Analysis
- max time kernel
148s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
13/08/2026, 06:39
General
- Target 2026-08-12_568d9c5a3b3a395278f50a2b763d5284_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 722KB
- Sample260813-hep6astera
- SHA256 488ed288ab35d7a483aca679b8b539805fa7575fea8a7dcb317c6da07a2e061e
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 40 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 19 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-12_568d9c5a3b3a395278f50a2b763d5284_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-12_568d9c5a3b3a395278f50a2b763d5284_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\heztrmjecwurmjeb.exeC:\Temp\heztrmjecwurmjeb.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jhbztomjez.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\jhbztomjez.exeC:\Temp\jhbztomjez.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jhbztomjez.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_jhbztomjez.exeC:\Temp\i_jhbztomjez.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wtrljebwto.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\wtrljebwto.exeC:\Temp\wtrljebwto.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wtrljebwto.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_wtrljebwto.exeC:\Temp\i_wtrljebwto.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ebwlgdbywq.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ebwlgdbywq.exeC:\Temp\ebwlgdbywq.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ebwlgdbywq.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ebwlgdbywq.exeC:\Temp\i_ebwlgdbywq.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vtnlfdyvqn.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\vtnlfdyvqn.exeC:\Temp\vtnlfdyvqn.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vtnlfdyvqn.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_vtnlfdyvqn.exeC:\Temp\i_vtnlfdyvqn.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\sqkigaxvtn.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\sqkigaxvtn.exeC:\Temp\sqkigaxvtn.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_sqkigaxvtn.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_sqkigaxvtn.exeC:\Temp\i_sqkigaxvtn.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pnhfzxspnh.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\pnhfzxspnh.exeC:\Temp\pnhfzxspnh.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pnhfzxspnh.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_pnhfzxspnh.exeC:\Temp\i_pnhfzxspnh.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\uspczxrpnk.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\uspczxrpnk.exeC:\Temp\uspczxrpnk.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_uspczxrpnk.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_uspczxrpnk.exeC:\Temp\i_uspczxrpnk.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pnhfzxrpjh.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\pnhfzxrpjh.exeC:\Temp\pnhfzxrpjh.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pnhfzxrpjh.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_pnhfzxrpjh.exeC:\Temp\i_pnhfzxrpjh.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\cwupmgezwr.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\cwupmgezwr.exeC:\Temp\cwupmgezwr.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_cwupmgezwr.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_cwupmgezwr.exeC:\Temp\i_cwupmgezwr.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ljebwuomgb.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ljebwuomgb.exeC:\Temp\ljebwuomgb.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ljebwuomgb.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ljebwuomgb.exeC:\Temp\i_ljebwuomgb.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ojytrljdbw.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ojytrljdbw.exeC:\Temp\ojytrljdbw.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ojytrljdbw.exe ups_ins3⤵
-
C:\Temp\i_ojytrljdbw.exeC:\Temp\i_ojytrljdbw.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gaywqoigay.exe ups_run3⤵
-
C:\Temp\gaywqoigay.exeC:\Temp\gaywqoigay.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gaywqoigay.exe ups_ins3⤵
-
C:\Temp\i_gaywqoigay.exeC:\Temp\i_gaywqoigay.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vtnlfdyvqn.exe ups_run3⤵
-
C:\Temp\vtnlfdyvqn.exeC:\Temp\vtnlfdyvqn.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vtnlfdyvqn.exe ups_ins3⤵
-
C:\Temp\i_vtnlfdyvqn.exeC:\Temp\i_vtnlfdyvqn.exe ups_ins4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\snkifaxvsn.exe ups_run3⤵
-
C:\Temp\snkifaxvsn.exeC:\Temp\snkifaxvsn.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_snkifaxvsn.exe ups_ins3⤵
-
C:\Temp\i_snkifaxvsn.exeC:\Temp\i_snkifaxvsn.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zxspkicsmk.exe ups_run3⤵
-
C:\Temp\zxspkicsmk.exeC:\Temp\zxspkicsmk.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zxspkicsmk.exe ups_ins3⤵
-
C:\Temp\i_zxspkicsmk.exeC:\Temp\i_zxspkicsmk.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xrpkhczusm.exe ups_run3⤵
