Overview

overview

10

Static

static

10

2026-05-09...op.exe

windows10-2004-x64

10

2026-05-09...op.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    145s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260130-en
  • resource tags

    arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    09/05/2026, 03:58

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-05-09_b96af26a0fa0d63ee0af813e2644b19e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
  • Size 376KB
  • Sample260509-ejnlgsdy6m
  • SHA256 c565ddfd9e92161d2f180d080db5514bc67d596ab51f439e3a029846ce401dad
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwarediscoverysystexspywaretrojan

Malware Config

Extracted

Family

  • systex

C2

  • http://xytets.com:2345/t.asp?os=wangba

  • http://xytets.com:2345/t.asp?os=home

  • http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

  • Family: Systex

    Systex is a trojan loader written in C++.

    trojansystex
  • Executes dropped EXE 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Gathers network information 2 TTPs 19 IoCs

    Uses commandline utility to view network configuration.

  • Modifies Internet Explorer settings 1 TTPs 29 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 20 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 19 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-05-09_b96af26a0fa0d63ee0af813e2644b19e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-05-09_b96af26a0fa0d63ee0af813e2644b19e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1048
    • C:\Temp\sqkicausnkfdxvpn.exe
      C:\Temp\sqkicausnkfdxvpn.exe run
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2692
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\causnkfdxv.exe ups_run
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:4800
        • C:\Temp\causnkfdxv.exe
          C:\Temp\causnkfdxv.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3900
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:4136
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:4436
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_causnkfdxv.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:5660
        • C:\Temp\i_causnkfdxv.exe
          C:\Temp\i_causnkfdxv.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:6080
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\nhfzxrpkhc.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:5448
        • C:\Temp\nhfzxrpkhc.exe
          C:\Temp\nhfzxrpkhc.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5576
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:2544
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:5500
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_nhfzxrpkhc.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:4456
        • C:\Temp\i_nhfzxrpkhc.exe
          C:\Temp\i_nhfzxrpkhc.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:5196
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\rmhbzuomhe.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:4952
        • C:\Temp\rmhbzuomhe.exe
          C:\Temp\rmhbzuomhe.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4852
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:4492
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:4484
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_rmhbzuomhe.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:2680
        • C:\Temp\i_rmhbzuomhe.exe
          C:\Temp\i_rmhbzuomhe.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:4520
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\cwuomhezxr.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:4304
        • C:\Temp\cwuomhezxr.exe
          C:\Temp\cwuomhezxr.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2008
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:2920
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:1904
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_cwuomhezxr.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:3140
        • C:\Temp\i_cwuomhezxr.exe
          C:\Temp\i_cwuomhezxr.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:5672
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\mgezwrojgb.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:3176
        • C:\Temp\mgezwrojgb.exe
          C:\Temp\mgezwrojgb.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5620
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:3812
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:2276
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_mgezwrojgb.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:4968
        • C:\Temp\i_mgezwrojgb.exe
          C:\Temp\i_mgezwrojgb.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:3300
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\oidbztrljd.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:3144
        • C:\Temp\oidbztrljd.exe
          C:\Temp\oidbztrljd.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5004
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:4676
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:5116
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_oidbztrljd.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:2388
        • C:\Temp\i_oidbztrljd.exe
          C:\Temp\i_oidbztrljd.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:2960
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\vqoigaysql.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:5328
        • C:\Temp\vqoigaysql.exe
          C:\Temp\vqoigaysql.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5864
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:3856
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:4256
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_vqoigaysql.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:2512
        • C:\Temp\i_vqoigaysql.exe
          C:\Temp\i_vqoigaysql.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:4436
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\qkidbvtoig.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:124
        • C:\Temp\qkidbvtoig.exe
          C:\Temp\qkidbvtoig.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1284
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:2756
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:3884
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_qkidbvtoig.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:3988
        • C:\Temp\i_qkidbvtoig.exe
          C:\Temp\i_qkidbvtoig.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:5696
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\xvpnifaysq.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:5572
        • C:\Temp\xvpnifaysq.exe
          C:\Temp\xvpnifaysq.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5188
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:448
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:3956
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_xvpnifaysq.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:3116
        • C:\Temp\i_xvpnifaysq.exe
          C:\Temp\i_xvpnifaysq.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:2340
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\kecxupnhfz.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:3660
        • C:\Temp\kecxupnhfz.exe
          C:\Temp\kecxupnhfz.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5592
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:240
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:5568
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_kecxupnhfz.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:1604
        • C:\Temp\i_kecxupnhfz.exe
          C:\Temp\i_kecxupnhfz.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:6140
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\xupnhfzxrp.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:6048
        • C:\Temp\xupnhfzxrp.exe
          C:\Temp\xupnhfzxrp.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2236
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
              PID:5396
              • C:\windows\system32\ipconfig.exe
                C:\windows\system32\ipconfig.exe /release
                6⤵
                • Gathers network information
                PID:5952
        • C:\temp\CreateProcess.exe
          C:\temp\CreateProcess.exe C:\Temp\i_xupnhfzxrp.exe ups_ins
          3⤵
            PID:4884
            • C:\Temp\i_xupnhfzxrp.exe
              C:\Temp\i_xupnhfzxrp.exe ups_ins
              4⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              PID:4460
