Overview

overview

10

Static

static

10

2026-04-16...op.exe

windows10-2004-x64

10

2026-04-16...op.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260130-en
  • resource tags

    arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    16/04/2026, 04:13

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-04-16_fa83b0dad004aa5cba26ef99c5608a37_amadey_darkgate_elex_smoke-loader_stop.exe
  • Size 384KB
  • Sample260416-etefkaft3p
  • SHA256 5643436196fcd90382a075339c9d0c00dc45045a0d8c0ee7ee01bf51169f5156
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwarediscoverysystexspywaretrojan

Malware Config

Signatures

  • Family: Systex

    Systex is a trojan loader written in C++.

    trojansystex
  • Executes dropped EXE 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Gathers network information 2 TTPs 20 IoCs

    Uses commandline utility to view network configuration.

  • Modifies Internet Explorer settings 1 TTPs 29 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 20 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 19 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-04-16_fa83b0dad004aa5cba26ef99c5608a37_amadey_darkgate_elex_smoke-loader_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-04-16_fa83b0dad004aa5cba26ef99c5608a37_amadey_darkgate_elex_smoke-loader_stop.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:5600
    • C:\Temp\smkecxupnhfzxrpk.exe
      C:\Temp\smkecxupnhfzxrpk.exe run
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4916
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\causmhfzxr.exe ups_run
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:2688
        • C:\Temp\causmhfzxr.exe
          C:\Temp\causmhfzxr.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5608
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:660
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:2732
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_causmhfzxr.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:2020
        • C:\Temp\i_causmhfzxr.exe
          C:\Temp\i_causmhfzxr.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:2224
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\usmkecwupm.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:3432
        • C:\Temp\usmkecwupm.exe
          C:\Temp\usmkecwupm.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3616
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:1692
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:6020
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_usmkecwupm.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:5548
        • C:\Temp\i_usmkecwupm.exe
          C:\Temp\i_usmkecwupm.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:4836
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\urmkecxrpj.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:672
        • C:\Temp\urmkecxrpj.exe
          C:\Temp\urmkecxrpj.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4996
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:1848
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:5308
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_urmkecxrpj.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:5812
        • C:\Temp\i_urmkecxrpj.exe
          C:\Temp\i_urmkecxrpj.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:1796
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\mgeywrojge.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:4780
        • C:\Temp\mgeywrojge.exe
          C:\Temp\mgeywrojge.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5268
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:488
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:3488
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_mgeywrojge.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:6032
        • C:\Temp\i_mgeywrojge.exe
          C:\Temp\i_mgeywrojge.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:3504
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\dbwtolgeyw.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:4484
        • C:\Temp\dbwtolgeyw.exe
          C:\Temp\dbwtolgeyw.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4836
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:4488
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:4924
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_dbwtolgeyw.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:5724
        • C:\Temp\i_dbwtolgeyw.exe
          C:\Temp\i_dbwtolgeyw.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:3952
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\vqnlgdywqo.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:2060
        • C:\Temp\vqnlgdywqo.exe
          C:\Temp\vqnlgdywqo.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2600
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:5808
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:1328
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_vqnlgdywqo.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:3252
        • C:\Temp\i_vqnlgdywqo.exe
          C:\Temp\i_vqnlgdywqo.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:5516
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\tnlfdyvqoi.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:396
        • C:\Temp\tnlfdyvqoi.exe
          C:\Temp\tnlfdyvqoi.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:6088
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:4364
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:5264
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_tnlfdyvqoi.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:2840
        • C:\Temp\i_tnlfdyvqoi.exe
          C:\Temp\i_tnlfdyvqoi.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:5720
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\snlfdxvpni.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:4004
        • C:\Temp\snlfdxvpni.exe
          C:\Temp\snlfdxvpni.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4884
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:932
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:5868
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_snlfdxvpni.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:2720
        • C:\Temp\i_snlfdxvpni.exe
          C:\Temp\i_snlfdxvpni.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:240
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\kicausmkfc.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:1700
        • C:\Temp\kicausmkfc.exe
          C:\Temp\kicausmkfc.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3400
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:6092
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:656
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_kicausmkfc.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:3352
        • C:\Temp\i_kicausmkfc.exe
          C:\Temp\i_kicausmkfc.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:3760
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\cwupmhfzxr.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:5928
        • C:\Temp\cwupmhfzxr.exe
          C:\Temp\cwupmhfzxr.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5444
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:584
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:3756
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_cwupmhfzxr.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:5176
        • C:\Temp\i_cwupmhfzxr.exe
          C:\Temp\i_cwupmhfzxr.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:1384
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\zxrpjhfzur.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:4308
        • C:\Temp\zxrpjhfzur.exe
          C:\Temp\zxrpjhfzur.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1756
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
              PID:3952
              • C:\windows\system32\ipconfig.exe
                C:\windows\system32\ipconfig.exe /release
                6⤵
                • Gathers network information
                PID:4992
        • C:\temp\CreateProcess.exe
          C:\temp\CreateProcess.exe C:\Temp\i_zxrpjhfzur.exe ups_ins
          3⤵
            PID:996
            • C:\Temp\i_zxrpjhfzur.exe
              C:\Temp\i_zxrpjhfzur.exe ups_ins
              4⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              PID:5564
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\Temp\omgezwrpjh.exe ups_run
            3⤵
              PID:5836
              • C:\Temp\omgezwrpjh.exe
                C:\Temp\omgezwrpjh.exe ups_run
                4⤵
                • System Location Discovery: System Language Discovery
                PID:1852
                • C:\temp\CreateProcess.exe
                  C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                  5⤵
                    PID:3360
                    • C:\windows\system32\ipconfig.exe
                      C:\windows\system32\ipconfig.exe /release
                      6⤵
                      • Gathers network information
                      PID:5352
              • C:\temp\CreateProcess.exe
                C:\temp\CreateProcess.exe C:\Temp\i_omgezwrpjh.exe ups_ins
                3⤵
                  PID:5320
                  • C:\Temp\i_omgezwrpjh.exe
                    C:\Temp\i_omgezwrpjh.exe ups_ins
                    4⤵
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4784
                • C:\temp\CreateProcess.exe
                  C:\temp\CreateProcess.exe C:\Temp\mgeywrojgb.exe ups_run
                  3⤵
                    PID:1880
                    • C:\Temp\mgeywrojgb.exe
                      C:\Temp\mgeywrojgb.exe ups_run
                      4⤵
                      • System Location Discovery: System Language Discovery
                      PID:3872
                      • C:\temp\CreateProcess.exe
                        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                        5⤵
                          PID:3728
                          • C:\windows\system32\ipconfig.exe
                            C:\windows\system32\ipconfig.exe /release
                            6⤵
                            • Gathers network information
                            PID:3424
                    • C:\temp\CreateProcess.exe
                      C:\temp\CreateProcess.exe C:\Temp\i_mgeywrojgb.exe ups_ins
                      3⤵
                        PID:1204
                        • C:\Temp\i_mgeywrojgb.exe
                          C:\Temp\i_mgeywrojgb.exe ups_ins
                          4⤵
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of AdjustPrivilegeToken
                          PID:3592
                      • C:\temp\CreateProcess.exe
                        C:\temp\CreateProcess.exe C:\Temp\ywqoigbytq.exe ups_run
                        3⤵
                          PID:5316
                          • C:\Temp\ywqoigbytq.exe
                            C:\Temp\ywqoigbytq.exe ups_run
                            4⤵
                            • System Location Discovery: System Language Discovery
                            PID:2372
                            • C:\temp\CreateProcess.exe
                              C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                              5⤵
                                PID:4556
                                • C:\windows\system32\ipconfig.exe
                                  C:\windows\system32\ipconfig.exe /release
