Overview

overview

10

Static

static

10

2026-05-09...op.exe

windows10-2004-x64

10

2026-05-09...op.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    149s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260130-en
  • resource tags

    arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    09/05/2026, 22:30

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-05-09_852fc406678cfb7e3716d0b4b1c8e70d_amadey_darkgate_elex_smoke-loader_stop.exe
  • Size 384KB
  • Sample260509-2e8r7agy6m
  • SHA256 fcf76d1db2169d8772357248b4ea875803ba5918f5ab80ec00d0b85f989e9070
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwarediscoverysystexspywaretrojan

Malware Config

Signatures

  • Family: Systex

    Systex is a trojan loader written in C++.

    trojansystex
  • Executes dropped EXE 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Gathers network information 2 TTPs 19 IoCs

    Uses commandline utility to view network configuration.

  • Modifies Internet Explorer settings 1 TTPs 29 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 20 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 19 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-05-09_852fc406678cfb7e3716d0b4b1c8e70d_amadey_darkgate_elex_smoke-loader_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-05-09_852fc406678cfb7e3716d0b4b1c8e70d_amadey_darkgate_elex_smoke-loader_stop.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4724
    • C:\Temp\icausmkfcxvpnhfz.exe
      C:\Temp\icausmkfcxvpnhfz.exe run
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3428
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\spkhcaupnh.exe ups_run
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:3052
        • C:\Temp\spkhcaupnh.exe
          C:\Temp\spkhcaupnh.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3716
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:1404
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:5408
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_spkhcaupnh.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:2456
        • C:\Temp\i_spkhcaupnh.exe
          C:\Temp\i_spkhcaupnh.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:4316
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\wuomhezwrp.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:2952
        • C:\Temp\wuomhezwrp.exe
          C:\Temp\wuomhezwrp.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1236
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:5612
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:4816
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_wuomhezwrp.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:1788
        • C:\Temp\i_wuomhezwrp.exe
          C:\Temp\i_wuomhezwrp.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:912
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\mgeywrojhb.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:5380
        • C:\Temp\mgeywrojhb.exe
          C:\Temp\mgeywrojhb.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5908
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:5188
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:2288
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_mgeywrojhb.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:5956
        • C:\Temp\i_mgeywrojhb.exe
          C:\Temp\i_mgeywrojhb.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:4456
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\mgbztrljeb.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:3124
        • C:\Temp\mgbztrljeb.exe
          C:\Temp\mgbztrljeb.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3996
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:2284
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:3140
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_mgbztrljeb.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:3232
        • C:\Temp\i_mgbztrljeb.exe
          C:\Temp\i_mgbztrljeb.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:1308
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\bvtolgdywq.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:3988
        • C:\Temp\bvtolgdywq.exe
          C:\Temp\bvtolgdywq.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:432
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:3268
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:4652
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_bvtolgdywq.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:4780
        • C:\Temp\i_bvtolgdywq.exe
          C:\Temp\i_bvtolgdywq.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:4764
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\lfdyvtnlfd.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:2932
        • C:\Temp\lfdyvtnlfd.exe
          C:\Temp\lfdyvtnlfd.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4676
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:5108
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:656
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_lfdyvtnlfd.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:1560
        • C:\Temp\i_lfdyvtnlfd.exe
          C:\Temp\i_lfdyvtnlfd.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:3132
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\sqkidavtnl.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:388
        • C:\Temp\sqkidavtnl.exe
          C:\Temp\sqkidavtnl.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4180
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:5528
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:6136
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_sqkidavtnl.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:2916
        • C:\Temp\i_sqkidavtnl.exe
          C:\Temp\i_sqkidavtnl.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:4688
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\nhfausnlfd.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:6132
        • C:\Temp\nhfausnlfd.exe
          C:\Temp\nhfausnlfd.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2576
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:5252
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:4460
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_nhfausnlfd.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:5288
        • C:\Temp\i_nhfausnlfd.exe
          C:\Temp\i_nhfausnlfd.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:2380
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\zxspkhcaus.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:5480
        • C:\Temp\zxspkhcaus.exe
          C:\Temp\zxspkhcaus.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2008
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:5984
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:5676
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_zxspkhcaus.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:5104
        • C:\Temp\i_zxspkhcaus.exe
          C:\Temp\i_zxspkhcaus.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:8
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\smkecxupmh.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:2336
        • C:\Temp\smkecxupmh.exe
          C:\Temp\smkecxupmh.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5276
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:2568
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:1528
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_smkecxupmh.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:2992
        • C:\Temp\i_smkecxupmh.exe
          C:\Temp\i_smkecxupmh.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:380
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\hbztrmjecw.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:5732
        • C:\Temp\hbztrmjecw.exe
          C:\Temp\hbztrmjecw.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4056
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
              PID:4576
              • C:\windows\system32\ipconfig.exe
                C:\windows\system32\ipconfig.exe /release
                6⤵
                • Gathers network information
                PID:6140
        • C:\temp\CreateProcess.exe
          C:\temp\CreateProcess.exe C:\Temp\i_hbztrmjecw.exe ups_ins
          3⤵
            PID:5264
            • C:\Temp\i_hbztrmjecw.exe
              C:\Temp\i_hbztrmjecw.exe ups_ins
              4⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              PID:5148
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\Temp\ezwuomgezw.exe ups_run
            3⤵
              PID:5436
              • C:\Temp\ezwuomgezw.exe
                C:\Temp\ezwuomgezw.exe ups_run
                4⤵
                • System Location Discovery: System Language Discovery
                PID:4864
                • C:\temp\CreateProcess.exe
                  C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                  5⤵
                    PID:4244
                    • C:\windows\system32\ipconfig.exe
                      C:\windows\system32\ipconfig.exe /release
                      6⤵
                      • Gathers network information
                      PID:5664
              • C:\temp\CreateProcess.exe
                C:\temp\CreateProcess.exe C:\Temp\i_ezwuomgezw.exe ups_ins
                3⤵
                  PID:4412
                  • C:\Temp\i_ezwuomgezw.exe
                    C:\Temp\i_ezwuomgezw.exe ups_ins
                    4⤵
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of AdjustPrivilegeToken
                    PID:5072
                • C:\temp\CreateProcess.exe
                  C:\temp\CreateProcess.exe C:\Temp\trljdbvqoj.exe ups_run
                  3⤵
                    PID:4836
                    • C:\Temp\trljdbvqoj.exe
                      C:\Temp\trljdbvqoj.exe ups_run
                      4⤵
                      • System Location Discovery: System Language Discovery
                      PID:6096
                      • C:\temp\CreateProcess.exe
                        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                        5⤵
                          PID:1320
                          • C:\windows\system32\ipconfig.exe
                            C:\windows\system32\ipconfig.exe /release
                            6⤵
