Overview

overview

10

Static

static

10

2026-05-03...op.exe

windows10-2004-x64

10

2026-05-03...op.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260130-en
  • resource tags

    arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    03/05/2026, 15:31

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-05-03_8cccb9e91904ad8461cdb119bd947dba_amadey_darkgate_elex_smoke-loader_stop.exe
  • Size 384KB
  • Sample260503-syf2vact8v
  • SHA256 0eb336302ee59c746240570214d2c19623e316ab1953f7fef23545198bda4183
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwarediscoverysystexspywaretrojan

Malware Config

Signatures

  • Family: Systex

    Systex is a trojan loader written in C++.

    trojansystex
  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 1 IoCs
  • Drops file in Windows directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Gathers network information 2 TTPs 19 IoCs

    Uses commandline utility to view network configuration.

  • Modifies Internet Explorer settings 1 TTPs 29 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 20 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 19 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-05-03_8cccb9e91904ad8461cdb119bd947dba_amadey_darkgate_elex_smoke-loader_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-05-03_8cccb9e91904ad8461cdb119bd947dba_amadey_darkgate_elex_smoke-loader_stop.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1168
    • C:\Temp\pkicausmkfcxvhfz.exe
      C:\Temp\pkicausmkfcxvhfz.exe run
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:5068
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\smkfcxrpke.exe ups_run
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:1484
        • C:\Temp\smkfcxrpke.exe
          C:\Temp\smkfcxrpke.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4544
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:5760
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:912
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_smkfcxrpke.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:4608
        • C:\Temp\i_smkfcxrpke.exe
          C:\Temp\i_smkfcxrpke.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:1848
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\khcausmkec.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:5636
        • C:\Temp\khcausmkec.exe
          C:\Temp\khcausmkec.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5860
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:5356
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:4456
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_khcausmkec.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:6068
        • C:\Temp\i_khcausmkec.exe
          C:\Temp\i_khcausmkec.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:1220
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\uojhbztrmk.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:864
        • C:\Temp\uojhbztrmk.exe
          C:\Temp\uojhbztrmk.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4660
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:5176
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:3320
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_uojhbztrmk.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:4872
        • C:\Temp\i_uojhbztrmk.exe
          C:\Temp\i_uojhbztrmk.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:6124
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\bwuomgeyto.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:5352
        • C:\Temp\bwuomgeyto.exe
          C:\Temp\bwuomgeyto.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5780
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:5268
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:3308
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_bwuomgeyto.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:2108
        • C:\Temp\i_bwuomgeyto.exe
          C:\Temp\i_bwuomgeyto.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:3548
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\qoigbytrlj.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:5332
        • C:\Temp\qoigbytrlj.exe
          C:\Temp\qoigbytrlj.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4352
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:2192
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:4804
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_qoigbytrlj.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:1032
        • C:\Temp\i_qoigbytrlj.exe
          C:\Temp\i_qoigbytrlj.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:3912
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\gdywqoigby.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:4864
        • C:\Temp\gdywqoigby.exe
          C:\Temp\gdywqoigby.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2096
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:3860
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:832
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_gdywqoigby.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:2100
        • C:\Temp\i_gdywqoigby.exe
          C:\Temp\i_gdywqoigby.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:2040
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\tnlfdxvqni.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:5528
        • C:\Temp\tnlfdxvqni.exe
          C:\Temp\tnlfdxvqni.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5248
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:5896
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:2644
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_tnlfdxvqni.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:2016
        • C:\Temp\i_tnlfdxvqni.exe
          C:\Temp\i_tnlfdxvqni.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:1572
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\icavsnlfdx.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:3644
        • C:\Temp\icavsnlfdx.exe
          C:\Temp\icavsnlfdx.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4344
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:3660
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:3920
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_icavsnlfdx.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:4020
        • C:\Temp\i_icavsnlfdx.exe
          C:\Temp\i_icavsnlfdx.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:2024
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\upnhfzxspk.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:3896
        • C:\Temp\upnhfzxspk.exe
          C:\Temp\upnhfzxspk.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5368
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:2888
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:4524
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_upnhfzxspk.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:5344
        • C:\Temp\i_upnhfzxspk.exe
          C:\Temp\i_upnhfzxspk.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:1640
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\fzxrpkfcxm.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:3196
        • C:\Temp\fzxrpkfcxm.exe
          C:\Temp\fzxrpkfcxm.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5648
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:5592
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:4408
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_fzxrpkfcxm.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:4960
        • C:\Temp\i_fzxrpkfcxm.exe
          C:\Temp\i_fzxrpkfcxm.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:2968
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\upjhbzxrpj.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:5544
        • C:\Temp\upjhbzxrpj.exe
          C:\Temp\upjhbzxrpj.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3172
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
              PID:2876
              • C:\windows\system32\ipconfig.exe
                C:\windows\system32\ipconfig.exe /release
                6⤵
                • Gathers network information
                PID:920
        • C:\temp\CreateProcess.exe
          C:\temp\CreateProcess.exe C:\Temp\i_upjhbzxrpj.exe ups_ins
          3⤵
            PID:5288
            • C:\Temp\i_upjhbzxrpj.exe
              C:\Temp\i_upjhbzxrpj.exe ups_ins
              4⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              PID:572
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\Temp\hbztrojhbz.exe ups_run
            3⤵
              PID:2644
              • C:\Temp\hbztrojhbz.exe
                C:\Temp\hbztrojhbz.exe ups_run
                4⤵
                • System Location Discovery: System Language Discovery
                PID:4620
                • C:\temp\CreateProcess.exe
                  C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                  5⤵
                    PID:1456