                                  6⤵
                                  • Gathers network information
                                  PID:5376
                          • C:\temp\CreateProcess.exe
                            C:\temp\CreateProcess.exe C:\Temp\i_ywqoigbytq.exe ups_ins
                            3⤵
                              PID:3064
                              • C:\Temp\i_ywqoigbytq.exe
                                C:\Temp\i_ywqoigbytq.exe ups_ins
                                4⤵
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of AdjustPrivilegeToken
                                PID:4604
                            • C:\temp\CreateProcess.exe
                              C:\temp\CreateProcess.exe C:\Temp\bvtnlfdyvq.exe ups_run
                              3⤵
                                PID:3120
                                • C:\Temp\bvtnlfdyvq.exe
                                  C:\Temp\bvtnlfdyvq.exe ups_run
                                  4⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:1124
                                  • C:\temp\CreateProcess.exe
                                    C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                                    5⤵
                                      PID:3052
                                      • C:\windows\system32\ipconfig.exe
                                        C:\windows\system32\ipconfig.exe /release
                                        6⤵
                                        • Gathers network information
                                        PID:5492
                                • C:\temp\CreateProcess.exe
                                  C:\temp\CreateProcess.exe C:\Temp\i_bvtnlfdyvq.exe ups_ins
                                  3⤵
                                    PID:5384
                                    • C:\Temp\i_bvtnlfdyvq.exe
                                      C:\Temp\i_bvtnlfdyvq.exe ups_ins
                                      4⤵
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:5904
                                  • C:\temp\CreateProcess.exe
                                    C:\temp\CreateProcess.exe C:\Temp\igaysnlfda.exe ups_run
                                    3⤵
                                      PID:3720
                                      • C:\Temp\igaysnlfda.exe
                                        C:\Temp\igaysnlfda.exe ups_run
                                        4⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:3996
                                        • C:\temp\CreateProcess.exe
                                          C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                                          5⤵
                                            PID:3416
                                            • C:\windows\system32\ipconfig.exe
                                              C:\windows\system32\ipconfig.exe /release
                                              6⤵
                                              • Gathers network information
                                              PID:4712
                                      • C:\temp\CreateProcess.exe
                                        C:\temp\CreateProcess.exe C:\Temp\i_igaysnlfda.exe ups_ins
                                        3⤵
                                          PID:2648
                                          • C:\Temp\i_igaysnlfda.exe
                                            C:\Temp\i_igaysnlfda.exe ups_ins
                                            4⤵
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:3184
                                        • C:\temp\CreateProcess.exe
                                          C:\temp\CreateProcess.exe C:\Temp\spkicausmk.exe ups_run
                                          3⤵
                                            PID:3504
                                            • C:\Temp\spkicausmk.exe
                                              C:\Temp\spkicausmk.exe ups_run
                                              4⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:5352
                                              • C:\temp\CreateProcess.exe
                                                C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                                                5⤵
                                                  PID:5856
                                                  • C:\windows\system32\ipconfig.exe
                                                    C:\windows\system32\ipconfig.exe /release
                                                    6⤵
                                                    • Gathers network information
                                                    PID:564
                                            • C:\temp\CreateProcess.exe
                                              C:\temp\CreateProcess.exe C:\Temp\i_spkicausmk.exe ups_ins
                                              3⤵
                                                PID:3392
                                                • C:\Temp\i_spkicausmk.exe
                                                  C:\Temp\i_spkicausmk.exe ups_ins
                                                  4⤵
                                                  • System Location Discovery: System Language Discovery
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:3916
                                              • C:\temp\CreateProcess.exe
                                                C:\temp\CreateProcess.exe C:\Temp\hcausmkfcw.exe ups_run
                                                3⤵
                                                  PID:3032
                                                  • C:\Temp\hcausmkfcw.exe
                                                    C:\Temp\hcausmkfcw.exe ups_run
                                                    4⤵
                                                    • System Location Discovery: System Language Discovery
                                                    PID:3396
                                                    • C:\temp\CreateProcess.exe
                                                      C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                                                      5⤵
                                                        PID:1636
                                                        • C:\windows\system32\ipconfig.exe
                                                          C:\windows\system32\ipconfig.exe /release
                                                          6⤵
                                                          • Gathers network information
                                                          PID:3344
                                                  • C:\temp\CreateProcess.exe
                                                    C:\temp\CreateProcess.exe C:\Temp\i_hcausmkfcw.exe ups_ins
                                                    3⤵
                                                      PID:2812
                                                      • C:\Temp\i_hcausmkfcw.exe
                                                        C:\Temp\i_hcausmkfcw.exe ups_ins
                                                        4⤵
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:1440
                                                    • C:\temp\CreateProcess.exe
                                                      C:\temp\CreateProcess.exe C:\Temp\caupjhczus.exe ups_run
                                                      3⤵
                                                        PID:5588
                                                        • C:\Temp\caupjhczus.exe
                                                          C:\Temp\caupjhczus.exe ups_run
                                                          4⤵
                                                          • System Location Discovery: System Language Discovery
                                                          PID:2828
                                                          • C:\temp\CreateProcess.exe
                                                            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                                                            5⤵
                                                              PID:1296
                                                              • C:\windows\system32\ipconfig.exe
                                                                C:\windows\system32\ipconfig.exe /release
                                                                6⤵
                                                                • Gathers network information
                                                                PID:5452
                                                        • C:\temp\CreateProcess.exe
                                                          C:\temp\CreateProcess.exe C:\Temp\i_caupjhczus.exe ups_ins
                                                          3⤵
                                                            PID:656
                                                            • C:\Temp\i_caupjhczus.exe
                                                              C:\Temp\i_caupjhczus.exe ups_ins
                                                              4⤵
                                                              • System Location Discovery: System Language Discovery
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:5804
                                                          • C:\temp\CreateProcess.exe
                                                            C:\temp\CreateProcess.exe C:\Temp\mjebwupmhe.exe ups_run
                                                            3⤵
                                                              PID:4208
                                                              • C:\Temp\mjebwupmhe.exe
                                                                C:\Temp\mjebwupmhe.exe ups_run
                                                                4⤵
                                                                • System Location Discovery: System Language Discovery
                                                                PID:3668
                                                                • C:\temp\CreateProcess.exe
                                                                  C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                                                                  5⤵
                                                                    PID:4000
                                                                    • C:\windows\system32\ipconfig.exe
                                                                      C:\windows\system32\ipconfig.exe /release
                                                                      6⤵
                                                                      • Gathers network information
                                                                      PID:3112
                                                            • C:\Program Files\Internet Explorer\iexplore.exe
                                                              "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
                                                              2⤵