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\Temp\urmhecwrom.exe ups_run
            3⤵
              PID:2972
              • C:\Temp\urmhecwrom.exe
                C:\Temp\urmhecwrom.exe ups_run
                4⤵
                • System Location Discovery: System Language Discovery
                PID:5888
                • C:\temp\CreateProcess.exe
                  C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                  5⤵
                    PID:420
                    • C:\windows\system32\ipconfig.exe
                      C:\windows\system32\ipconfig.exe /release
                      6⤵
                      • Gathers network information
                      PID:5608
              • C:\temp\CreateProcess.exe
                C:\temp\CreateProcess.exe C:\Temp\i_urmhecwrom.exe ups_ins
                3⤵
                  PID:2960
                  • C:\Temp\i_urmhecwrom.exe
                    C:\Temp\i_urmhecwrom.exe ups_ins
                    4⤵
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of AdjustPrivilegeToken
                    PID:5556
                • C:\temp\CreateProcess.exe
                  C:\temp\CreateProcess.exe C:\Temp\gezwrpjhcz.exe ups_run
                  3⤵
                    PID:1392
                    • C:\Temp\gezwrpjhcz.exe
                      C:\Temp\gezwrpjhcz.exe ups_run
                      4⤵
                      • System Location Discovery: System Language Discovery
                      PID:3948
                      • C:\temp\CreateProcess.exe
                        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                        5⤵
                          PID:4252
                          • C:\windows\system32\ipconfig.exe
                            C:\windows\system32\ipconfig.exe /release
                            6⤵
                            • Gathers network information
                            PID:4032
                    • C:\temp\CreateProcess.exe
                      C:\temp\CreateProcess.exe C:\Temp\i_gezwrpjhcz.exe ups_ins
                      3⤵
                        PID:3868
                        • C:\Temp\i_gezwrpjhcz.exe
                          C:\Temp\i_gezwrpjhcz.exe ups_ins
                          4⤵
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of AdjustPrivilegeToken
                          PID:2904
                      • C:\temp\CreateProcess.exe
                        C:\temp\CreateProcess.exe C:\Temp\wrojgbztrl.exe ups_run
                        3⤵
                          PID:1276
                          • C:\Temp\wrojgbztrl.exe
                            C:\Temp\wrojgbztrl.exe ups_run
                            4⤵
                            • System Location Discovery: System Language Discovery
                            PID:4688
                            • C:\temp\CreateProcess.exe
                              C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                              5⤵
                                PID:3704
                                • C:\windows\system32\ipconfig.exe
                                  C:\windows\system32\ipconfig.exe /release
                                  6⤵
                                  • Gathers network information
                                  PID:756
                          • C:\temp\CreateProcess.exe
                            C:\temp\CreateProcess.exe C:\Temp\i_wrojgbztrl.exe ups_ins
                            3⤵
                              PID:4744
                              • C:\Temp\i_wrojgbztrl.exe
                                C:\Temp\i_wrojgbztrl.exe ups_ins
                                4⤵
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of AdjustPrivilegeToken
                                PID:6060
                            • C:\temp\CreateProcess.exe
                              C:\temp\CreateProcess.exe C:\Temp\dbytqlidbv.exe ups_run
                              3⤵
                                PID:4924
                                • C:\Temp\dbytqlidbv.exe
                                  C:\Temp\dbytqlidbv.exe ups_run
                                  4⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:2340
                                  • C:\temp\CreateProcess.exe
                                    C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                                    5⤵
                                      PID:5824
                                      • C:\windows\system32\ipconfig.exe
                                        C:\windows\system32\ipconfig.exe /release
                                        6⤵
                                        • Gathers network information
                                        PID:2792
                                • C:\temp\CreateProcess.exe
                                  C:\temp\CreateProcess.exe C:\Temp\i_dbytqlidbv.exe ups_ins
                                  3⤵
                                    PID:2000
                                    • C:\Temp\i_dbytqlidbv.exe
                                      C:\Temp\i_dbytqlidbv.exe ups_ins
                                      4⤵
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:1828
                                  • C:\temp\CreateProcess.exe
                                    C:\temp\CreateProcess.exe C:\Temp\yvqoigaysq.exe ups_run
                                    3⤵
                                      PID:3904
                                      • C:\Temp\yvqoigaysq.exe
                                        C:\Temp\yvqoigaysq.exe ups_run
                                        4⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:5300
                                        • C:\temp\CreateProcess.exe
                                          C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                                          5⤵
                                            PID:5092
                                            • C:\windows\system32\ipconfig.exe
                                              C:\windows\system32\ipconfig.exe /release
                                              6⤵
                                              • Gathers network information
                                              PID:2088
                                      • C:\temp\CreateProcess.exe
                                        C:\temp\CreateProcess.exe C:\Temp\i_yvqoigaysq.exe ups_ins
                                        3⤵
                                          PID:5372
                                          • C:\Temp\i_yvqoigaysq.exe
                                            C:\Temp\i_yvqoigaysq.exe ups_ins
                                            4⤵
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:5952
                                        • C:\temp\CreateProcess.exe
                                          C:\temp\CreateProcess.exe C:\Temp\fdavqnicay.exe ups_run
                                          3⤵
                                            PID:3824
                                            • C:\Temp\fdavqnicay.exe
                                              C:\Temp\fdavqnicay.exe ups_run
                                              4⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:584
                                              • C:\temp\CreateProcess.exe
                                                C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                                                5⤵
                                                  PID:4520
                                                  • C:\windows\system32\ipconfig.exe
                                                    C:\windows\system32\ipconfig.exe /release
                                                    6⤵
                                                    • Gathers network information
                                                    PID:1344
                                            • C:\temp\CreateProcess.exe
                                              C:\temp\CreateProcess.exe C:\Temp\i_fdavqnicay.exe ups_ins
                                              3⤵
                                                PID:3328
                                                • C:\Temp\i_fdavqnicay.exe
                                                  C:\Temp\i_fdavqnicay.exe ups_ins
                                                  4⤵