                    • C:\windows\system32\ipconfig.exe
                      C:\windows\system32\ipconfig.exe /release
                      6⤵
                      • Gathers network information
                      PID:1864
              • C:\temp\CreateProcess.exe
                C:\temp\CreateProcess.exe C:\Temp\i_hbztrojhbz.exe ups_ins
                3⤵
                  PID:3548
                  • C:\Temp\i_hbztrojhbz.exe
                    C:\Temp\i_hbztrojhbz.exe ups_ins
                    4⤵
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of AdjustPrivilegeToken
                    PID:5920
                • C:\temp\CreateProcess.exe
                  C:\temp\CreateProcess.exe C:\Temp\trljeywqoj.exe ups_run
                  3⤵
                    PID:5124
                    • C:\Temp\trljeywqoj.exe
                      C:\Temp\trljeywqoj.exe ups_run
                      4⤵
                      • System Location Discovery: System Language Discovery
                      PID:3920
                      • C:\temp\CreateProcess.exe
                        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                        5⤵
                          PID:3032
                          • C:\windows\system32\ipconfig.exe
                            C:\windows\system32\ipconfig.exe /release
                            6⤵
                            • Gathers network information
                            PID:2440
                    • C:\temp\CreateProcess.exe
                      C:\temp\CreateProcess.exe C:\Temp\i_trljeywqoj.exe ups_ins
                      3⤵
                        PID:3252
                        • C:\Temp\i_trljeywqoj.exe
                          C:\Temp\i_trljeywqoj.exe ups_ins
                          4⤵
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of AdjustPrivilegeToken
                          PID:1888
                      • C:\temp\CreateProcess.exe
                        C:\temp\CreateProcess.exe C:\Temp\ljdbwlgeyw.exe ups_run
                        3⤵
                          PID:5328
                          • C:\Temp\ljdbwlgeyw.exe
                            C:\Temp\ljdbwlgeyw.exe ups_run
                            4⤵
                            • System Location Discovery: System Language Discovery
                            PID:588
                            • C:\temp\CreateProcess.exe
                              C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                              5⤵
                                PID:2468
                                • C:\windows\system32\ipconfig.exe
                                  C:\windows\system32\ipconfig.exe /release
                                  6⤵
                                  • Gathers network information
                                  PID:1196
                          • C:\temp\CreateProcess.exe
                            C:\temp\CreateProcess.exe C:\Temp\i_ljdbwlgeyw.exe ups_ins
                            3⤵
                              PID:4636
                              • C:\Temp\i_ljdbwlgeyw.exe
                                C:\Temp\i_ljdbwlgeyw.exe ups_ins
                                4⤵
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of AdjustPrivilegeToken
                                PID:1744
                            • C:\temp\CreateProcess.exe
                              C:\temp\CreateProcess.exe C:\Temp\bvtnlgdywq.exe ups_run
                              3⤵
                                PID:1652
                                • C:\Temp\bvtnlgdywq.exe
                                  C:\Temp\bvtnlgdywq.exe ups_run
                                  4⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:5988
                                  • C:\temp\CreateProcess.exe
                                    C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                                    5⤵
                                      PID:3372
                                      • C:\windows\system32\ipconfig.exe
                                        C:\windows\system32\ipconfig.exe /release
                                        6⤵
                                        • Gathers network information
                                        PID:2364
                                • C:\temp\CreateProcess.exe
                                  C:\temp\CreateProcess.exe C:\Temp\i_bvtnlgdywq.exe ups_ins
                                  3⤵
                                    PID:5856
                                    • C:\Temp\i_bvtnlgdywq.exe
                                      C:\Temp\i_bvtnlgdywq.exe ups_ins
                                      4⤵
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:4900
                                  • C:\temp\CreateProcess.exe
                                    C:\temp\CreateProcess.exe C:\Temp\lfdxvpnifa.exe ups_run
                                    3⤵
                                      PID:4508
                                      • C:\Temp\lfdxvpnifa.exe
                                        C:\Temp\lfdxvpnifa.exe ups_run
                                        4⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:4820
                                        • C:\temp\CreateProcess.exe
                                          C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                                          5⤵
                                            PID:3396
                                            • C:\windows\system32\ipconfig.exe
                                              C:\windows\system32\ipconfig.exe /release
                                              6⤵
                                              • Gathers network information
                                              PID:5028
                                      • C:\temp\CreateProcess.exe
                                        C:\temp\CreateProcess.exe C:\Temp\i_lfdxvpnifa.exe ups_ins
                                        3⤵
                                          PID:572
                                          • C:\Temp\i_lfdxvpnifa.exe
                                            C:\Temp\i_lfdxvpnifa.exe ups_ins
                                            4⤵
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:4588
                                        • C:\temp\CreateProcess.exe
                                          C:\temp\CreateProcess.exe C:\Temp\vpnhfzxspk.exe ups_run
                                          3⤵
                                            PID:5160
                                            • C:\Temp\vpnhfzxspk.exe
                                              C:\Temp\vpnhfzxspk.exe ups_run
                                              4⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:4244
                                              • C:\temp\CreateProcess.exe
                                                C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                                                5⤵
                                                  PID:4092
                                                  • C:\windows\system32\ipconfig.exe
                                                    C:\windows\system32\ipconfig.exe /release
                                                    6⤵
                                                    • Gathers network information
                                                    PID:5888
                                            • C:\temp\CreateProcess.exe
                                              C:\temp\CreateProcess.exe C:\Temp\i_vpnhfzxspk.exe ups_ins
                                              3⤵
                                                PID:2208
                                                • C:\Temp\i_vpnhfzxspk.exe
                                                  C:\Temp\i_vpnhfzxspk.exe ups_ins
                                                  4⤵
                                                  • System Location Discovery: System Language Discovery
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:6056
                                              • C:\temp\CreateProcess.exe
                                                C:\temp\CreateProcess.exe C:\Temp\vpcausmkec.exe ups_run
                                                3⤵
                                                  PID:5968
                                                  • C:\Temp\vpcausmkec.exe
                                                    C:\Temp\vpcausmkec.exe ups_run
                                                    4⤵
                                                    • System Location Discovery: System Language Discovery
                                                    PID:5076
                                                    • C:\temp\CreateProcess.exe
