752 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4312,i,5265823557039862371,4110198533581692250,2097152 --field-trial-handle=2168,i,13241872116536714860,13674861741672601511,262144 --variations-seed-version --mojo-platform-channel-handle=4756 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5396,i,3618015116131908517,1871064055400759551,524288 --field-trial-handle=2168,i,13241872116536714860,13674861741672601511,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5300,i,11913983471026424907,3097863715680847444,524288 --field-trial-handle=2168,i,13241872116536714860,13674861741672601511,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5252,i,3261273941277042232,2322826942967952279,524288 --field-trial-handle=2168,i,13241872116536714860,13674861741672601511,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,3997310557073136480,976470444373152336,524288 --field-trial-handle=2168,i,13241872116536714860,13674861741672601511,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,3997310557073136480,976470444373152336,524288 --field-trial-handle=2168,i,13241872116536714860,13674861741672601511,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6296,i,7101956969481872715,16106073476760271264,524288 --field-trial-handle=2168,i,13241872116536714860,13674861741672601511,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6244,i,17411028291374358179,7971640406823880155,524288 --field-trial-handle=2168,i,13241872116536714860,13674861741672601511,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6548,i,1229236475276707117,4610368725352259857,524288 --field-trial-handle=2168,i,13241872116536714860,13674861741672601511,262144 --variations-seed-version --mojo-platform-channel-handle=6568 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6516,i,8126594439985249918,3887270724331816634,524288 --field-trial-handle=2168,i,13241872116536714860,13674861741672601511,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4816,i,14737878516910438224,16595746624366378057,524288 --field-trial-handle=2168,i,13241872116536714860,13674861741672601511,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5292,i,18001306447706781759,16653833444655947133,524288 --field-trial-handle=2168,i,13241872116536714860,13674861741672601511,262144 --variations-seed-version --mojo-platform-channel-handle=6552 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5288,i,16546086414929705735,11499957960967854990,524288 --field-trial-handle=2168,i,13241872116536714860,13674861741672601511,262144 --variations-seed-version --mojo-platform-channel-handle=5104 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5676,i,10218830934676571978,17180573719440163129,524288 --field-trial-handle=2168,i,13241872116536714860,13674861741672601511,262144 --variations-seed-version --mojo-platform-channel-handle=6884 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6916,i,15169398815169670239,472143047674366907,524288 --field-trial-handle=2168,i,13241872116536714860,13674861741672601511,262144 --variations-seed-version --mojo-platform-channel-handle=3016 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3400,i,5092592900591724686,15081606642499314039,524288 --field-trial-handle=2168,i,13241872116536714860,13674861741672601511,262144 --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7084,i,2055140654049139727,1751307073030878745,524288 --field-trial-handle=2168,i,13241872116536714860,13674861741672601511,262144 --variations-seed-version --mojo-platform-channel-handle=7076 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6912,i,13679060953480476870,3879997615325696604,262144 --field-trial-handle=2168,i,13241872116536714860,13674861741672601511,262144 --variations-seed-version --mojo-platform-channel-handle=7064 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6676,i,6542029194149509787,9666070694391957453,524288 --field-trial-handle=2168,i,13241872116536714860,13674861741672601511,262144 --variations-seed-version --mojo-platform-channel-handle=6672 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\mhezxrpjhbzurmke.sysC:\Temp\mhezxrpjhbzurmke.sys1⤵
- Executes dropped EXE
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Temp\bztrmjhbzu.sysC:\Temp\bztrmjhbzu.sys1⤵
- Executes dropped EXE
-
C:\Temp\eywurljetr.sysC:\Temp\eywurljetr.sys1⤵
- Executes dropped EXE
-
C:\Temp\wtoigbywqo.sysC:\Temp\wtoigbywqo.sys1⤵
- Executes dropped EXE
-
C:\Temp\lgdywtnlid.sysC:\Temp\lgdywtnlid.sys1⤵
- Executes dropped EXE
-
C:\Temp\tnlfdxvqni.sysC:\Temp\tnlfdxvqni.sys1⤵
- Executes dropped EXE
-
C:\Temp\vtnlfdxnif.sysC:\Temp\vtnlfdxnif.sys1⤵
- Executes dropped EXE
-
C:\Temp\uspnhfaxsp.sysC:\Temp\uspnhfaxsp.sys1⤵
- Executes dropped EXE
-
C:\Temp\hcausmkhcz.sysC:\Temp\hcausmkhcz.sys1⤵
- Executes dropped EXE
-
C:\Temp\zwrpjhezwu.sysC:\Temp\zwrpjhezwu.sys1⤵
- Executes dropped EXE
-
C:\Temp\wuomjecwuo.sysC:\Temp\wuomjecwuo.sys1⤵
- Executes dropped EXE
-
C:\Temp\trljdbwtrl.sysC:\Temp\trljdbwtrl.sys1⤵
-
C:\Temp\lgeyvtolgd.sysC:\Temp\lgeyvtolgd.sys1⤵
-
C:\Temp\ayvqoifdyv.sysC:\Temp\ayvqoifdyv.sys1⤵
-
C:\Temp\aysqkifdxv.sysC:\Temp\aysqkifdxv.sys1⤵
-
C:\Temp\pnlfdxvpni.sysC:\Temp\pnlfdxvpni.sys1⤵
-
C:\Temp\hfcxuspnhe.sysC:\Temp\hfcxuspnhe.sys1⤵
-
C:\Temp\eczurmkecw.sysC:\Temp\eczurmkecw.sys1⤵
-
C:\Temp\kecwurmjeb.sysC:\Temp\kecwurmjeb.sys1⤵
-
C:\Temp\bywuomgebw.sysC:\Temp\bywuomgebw.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
bztrmjhbzu.sys
eywurljetr.sys
hecwrpjhzu.exe
i_hecwrpjhzu.exe
i_idyvqoigay.exe
i_trojgebwtr.exe
i_wrojgezwro.exe
i_ztrljdbwlg.exe
idyvqoigay.exe
lfdxvpnlfd.exe
lgdywtnlid.sys
mhezxrpjhbzurmke.exe
mhezxrpjhbzurmke.sys
tnlfdxvqni.sys
trojgebwtr.exe
wrojgezwro.exe
wtoigbywqo.sys
ztrljdbwlg.exe
settings.dat
settings.dat
the-real-index
the-real-index~RFe596b53.TMP
SiteList-Enterprise.json
Edge Profile.ico
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Preferences
Preferences
Preferences
Secure Preferences
780adc7e-3d98-485b-bfa5-a180f1c61f26.tmp
Local State
Local State
Local State
Local State
Local State
Local State
metadata.json
metadata.json
metadata.json
299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
c559d6a4-8688-456d-9f3a-f9a4ce81dd44.tmp
metadata.json~RFe5942ac.TMP
fc9fa7f1-b893-4a42-a3b3-f25ca2e474c4.tmp
content_new.js
CreateProcess.exe
memory/1168-675-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1288-600-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1324-511-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1524-664-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2796-553-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2796-547-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3260-567-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3260-524-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3784-721-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4540-471-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4692-499-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4716-696-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4732-644-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4832-620-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4872-456-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4872-66-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4900-551-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4920-571-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5364-423-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5584-640-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5620-700-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5952-704-0x0000000000010000-0x00000000000AB000-memory.dmp