                            • Gathers network information
                            PID:1444
                    • C:\temp\CreateProcess.exe
                      C:\temp\CreateProcess.exe C:\Temp\i_trljdbvqoj.exe ups_ins
                      3⤵
                        PID:3140
                        • C:\Temp\i_trljdbvqoj.exe
                          C:\Temp\i_trljdbvqoj.exe ups_ins
                          4⤵
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of AdjustPrivilegeToken
                          PID:6016
                      • C:\temp\CreateProcess.exe
                        C:\temp\CreateProcess.exe C:\Temp\gaywqoigby.exe ups_run
                        3⤵
                          PID:3648
                          • C:\Temp\gaywqoigby.exe
                            C:\Temp\gaywqoigby.exe ups_run
                            4⤵
                            • System Location Discovery: System Language Discovery
                            PID:6136
                            • C:\temp\CreateProcess.exe
                              C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                              5⤵
                                PID:3680
                                • C:\windows\system32\ipconfig.exe
                                  C:\windows\system32\ipconfig.exe /release
                                  6⤵
                                  • Gathers network information
                                  PID:5408
                          • C:\temp\CreateProcess.exe
                            C:\temp\CreateProcess.exe C:\Temp\i_gaywqoigby.exe ups_ins
                            3⤵
                              PID:3112
                              • C:\Temp\i_gaywqoigby.exe
                                C:\Temp\i_gaywqoigby.exe ups_ins
                                4⤵
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of AdjustPrivilegeToken
                                PID:5160
                            • C:\temp\CreateProcess.exe
                              C:\temp\CreateProcess.exe C:\Temp\tnlfdxvqni.exe ups_run
                              3⤵
                                PID:4916
                                • C:\Temp\tnlfdxvqni.exe
                                  C:\Temp\tnlfdxvqni.exe ups_run
                                  4⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:4768
                                  • C:\temp\CreateProcess.exe
                                    C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                                    5⤵
                                      PID:756
                                      • C:\windows\system32\ipconfig.exe
                                        C:\windows\system32\ipconfig.exe /release
                                        6⤵
                                        • Gathers network information
                                        PID:2904
                                • C:\temp\CreateProcess.exe
                                  C:\temp\CreateProcess.exe C:\Temp\i_tnlfdxvqni.exe ups_ins
                                  3⤵
                                    PID:2460
                                    • C:\Temp\i_tnlfdxvqni.exe
                                      C:\Temp\i_tnlfdxvqni.exe ups_ins
                                      4⤵
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:1564
                                  • C:\temp\CreateProcess.exe
                                    C:\temp\CreateProcess.exe C:\Temp\nigaysqkid.exe ups_run
                                    3⤵
                                      PID:2936
                                      • C:\Temp\nigaysqkid.exe
                                        C:\Temp\nigaysqkid.exe ups_run
                                        4⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:5788
                                        • C:\temp\CreateProcess.exe
                                          C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                                          5⤵
                                            PID:2116
                                            • C:\windows\system32\ipconfig.exe
                                              C:\windows\system32\ipconfig.exe /release
                                              6⤵
                                              • Gathers network information
                                              PID:484
                                      • C:\temp\CreateProcess.exe
                                        C:\temp\CreateProcess.exe C:\Temp\i_nigaysqkid.exe ups_ins
                                        3⤵
                                          PID:5500
                                          • C:\Temp\i_nigaysqkid.exe
                                            C:\Temp\i_nigaysqkid.exe ups_ins
                                            4⤵
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:4292
                                        • C:\temp\CreateProcess.exe
                                          C:\temp\CreateProcess.exe C:\Temp\pkicausmkf.exe ups_run
                                          3⤵
                                            PID:4572
                                            • C:\Temp\pkicausmkf.exe
                                              C:\Temp\pkicausmkf.exe ups_run
                                              4⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:2528
                                              • C:\temp\CreateProcess.exe
                                                C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                                                5⤵
                                                  PID:3816
                                                  • C:\windows\system32\ipconfig.exe
                                                    C:\windows\system32\ipconfig.exe /release
                                                    6⤵
                                                    • Gathers network information
                                                    PID:6140
                                            • C:\temp\CreateProcess.exe
                                              C:\temp\CreateProcess.exe C:\Temp\i_pkicausmkf.exe ups_ins
                                              3⤵
                                                PID:2488
                                                • C:\Temp\i_pkicausmkf.exe
                                                  C:\Temp\i_pkicausmkf.exe ups_ins
                                                  4⤵
                                                  • System Location Discovery: System Language Discovery
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:4268
                                              • C:\temp\CreateProcess.exe
                                                C:\temp\CreateProcess.exe C:\Temp\xrpkhcwupm.exe ups_run
                                                3⤵
                                                  PID:2288
                                                  • C:\Temp\xrpkhcwupm.exe
                                                    C:\Temp\xrpkhcwupm.exe ups_run
                                                    4⤵
                                                    • System Location Discovery: System Language Discovery
                                                    PID:5132
                                                    • C:\temp\CreateProcess.exe
                                                      C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                                                      5⤵
                                                        PID:5092
                                                        • C:\windows\system32\ipconfig.exe
                                                          C:\windows\system32\ipconfig.exe /release
                                                          6⤵
                                                          • Gathers network information
                                                          PID:2232
                                                  • C:\temp\CreateProcess.exe
                                                    C:\temp\CreateProcess.exe C:\Temp\i_xrpkhcwupm.exe ups_ins
                                                    3⤵
                                                      PID:3888
                                                      • C:\Temp\i_xrpkhcwupm.exe
                                                        C:\Temp\i_xrpkhcwupm.exe ups_ins
                                                        4⤵
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:4560
                                                    • C:\temp\CreateProcess.exe
                                                      C:\temp\CreateProcess.exe C:\Temp\hbzurpjhbz.exe ups_run
                                                      3⤵
                                                        PID:1444
                                                        • C:\Temp\hbzurpjhbz.exe
                                                          C:\Temp\hbzurpjhbz.exe ups_run
                                                          4⤵
                                                          • System Location Discovery: System Language Discovery
                                                          PID:5640
                                                          • C:\temp\CreateProcess.exe
                                                            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                                                            5⤵
                                                              PID:820
                                                              • C:\windows\system32\ipconfig.exe
                                                                C:\windows\system32\ipconfig.exe /release
                                                                6⤵
                                                                • Gathers network information
                                                                PID:4904
                                                        • C:\temp\CreateProcess.exe