-
C:\Temp\xrpkhczusm.exeC:\Temp\xrpkhczusm.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xrpkhczusm.exe ups_ins3⤵
-
C:\Temp\i_xrpkhczusm.exeC:\Temp\i_xrpkhczusm.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pmhezxrpjh.exe ups_run3⤵
-
C:\Temp\pmhezxrpjh.exeC:\Temp\pmhezxrpjh.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pmhezxrpjh.exe ups_ins3⤵
-
C:\Temp\i_pmhezxrpjh.exeC:\Temp\i_pmhezxrpjh.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jebztrmjec.exe ups_run3⤵
-
C:\Temp\jebztrmjec.exeC:\Temp\jebztrmjec.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jebztrmjec.exe ups_ins3⤵
-
C:\Temp\i_jebztrmjec.exeC:\Temp\i_jebztrmjec.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ljgbztrljd.exe ups_run3⤵
-
C:\Temp\ljgbztrljd.exeC:\Temp\ljgbztrljd.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ljgbztrljd.exe ups_ins3⤵
-
C:\Temp\i_ljgbztrljd.exeC:\Temp\i_ljgbztrljd.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2c8,0x304,0x7ffec25dc188,0x7ffec25dc194,0x7ffec25dc1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1684,i,11509149223254398663,12263131857909800358,262144 --field-trial-handle=2352,i,8582240192148096880,16493577425376149630,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1900,i,15779542734078356079,8114063575001790844,524288 --field-trial-handle=2352,i,8582240192148096880,16493577425376149630,262144 --variations-seed-version --mojo-platform-channel-handle=2380 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2284,i,1970301486074871659,6808067767704196893,524288 --field-trial-handle=2352,i,8582240192148096880,16493577425376149630,262144 --variations-seed-version --mojo-platform-channel-handle=3020 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3572,i,5728473685614575456,3293010029528594718,2097152 --field-trial-handle=2352,i,8582240192148096880,16493577425376149630,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3596,i,9279877846595223037,14657335700201721789,2097152 --field-trial-handle=2352,i,8582240192148096880,16493577425376149630,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4256,i,7132119743637582792,3951102866464406898,2097152 --field-trial-handle=2352,i,8582240192148096880,16493577425376149630,262144 --variations-seed-version --mojo-platform-channel-handle=4800 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4276,i,4534729925170598052,15430056384482908359,2097152 --field-trial-handle=2352,i,8582240192148096880,16493577425376149630,262144 --variations-seed-version --mojo-platform-channel-handle=4808 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5160,i,4324073668924069673,3967672414730367770,2097152 --field-trial-handle=2352,i,8582240192148096880,16493577425376149630,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3788,i,10248563169641881767,6710580415941282177,524288 --field-trial-handle=2352,i,8582240192148096880,16493577425376149630,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5488,i,12222046011822289242,14736883554700611088,2097152 --field-trial-handle=2352,i,8582240192148096880,16493577425376149630,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,12254600963133082678,17989244350817487659,524288 --field-trial-handle=2352,i,8582240192148096880,16493577425376149630,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,12254600963133082678,17989244350817487659,524288 --field-trial-handle=2352,i,8582240192148096880,16493577425376149630,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5392,i,4273599631085567582,13635920498217593102,524288 --field-trial-handle=2352,i,8582240192148096880,16493577425376149630,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5256,i,17519689257348275179,3957342910043327024,524288 --field-trial-handle=2352,i,8582240192148096880,16493577425376149630,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6124,i,10270678574527085858,8950279651328412044,524288 --field-trial-handle=2352,i,8582240192148096880,16493577425376149630,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,5530407215681816010,11703794945634590578,524288 --field-trial-handle=2352,i,8582240192148096880,16493577425376149630,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6920,i,8342831255430063705,3039796838005164418,524288 --field-trial-handle=2352,i,8582240192148096880,16493577425376149630,262144 --variations-seed-version --mojo-platform-channel-handle=6924 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7076,i,16368895406995768040,974555644155773164,524288 --field-trial-handle=2352,i,8582240192148096880,16493577425376149630,262144 --variations-seed-version --mojo-platform-channel-handle=7068 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6756,i,5991372607315631585,10631232568247225794,2097152 --field-trial-handle=2352,i,8582240192148096880,16493577425376149630,262144 --variations-seed-version --mojo-platform-channel-handle=6716 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3852,i,6754872630272415158,6408793662725190683,524288 --field-trial-handle=2352,i,8582240192148096880,16493577425376149630,262144 --variations-seed-version --mojo-platform-channel-handle=4960 