                                                              • Modifies Internet Explorer settings
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:5752
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
                                                                3⤵
                                                                • Drops file in Windows directory
                                                                • Enumerates system info in registry
                                                                • Modifies data under HKEY_USERS
                                                                • Modifies registry class
                                                                • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                • Suspicious use of FindShellTrayWindow
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:6096
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x368,0x7ffa81c1c188,0x7ffa81c1c194,0x7ffa81c1c1a0
                                                                  4⤵
                                                                    PID:5844
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1772,i,5681500652456657072,9125302780216667859,524288 --field-trial-handle=2196,i,11419491752125743333,1937606289833155074,262144 --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:11
                                                                    4⤵
                                                                    • System Time Discovery
                                                                    PID:5936
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1604,i,4955090274878881608,7556011619392489569,262144 --field-trial-handle=2196,i,11419491752125743333,1937606289833155074,262144 --variations-seed-version --mojo-platform-channel-handle=2192 /prefetch:2
                                                                    4⤵
                                                                      PID:2280
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2408,i,9558001221430258086,9524038867522920318,524288 --field-trial-handle=2196,i,11419491752125743333,1937606289833155074,262144 --variations-seed-version --mojo-platform-channel-handle=3064 /prefetch:13
                                                                      4⤵
                                                                        PID:2996
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3468,i,6466138402662261180,6612785510434500530,2097152 --field-trial-handle=2196,i,11419491752125743333,1937606289833155074,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
                                                                        4⤵
                                                                          PID:1040
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3472,i,5844130603031240225,3532942118220429517,2097152 --field-trial-handle=2196,i,11419491752125743333,1937606289833155074,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
                                                                          4⤵
                                                                            PID:2380
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4852,i,5203049190592562109,18189715559193853139,524288 --field-trial-handle=2196,i,11419491752125743333,1937606289833155074,262144 --variations-seed-version --mojo-platform-channel-handle=4908 /prefetch:14
                                                                            4⤵
                                                                              PID:2168
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4872,i,17060883846901602646,18354314553083929196,524288 --field-trial-handle=2196,i,11419491752125743333,1937606289833155074,262144 --variations-seed-version --mojo-platform-channel-handle=4960 /prefetch:14
                                                                              4⤵
                                                                                PID:3436
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5664,i,2800825370215690625,16382555110273429155,524288 --field-trial-handle=2196,i,11419491752125743333,1937606289833155074,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:14
                                                                                4⤵
                                                                                  PID:560
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5664,i,2800825370215690625,16382555110273429155,524288 --field-trial-handle=2196,i,11419491752125743333,1937606289833155074,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:14
                                                                                  4⤵
                                                                                    PID:3028
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5792,i,9172503839619823647,15192134391692917236,524288 --field-trial-handle=2196,i,11419491752125743333,1937606289833155074,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:14
                                                                                    4⤵
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:4092
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
                                                                                      cookie_exporter.exe --cookie-json=1140
                                                                                      5⤵
                                                                                        PID:1200
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5748,i,14917438374236099507,4643329872701984328,524288 --field-trial-handle=2196,i,11419491752125743333,1937606289833155074,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:14
                                                                                      4⤵
                                                                                        PID:1232
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5664,i,14183710105405152893,12438050652612855543,524288 --field-trial-handle=2196,i,11419491752125743333,1937606289833155074,262144 --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:14
                                                                                        4⤵
                                                                                          PID:5264
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5776,i,15993288809583277079,16145979449657066753,524288 --field-trial-handle=2196,i,11419491752125743333,1937606289833155074,262144 --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:14
                                                                                          4⤵
                                                                                            PID:2792
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6244,i,6235625990400676772,8317078716009729817,524288 --field-trial-handle=2196,i,11419491752125743333,1937606289833155074,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:14
                                                                                            4⤵
                                                                                              PID:4796
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5780,i,4893319056329612964,11536879088661691986,524288 --field-trial-handle=2196,i,11419491752125743333,1937606289833155074,262144 --variations-seed-version --mojo-platform-channel-handle=6440 /prefetch:14
                                                                                              4⤵
                                                                                                PID:1712
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4968,i,7183409628574302150,16406759631402680964,524288 --field-trial-handle=2196,i,11419491752125743333,1937606289833155074,262144 --variations-seed-version --mojo-platform-channel-handle=4872 /prefetch:14
                                                                                                4⤵
                                                                                                  PID:3260
                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5852,i,10186959316533125428,10095230530541176502,524288 --field-trial-handle=2196,i,11419491752125743333,1937606289833155074,262144 --variations-seed-version --mojo-platform-channel-handle=6440 /prefetch:14
                                                                                                  4⤵
                                                                                                    PID:2136
                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6488,i,17886237566714671928,9714150799819844611,524288 --field-trial-handle=2196,i,11419491752125743333,1937606289833155074,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:14
                                                                                                    4⤵
                                                                                                      PID:5012
                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5920,i,8339658691472100403,15095864320950470049,524288 --field-trial-handle=2196,i,11419491752125743333,1937606289833155074,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:14
                                                                                                      4⤵
                                                                                                        PID:3888
                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5068,i,13706977930626061235,2240008473578564790,524288 --field-trial-handle=2196,i,11419491752125743333,1937606289833155074,262144 --variations-seed-version --mojo-platform-channel-handle=4952 /prefetch:14
                                                                                                        4⤵
                                                                                                          PID:6052
                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6316,i,199277027299558082,1997111114361389420,262144 --field-trial-handle=2196,i,11419491752125743333,1937606289833155074,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:10
                                                                                                          4⤵
                                                                                                            PID:4544
                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6264,i,13471461210250496933,4205635697053619555,524288 --field-trial-handle=2196,i,11419491752125743333,1937606289833155074,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:14
                                                                                                            4⤵
                                                                                                              PID:6116
                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                                        1⤵
                                                                                                          PID:5296
                                                                                                        • C:\Temp\smkecxupnhfzxrpk.sys
                                                                                                          C:\Temp\smkecxupnhfzxrpk.sys