                                                  • System Location Discovery: System Language Discovery
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:4832
                                              • C:\temp\CreateProcess.exe
                                                C:\temp\CreateProcess.exe C:\Temp\xsmkfcxvpn.exe ups_run
                                                3⤵
                                                  PID:5604
                                                  • C:\Temp\xsmkfcxvpn.exe
                                                    C:\Temp\xsmkfcxvpn.exe ups_run
                                                    4⤵
                                                    • System Location Discovery: System Language Discovery
                                                    PID:4256
                                                    • C:\temp\CreateProcess.exe
                                                      C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                                                      5⤵
                                                        PID:3572
                                                        • C:\windows\system32\ipconfig.exe
                                                          C:\windows\system32\ipconfig.exe /release
                                                          6⤵
                                                          • Gathers network information
                                                          PID:1504
                                                  • C:\temp\CreateProcess.exe
                                                    C:\temp\CreateProcess.exe C:\Temp\i_xsmkfcxvpn.exe ups_ins
                                                    3⤵
                                                      PID:332
                                                      • C:\Temp\i_xsmkfcxvpn.exe
                                                        C:\Temp\i_xsmkfcxvpn.exe ups_ins
                                                        4⤵
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:224
                                                    • C:\temp\CreateProcess.exe
                                                      C:\temp\CreateProcess.exe C:\Temp\hfzxspkhca.exe ups_run
                                                      3⤵
                                                        PID:3252
                                                        • C:\Temp\hfzxspkhca.exe
                                                          C:\Temp\hfzxspkhca.exe ups_run
                                                          4⤵
                                                          • System Location Discovery: System Language Discovery
                                                          PID:3308
                                                          • C:\temp\CreateProcess.exe
                                                            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                                                            5⤵
                                                              PID:3236
                                                              • C:\windows\system32\ipconfig.exe
                                                                C:\windows\system32\ipconfig.exe /release
                                                                6⤵
                                                                • Gathers network information
                                                                PID:2240
                                                        • C:\temp\CreateProcess.exe
                                                          C:\temp\CreateProcess.exe C:\Temp\i_hfzxspkhca.exe ups_ins
                                                          3⤵
                                                            PID:4976
                                                            • C:\Temp\i_hfzxspkhca.exe
                                                              C:\Temp\i_hfzxspkhca.exe ups_ins
                                                              4⤵
                                                              • System Location Discovery: System Language Discovery
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:2224
                                                        • C:\Program Files\Internet Explorer\iexplore.exe
                                                          "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
                                                          2⤵
                                                          • Modifies Internet Explorer settings
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:620
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
                                                            3⤵
                                                            • Drops file in Windows directory
                                                            • Enumerates system info in registry
                                                            • Modifies data under HKEY_USERS
                                                            • Modifies registry class
                                                            • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                            • Suspicious use of FindShellTrayWindow
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:1376
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x2f0,0x7fffaf7fc188,0x7fffaf7fc194,0x7fffaf7fc1a0
                                                              4⤵
                                                                PID:3688
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1748,i,2408318176132345335,7702107299733377700,524288 --field-trial-handle=2156,i,16447372516405265568,14500354733478779972,262144 --variations-seed-version --mojo-platform-channel-handle=2192 /prefetch:11
                                                                4⤵
                                                                • System Time Discovery
                                                                PID:2072
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1624,i,1104184714348521389,11418005039091359362,262144 --field-trial-handle=2156,i,16447372516405265568,14500354733478779972,262144 --variations-seed-version --mojo-platform-channel-handle=2152 /prefetch:2
                                                                4⤵
                                                                  PID:2084
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2440,i,4523850026963232334,772885032812249805,524288 --field-trial-handle=2156,i,16447372516405265568,14500354733478779972,262144 --variations-seed-version --mojo-platform-channel-handle=2768 /prefetch:13
                                                                  4⤵
                                                                    PID:4344
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3468,i,12259629000270568371,11504811536518055755,2097152 --field-trial-handle=2156,i,16447372516405265568,14500354733478779972,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
                                                                    4⤵
                                                                      PID:3292
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3488,i,17405389063194767136,5042854770753128710,2097152 --field-trial-handle=2156,i,16447372516405265568,14500354733478779972,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
                                                                      4⤵
                                                                        PID:1832
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4864,i,3783297681441004613,6313196790580999140,524288 --field-trial-handle=2156,i,16447372516405265568,14500354733478779972,262144 --variations-seed-version --mojo-platform-channel-handle=4928 /prefetch:14
                                                                        4⤵
                                                                          PID:3480
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4868,i,12561298548441928202,16651471188233268000,524288 --field-trial-handle=2156,i,16447372516405265568,14500354733478779972,262144 --variations-seed-version --mojo-platform-channel-handle=4892 /prefetch:14
                                                                          4⤵