                                                          C:\temp\CreateProcess.exe C:\Temp\i_hbzurpjhbz.exe ups_ins
                                                          3⤵
                                                            PID:3968
                                                            • C:\Temp\i_hbzurpjhbz.exe
                                                              C:\Temp\i_hbzurpjhbz.exe ups_ins
                                                              4⤵
                                                              • System Location Discovery: System Language Discovery
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:1680
                                                        • C:\Program Files\Internet Explorer\iexplore.exe
                                                          "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
                                                          2⤵
                                                          • Modifies Internet Explorer settings
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:1412
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
                                                            3⤵
                                                            • Drops file in Windows directory
                                                            • Enumerates system info in registry
                                                            • Modifies data under HKEY_USERS
                                                            • Modifies registry class
                                                            • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                            • Suspicious use of FindShellTrayWindow
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:4896
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x33c,0x7ff9c42ec188,0x7ff9c42ec194,0x7ff9c42ec1a0
                                                              4⤵
                                                                PID:5052
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1792,i,4927663517615944477,12376279488264551441,524288 --field-trial-handle=2016,i,13207592147558915160,10529599442827626985,262144 --variations-seed-version --mojo-platform-channel-handle=2064 /prefetch:11
                                                                4⤵
                                                                • System Time Discovery
                                                                PID:4436
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1576,i,3051464704648815967,1533261602105954450,262144 --field-trial-handle=2016,i,13207592147558915160,10529599442827626985,262144 --variations-seed-version --mojo-platform-channel-handle=2008 /prefetch:2
                                                                4⤵
                                                                  PID:4704
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2344,i,2019879553189025866,1904870849395303812,524288 --field-trial-handle=2016,i,13207592147558915160,10529599442827626985,262144 --variations-seed-version --mojo-platform-channel-handle=2488 /prefetch:13
                                                                  4⤵
                                                                    PID:5404
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3500,i,14931408771096212754,672151803233548195,2097152 --field-trial-handle=2016,i,13207592147558915160,10529599442827626985,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
                                                                    4⤵
                                                                      PID:612
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3504,i,13226836623607547333,8594181547621540763,2097152 --field-trial-handle=2016,i,13207592147558915160,10529599442827626985,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
                                                                      4⤵
                                                                        PID:5356
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4900,i,15876858531100426773,2880484631607504277,524288 --field-trial-handle=2016,i,13207592147558915160,10529599442827626985,262144 --variations-seed-version --mojo-platform-channel-handle=4936 /prefetch:14
                                                                        4⤵
                                                                          PID:5892
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4904,i,5941771602060275623,17963724936732315167,524288 --field-trial-handle=2016,i,13207592147558915160,10529599442827626985,262144 --variations-seed-version --mojo-platform-channel-handle=4960 /prefetch:14
                                                                          4⤵
                                                                            PID:5844
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5696,i,13371587372171490484,2147241466271444401,524288 --field-trial-handle=2016,i,13207592147558915160,10529599442827626985,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:14
                                                                            4⤵
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:2228
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
                                                                              cookie_exporter.exe --cookie-json=1128
                                                                              5⤵
                                                                                PID:4460
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5756,i,16709216687676929582,7180941041294559866,524288 --field-trial-handle=2016,i,13207592147558915160,10529599442827626985,262144 --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:14
                                                                              4⤵
                                                                                PID:2508
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5756,i,16709216687676929582,7180941041294559866,524288 --field-trial-handle=2016,i,13207592147558915160,10529599442827626985,262144 --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:14
                                                                                4⤵
                                                                                  PID:3732
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5836,i,15005670120879189889,9296510285666974707,524288 --field-trial-handle=2016,i,13207592147558915160,10529599442827626985,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:14
                                                                                  4⤵
                                                                                    PID:3964
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5776,i,5817757491793100814,16812695454347613270,524288 --field-trial-handle=2016,i,13207592147558915160,10529599442827626985,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:14
                                                                                    4⤵
                                                                                      PID:3968
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5808,i,9163578048218134312,8688488070551044709,524288 --field-trial-handle=2016,i,13207592147558915160,10529599442827626985,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:14
                                                                                      4⤵
                                                                                        PID:4088
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6260,i,1681978025808262932,7112437886320459395,524288 --field-trial-handle=2016,i,13207592147558915160,10529599442827626985,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:14
                                                                                        4⤵
                                                                                          PID:3912
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6464,i,7626676205036910020,5765726493222406585,524288 --field-trial-handle=2016,i,13207592147558915160,10529599442827626985,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:14
                                                                                          4⤵
                                                                                            PID:5652
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5244,i,5178605434765805423,4558510275764903176,524288 --field-trial-handle=2016,i,13207592147558915160,10529599442827626985,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:14
                                                                                            4⤵
                                                                                              PID:4488
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=880,i,2015301642986127586,17382413019887323287,524288 --field-trial-handle=2016,i,13207592147558915160,10529599442827626985,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:14
                                                                                              4⤵
                                                                                                PID:3064
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4972,i,10850063354083604930,8956266903785854954,262144 --field-trial-handle=2016,i,13207592147558915160,10529599442827626985,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:10
                                                                                                4⤵
                                                                                                  PID:2084
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                            1⤵
                                                                                              PID:4824
                                                                                            • C:\Temp\icausmkfcxvpnhfz.sys
                                                                                              C:\Temp\icausmkfcxvpnhfz.sys
                                                                                              1⤵