                                                                                                          1⤵
                                                                                                          • Executes dropped EXE
                                                                                                          PID:4168
                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
                                                                                                          1⤵
                                                                                                            PID:5176
                                                                                                          • C:\Temp\pjhfzxrpkh.sys
                                                                                                            C:\Temp\pjhfzxrpkh.sys
                                                                                                            1⤵
                                                                                                            • Executes dropped EXE
                                                                                                            PID:2116
                                                                                                          • C:\Temp\ezwrpjhbzu.sys
                                                                                                            C:\Temp\ezwrpjhbzu.sys
                                                                                                            1⤵
                                                                                                            • Executes dropped EXE
                                                                                                            PID:5032
                                                                                                          • C:\Temp\uomgeywroj.sys
                                                                                                            C:\Temp\uomgeywroj.sys
                                                                                                            1⤵
                                                                                                            • Executes dropped EXE
                                                                                                            PID:4108
                                                                                                          • C:\Temp\ljdbvtolgd.sys
                                                                                                            C:\Temp\ljdbvtolgd.sys
                                                                                                            1⤵
                                                                                                            • Executes dropped EXE
                                                                                                            PID:5452
                                                                                                          • C:\Temp\ljdbvtnlge.sys
                                                                                                            C:\Temp\ljdbvtnlge.sys
                                                                                                            1⤵
                                                                                                            • Executes dropped EXE
                                                                                                            PID:3416
                                                                                                          • C:\Temp\aysqlidavt.sys
                                                                                                            C:\Temp\aysqlidavt.sys
                                                                                                            1⤵
                                                                                                            • Executes dropped EXE
                                                                                                            PID:5568
                                                                                                          • C:\Temp\avsnlfdxvq.sys
                                                                                                            C:\Temp\avsnlfdxvq.sys
                                                                                                            1⤵
                                                                                                            • Executes dropped EXE
                                                                                                            PID:1760
                                                                                                          • C:\Temp\spnhfaxspk.sys
                                                                                                            C:\Temp\spnhfaxspk.sys
                                                                                                            1⤵
                                                                                                            • Executes dropped EXE
                                                                                                            PID:1640
                                                                                                          • C:\Temp\upnhfzxspk.sys
                                                                                                            C:\Temp\upnhfzxspk.sys
                                                                                                            1⤵
                                                                                                            • Executes dropped EXE
                                                                                                            PID:4608
                                                                                                          • C:\Temp\kecwuomhez.sys
                                                                                                            C:\Temp\kecwuomhez.sys
                                                                                                            1⤵
                                                                                                            • Executes dropped EXE
                                                                                                            PID:2816
                                                                                                          • C:\Temp\zwromhbztr.sys
                                                                                                            C:\Temp\zwromhbztr.sys
                                                                                                            1⤵
                                                                                                              PID:4168
                                                                                                            • C:\Temp\tolgeywqoj.sys
                                                                                                              C:\Temp\tolgeywqoj.sys
                                                                                                              1⤵
                                                                                                                PID:3892
                                                                                                              • C:\Temp\qojgbytrlj.sys
                                                                                                                C:\Temp\qojgbytrlj.sys
                                                                                                                1⤵
                                                                                                                  PID:4628
                                                                                                                • C:\Temp\idbvtnlfdy.sys
                                                                                                                  C:\Temp\idbvtnlfdy.sys
                                                                                                                  1⤵
                                                                                                                    PID:5148
                                                                                                                  • C:\Temp\vsnlfdysqk.sys
                                                                                                                    C:\Temp\vsnlfdysqk.sys
                                                                                                                    1⤵
                                                                                                                      PID:4356
                                                                                                                    • C:\Temp\davpnhfaxs.sys
                                                                                                                      C:\Temp\davpnhfaxs.sys
                                                                                                                      1⤵
                                                                                                                        PID:5288
                                                                                                                      • C:\Temp\xspkhcausm.sys
                                                                                                                        C:\Temp\xspkhcausm.sys
                                                                                                                        1⤵
                                                                                                                          PID:1276
                                                                                                                        • C:\Temp\mkezxrpmhf.sys
                                                                                                                          C:\Temp\mkezxrpmhf.sys
                                                                                                                          1⤵
                                                                                                                            PID:4772
                                                                                                                          • C:\Temp\zwrpjhbztr.sys
                                                                                                                            C:\Temp\zwrpjhbztr.sys
                                                                                                                            1⤵
                                                                                                                              PID:3000