                                                                            PID:6116
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5760,i,4861948113655720163,1524944606750538711,524288 --field-trial-handle=2156,i,16447372516405265568,14500354733478779972,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:14
                                                                            4⤵
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:1500
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
                                                                              cookie_exporter.exe --cookie-json=1128
                                                                              5⤵
                                                                                PID:1648
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5756,i,10917990994430050758,4755480147518240143,524288 --field-trial-handle=2156,i,16447372516405265568,14500354733478779972,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:14
                                                                              4⤵
                                                                                PID:1284
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5756,i,10917990994430050758,4755480147518240143,524288 --field-trial-handle=2156,i,16447372516405265568,14500354733478779972,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:14
                                                                                4⤵
                                                                                  PID:6068
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,4730952356336758161,13632301086394470202,524288 --field-trial-handle=2156,i,16447372516405265568,14500354733478779972,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:14
                                                                                  4⤵
                                                                                    PID:1560
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6240,i,2407009689038333251,17126908337741863379,524288 --field-trial-handle=2156,i,16447372516405265568,14500354733478779972,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:14
                                                                                    4⤵
                                                                                      PID:4352
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6220,i,14317401199512780312,2604449300081681742,524288 --field-trial-handle=2156,i,16447372516405265568,14500354733478779972,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:14
                                                                                      4⤵
                                                                                        PID:3104
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,12359190355184869274,7039170096828008431,524288 --field-trial-handle=2156,i,16447372516405265568,14500354733478779972,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:14
                                                                                        4⤵
                                                                                          PID:6096
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6220,i,12176783935584340809,13050182740214553733,524288 --field-trial-handle=2156,i,16447372516405265568,14500354733478779972,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:14
                                                                                          4⤵
                                                                                            PID:2212
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5096,i,11621671872162607012,1047735648623447685,524288 --field-trial-handle=2156,i,16447372516405265568,14500354733478779972,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:14
                                                                                            4⤵
                                                                                              PID:4316
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6296,i,5214469048772457100,4969557429983272260,524288 --field-trial-handle=2156,i,16447372516405265568,14500354733478779972,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:14
                                                                                              4⤵
                                                                                                PID:3984
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4908,i,9885244278727047951,3311580421089733705,524288 --field-trial-handle=2156,i,16447372516405265568,14500354733478779972,262144 --variations-seed-version --mojo-platform-channel-handle=4992 /prefetch:14
                                                                                                4⤵
                                                                                                  PID:5920
                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6400,i,5272875559206521457,9409509539463289819,262144 --field-trial-handle=2156,i,16447372516405265568,14500354733478779972,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:10
                                                                                                  4⤵
                                                                                                    PID:5348
                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5744,i,5104288612651333549,398475616852614302,524288 --field-trial-handle=2156,i,16447372516405265568,14500354733478779972,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:14
                                                                                                    4⤵
                                                                                                      PID:1484
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                                1⤵
                                                                                                  PID:1464
                                                                                                • C:\Temp\sqkicausnkfdxvpn.sys
                                                                                                  C:\Temp\sqkicausnkfdxvpn.sys
                                                                                                  1⤵
                                                                                                  • Executes dropped EXE
                                                                                                  PID:3104
                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
                                                                                                  1⤵
                                                                                                    PID:1532
                                                                                                  • C:\Temp\usmkfcausm.sys
                                                                                                    C:\Temp\usmkfcausm.sys
                                                                                                    1⤵
                                                                                                    • Executes dropped EXE
                                                                                                    PID:5996
                                                                                                  • C:\Temp\mkezxrpkhc.sys
                                                                                                    C:\Temp\mkezxrpkhc.sys
                                                                                                    1⤵
                                                                                                    • Executes dropped EXE
                                                                                                    PID:3012
                                                                                                  • C:\Temp\mkecwupjhb.sys
                                                                                                    C:\Temp\mkecwupjhb.sys
                                                                                                    1⤵
                                                                                                    • Executes dropped EXE