                                                      C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                                                      5⤵
                                                        PID:1808
                                                        • C:\windows\system32\ipconfig.exe
                                                          C:\windows\system32\ipconfig.exe /release
                                                          6⤵
                                                          • Gathers network information
                                                          PID:4716
                                                  • C:\temp\CreateProcess.exe
                                                    C:\temp\CreateProcess.exe C:\Temp\i_vpcausmkec.exe ups_ins
                                                    3⤵
                                                      PID:232
                                                      • C:\Temp\i_vpcausmkec.exe
                                                        C:\Temp\i_vpcausmkec.exe ups_ins
                                                        4⤵
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:4812
                                                    • C:\temp\CreateProcess.exe
                                                      C:\temp\CreateProcess.exe C:\Temp\hezxrpjhcz.exe ups_run
                                                      3⤵
                                                        PID:4644
                                                        • C:\Temp\hezxrpjhcz.exe
                                                          C:\Temp\hezxrpjhcz.exe ups_run
                                                          4⤵
                                                          • System Location Discovery: System Language Discovery
                                                          PID:1416
                                                          • C:\temp\CreateProcess.exe
                                                            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                                                            5⤵
                                                              PID:976
                                                              • C:\windows\system32\ipconfig.exe
                                                                C:\windows\system32\ipconfig.exe /release
                                                                6⤵
                                                                • Gathers network information
                                                                PID:4456
                                                        • C:\temp\CreateProcess.exe
                                                          C:\temp\CreateProcess.exe C:\Temp\i_hezxrpjhcz.exe ups_ins
                                                          3⤵
                                                            PID:5432
                                                            • C:\Temp\i_hezxrpjhcz.exe
                                                              C:\Temp\i_hezxrpjhcz.exe ups_ins
                                                              4⤵
                                                              • System Location Discovery: System Language Discovery
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:6024
                                                        • C:\Program Files\Internet Explorer\iexplore.exe
                                                          "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
                                                          2⤵
                                                          • Modifies Internet Explorer settings
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:5020
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
                                                            3⤵
                                                            • Loads dropped DLL
                                                            • Drops file in Windows directory
                                                            • Enumerates system info in registry
                                                            • Modifies data under HKEY_USERS
                                                            • Modifies registry class
                                                            • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                            • Suspicious use of FindShellTrayWindow
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:4024
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x348,0x7fff5216c188,0x7fff5216c194,0x7fff5216c1a0
                                                              4⤵
                                                                PID:4148
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1804,i,9864778831530634026,6883749574596953212,524288 --field-trial-handle=2712,i,5633960988180080579,18432886694231314952,262144 --variations-seed-version --mojo-platform-channel-handle=2772 /prefetch:11
                                                                4⤵
                                                                • System Time Discovery
                                                                PID:1644
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,6698556050660372683,10234140373914528728,262144 --field-trial-handle=2712,i,5633960988180080579,18432886694231314952,262144 --variations-seed-version --mojo-platform-channel-handle=2716 /prefetch:2
                                                                4⤵
                                                                  PID:2852
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2280,i,620601161861621702,4918997182552350105,524288 --field-trial-handle=2712,i,5633960988180080579,18432886694231314952,262144 --variations-seed-version --mojo-platform-channel-handle=2780 /prefetch:13
                                                                  4⤵
                                                                    PID:5612
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,10143270241397233817,2733834789626558240,2097152 --field-trial-handle=2712,i,5633960988180080579,18432886694231314952,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
                                                                    4⤵
                                                                      PID:4796
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3484,i,9891305845397770605,4029372105974824477,2097152 --field-trial-handle=2712,i,5633960988180080579,18432886694231314952,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
                                                                      4⤵
                                                                        PID:2568
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4872,i,10891700723092628104,13834319700578132944,524288 --field-trial-handle=2712,i,5633960988180080579,18432886694231314952,262144 --variations-seed-version --mojo-platform-channel-handle=4952 /prefetch:14
                                                                        4⤵
                                                                          PID:5516
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4876,i,11924385884435470403,3381023247020726396,524288 --field-trial-handle=2712,i,5633960988180080579,18432886694231314952,262144 --variations-seed-version --mojo-platform-channel-handle=4908 /prefetch:14
                                                                          4⤵
                                                                            PID:4976
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5628,i,1524942839071671573,14637111628944415298,524288 --field-trial-handle=2712,i,5633960988180080579,18432886694231314952,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:14
                                                                            4⤵
                                                                              PID:1860
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5628,i,1524942839071671573,14637111628944415298,524288 --field-trial-handle=2712,i,5633960988180080579,18432886694231314952,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:14
                                                                              4⤵
                                                                                PID:3520
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5740,i,3304925416485576236,17904874500114712555,524288 --field-trial-handle=2712,i,5633960988180080579,18432886694231314952,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:14
                                                                                4⤵
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:1580
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