                                                                                                                            Network

                                                                                                                                  MITRE ATT&CK Enterprise v16

                                                                                                                                  Replay Monitor

                                                                                                                                  Loading Replay Monitor...

                                                                                                                                  Downloads

                                                                                                                                  CreateProcess.exe
                                                                                                                                  • Path C:\Temp\CreateProcess.exe
                                                                                                                                  • Size 3KB
                                                                                                                                  • SHA256 2c3232adb6cad3c150e66ab9886f2dca1da5f95d059e7c10e3355cdf7eece004
                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                  Submit Download

                                                                                                                                  causmhfzxr.exe
                                                                                                                                  • Path C:\Temp\causmhfzxr.exe
                                                                                                                                  • Size 384KB
                                                                                                                                  • SHA256 cef605316bb1f149dc8ac572ed5d22f96b5bef32ceb28381e13ac188835a7fc0
                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                  Submit Download

                                                                                                                                  dbwtolgeyw.exe
                                                                                                                                  • Path C:\Temp\dbwtolgeyw.exe
                                                                                                                                  • Size 384KB
                                                                                                                                  • SHA256 cea30a440139131255edccc4c9fdb517ebe167b23cd31f70290bd4add38a81d2
                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                  Submit Download

                                                                                                                                  ezwrpjhbzu.sys
                                                                                                                                  • Path C:\Temp\ezwrpjhbzu.sys
                                                                                                                                  • Size 293KB
                                                                                                                                  • SHA256 3fccf18d419054126b50ceb7d3dcd63b60f11df7250abdb90d565f5dffa73867
                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                  Submit Download

                                                                                                                                  i_causmhfzxr.exe
                                                                                                                                  • Path C:\Temp\i_causmhfzxr.exe
                                                                                                                                  • Size 384KB
                                                                                                                                  • SHA256 414ef101637353fc5edaa8b4b02ab091dd6d7422d459412d67b5bea5b5641692
                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                  Submit Download

                                                                                                                                  i_dbwtolgeyw.exe
                                                                                                                                  • Path C:\Temp\i_dbwtolgeyw.exe
                                                                                                                                  • Size 384KB
                                                                                                                                  • SHA256 67bf9f5a86acbbfd60dfe610933953b89c5f57ebbe1392912e30cd6cc0d298f2
                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                  Submit Download