                                                                                                    PID:800
                                                                                                  • C:\Temp\wrojhbztrl.sys
                                                                                                    C:\Temp\wrojhbztrl.sys
                                                                                                    1⤵
                                                                                                    • Executes dropped EXE
                                                                                                    PID:3984
                                                                                                  • C:\Temp\bwqoigbztr.sys
                                                                                                    C:\Temp\bwqoigbztr.sys
                                                                                                    1⤵
                                                                                                    • Executes dropped EXE
                                                                                                    PID:5900
                                                                                                  • C:\Temp\oigaytqljd.sys
                                                                                                    C:\Temp\oigaytqljd.sys
                                                                                                    1⤵
                                                                                                    • Executes dropped EXE
                                                                                                    PID:4824
                                                                                                  • C:\Temp\aysqkidavt.sys
                                                                                                    C:\Temp\aysqkidavt.sys
                                                                                                    1⤵
                                                                                                    • Executes dropped EXE
                                                                                                    PID:2644
                                                                                                  • C:\Temp\idavsnlfdx.sys
                                                                                                    C:\Temp\idavsnlfdx.sys
                                                                                                    1⤵
                                                                                                    • Executes dropped EXE
                                                                                                    PID:4308
                                                                                                  • C:\Temp\usnkfaxspk.sys
                                                                                                    C:\Temp\usnkfaxspk.sys
                                                                                                    1⤵
                                                                                                    • Executes dropped EXE
                                                                                                    PID:2620
                                                                                                  • C:\Temp\pnhcausmke.sys
                                                                                                    C:\Temp\pnhcausmke.sys
                                                                                                    1⤵
                                                                                                    • Executes dropped EXE
                                                                                                    PID:5488
                                                                                                  • C:\Temp\ecwupmhfzx.sys
                                                                                                    C:\Temp\ecwupmhfzx.sys
                                                                                                    1⤵
                                                                                                      PID:3680
                                                                                                    • C:\Temp\uomhbztrmg.sys
                                                                                                      C:\Temp\uomhbztrmg.sys
                                                                                                      1⤵
                                                                                                        PID:3932
                                                                                                      • C:\Temp\gbwtomgeyw.sys
                                                                                                        C:\Temp\gbwtomgeyw.sys
                                                                                                        1⤵
                                                                                                          PID:1648
                                                                                                        • C:\Temp\ytrljdbwto.sys
                                                                                                          C:\Temp\ytrljdbwto.sys
                                                                                                          1⤵
                                                                                                            PID:3892
                                                                                                          • C:\Temp\igaysqlidb.sys
                                                                                                            C:\Temp\igaysqlidb.sys
                                                                                                            1⤵
                                                                                                              PID:2128
                                                                                                            • C:\Temp\vtnlfdxvqn.sys
                                                                                                              C:\Temp\vtnlfdxvqn.sys
                                                                                                              1⤵
                                                                                                                PID:3320
                                                                                                              • C:\Temp\fdxvpnhfax.sys
                                                                                                                C:\Temp\fdxvpnhfax.sys
                                                                                                                1⤵
                                                                                                                  PID:4352
                                                                                                                • C:\Temp\zxspkicaup.sys
                                                                                                                  C:\Temp\zxspkicaup.sys
                                                                                                                  1⤵
                                                                                                                    PID:2116
                                                                                                                  • C:\Temp\smkecwupmh.sys
                                                                                                                    C:\Temp\smkecwupmh.sys
                                                                                                                    1⤵
                                                                                                                      PID:4812