                                                                                              • Executes dropped EXE
                                                                                              PID:3968
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
                                                                                              1⤵
                                                                                                PID:2512
                                                                                              • C:\Temp\kecwuomhez.sys
                                                                                                C:\Temp\kecwuomhez.sys
                                                                                                1⤵
                                                                                                • Executes dropped EXE
                                                                                                PID:3592
                                                                                              • C:\Temp\ezxrpjhbzu.sys
                                                                                                C:\Temp\ezxrpjhbzu.sys
                                                                                                1⤵
                                                                                                • Executes dropped EXE
                                                                                                PID:1744
                                                                                              • C:\Temp\trljebwtom.sys
                                                                                                C:\Temp\trljebwtom.sys
                                                                                                1⤵
                                                                                                • Executes dropped EXE
                                                                                                PID:2028
                                                                                              • C:\Temp\lgdywqoigb.sys
                                                                                                C:\Temp\lgdywqoigb.sys
                                                                                                1⤵
                                                                                                • Executes dropped EXE
                                                                                                PID:1724
                                                                                              • C:\Temp\vqoigaysql.sys
                                                                                                C:\Temp\vqoigaysql.sys
                                                                                                1⤵
                                                                                                • Executes dropped EXE
                                                                                                PID:2672
                                                                                              • C:\Temp\nigaysqkid.sys
                                                                                                C:\Temp\nigaysqkid.sys
                                                                                                1⤵
                                                                                                • Executes dropped EXE
                                                                                                PID:5364
                                                                                              • C:\Temp\xvpnifaxsq.sys
                                                                                                C:\Temp\xvpnifaxsq.sys
                                                                                                1⤵
                                                                                                • Executes dropped EXE
                                                                                                PID:808
                                                                                              • C:\Temp\kicausnkfc.sys
                                                                                                C:\Temp\kicausnkfc.sys
                                                                                                1⤵
                                                                                                • Executes dropped EXE
                                                                                                PID:3900
                                                                                              • C:\Temp\cxupmhfzxr.sys
                                                                                                C:\Temp\cxupmhfzxr.sys
                                                                                                1⤵
                                                                                                • Executes dropped EXE
                                                                                                PID:3184
                                                                                              • C:\Temp\zxrpjhbzur.sys
                                                                                                C:\Temp\zxrpjhbzur.sys
                                                                                                1⤵
                                                                                                • Executes dropped EXE
                                                                                                PID:5668
                                                                                              • C:\Temp\rmjecwuomg.sys
                                                                                                C:\Temp\rmjecwuomg.sys
                                                                                                1⤵
                                                                                                  PID:4792
                                                                                                • C:\Temp\dbvtolgeyw.sys
                                                                                                  C:\Temp\dbvtolgeyw.sys
                                                                                                  1⤵
                                                                                                    PID:5384
                                                                                                  • C:\Temp\tolgdywqoi.sys
                                                                                                    C:\Temp\tolgdywqoi.sys
                                                                                                    1⤵
                                                                                                      PID:5332
                                                                                                    • C:\Temp\nlgdywqoig.sys
                                                                                                      C:\Temp\nlgdywqoig.sys
                                                                                                      1⤵
                                                                                                        PID:3872
                                                                                                      • C:\Temp\xvpnigaysq.sys
                                                                                                        C:\Temp\xvpnigaysq.sys
                                                                                                        1⤵
                                                                                                          PID:4316
                                                                                                        • C:\Temp\cxvpnhfaxs.sys
                                                                                                          C:\Temp\cxvpnhfaxs.sys
                                                                                                          1⤵
                                                                                                            PID:5228
                                                                                                          • C:\Temp\khcausmkfc.sys
                                                                                                            C:\Temp\khcausmkfc.sys
                                                                                                            1⤵
                                                                                                              PID:2848
                                                                                                            • C:\Temp\zxrpjhczus.sys
                                                                                                              C:\Temp\zxrpjhczus.sys
                                                                                                              1⤵
                                                                                                                PID:3828
                                                                                                              • C:\Temp\jebwuomgez.sys
                                                                                                                C:\Temp\jebwuomgez.sys
                                                                                                                1⤵
                                                                                                                  PID:3820