                                                                                  cookie_exporter.exe --cookie-json=1124
                                                                                  5⤵
                                                                                    PID:3140
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6092,i,17244951765544994689,2229309819693273596,524288 --field-trial-handle=2712,i,5633960988180080579,18432886694231314952,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:14
                                                                                  4⤵
                                                                                    PID:6116
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5696,i,1149656312191722122,12865333940037963275,524288 --field-trial-handle=2712,i,5633960988180080579,18432886694231314952,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:14
                                                                                    4⤵
                                                                                      PID:4588
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6120,i,10421495714738817953,1103794933302362102,524288 --field-trial-handle=2712,i,5633960988180080579,18432886694231314952,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:14
                                                                                      4⤵
                                                                                        PID:788
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6120,i,11091655302803547616,12526956576614255074,524288 --field-trial-handle=2712,i,5633960988180080579,18432886694231314952,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:14
                                                                                        4⤵
                                                                                          PID:4964
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6120,i,3229756111811125046,3195162742115191938,524288 --field-trial-handle=2712,i,5633960988180080579,18432886694231314952,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:14
                                                                                          4⤵
                                                                                            PID:1504
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2852,i,11846395885443500213,15449917486131180016,524288 --field-trial-handle=2712,i,5633960988180080579,18432886694231314952,262144 --variations-seed-version --mojo-platform-channel-handle=4908 /prefetch:14
                                                                                            4⤵
                                                                                              PID:5260
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2852,i,11846395885443500213,15449917486131180016,524288 --field-trial-handle=2712,i,5633960988180080579,18432886694231314952,262144 --variations-seed-version --mojo-platform-channel-handle=4908 /prefetch:14
                                                                                              4⤵
                                                                                                PID:2356
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6208,i,823727329321998550,14561997315541717985,524288 --field-trial-handle=2712,i,5633960988180080579,18432886694231314952,262144 --variations-seed-version --mojo-platform-channel-handle=3264 /prefetch:14
                                                                                                4⤵
                                                                                                  PID:3184
                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2852,i,9285997567913271992,5523609712257863693,524288 --field-trial-handle=2712,i,5633960988180080579,18432886694231314952,262144 --variations-seed-version --mojo-platform-channel-handle=2868 /prefetch:14
                                                                                                  4⤵
                                                                                                    PID:4388
                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4928,i,8834904952513722873,6987551091289369611,524288 --field-trial-handle=2712,i,5633960988180080579,18432886694231314952,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:14
                                                                                                    4⤵
                                                                                                      PID:5888
                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5820,i,15197706491458921641,11484116197207702425,524288 --field-trial-handle=2712,i,5633960988180080579,18432886694231314952,262144 --variations-seed-version --mojo-platform-channel-handle=904 /prefetch:14
                                                                                                      4⤵
                                                                                                        PID:5864
                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5060,i,4842060829219077110,17730417967248910306,262144 --field-trial-handle=2712,i,5633960988180080579,18432886694231314952,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:10
                                                                                                        4⤵
                                                                                                          PID:5660
                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3992,i,15624887700720385512,10707212831037408028,524288 --field-trial-handle=2712,i,5633960988180080579,18432886694231314952,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:14
                                                                                                          4⤵
                                                                                                            PID:4948
                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                                      1⤵
                                                                                                        PID:788
                                                                                                      • C:\Temp\pkicausmkfcxvhfz.sys
                                                                                                        C:\Temp\pkicausmkfcxvhfz.sys
                                                                                                        1⤵
                                                                                                        • Executes dropped EXE
                                                                                                        PID:4264
                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
                                                                                                        1⤵
                                                                                                          PID:4392
                                                                                                        • C:\Temp\xupnhcxupn.sys
                                                                                                          C:\Temp\xupnhcxupn.sys
                                                                                                          1⤵
                                                                                                          • Executes dropped EXE
                                                                                                          PID:5944
                                                                                                        • C:\Temp\ezwrpjhbzu.sys
                                                                                                          C:\Temp\ezwrpjhbzu.sys
                                                                                                          1⤵
                                                                                                          • Executes dropped EXE
                                                                                                          PID:3180
                                                                                                        • C:\Temp\jhbztrljhb.sys
                                                                                                          C:\Temp\jhbztrljhb.sys
                                                                                                          1⤵
                                                                                                          • Executes dropped EXE