                                                                                                                    Network

                                                                                                                          MITRE ATT&CK Enterprise v16

                                                                                                                          Replay Monitor

                                                                                                                          Loading Replay Monitor...

                                                                                                                          Downloads

                                                                                                                          CreateProcess.exe
                                                                                                                          • Path C:\Temp\CreateProcess.exe
                                                                                                                          • Size 3KB
                                                                                                                          • SHA256 d2e17cc261ec90d576d420d71d283fffacfa6f4073c91f2732ffd260692144ba
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          bwqoigbztr.sys
                                                                                                                          • Path C:\Temp\bwqoigbztr.sys
                                                                                                                          • Size 293KB
                                                                                                                          • SHA256 df864a9cb3face326686581103028fb749c47cc238952f24d7094507778f8b57
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          causnkfdxv.exe
                                                                                                                          • Path C:\Temp\causnkfdxv.exe
                                                                                                                          • Size 376KB
                                                                                                                          • SHA256 26c00dd545abb7bb11033676933bfea48890f820ccc045f22841e5c80bc4e0b2
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          cwuomhezxr.exe
                                                                                                                          • Path C:\Temp\cwuomhezxr.exe
                                                                                                                          • Size 376KB
                                                                                                                          • SHA256 b2676b81d67ae701bbd6a3a73be82cfbb16d4cc2385614c9be61ea55b747ec05
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          i_causnkfdxv.exe
                                                                                                                          • Path C:\Temp\i_causnkfdxv.exe
                                                                                                                          • Size 376KB
                                                                                                                          • SHA256 5c3025c50523a486c0f9079e7b7574c56061e71d1a489ea6337df9e5e023aa45
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          i_cwuomhezxr.exe
                                                                                                                          • Path C:\Temp\i_cwuomhezxr.exe
                                                                                                                          • Size 376KB
                                                                                                                          • SHA256 04338d1c4b71e89ce228b8a4f809f4d7f28d505eae385dd2ebf751c34b4956bf
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          i_mgezwrojgb.exe
                                                                                                                          • Path C:\Temp\i_mgezwrojgb.exe
                                                                                                                          • Size 376KB
                                                                                                                          • SHA256 9f97413510789753afa9765bfc5e2fe15049d1258cd66bf5111638e223774559
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          i_nhfzxrpkhc.exe
                                                                                                                          • Path C:\Temp\i_nhfzxrpkhc.exe
                                                                                                                          • Size 376KB
                                                                                                                          • SHA256 c011ef85ff2c44db14ec92aabbdbb31177a52b35f989ad424badec2a987f067a
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          i_oidbztrljd.exe
                                                                                                                          • Path C:\Temp\i_oidbztrljd.exe
                                                                                                                          • Size 376KB
                                                                                                                          • SHA256 36277e6ff8efd257385c98aba64d31d4b5526ad0876182a7aedfb83f42f6756c
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          i_rmhbzuomhe.exe
                                                                                                                          • Path C:\Temp\i_rmhbzuomhe.exe
                                                                                                                          • Size 376KB
                                                                                                                          • SHA256 32eeeed1bb6020bdeb61a40fb882e6db963de70273225c079fe4b4c9ac0e08fa
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          mgezwrojgb.exe
                                                                                                                          • Path C:\Temp\mgezwrojgb.exe
                                                                                                                          • Size 376KB
                                                                                                                          • SHA256 682a9016bb9897cfb3d03942e4bfca9450cfb2a33700f1a77e597ae02f799acb
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          mkecwupjhb.sys
                                                                                                                          • Path C:\Temp\mkecwupjhb.sys
                                                                                                                          • Size 293KB
                                                                                                                          • SHA256 1174408fb8844c004269234134df981d02712d5123a3dd1e967e2f985868a276
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          mkezxrpkhc.sys
                                                                                                                          • Path C:\Temp\mkezxrpkhc.sys
                                                                                                                          • Size 293KB
                                                                                                                          • SHA256 c5a97181da5d39af3c7db6211a95e3455724f93946162c4902cd4da565b0f445
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          nhfzxrpkhc.exe
                                                                                                                          • Path C:\Temp\nhfzxrpkhc.exe
                                                                                                                          • Size 376KB
                                                                                                                          • SHA256 122417f9665503036f9a89325c9a1569d0c20a6b00be888da0ba6bc0b7c22beb
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          oidbztrljd.exe
                                                                                                                          • Path C:\Temp\oidbztrljd.exe
                                                                                                                          • Size 376KB
                                                                                                                          • SHA256 671585bbaff5966915085bf51daa6903658ea1592be27cb3a0b4914401653920
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          rmhbzuomhe.exe
                                                                                                                          • Path C:\Temp\rmhbzuomhe.exe
                                                                                                                          • Size 376KB
                                                                                                                          • SHA256 4d7838486892e0aa0b2a5551a21f58e50b457d077795917ee8382cec7aebd06e
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          sqkicausnkfdxvpn.exe
                                                                                                                          • Path C:\Temp\sqkicausnkfdxvpn.exe
                                                                                                                          • Size 376KB
                                                                                                                          • SHA256 d8bca7e589629bef9d187b712d90e71f1f76382e7483c64b48e7d2fb456bd339
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          sqkicausnkfdxvpn.sys
                                                                                                                          • Path C:\Temp\sqkicausnkfdxvpn.sys
                                                                                                                          • Size 293KB
                                                                                                                          • SHA256 eff3a8dc33fe83c3d938f8f53e7b5aa0c9473ba058a2c09965416392cf69b246
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          usmkfcausm.sys
                                                                                                                          • Path C:\Temp\usmkfcausm.sys
                                                                                                                          • Size 293KB
                                                                                                                          • SHA256 88253a63d9ef673467fc9b15fb5c72f3a4847de59ab3dfd4d8b5826d3d58a840
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          wrojhbztrl.sys
                                                                                                                          • Path C:\Temp\wrojhbztrl.sys
                                                                                                                          • Size 293KB
                                                                                                                          • SHA256 24592f0600304131e109b0b2b768e609e8680dcc71a221d2856abcbdd6bcf515
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          autofill_bypass_cache_forms.json
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\autofill_bypass_cache_forms.json
                                                                                                                          • Size 161B
                                                                                                                          • SHA256 f7510e38f81f8a84027304070205dd55127e3233fdf011411465ede67b5b5d92
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          edge_autofill_global_block_list.json
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\edge_autofill_global_block_list.json
                                                                                                                          • Size 6KB
                                                                                                                          • SHA256 7d3c45c8207ba69066516e51e10a2137bc4f1fce070a692e0c65225f9856e04c
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          v1FieldTypes.json
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\v1FieldTypes.json
                                                                                                                          • Size 509KB
                                                                                                                          • SHA256 611e7995ab7599a0c89f98d6c6152a42aaedf7449748109a465bb5b0badd0af2
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          settings.dat
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                          • Size 280B
                                                                                                                          • SHA256 4f20f916a46d879220b75412e974c6df37fba8f0e80e78f071a3124fdb665aee
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          settings.dat
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                          • Size 280B
                                                                                                                          • SHA256 09d43745b7beb0d2574056dfdacdb3449b786708a0b1a5f978e5c9d69f81a1ce
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          BookmarkMergedSurfaceOrdering
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
                                                                                                                          • Size 6B
                                                                                                                          • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                          Submit Download