                                                                                                                                  i_mgeywrojge.exe
                                                                                                                                  • Path C:\Temp\i_mgeywrojge.exe
                                                                                                                                  • Size 384KB
                                                                                                                                  • SHA256 4ca2ca5e18bb25e74a9f74b0b5e87ce6cdf0020e67fa9a48e2c01bdfa0306b40
                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                  Submit Download

                                                                                                                                  i_urmkecxrpj.exe
                                                                                                                                  • Path C:\Temp\i_urmkecxrpj.exe
                                                                                                                                  • Size 384KB
                                                                                                                                  • SHA256 9bdcedcd7f68fb74b07027e309a5327c3040d59ec61989ac5146def1aab01ec5
                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                  Submit Download

                                                                                                                                  i_usmkecwupm.exe
                                                                                                                                  • Path C:\Temp\i_usmkecwupm.exe
                                                                                                                                  • Size 384KB
                                                                                                                                  • SHA256 1fa85e7b6e8e8cf7b976e24006def91c3972c40b909c48a29fd0426a965650bd
                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                  Submit Download

                                                                                                                                  i_vqnlgdywqo.exe
                                                                                                                                  • Path C:\Temp\i_vqnlgdywqo.exe
                                                                                                                                  • Size 384KB
                                                                                                                                  • SHA256 06bc2d9442c96338c75622d381f4b182417de8ac3d345a069b30ce8dd0e70580
                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                  Submit Download

                                                                                                                                  ljdbvtnlge.sys
                                                                                                                                  • Path C:\Temp\ljdbvtnlge.sys
                                                                                                                                  • Size 293KB
                                                                                                                                  • SHA256 2734141f79b208753df296822016146c2614e62f7010a124baf29d0eda7556e7
                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                  Submit Download

                                                                                                                                  ljdbvtolgd.sys
                                                                                                                                  • Path C:\Temp\ljdbvtolgd.sys
                                                                                                                                  • Size 293KB
                                                                                                                                  • SHA256 d039da67fff170f022f04c3017442191a9442f07434820b3e011ee19f7956481
                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                  Submit Download

                                                                                                                                  mgeywrojge.exe
                                                                                                                                  • Path C:\Temp\mgeywrojge.exe
                                                                                                                                  • Size 384KB
                                                                                                                                  • SHA256 569b412c4474b19fc70a829394261c92900c2dd4799e3acb30d4cc2da6781b9e
                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                  Submit Download

                                                                                                                                  pjhfzxrpkh.sys
                                                                                                                                  • Path C:\Temp\pjhfzxrpkh.sys
                                                                                                                                  • Size 293KB
                                                                                                                                  • SHA256 931dd52b00fc61caf0b6473d17f5bc67b7a8295b7428633a73b14c7362ba1a27
                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                  Submit Download

                                                                                                                                  smkecxupnhfzxrpk.exe
                                                                                                                                  • Path C:\Temp\smkecxupnhfzxrpk.exe
                                                                                                                                  • Size 384KB
                                                                                                                                  • SHA256 d75ba4632fe4f11d2927e87ac35e55e42a19d06fed40b3ecba366a08b1a35c51
                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                  Submit Download

                                                                                                                                  smkecxupnhfzxrpk.sys
                                                                                                                                  • Path C:\Temp\smkecxupnhfzxrpk.sys
                                                                                                                                  • Size 293KB
                                                                                                                                  • SHA256 b438fd84f93ecd0d2724c35dbaf1c718aed3fba259660b8f2daa5e0f2c8811ca
                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                  Submit Download

                                                                                                                                  uomgeywroj.sys
                                                                                                                                  • Path C:\Temp\uomgeywroj.sys
                                                                                                                                  • Size 293KB
                                                                                                                                  • SHA256 75215f68432da33187f90aa12e791c3ed72d593b5d9bad3fc9b4a7e37fc831a0
                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                  Submit Download

                                                                                                                                  urmkecxrpj.exe
                                                                                                                                  • Path C:\Temp\urmkecxrpj.exe
                                                                                                                                  • Size 384KB
                                                                                                                                  • SHA256 8cc65d2dba8cdbca00b840ca36fd08a0fe3d2a6a254a5f8b61d53381b2cabde7
                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                  Submit Download

                                                                                                                                  usmkecwupm.exe
                                                                                                                                  • Path C:\Temp\usmkecwupm.exe
                                                                                                                                  • Size 384KB
                                                                                                                                  • SHA256 880babf1acc53adedb6d15d734c74af774f69e40e929ab25f19c70e1ee7f69cb
                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                  Submit Download

                                                                                                                                  vqnlgdywqo.exe
                                                                                                                                  • Path C:\Temp\vqnlgdywqo.exe
                                                                                                                                  • Size 384KB
                                                                                                                                  • SHA256 2561f1da1ef028451ce6ab1f7c63e96aeee48fa0e7dfc6f6ae8a190750c7f845
                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                  Submit Download

                                                                                                                                  77cc5855-eac6-4bc2-a742-80f5eba22d5a.tmp
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\77cc5855-eac6-4bc2-a742-80f5eba22d5a.tmp
                                                                                                                                  • Size 27KB
                                                                                                                                  • SHA256 8e865969ce79de742b2158b8f3a092c2b414f401aa236955fc6dd4ecff37c0b1
                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                  Submit Download

                                                                                                                                  autofill_bypass_cache_forms.json
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\autofill_bypass_cache_forms.json
                                                                                                                                  • Size 161B
                                                                                                                                  • SHA256 f7510e38f81f8a84027304070205dd55127e3233fdf011411465ede67b5b5d92
                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                  Submit Download