                                                                                                                Network

                                                                                                                      MITRE ATT&CK Enterprise v16

                                                                                                                      Replay Monitor

                                                                                                                      Loading Replay Monitor...

                                                                                                                      Downloads

                                                                                                                      CreateProcess.exe
                                                                                                                      • Path C:\Temp\CreateProcess.exe
                                                                                                                      • Size 3KB
                                                                                                                      • SHA256 6356bbae8b129ac634f0bc63a80911b5e27877d3b62e5dfbd44dcdaaa77b882b
                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                      Submit Download

                                                                                                                      bvtolgdywq.exe
                                                                                                                      • Path C:\Temp\bvtolgdywq.exe
                                                                                                                      • Size 384KB
                                                                                                                      • SHA256 e318b819b2ac8af198abd50275e54d6454bf6d47beba86fcf9a0baa8bd7215c1
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                      Submit Download

                                                                                                                      ezxrpjhbzu.sys
                                                                                                                      • Path C:\Temp\ezxrpjhbzu.sys
                                                                                                                      • Size 293KB
                                                                                                                      • SHA256 4d21d47d7d36b77ed511b6935c33155eecf5c479a0a2d14696c39b4bde5c1ae6
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                      Submit Download

                                                                                                                      i_bvtolgdywq.exe
                                                                                                                      • Path C:\Temp\i_bvtolgdywq.exe
                                                                                                                      • Size 384KB
                                                                                                                      • SHA256 54a984a4c4a437e75a56aa93683c833448c591807107aab55b010cd1237c37e0
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                      Submit Download