                                                                                                          PID:2096
                                                                                                        • C:\Temp\jgbztrljdb.sys
                                                                                                          C:\Temp\jgbztrljdb.sys
                                                                                                          1⤵
                                                                                                          • Executes dropped EXE
                                                                                                          PID:4064
                                                                                                        • C:\Temp\qljdbvtnlg.sys
                                                                                                          C:\Temp\qljdbvtnlg.sys
                                                                                                          1⤵
                                                                                                          • Executes dropped EXE
                                                                                                          PID:2276
                                                                                                        • C:\Temp\aysqlidbvt.sys
                                                                                                          C:\Temp\aysqlidbvt.sys
                                                                                                          1⤵
                                                                                                          • Executes dropped EXE
                                                                                                          PID:5028
                                                                                                        • C:\Temp\qnifaysqki.sys
                                                                                                          C:\Temp\qnifaysqki.sys
                                                                                                          1⤵
                                                                                                          • Executes dropped EXE
                                                                                                          PID:544
                                                                                                        • C:\Temp\nkicausnhf.sys
                                                                                                          C:\Temp\nkicausnhf.sys
                                                                                                          1⤵
                                                                                                          • Executes dropped EXE
                                                                                                          PID:4688
                                                                                                        • C:\Temp\pnhfzxspki.sys
                                                                                                          C:\Temp\pnhfzxspki.sys
                                                                                                          1⤵
                                                                                                          • Executes dropped EXE
                                                                                                          PID:1684
                                                                                                        • C:\Temp\fzxrpkhcwu.sys
                                                                                                          C:\Temp\fzxrpkhcwu.sys
                                                                                                          1⤵
                                                                                                          • Executes dropped EXE
                                                                                                          PID:4444
                                                                                                        • C:\Temp\rmgezwrpjh.sys
                                                                                                          C:\Temp\rmgezwrpjh.sys
                                                                                                          1⤵
                                                                                                            PID:1360
                                                                                                          • C:\Temp\mjebwuojet.sys
                                                                                                            C:\Temp\mjebwuojet.sys
                                                                                                            1⤵
                                                                                                              PID:6008
                                                                                                            • C:\Temp\wqoigbytrl.sys
                                                                                                              C:\Temp\wqoigbytrl.sys
                                                                                                              1⤵
                                                                                                                PID:5872
                                                                                                              • C:\Temp\lidbvtnlgd.sys
                                                                                                                C:\Temp\lidbvtnlgd.sys
                                                                                                                1⤵
                                                                                                                  PID:4932
                                                                                                                • C:\Temp\vqnigaysqk.sys
                                                                                                                  C:\Temp\vqnigaysqk.sys
                                                                                                                  1⤵
                                                                                                                    PID:4836
                                                                                                                  • C:\Temp\nlfdxnifay.sys
                                                                                                                    C:\Temp\nlfdxnifay.sys
                                                                                                                    1⤵
                                                                                                                      PID:3056
                                                                                                                    • C:\Temp\axvpnhfaxs.sys
                                                                                                                      C:\Temp\axvpnhfaxs.sys
                                                                                                                      1⤵
                                                                                                                        PID:1800
                                                                                                                      • C:\Temp\smkecwupmh.sys
                                                                                                                        C:\Temp\smkecwupmh.sys
                                                                                                                        1⤵
                                                                                                                          PID:2512
                                                                                                                        • C:\Temp\jhbzurmkec.sys
                                                                                                                          C:\Temp\jhbzurmkec.sys
                                                                                                                          1⤵
                                                                                                                            PID:1736