                                                                                                                                  edge_autofill_global_block_list.json
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\edge_autofill_global_block_list.json
                                                                                                                                  • Size 6KB
                                                                                                                                  • SHA256 7d3c45c8207ba69066516e51e10a2137bc4f1fce070a692e0c65225f9856e04c
                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                  Submit Download

                                                                                                                                  v1FieldTypes.json
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\v1FieldTypes.json
                                                                                                                                  • Size 509KB
                                                                                                                                  • SHA256 611e7995ab7599a0c89f98d6c6152a42aaedf7449748109a465bb5b0badd0af2
                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                  Submit Download

                                                                                                                                  settings.dat
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                  • Size 280B
                                                                                                                                  • SHA256 9cf5acc3a4797f1d8e969ab1970c2330530e33f7dac25d2b42a810961a67ea68
                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                  Submit Download

                                                                                                                                  settings.dat
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                  • Size 280B
                                                                                                                                  • SHA256 ea750b8ccfa8d7c7a393cdf6c9c8a3be0f2f086fb814bb44905a02c83d9af71f
                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                  Submit Download

                                                                                                                                  BookmarkMergedSurfaceOrdering
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
                                                                                                                                  • Size 6B
                                                                                                                                  • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                  Submit Download

                                                                                                                                  BrowsingTopicsState
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
                                                                                                                                  • Size 414B
                                                                                                                                  • SHA256 42b103858244c376c48ef2ce9d9e2a0509f7d84a10c01a38afce67b16f081e65
                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                  Submit Download

                                                                                                                                  SiteList-Enterprise.json
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                                                                                                  • Size 2B
                                                                                                                                  • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                  Submit Download

                                                                                                                                  HubApps
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
                                                                                                                                  • Size 106KB
                                                                                                                                  • SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                  Submit Download

                                                                                                                                  Network Persistent State
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                                  • Size 2KB
                                                                                                                                  • SHA256 22c97eb510e02eb8996e8de12a5fd903a24c83e9b789a7d4207944b0d12e51a1
                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                  Submit Download

                                                                                                                                  SCT Auditing Pending Reports
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                                                                  • Size 2B
                                                                                                                                  • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                  Submit Download

                                                                                                                                  Sdch Dictionaries
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
                                                                                                                                  • Size 40B
                                                                                                                                  • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                  Submit Download

                                                                                                                                  Preferences
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                  • Size 16KB
                                                                                                                                  • SHA256 6f56df64fc6f8044d991dea0c981d383369c00eb0f9d6396a26a284e8133d13d
                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                  Submit Download

                                                                                                                                  Preferences
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                  • Size 15KB
                                                                                                                                  • SHA256 eddf0f75a865b5078acb447152896fd5c184c3029e429531623d2450e4e3c0cc
                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                  Submit Download

                                                                                                                                  Secure Preferences
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                                                                                  • Size 36KB
                                                                                                                                  • SHA256 9cda88cbc42adbb8255b297c356c4f78fd226509cbaa4144f019f720542a05a5
                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                  Submit Download

                                                                                                                                  sync_diagnostic.log
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                                                                                  • Size 23KB
                                                                                                                                  • SHA256 206ab9b563f2fd0c2c18544d5319128465db2bf6ecc43c2b47e27aaaf2fd56da
                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                  Submit Download

                                                                                                                                  CURRENT
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
                                                                                                                                  • Size 16B
                                                                                                                                  • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                  Submit Download

                                                                                                                                  MANIFEST-000001
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
                                                                                                                                  • Size 41B
                                                                                                                                  • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                  Submit Download

                                                                                                                                  data.txt
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.4.4\data.txt
                                                                                                                                  • Size 145KB
                                                                                                                                  • SHA256 7dd75cb36b4cc7c5f2df67bac823b9d9d2c3653172ff73ce6cccd39683970a08
                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                  Submit Download

                                                                                                                                  Local State
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                  • Size 26KB
                                                                                                                                  • SHA256 d436c59a4298467242a01d4dba9c1b474734754fe1b11d0148288099f54deebf
                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                  Submit Download

                                                                                                                                  Local State
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                  • Size 27KB
                                                                                                                                  • SHA256 3668c67615b2d0cb32514983165832b45a2b437206ba9c6cf6cb634fde907a26
                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                  Submit Download

                                                                                                                                  Local State
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                  • Size 27KB
                                                                                                                                  • SHA256 cddb2b6ecc2162f42a697bb528db73c88a61a0abe4676fe0cf1997aef022ea26
                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                  Submit Download

                                                                                                                                  Local State
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                  • Size 27KB
                                                                                                                                  • SHA256 9a4b57b82b876e3d742a722f8d7f1227aa6314da7880e3b371a9e21a42754c54
                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                  Submit Download

                                                                                                                                  Local State
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                  • Size 32KB
                                                                                                                                  • SHA256 6638e479424d977fd68a8b4943588e882c2d2e31c20a768cf14efb0363a5ec0f
                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                  Submit Download

                                                                                                                                  crs.pb
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\29.0.0.0\crs.pb
                                                                                                                                  • Size 251KB
                                                                                                                                  • SHA256 576d77d3085ff9156298e60dee868364cabab7911edf6f9a4d3ad5f351d5059f
                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                  Submit Download

                                                                                                                                  ct_config.pb
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\29.0.0.0\ct_config.pb
                                                                                                                                  • Size 16KB
                                                                                                                                  • SHA256 dfc86083d2fa2463f12d1d096db6084c860cb8bfddc3d2cf8e818f65353241d6
                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                  Submit Download