                                                                                                                      i_lfdyvtnlfd.exe
                                                                                                                      • Path C:\Temp\i_lfdyvtnlfd.exe
                                                                                                                      • Size 384KB
                                                                                                                      • SHA256 9886ade851ba0f60c7656f36259ec43d1bc7c773b41dbccde113a8a263cf123f
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                      Submit Download

                                                                                                                      i_mgbztrljeb.exe
                                                                                                                      • Path C:\Temp\i_mgbztrljeb.exe
                                                                                                                      • Size 384KB
                                                                                                                      • SHA256 1606107983336d61f6860d5ecc0b7676b6b7ca01cd2ddb948af60281fa116bf0
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                      Submit Download

                                                                                                                      i_mgeywrojhb.exe
                                                                                                                      • Path C:\Temp\i_mgeywrojhb.exe
                                                                                                                      • Size 384KB
                                                                                                                      • SHA256 5a1540c62b94191f89c7b654cec69d8ee1c2437f7602e6df7b866ace74e15197
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                      Submit Download

                                                                                                                      i_spkhcaupnh.exe
                                                                                                                      • Path C:\Temp\i_spkhcaupnh.exe
                                                                                                                      • Size 384KB
                                                                                                                      • SHA256 ecd8add70628317967f2cc0d5cddbb219102624b73586a28de1830fbcb1462b5
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                      Submit Download

                                                                                                                      i_wuomhezwrp.exe
                                                                                                                      • Path C:\Temp\i_wuomhezwrp.exe
                                                                                                                      • Size 384KB
                                                                                                                      • SHA256 7ec1b07036e70ffc9301d668dfd3f4caf704cd46a1d7ae73e50c3b7ad3e7f4b9
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                      Submit Download

                                                                                                                      icausmkfcxvpnhfz.exe
                                                                                                                      • Path C:\Temp\icausmkfcxvpnhfz.exe
                                                                                                                      • Size 384KB
                                                                                                                      • SHA256 c850e97eb39ca152863d64c842b7f8b49a1f08f97e0bef75ad71461b84ec0999
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                      Submit Download

                                                                                                                      icausmkfcxvpnhfz.sys
                                                                                                                      • Path C:\Temp\icausmkfcxvpnhfz.sys
                                                                                                                      • Size 293KB
                                                                                                                      • SHA256 bdf1cd3c90036bb6c1dc35f210a441b13f1a003eaf955a8c36cf46215c896441
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                      Submit Download

                                                                                                                      kecwuomhez.sys
                                                                                                                      • Path C:\Temp\kecwuomhez.sys
                                                                                                                      • Size 293KB
                                                                                                                      • SHA256 481dd1d0ccc0e15acfbed484fd2e396b043a4d76931269cbec62d9995d5ebcd3
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                      Submit Download

                                                                                                                      lfdyvtnlfd.exe
                                                                                                                      • Path C:\Temp\lfdyvtnlfd.exe
                                                                                                                      • Size 384KB
                                                                                                                      • SHA256 6a486a4970ea2df6e483ec1f23aa5fbbb076e0487a95bd1ca726a2a304d174eb
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                      Submit Download

                                                                                                                      lgdywqoigb.sys
                                                                                                                      • Path C:\Temp\lgdywqoigb.sys
                                                                                                                      • Size 293KB
                                                                                                                      • SHA256 e11a203559078153742c330e21ef5cd82fc184f847160dc2519eb17d892874c9
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                      Submit Download

                                                                                                                      mgbztrljeb.exe
                                                                                                                      • Path C:\Temp\mgbztrljeb.exe
                                                                                                                      • Size 384KB
                                                                                                                      • SHA256 3dbf60099854a8065f63f974dc8ca7943d02e1a87780bd08e09418988c866f9a
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                      Submit Download

                                                                                                                      mgeywrojhb.exe
                                                                                                                      • Path C:\Temp\mgeywrojhb.exe
                                                                                                                      • Size 384KB
                                                                                                                      • SHA256 14e31773e27d843b4534ca8462b1edda67e90da5824575db46b991aa42633991
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                      Submit Download

                                                                                                                      spkhcaupnh.exe
                                                                                                                      • Path C:\Temp\spkhcaupnh.exe
                                                                                                                      • Size 384KB
                                                                                                                      • SHA256 17edc2dc7b1ba8ecb48bf750a89b9d7041ceaf2712fb975456d1cd9f07cb83d4
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                      Submit Download

                                                                                                                      trljebwtom.sys
                                                                                                                      • Path C:\Temp\trljebwtom.sys
                                                                                                                      • Size 293KB
                                                                                                                      • SHA256 2fd14b5190d1979ff5fcf6509c182f0899f5a1f794bb436f2e99c9246ea7c4f8
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                      Submit Download

