Overview

overview

7

Static

static

3

2026-06-04...op.exe

windows10-2004-x64

7

2026-06-04...op.exe

windows11-21h2-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    127s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    04/06/2026, 12:57

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-06-04_3d15a5d13e3fc25b461be593d4b2f366_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
  • Size 722KB
  • Sample260604-p62rqsf14k
  • SHA256 13600536ae671d91fe1108cafdc878c76f1327c9f204ff2665ef261f5ac94b70
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
adwarediscoveryspyware

Malware Config

Signatures

  • Executes dropped EXE 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Gathers network information 2 TTPs 20 IoCs

    Uses commandline utility to view network configuration.

  • Modifies Internet Explorer settings 1 TTPs 29 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 20 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 19 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-06-04_3d15a5d13e3fc25b461be593d4b2f366_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-04_3d15a5d13e3fc25b461be593d4b2f366_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3528
    • C:\Temp\fcxvpnhfzxspkica.exe
      C:\Temp\fcxvpnhfzxspkica.exe run
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1396
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\snhfaukfap.exe ups_run
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:708
        • C:\Temp\snhfaukfap.exe
          C:\Temp\snhfaukfap.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:400
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:3248
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:5772
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_snhfaukfap.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:4952
        • C:\Temp\i_snhfaukfap.exe
          C:\Temp\i_snhfaukfap.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:2280
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\upmhfzxrpk.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:3112
        • C:\Temp\upmhfzxrpk.exe
          C:\Temp\upmhfzxrpk.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2084
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:2636
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:5936
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_upmhfzxrpk.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:2592
        • C:\Temp\i_upmhfzxrpk.exe
          C:\Temp\i_upmhfzxrpk.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:4780
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\kecwuomhez.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:3048
        • C:\Temp\kecwuomhez.exe
          C:\Temp\kecwuomhez.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5224
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:1216
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:4820
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_kecwuomhez.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:4936
        • C:\Temp\i_kecwuomhez.exe
          C:\Temp\i_kecwuomhez.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:4168
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\bztrmjecwu.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:1032
        • C:\Temp\bztrmjecwu.exe
          C:\Temp\bztrmjecwu.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4436
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:3948
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:1060
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_bztrmjecwu.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:3964
        • C:\Temp\i_bztrmjecwu.exe
          C:\Temp\i_bztrmjecwu.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:5600
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\rljdbwtomg.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:5160
        • C:\Temp\rljdbwtomg.exe
          C:\Temp\rljdbwtomg.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:616
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:3684
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:3208
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_rljdbwtomg.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:1688
        • C:\Temp\i_rljdbwtomg.exe
          C:\Temp\i_rljdbwtomg.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:3472
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\lgbytqljdb.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:4660
        • C:\Temp\lgbytqljdb.exe
          C:\Temp\lgbytqljdb.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1348
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:5984
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:2888
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_lgbytqljdb.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:3624
        • C:\Temp\i_lgbytqljdb.exe
          C:\Temp\i_lgbytqljdb.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:2072
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\daytnlfdxv.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:3996
        • C:\Temp\daytnlfdxv.exe
          C:\Temp\daytnlfdxv.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4608
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:5472
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:1344
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_daytnlfdxv.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:1664
        • C:\Temp\i_daytnlfdxv.exe
          C:\Temp\i_daytnlfdxv.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:5240
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\vpnifaysqk.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:3272
        • C:\Temp\vpnifaysqk.exe
          C:\Temp\vpnifaysqk.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4300
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:5096
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:4340
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_vpnifaysqk.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:1944
        • C:\Temp\i_vpnifaysqk.exe
          C:\Temp\i_vpnifaysqk.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:2204
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\fcausmkicx.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:5140
        • C:\Temp\fcausmkicx.exe
          C:\Temp\fcausmkicx.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5928
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:3440
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:3060
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_fcausmkicx.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:2400
        • C:\Temp\i_fcausmkicx.exe