                                                                                                                          BrowsingTopicsState
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
                                                                                                                          • Size 414B
                                                                                                                          • SHA256 3be140109dd9b3e7641117cc466b7f4fc1a407383ffd84dcbaaaae62fd4ec4be
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          SiteList-Enterprise.json
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                                                                                          • Size 2B
                                                                                                                          • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                          Submit Download

                                                                                                                          HubApps
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
                                                                                                                          • Size 106KB
                                                                                                                          • SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          Network Persistent State
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                          • Size 2KB
                                                                                                                          • SHA256 fc9c7b476aa05c18e9701efd0f82837e9a1704da49676e587c18ad81a804cb8d
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          SCT Auditing Pending Reports
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                                                          • Size 2B
                                                                                                                          • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                          Submit Download

                                                                                                                          Sdch Dictionaries
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
                                                                                                                          • Size 40B
                                                                                                                          • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                          Submit Download

                                                                                                                          Preferences
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                          • Size 16KB
                                                                                                                          • SHA256 6d740606f3f562eec5fb9bc298c67f595bb21381011a3c5cdac46f61cad8a3b6
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          Preferences
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                          • Size 15KB
                                                                                                                          • SHA256 d4cb727a869d02742eef3fde1fe81ab7b9dda8aab527214d75ca90c0ea2235bc
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          Secure Preferences
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                                                                          • Size 36KB
                                                                                                                          • SHA256 a5130726453d361219217a1a5fc9c081664301b4ec295b8d9193218f07800c11
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          sync_diagnostic.log
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                                                                          • Size 23KB
                                                                                                                          • SHA256 9773c31657b53c86c51b1f9308f09ac13101a9d3f8723baf85da416922a263ab
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          CURRENT
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
                                                                                                                          • Size 16B
                                                                                                                          • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                          Submit Download

                                                                                                                          MANIFEST-000001
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
                                                                                                                          • Size 41B
                                                                                                                          • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                          Submit Download