                                                                                                                      vqoigaysql.sys
                                                                                                                      • Path C:\Temp\vqoigaysql.sys
                                                                                                                      • Size 293KB
                                                                                                                      • SHA256 7bb1c7ae6eea5a1a83ca5364bce16e117389e99eab47b2594a1fdd6a4a67f726
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                      Submit Download

                                                                                                                      wuomhezwrp.exe
                                                                                                                      • Path C:\Temp\wuomhezwrp.exe
                                                                                                                      • Size 384KB
                                                                                                                      • SHA256 b2b011fc039e020a8561211332520ac6b531b0c44e27dfa2cf30bf7ed4955f7a
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                      Submit Download

                                                                                                                      69d89a50-8037-4f3d-a5eb-505791594e52.tmp
                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\69d89a50-8037-4f3d-a5eb-505791594e52.tmp
                                                                                                                      • Size 26KB
                                                                                                                      • SHA256 a8457457b65ae141bf6d2fc90663d7dda2dcdf4c2c9ecc8fc5401202f5c85546
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                      Submit Download

                                                                                                                      settings.dat
                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                      • Size 280B
                                                                                                                      • SHA256 1eac715bceeccb15cc45a13a9b914a80ac00eeb9f178f8c94511c17b32720b1a
                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                      Submit Download

                                                                                                                      settings.dat
                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                      • Size 280B
                                                                                                                      • SHA256 2172811336537a33607e0aadb9c5ba8cadf28b2a4fcb84d32213c685b1c34544
                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                      Submit Download

                                                                                                                      BookmarkMergedSurfaceOrdering
                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
                                                                                                                      • Size 6B
                                                                                                                      • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                      Submit Download

                                                                                                                      BrowsingTopicsState
                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
                                                                                                                      • Size 414B
                                                                                                                      • SHA256 d0fee2229b26acdc7a4bf6604f60ade488d8ef78a1bd1fb2895185a2b9bdb638
                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                      Submit Download

                                                                                                                      SiteList-Enterprise.json
                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                                                                                      • Size 2B
                                                                                                                      • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                      Submit Download

                                                                                                                      HubApps
                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
                                                                                                                      • Size 106KB
                                                                                                                      • SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                      Submit Download

                                                                                                                      Network Persistent State
                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                      • Size 2KB
                                                                                                                      • SHA256 65d30345463f3f3395abb55e88162e73997df8ea287011562f6a7b466668ce5c
                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                      Submit Download

                                                                                                                      SCT Auditing Pending Reports
                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                                                      • Size 2B
                                                                                                                      • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                      Submit Download

                                                                                                                      Sdch Dictionaries
                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
                                                                                                                      • Size 40B
                                                                                                                      • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                      Submit Download

                                                                                                                      Preferences
                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                      • Size 16KB
                                                                                                                      • SHA256 6831117c2172300987143ad4afac140d5718cca668e64cfeebbfa9ad1259070f
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                      Submit Download

                                                                                                                      Preferences
                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                      • Size 15KB
                                                                                                                      • SHA256 fb144d339fa3a6514295a8439c23a5ebaf5bd57772d7cf421fcf521f5e8cdf13
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                      Submit Download

                                                                                                                      Secure Preferences
                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                                                                      • Size 36KB
                                                                                                                      • SHA256 71448e84d00c168b5ff86221afe4173f251b0d80d42ff32326b36e3660598931
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                      Submit Download

                                                                                                                      sync_diagnostic.log
                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                                                                      • Size 23KB
                                                                                                                      • SHA256 4e33dd7b64fe2f5459f37c6628289a96d4f71b8e1086c496c5888ade3d272825
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                      Submit Download

                                                                                                                      CURRENT
                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
                                                                                                                      • Size 16B
                                                                                                                      • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                      Submit Download

                                                                                                                      MANIFEST-000001
                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
                                                                                                                      • Size 41B
                                                                                                                      • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                      Submit Download

                                                                                                                      Local State
                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                      • Size 32KB
                                                                                                                      • SHA256 d7d1c2e0101de33d87694f0aff141085493ef7b3a45ae4fcccf56c84e9e9a578
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                      Submit Download

                                                                                                                      Local State
                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                      • Size 27KB
                                                                                                                      • SHA256 86fca93be7f14c05762a70f0d0e1ead379e7ab97a5dbf1753b2679a025d76d43
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                      Submit Download

                                                                                                                      Local State
                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                      • Size 27KB
                                                                                                                      • SHA256 fa096432bf0f3a3ad6702f900b8164a8776ce962783875857927c8013e73b2f1
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                      Submit Download

                                                                                                                      Local State
                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                      • Size 27KB
                                                                                                                      • SHA256 8b9cf16bb0c9aa4f2db1e79f068856f91db0e9d3835076eae0063ace7e35ba80
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                      Submit Download

                                                                                                                      Local State
                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                      • Size 27KB
                                                                                                                      • SHA256 efe10d3dc8b49803c03e4d10290b4ff877b52496fab2d555a89c3ae8caa82839
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                      Submit Download