                                                                                                                          Network

                                                                                                                                MITRE ATT&CK Enterprise v16

                                                                                                                                Replay Monitor

                                                                                                                                Loading Replay Monitor...

                                                                                                                                Downloads

                                                                                                                                CreateProcess.exe
                                                                                                                                • Path C:\Temp\CreateProcess.exe
                                                                                                                                • Size 3KB
                                                                                                                                • SHA256 bf98cee5eb83246188fb1375f4f1c1e114a405cff9a61e00f389f86fbb33c2e8
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                bwuomgeyto.exe
                                                                                                                                • Path C:\Temp\bwuomgeyto.exe
                                                                                                                                • Size 384KB
                                                                                                                                • SHA256 4479d67ece2b241d17a161c4e7df43c93ec6d50d261ff5d6d1a60dde1ec3a562
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                ezwrpjhbzu.sys
                                                                                                                                • Path C:\Temp\ezwrpjhbzu.sys
                                                                                                                                • Size 293KB
                                                                                                                                • SHA256 d996d1c6f6f8b8d79a4c1a2c0e8369c02ed9ab0b42dbbde580044adeaa80361c
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                gdywqoigby.exe
                                                                                                                                • Path C:\Temp\gdywqoigby.exe
                                                                                                                                • Size 384KB
                                                                                                                                • SHA256 90c83fcccc75b6f7c589d1d73806dafdecf83c7a05822f6cb9821e46ae6ed203
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                i_bwuomgeyto.exe
                                                                                                                                • Path C:\Temp\i_bwuomgeyto.exe
                                                                                                                                • Size 384KB
                                                                                                                                • SHA256 48cc4cd973ed3d7a9fd78197e5e3b870bdcb07da9d17df6576b1323964f6ca44
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                i_gdywqoigby.exe
                                                                                                                                • Path C:\Temp\i_gdywqoigby.exe
                                                                                                                                • Size 384KB
                                                                                                                                • SHA256 399bcb01415d0f72f1a5c6da69b26cb071df4763aa199944c28ee5fa3fc0833a
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                i_khcausmkec.exe
                                                                                                                                • Path C:\Temp\i_khcausmkec.exe
                                                                                                                                • Size 384KB
                                                                                                                                • SHA256 e023f52317f58ba850bc807740ecc25ec4870ac3a7990e95df0fc56eedd4604b
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                i_qoigbytrlj.exe
                                                                                                                                • Path C:\Temp\i_qoigbytrlj.exe
                                                                                                                                • Size 384KB
                                                                                                                                • SHA256 cc3828b72c69ff3c4b17841d1efd05836d85e4476c78aeb14f8e52945a745fdb
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                i_smkfcxrpke.exe
                                                                                                                                • Path C:\Temp\i_smkfcxrpke.exe
                                                                                                                                • Size 384KB
                                                                                                                                • SHA256 52d007eeea20a08ac715804d308bdc4911ff30787cd4f389b6990a67e3a0c068
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                i_uojhbztrmk.exe
                                                                                                                                • Path C:\Temp\i_uojhbztrmk.exe
                                                                                                                                • Size 384KB
                                                                                                                                • SHA256 d385ae19be3f11a61ec7f73ae725d2a3f955bfb722183def31329fbe967a0a68
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                jgbztrljdb.sys
                                                                                                                                • Path C:\Temp\jgbztrljdb.sys
                                                                                                                                • Size 293KB
                                                                                                                                • SHA256 14950b2d526c51fd08698e821b7a715cb6430ea6c69a7eb1db3c187719e06185
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                jhbztrljhb.sys
                                                                                                                                • Path C:\Temp\jhbztrljhb.sys
                                                                                                                                • Size 293KB
                                                                                                                                • SHA256 68a19de0095e0be0db41b70ea42e9a844e8c0f600eaac46a308cd0895eb57d9a
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                khcausmkec.exe
                                                                                                                                • Path C:\Temp\khcausmkec.exe
                                                                                                                                • Size 384KB
                                                                                                                                • SHA256 ac9881979b4c7532c9011d5691d4b06fc7b212dc98ca0b80f256897311558380
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                pkicausmkfcxvhfz.exe
                                                                                                                                • Path C:\Temp\pkicausmkfcxvhfz.exe
                                                                                                                                • Size 384KB
                                                                                                                                • SHA256 2289a0dd87bf4b00bde00461e07c13ead412cf9922690e892261ef29cd228c69
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                pkicausmkfcxvhfz.sys
                                                                                                                                • Path C:\Temp\pkicausmkfcxvhfz.sys
                                                                                                                                • Size 293KB
                                                                                                                                • SHA256 763725fc7a0d3627018ebeec99cbdb3386b43053cbb0834b8f0712b1b4233902
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                qljdbvtnlg.sys
                                                                                                                                • Path C:\Temp\qljdbvtnlg.sys
                                                                                                                                • Size 293KB
                                                                                                                                • SHA256 865385465860917492b2dd16d69ed93fd80ece612030e6063295f8e644cef5e4
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                qoigbytrlj.exe
                                                                                                                                • Path C:\Temp\qoigbytrlj.exe
                                                                                                                                • Size 384KB
                                                                                                                                • SHA256 5000e5205d372e24b033a7fba7e50fb4566b3ac1995747c142ecfd06c020cc6f
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                smkfcxrpke.exe
                                                                                                                                • Path C:\Temp\smkfcxrpke.exe
                                                                                                                                • Size 384KB
                                                                                                                                • SHA256 e4db8bd4f989f4ace9fb4fbb6e88d25d3ad9b4d175a6e34cf9754a58e8c5b3e7
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                uojhbztrmk.exe
                                                                                                                                • Path C:\Temp\uojhbztrmk.exe
                                                                                                                                • Size 384KB
                                                                                                                                • SHA256 ce26fc0e9460fb53847cc0eada1fa3425f6f67c512736444eaae293e82c2b9da
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                xupnhcxupn.sys
                                                                                                                                • Path C:\Temp\xupnhcxupn.sys
                                                                                                                                • Size 293KB
                                                                                                                                • SHA256 7635f9f69660b2dacd6b3a67258091adeb723b9192b79c8a0e6c1b0ce41b1b76
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                autofill_bypass_cache_forms.json
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\autofill_bypass_cache_forms.json
                                                                                                                                • Size 161B
                                                                                                                                • SHA256 f7510e38f81f8a84027304070205dd55127e3233fdf011411465ede67b5b5d92
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                edge_autofill_global_block_list.json
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\edge_autofill_global_block_list.json
                                                                                                                                • Size 6KB
                                                                                                                                • SHA256 7d3c45c8207ba69066516e51e10a2137bc4f1fce070a692e0c65225f9856e04c
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                v1FieldTypes.json
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\v1FieldTypes.json
                                                                                                                                • Size 509KB
                                                                                                                                • SHA256 611e7995ab7599a0c89f98d6c6152a42aaedf7449748109a465bb5b0badd0af2
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                settings.dat
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                • Size 280B
                                                                                                                                • SHA256 4f20f916a46d879220b75412e974c6df37fba8f0e80e78f071a3124fdb665aee
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                settings.dat
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                • Size 280B
                                                                                                                                • SHA256 09d43745b7beb0d2574056dfdacdb3449b786708a0b1a5f978e5c9d69f81a1ce
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                BookmarkMergedSurfaceOrdering
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
                                                                                                                                • Size 6B
                                                                                                                                • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                Submit Download