                                                                                                                                  kp_pinslist.pb
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\29.0.0.0\kp_pinslist.pb
                                                                                                                                  • Size 10KB
                                                                                                                                  • SHA256 9314218dc6642ea1980d504ec45e23aa2b4e7775ef13f7c7121271dbd60b1df4
                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                  Submit Download

                                                                                                                                  metadata.json
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                  • Size 2KB
                                                                                                                                  • SHA256 8ee061f041da45e8544b8ea33a7312659651202c69d3e92e81be16fa232f93c8
                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                  Submit Download

                                                                                                                                  metadata.json
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                  • Size 2KB
                                                                                                                                  • SHA256 cc2a6f66131e42e108e064d01abb5754b66dda2f9ed28fcb9366d04d2896ccc0
                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                  Submit Download

                                                                                                                                  metadata.json
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                  • Size 2KB
                                                                                                                                  • SHA256 8b4a44478b071d5aaae8ad3dfb6bb5f498c188be15e6eaf7eb7af673709c4159
                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                  Submit Download

                                                                                                                                  metadata.json
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                  • Size 2KB
                                                                                                                                  • SHA256 923996e6876503e3482adc9eb5370baf141a491cdb62d37d5967023e9a40ed37
                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                  Submit Download

                                                                                                                                  3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
                                                                                                                                  • Size 147KB
                                                                                                                                  • SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                  Submit Download

                                                                                                                                  metadata.json
                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
                                                                                                                                  • Size 132B
                                                                                                                                  • SHA256 54f761e00d363bd15db7bae3cc55144c80148a5fa1db7c3c2049e0e406a9142c
                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                  Submit Download

                                                                                                                                  manifest.json
                                                                                                                                  • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6096_132364200\manifest.json
                                                                                                                                  • Size 102B
                                                                                                                                  • SHA256 0b11bc370854bd2e625deb04fdfc53ba444e4af63ba831f9de785b44464b59b9
                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                  Submit Download

                                                                                                                                  manifest.json
                                                                                                                                  • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6096_1484929838\manifest.json
                                                                                                                                  • Size 119B
                                                                                                                                  • SHA256 7169d86e87f904218238cd293e043e20b7828afad9acd1ff2e5d64188530b9d7
                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                  Submit Download

                                                                                                                                  manifest.json
                                                                                                                                  • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6096_1779051797\manifest.json
                                                                                                                                  • Size 52B
                                                                                                                                  • SHA256 36565d2ebd6c48537cb3e6fe24ac74ca68dda18b3f0f8be13f47d01aec181d62
                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                  Submit Download

                                                                                                                                  keys.json
                                                                                                                                  • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6096_909065725\keys.json
                                                                                                                                  • Size 8KB
                                                                                                                                  • SHA256 ae6e69a145f84c0a261b4e82888779fbf137f193881d687588e1af71609ae947
                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                  Submit Download

                                                                                                                                  manifest.json
                                                                                                                                  • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6096_909065725\manifest.json
                                                                                                                                  • Size 79B
                                                                                                                                  • SHA256 7ea98f2308a9c51d17a1ac71b64afbe2a41ff0a083a166a0e4cc428bf44f0715
                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                  Submit Download

                                                                                                                                  manifest.json
                                                                                                                                  • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6096_995441031\manifest.json
                                                                                                                                  • Size 177B
                                                                                                                                  • SHA256 096e772e0f2e8c15e6dec9087ee0a1fb8b0c56b25061626aedc9e7e705adfc2e
                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                  Submit Download

                                                                                                                                  memory/1200-88-0x000001B595D00000-0x000001B595DEA000-memory.dmp
                                                                                                                                  Download

                                                                                                                                  memory/1200-89-0x000001B595E70000-0x000001B595E79000-memory.dmp
                                                                                                                                  Download

                                                                                                                                  memory/1276-807-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                                  Download

                                                                                                                                  memory/1640-579-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                                  Download

                                                                                                                                  memory/1640-603-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                                  Download

                                                                                                                                  memory/1760-559-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                                  Download

                                                                                                                                  memory/2116-197-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                                  Download

                                                                                                                                  memory/2816-650-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                                  Download

                                                                                                                                  memory/3000-839-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                                  Download

                                                                                                                                  memory/3028-222-0x0000024C8C050000-0x0000024C8C3C8000-memory.dmp
                                                                                                                                  Download

                                                                                                                                  memory/3028-223-0x0000024C8C050000-0x0000024C8C3C8000-memory.dmp
                                                                                                                                  Download

                                                                                                                                  memory/3416-516-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                                  Download

                                                                                                                                  memory/3892-699-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                                  Download

                                                                                                                                  memory/4108-254-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                                  Download

                                                                                                                                  memory/4168-662-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                                  Download

                                                                                                                                  memory/4168-57-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                                  Download

                                                                                                                                  memory/4356-762-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                                  Download

                                                                                                                                  memory/4608-602-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                                  Download

                                                                                                                                  memory/4628-719-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                                  Download

                                                                                                                                  memory/4628-751-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                                  Download

                                                                                                                                  memory/4772-827-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                                  Download

                                                                                                                                  memory/5032-234-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                                  Download

                                                                                                                                  memory/5148-741-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                                  Download

                                                                                                                                  memory/5288-775-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                                  Download

                                                                                                                                  memory/5452-363-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                                  Download

                                                                                                                                  memory/5568-555-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                                  Download