                                                                                                                      metadata.json
                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                      • Size 2KB
                                                                                                                      • SHA256 9ab984842f0baa832b53bd8d3a1d42dfdf7ad335609e65722cecc3b0b729b8c3
                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                      Submit Download

                                                                                                                      3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
                                                                                                                      • Size 147KB
                                                                                                                      • SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                      Submit Download

                                                                                                                      7e49ad1d-f2dc-4bb3-bec0-f05d47274604.tmp
                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\7e49ad1d-f2dc-4bb3-bec0-f05d47274604.tmp
                                                                                                                      • Size 132B
                                                                                                                      • SHA256 54f761e00d363bd15db7bae3cc55144c80148a5fa1db7c3c2049e0e406a9142c
                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                      Submit Download

                                                                                                                      memory/388-583-0x00000000009F0000-0x0000000000ACF000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/756-714-0x0000000000620000-0x00000000006FF000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/808-587-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/820-774-0x0000000000820000-0x00000000008FF000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/1320-679-0x0000000000960000-0x0000000000A3F000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/1404-68-0x0000000000A40000-0x0000000000B1F000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/1444-775-0x0000000000970000-0x0000000000A4F000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/1560-578-0x00000000009E0000-0x0000000000ABF000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/1724-302-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/1744-241-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/1788-239-0x0000000000A40000-0x0000000000B1F000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/2028-264-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/2116-721-0x00000000009A0000-0x0000000000A7F000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/2284-270-0x0000000000900000-0x00000000009DF000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/2288-768-0x0000000000980000-0x0000000000A5F000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/2336-642-0x00000000009A0000-0x0000000000A7F000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/2456-201-0x00000000009F0000-0x0000000000ACF000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/2460-718-0x0000000000980000-0x0000000000A5F000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/2488-748-0x0000000000A20000-0x0000000000AFF000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/2568-641-0x0000000000820000-0x00000000008FF000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/2672-580-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/2672-536-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/2848-749-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/2916-586-0x00000000009D0000-0x0000000000AAF000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/2932-567-0x0000000000980000-0x0000000000A5F000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/2936-722-0x0000000000A40000-0x0000000000B1F000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/2952-225-0x00000000009B0000-0x0000000000A8F000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/2992-645-0x0000000000A70000-0x0000000000B4F000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/3052-69-0x0000000000A70000-0x0000000000B4F000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/3112-706-0x0000000000980000-0x0000000000A5F000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/3124-271-0x0000000000970000-0x0000000000A4F000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/3140-683-0x00000000009C0000-0x0000000000A9F000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/3184-618-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/3232-278-0x0000000000900000-0x00000000009DF000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/3268-521-0x0000000000960000-0x0000000000A3F000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/3592-248-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/3592-203-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/3648-687-0x0000000000960000-0x0000000000A3F000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/3680-686-0x00000000009A0000-0x0000000000A7F000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/3816-744-0x0000000000AA0000-0x0000000000B7F000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/3820-779-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/3828-772-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/3872-707-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/3888-771-0x0000000000A00000-0x0000000000ADF000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/3900-611-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/3968-778-0x0000000000A60000-0x0000000000B3F000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/3968-64-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/3988-522-0x00000000009A0000-0x0000000000A7F000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/4244-655-0x0000000000A60000-0x0000000000B3F000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/4316-719-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/4412-676-0x0000000000660000-0x000000000073F000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/4572-745-0x0000000000960000-0x0000000000A3F000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/4576-648-0x0000000000A20000-0x0000000000AFF000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/4780-534-0x0000000000960000-0x0000000000A3F000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/4792-653-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/4836-680-0x0000000000980000-0x0000000000A5F000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/4916-715-0x0000000000970000-0x0000000000A4F000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/5092-767-0x0000000000840000-0x000000000091F000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/5104-617-0x0000000000960000-0x0000000000A3F000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/5108-566-0x0000000000A70000-0x0000000000B4F000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/5188-247-0x0000000000840000-0x000000000091F000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/5228-742-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/5252-589-0x0000000000890000-0x000000000096F000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/5264-652-0x0000000000A00000-0x0000000000ADF000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/5288-610-0x0000000000990000-0x0000000000A6F000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/5332-684-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/5364-607-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/5364-579-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/5384-677-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/5436-656-0x0000000000A20000-0x0000000000AFF000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/5480-614-0x0000000000980000-0x0000000000A5F000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/5500-741-0x0000000000A70000-0x0000000000B4F000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/5528-582-0x0000000000900000-0x00000000009DF000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/5612-224-0x0000000000900000-0x00000000009DF000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/5668-646-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/5732-649-0x0000000000A00000-0x0000000000ADF000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/5956-262-0x00000000009F0000-0x0000000000ACF000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/5984-613-0x0000000000970000-0x0000000000A4F000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/6132-590-0x0000000000A00000-0x0000000000ADF000-memory.dmp
                                                                                                                      Download