                                                                                                                                BrowsingTopicsState
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
                                                                                                                                • Size 414B
                                                                                                                                • SHA256 657347a61f7bc6444444d64a8a745089ef0ad4df7687e65217b1fd5c52e8e370
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                SiteList-Enterprise.json
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                                                                                                • Size 2B
                                                                                                                                • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                Submit Download

                                                                                                                                HubApps
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
                                                                                                                                • Size 106KB
                                                                                                                                • SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                Network Persistent State
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                                • Size 2KB
                                                                                                                                • SHA256 b5b1e6183ce842d31e88201602c6864dec7792e159297ca20ec33e520a11a3e8
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                SCT Auditing Pending Reports
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                                                                • Size 2B
                                                                                                                                • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                Submit Download

                                                                                                                                Sdch Dictionaries
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
                                                                                                                                • Size 40B
                                                                                                                                • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                Submit Download

                                                                                                                                Preferences
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                • Size 16KB
                                                                                                                                • SHA256 7761619053f6199b750494e9f5f27729eefd1cc870978ab8d1256b0e777fb383
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                Preferences
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                • Size 15KB
                                                                                                                                • SHA256 774e95751b241efa2ee4568a953e771eb8dbbae2ca5793d0fd68842b4dddf50c
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                Secure Preferences
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                                                                                • Size 37KB
                                                                                                                                • SHA256 3e552de0640e8db2930ff7db4049c2ad6b16f389d0a9ac8bf85f61fccc7a9d89
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                Secure Preferences
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                                                                                • Size 37KB
                                                                                                                                • SHA256 c18ea639f62219b9b754e3f4af3d88cca098f2af993027ec3747e67801712b5c
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                sync_diagnostic.log
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                                                                                • Size 23KB
                                                                                                                                • SHA256 67bb342e37d171af5567249eca553f74e48c5705501508a8a9cdc65ebbd66e8c
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                CURRENT
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
                                                                                                                                • Size 16B
                                                                                                                                • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                Submit Download