                                                                                                                          Local State
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                          • Size 26KB
                                                                                                                          • SHA256 d99588ed13be1c2c3c8930f763381834cc50036193c9676a80182f3e11b97a83
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          Local State
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                          • Size 27KB
                                                                                                                          • SHA256 0fa4308d1e101a5a6ae960cbcfcf588409e71b8b7174444d4374f2e66e63adeb
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          Local State
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                          • Size 27KB
                                                                                                                          • SHA256 02fa544fb00a2abf0dcd54b3fe82bdb11b14dc273b7f550961c878708275307e
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          Local State
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                          • Size 27KB
                                                                                                                          • SHA256 8e06c0fa01fd364b8c8bfc57faeced7f6ee18f01ffc6e8d6090415f8e1d6d839
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          Local State
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                          • Size 27KB
                                                                                                                          • SHA256 685532544332b12b80bed53aa0f79d445b94839ec1d7e4b410a3d0f09bb3e103
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          Local State
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                          • Size 32KB
                                                                                                                          • SHA256 20bec99e3d536b1b53de8c1327d7fea68af21209bda7222b3a3c56d45c320338
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          metadata.json
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                          • Size 2KB
                                                                                                                          • SHA256 a6a732e8c4c01a37fafaa75a3113aa393b5c52cbe40e5e0219a6598500f288d4
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          metadata.json
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                          • Size 2KB
                                                                                                                          • SHA256 69361d8b9a7ab9ec4e5d287ff7051379218257ae50e4223826a07bb988a297c5
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          metadata.json
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                          • Size 2KB
                                                                                                                          • SHA256 790882ff86df9ce27bcf30ed555c4d7b78294069054fabe841e3727c47e0e8e2
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
                                                                                                                          • Size 147KB
                                                                                                                          • SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          metadata.json
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
                                                                                                                          • Size 132B
                                                                                                                          • SHA256 54f761e00d363bd15db7bae3cc55144c80148a5fa1db7c3c2049e0e406a9142c
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          manifest.json
                                                                                                                          • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1376_1053554434\manifest.json
                                                                                                                          • Size 119B
                                                                                                                          • SHA256 7169d86e87f904218238cd293e043e20b7828afad9acd1ff2e5d64188530b9d7
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          manifest.json
                                                                                                                          • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1376_1487923722\manifest.json
                                                                                                                          • Size 177B
                                                                                                                          • SHA256 096e772e0f2e8c15e6dec9087ee0a1fb8b0c56b25061626aedc9e7e705adfc2e
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          keys.json
                                                                                                                          • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1376_1815870282\keys.json
                                                                                                                          • Size 8KB
                                                                                                                          • SHA256 ae6e69a145f84c0a261b4e82888779fbf137f193881d687588e1af71609ae947
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          manifest.json
                                                                                                                          • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1376_1815870282\manifest.json
                                                                                                                          • Size 79B
                                                                                                                          • SHA256 7ea98f2308a9c51d17a1ac71b64afbe2a41ff0a083a166a0e4cc428bf44f0715
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          memory/124-602-0x0000000000BA0000-0x0000000000BC5000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/240-644-0x0000000000860000-0x0000000000885000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/332-859-0x0000000000670000-0x0000000000695000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/420-698-0x0000000000970000-0x0000000000995000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/448-624-0x0000000000990000-0x00000000009B5000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/800-265-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/1276-755-0x0000000000B80000-0x0000000000BA5000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/1392-723-0x0000000000890000-0x00000000008B5000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/1604-656-0x0000000000970000-0x0000000000995000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/1648-93-0x0000013F06EB0000-0x0000013F06F1F000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/1648-744-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/2000-781-0x0000000000970000-0x0000000000995000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/2116-860-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/2128-782-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/2388-583-0x0000000000970000-0x0000000000995000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/2512-598-0x0000000000680000-0x00000000006A5000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/2544-224-0x0000000000830000-0x0000000000855000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/2620-637-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/2644-599-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/2680-263-0x0000000000870000-0x0000000000895000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/2756-601-0x0000000000830000-0x0000000000855000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/2920-279-0x0000000000840000-0x0000000000865000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/2960-711-0x0000000000970000-0x0000000000995000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/2972-699-0x0000000000970000-0x0000000000995000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/3012-242-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/3104-64-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/3104-226-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/3116-628-0x0000000000640000-0x0000000000665000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/3140-287-0x0000000000970000-0x0000000000995000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/3144-577-0x0000000000990000-0x00000000009B5000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/3176-538-0x0000000000970000-0x0000000000995000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/3236-863-0x0000000000B90000-0x0000000000BB5000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/3252-864-0x0000000000670000-0x0000000000695000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/3320-822-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/3328-836-0x0000000000990000-0x00000000009B5000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/3572-855-0x0000000000690000-0x00000000006B5000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/3660-645-0x0000000000680000-0x00000000006A5000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/3680-691-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/3704-746-0x0000000000670000-0x0000000000695000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/3812-537-0x0000000000880000-0x00000000008A5000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/3824-825-0x0000000000970000-0x0000000000995000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/3856-594-0x0000000000680000-0x00000000006A5000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/3868-743-0x0000000000990000-0x00000000009B5000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/3892-759-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/3904-793-0x0000000000690000-0x00000000006B5000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/3932-712-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/3984-523-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/3988-613-0x00000000005A0000-0x00000000005C5000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/4136-68-0x0000000000670000-0x0000000000695000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/4252-722-0x0000000000670000-0x0000000000695000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/4304-280-0x0000000000880000-0x00000000008A5000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/4308-614-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/4352-861-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/4352-845-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/4456-240-0x0000000000970000-0x0000000000995000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/4492-248-0x0000000000860000-0x0000000000885000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/4520-824-0x0000000000840000-0x0000000000865000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/4676-576-0x0000000000840000-0x0000000000865000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/4744-758-0x0000000000970000-0x0000000000995000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/4800-69-0x0000000000680000-0x00000000006A5000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/4812-884-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/4824-584-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/4884-690-0x0000000000B80000-0x0000000000BA5000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/4924-778-0x0000000000970000-0x0000000000995000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/4952-249-0x0000000000980000-0x00000000009A5000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/4968-547-0x0000000000980000-0x00000000009A5000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/4976-883-0x00000000005A0000-0x00000000005C5000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/5092-792-0x0000000000630000-0x0000000000655000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/5328-595-0x0000000000970000-0x0000000000995000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/5372-801-0x0000000000970000-0x0000000000995000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/5396-678-0x0000000000780000-0x00000000007A5000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/5448-225-0x0000000000970000-0x0000000000995000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/5488-676-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/5572-625-0x0000000000990000-0x00000000009B5000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/5604-856-0x00000000009B0000-0x00000000009D5000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/5660-201-0x0000000000850000-0x0000000000875000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/5824-777-0x0000000000670000-0x0000000000695000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/5900-549-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/5996-203-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/6048-679-0x0000000000600000-0x0000000000625000-memory.dmp
                                                                                                                          Download