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4788,i,14461624022652106888,15719735408715680323,524288 --field-trial-handle=2352,i,8582240192148096880,16493577425376149630,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4792,i,361719798063150191,7820361036721635373,524288 --field-trial-handle=2352,i,8582240192148096880,16493577425376149630,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6428,i,5453758752260581022,16568230412053939633,524288 --field-trial-handle=2352,i,8582240192148096880,16493577425376149630,262144 --variations-seed-version --mojo-platform-channel-handle=6628 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6584,i,17686103746281888661,9919147681458987061,524288 --field-trial-handle=2352,i,8582240192148096880,16493577425376149630,262144 --variations-seed-version --mojo-platform-channel-handle=5088 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4768,i,11939887321329858029,7759955314578734360,524288 --field-trial-handle=2352,i,8582240192148096880,16493577425376149630,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,8611091176521673296,9014864425499763020,524288 --field-trial-handle=2352,i,8582240192148096880,16493577425376149630,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6276,i,3893231197146791655,7076158321825061217,262144 --field-trial-handle=2352,i,8582240192148096880,16493577425376149630,262144 --variations-seed-version --mojo-platform-channel-handle=6660 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5988,i,12618221913926605715,6332603046544977523,524288 --field-trial-handle=2352,i,8582240192148096880,16493577425376149630,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\heztrmjecwurmjeb.sysC:\Temp\heztrmjecwurmjeb.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Temp\gbywuomjet.sysC:\Temp\gbywuomjet.sys1⤵
- Executes dropped EXE
-
C:\Temp\dbvtoljdby.sysC:\Temp\dbvtoljdby.sys1⤵
- Executes dropped EXE
-
C:\Temp\dbvtnlgdyw.sysC:\Temp\dbvtnlgdyw.sys1⤵
- Executes dropped EXE
-
C:\Temp\aysqkidavt.sysC:\Temp\aysqkidavt.sys1⤵
- Executes dropped EXE
-
C:\Temp\dankfdxvpn.sysC:\Temp\dankfdxvpn.sys1⤵
- Executes dropped EXE
-
C:\Temp\usmkfcxvsq.sysC:\Temp\usmkfcxvsq.sys1⤵
- Executes dropped EXE
-
C:\Temp\pnhfzxupmk.sysC:\Temp\pnhfzxupmk.sys1⤵
- Executes dropped EXE
-
C:\Temp\mgezwrpmhe.sysC:\Temp\mgezwrpmhe.sys1⤵
- Executes dropped EXE
-
C:\Temp\wjgebwtrlj.sysC:\Temp\wjgebwtrlj.sys1⤵
- Executes dropped EXE
-
C:\Temp\ojgbytrljg.sysC:\Temp\ojgbytrljg.sys1⤵
- Executes dropped EXE
-
C:\Temp\igbytqolgd.sysC:\Temp\igbytqolgd.sys1⤵
-
C:\Temp\gaysqkidav.sysC:\Temp\gaysqkidav.sys1⤵
-
C:\Temp\vtqdaxspnk.sysC:\Temp\vtqdaxspnk.sys1⤵
-
C:\Temp\causnkfdxv.sysC:\Temp\causnkfdxv.sys1⤵
-
C:\Temp\zxspkhfzxr.sysC:\Temp\zxspkhfzxr.sys1⤵
-
C:\Temp\spjhbzurmk.sysC:\Temp\spjhbzurmk.sys1⤵
-
C:\Temp\omkecwuomc.sysC:\Temp\omkecwuomc.sys1⤵
-
C:\Temp\omgebztrlj.sysC:\Temp\omgebztrlj.sys1⤵
-
C:\Temp\gbztrljdbw.sysC:\Temp\gbztrljdbw.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
aysqkidavt.sys
dankfdxvpn.sys
dbvtnlgdyw.sys
dbvtoljdby.sys
ebwlgdbywq.exe
gbywuomjet.sys
heztrmjecwurmjeb.exe
heztrmjecwurmjeb.sys
i_ebwlgdbywq.exe
i_jhbztomjez.exe
i_sqkigaxvtn.exe
i_vtnlfdyvqn.exe
i_wtrljebwto.exe
jhbztomjez.exe
sqkigaxvtn.exe
vtnlfdyvqn.exe
wtrljebwto.exe
settings.dat
settings.dat
BookmarkMergedSurfaceOrdering
the-real-index
the-real-index~RFe598802.TMP
SiteList-Enterprise.json
Edge Profile.ico
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Preferences
Preferences
Preferences
Secure Preferences
sync_diagnostic.log
5e85ee23-e97f-4399-bf40-4fa73d741b78.tmp
Local State
Local State
Local State
Local State
Local State
Local State
metadata.json
metadata.json
metadata.json
299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
metadata.json
metadata.json
e07c315d-ce4c-46a2-978e-6848283370d1.tmp
content_new.js
CreateProcess.exe
memory/1076-719-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1240-630-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1656-715-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1884-654-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2424-419-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2976-494-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3380-66-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4144-634-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4380-542-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4544-686-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4680-557-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4748-610-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4832-561-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4832-538-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5312-665-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5732-590-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5892-466-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5928-506-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5968-690-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/6120-518-0x0000000000010000-0x00000000000AB000-memory.dmp