                                                                                                                                MANIFEST-000001
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
                                                                                                                                • Size 41B
                                                                                                                                • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                Submit Download

                                                                                                                                domain_actions.dll
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Domain Actions\3.0.0.18\domain_actions.dll
                                                                                                                                • Size 83KB
                                                                                                                                • SHA256 d35c8efcb710239f009633bcc5ae904ac6dafa985d451bedf791cf6909f014d4
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                Local State
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                • Size 32KB
                                                                                                                                • SHA256 a224a81838ac8c239af4342b2fd2e23c2e7a20cddb0c7b2ba0bc3fb1494bf021
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                Local State
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                • Size 27KB
                                                                                                                                • SHA256 40a6d07c0da96486548f3d338e362a514813daf24c64fb3d0d46bbe039b9472d
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                Local State
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                • Size 26KB
                                                                                                                                • SHA256 5e03e510f5119cee908ea4cddc547c1db5fabe97e0d5e4ec54e8380ef2a7f1b7
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                Local State
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                • Size 27KB
                                                                                                                                • SHA256 b8d8c3eef282ef1c978b8c808506d4ceeeddbab35784481bc10d20b5c2599996
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                Local State
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                • Size 27KB
                                                                                                                                • SHA256 8a67d07fd317e95bc9db76d8a3a9b0fffbefed234efc92a52af66acf12954735
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                Local State
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                • Size 27KB
                                                                                                                                • SHA256 399a2c892b85ff523f9a9220e5c490ade2738117302288292aebbfc4347919f0
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                Local State
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                • Size 27KB
                                                                                                                                • SHA256 b9387205856af57cd49b7609f3345d104612bdfa2de6a8559c8b3e54832286c8
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                metadata.json
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                • Size 2KB
                                                                                                                                • SHA256 8c2868fde215e77093207d371ec6605a594d9849fb391e68f73c82d755872e45
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                metadata.json
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                • Size 2KB
                                                                                                                                • SHA256 96267db50672fe3ae7551e09826d59f7f083380fc8e91ec1f8009bd2269c9da6
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                metadata.json
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                • Size 2KB
                                                                                                                                • SHA256 a11ac0d44eb530066ae501c04df59992e1884fc29df8cbc94ee0900b58eb1b59
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                metadata.json
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                • Size 2KB
                                                                                                                                • SHA256 7386e212f2eec38e1d53dd5e4e86348a8b91f082aecf53d9e0182b0bbe7d9af3
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
                                                                                                                                • Size 147KB
                                                                                                                                • SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                metadata.json
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
                                                                                                                                • Size 132B
                                                                                                                                • SHA256 54f761e00d363bd15db7bae3cc55144c80148a5fa1db7c3c2049e0e406a9142c
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                keys.json
                                                                                                                                • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4024_1377554207\keys.json
                                                                                                                                • Size 8KB
                                                                                                                                • SHA256 ae6e69a145f84c0a261b4e82888779fbf137f193881d687588e1af71609ae947
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                manifest.json
                                                                                                                                • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4024_1377554207\manifest.json
                                                                                                                                • Size 79B
                                                                                                                                • SHA256 7ea98f2308a9c51d17a1ac71b64afbe2a41ff0a083a166a0e4cc428bf44f0715
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                manifest.json
                                                                                                                                • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4024_1918857652\manifest.json
                                                                                                                                • Size 177B
                                                                                                                                • SHA256 096e772e0f2e8c15e6dec9087ee0a1fb8b0c56b25061626aedc9e7e705adfc2e
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                manifest.json
                                                                                                                                • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4024_317795423\manifest.json
                                                                                                                                • Size 119B
                                                                                                                                • SHA256 7169d86e87f904218238cd293e043e20b7828afad9acd1ff2e5d64188530b9d7
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                manifest.json
                                                                                                                                • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4024_462089007\manifest.json
                                                                                                                                • Size 165B
                                                                                                                                • SHA256 daf50c160ae8f5935baa4a7207e9d04afbbc81a6dd9ed02d99de12056743eeb6
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                memory/544-546-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/788-40-0x0000019129E60000-0x0000019129F0F000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1360-673-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1684-657-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1684-611-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1736-839-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1800-805-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/2096-225-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/2276-502-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/2356-608-0x0000019A70F10000-0x0000019A70FBF000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/2512-827-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/3056-793-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/3140-84-0x00000292EFD70000-0x00000292EFE1F000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/3180-205-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/3520-194-0x00000178DA600000-0x00000178DA6AF000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/4064-405-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/4264-65-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/4444-647-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/4688-590-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/4836-772-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/4932-728-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/5028-534-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/5872-716-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/5944-169-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/6008-696-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                                Download