          C:\Temp\i_fcausmkicx.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:1020
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\cxupnhfzxs.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:1332
        • C:\Temp\cxupnhfzxs.exe
          C:\Temp\cxupnhfzxs.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:580
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:5756
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:3916
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_cxupnhfzxs.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:5596
        • C:\Temp\i_cxupnhfzxs.exe
          C:\Temp\i_cxupnhfzxs.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:4108
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\uomhezxrpj.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:5964
        • C:\Temp\uomhezxrpj.exe
          C:\Temp\uomhezxrpj.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3912
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
              PID:4832
              • C:\windows\system32\ipconfig.exe
                C:\windows\system32\ipconfig.exe /release
                6⤵
                • Gathers network information
                PID:2864
        • C:\temp\CreateProcess.exe
          C:\temp\CreateProcess.exe C:\Temp\i_uomhezxrpj.exe ups_ins
          3⤵
            PID:5632
            • C:\Temp\i_uomhezxrpj.exe
              C:\Temp\i_uomhezxrpj.exe ups_ins
              4⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              PID:1456
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\Temp\jecwtrmjec.exe ups_run
            3⤵
              PID:3288
              • C:\Temp\jecwtrmjec.exe
                C:\Temp\jecwtrmjec.exe ups_run
                4⤵
                • System Location Discovery: System Language Discovery
                PID:4380
                • C:\temp\CreateProcess.exe
                  C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                  5⤵
                    PID:4672
                    • C:\windows\system32\ipconfig.exe
                      C:\windows\system32\ipconfig.exe /release
                      6⤵
                      • Gathers network information
                      PID:2496
              • C:\temp\CreateProcess.exe
                C:\temp\CreateProcess.exe C:\Temp\i_jecwtrmjec.exe ups_ins
                3⤵
                  PID:4856
                  • C:\Temp\i_jecwtrmjec.exe
                    C:\Temp\i_jecwtrmjec.exe ups_ins
                    4⤵
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2680
                • C:\temp\CreateProcess.exe
                  C:\temp\CreateProcess.exe C:\Temp\ztrljebwto.exe ups_run
                  3⤵
                    PID:6000
                    • C:\Temp\ztrljebwto.exe
                      C:\Temp\ztrljebwto.exe ups_run
                      4⤵
                      • System Location Discovery: System Language Discovery
                      PID:5208
                      • C:\temp\CreateProcess.exe
                        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                        5⤵
                          PID:4104
                          • C:\windows\system32\ipconfig.exe
                            C:\windows\system32\ipconfig.exe /release
                            6⤵
                            • Gathers network information
                            PID:5420
                    • C:\temp\CreateProcess.exe
                      C:\temp\CreateProcess.exe C:\Temp\i_ztrljebwto.exe ups_ins
                      3⤵
                        PID:2452
                        • C:\Temp\i_ztrljebwto.exe
                          C:\Temp\i_ztrljebwto.exe ups_ins
                          4⤵
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of AdjustPrivilegeToken
                          PID:5968
                      • C:\temp\CreateProcess.exe
                        C:\temp\CreateProcess.exe C:\Temp\ytolgdbwtr.exe ups_run
                        3⤵
                          PID:4720
                          • C:\Temp\ytolgdbwtr.exe
                            C:\Temp\ytolgdbwtr.exe ups_run
                            4⤵
                            • System Location Discovery: System Language Discovery
                            PID:4712
                            • C:\temp\CreateProcess.exe
                              C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                              5⤵
                                PID:3168
                                • C:\windows\system32\ipconfig.exe
                                  C:\windows\system32\ipconfig.exe /release
                                  6⤵
                                  • Gathers network information
                                  PID:5488
                          • C:\temp\CreateProcess.exe
                            C:\temp\CreateProcess.exe C:\Temp\i_ytolgdbwtr.exe ups_ins
                            3⤵
                              PID:452
                              • C:\Temp\i_ytolgdbwtr.exe
                                C:\Temp\i_ytolgdbwtr.exe ups_ins
                                4⤵
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of AdjustPrivilegeToken
                                PID:5428
                            • C:\temp\CreateProcess.exe
                              C:\temp\CreateProcess.exe C:\Temp\nlgdyvqoig.exe ups_run
                              3⤵
                                PID:2904
                                • C:\Temp\nlgdyvqoig.exe
                                  C:\Temp\nlgdyvqoig.exe ups_run
                                  4⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:2816
                                  • C:\temp\CreateProcess.exe
                                    C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                                    5⤵
                                      PID:3924
                                      • C:\windows\system32\ipconfig.exe
                                        C:\windows\system32\ipconfig.exe /release
                                        6⤵
                                        • Gathers network information
                                        PID:2172
                                • C:\temp\CreateProcess.exe
                                  C:\temp\CreateProcess.exe C:\Temp\i_nlgdyvqoig.exe ups_ins
                                  3⤵
                                    PID:3696
                                    • C:\Temp\i_nlgdyvqoig.exe
                                      C:\Temp\i_nlgdyvqoig.exe ups_ins
                                      4⤵
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:1340
                                  • C:\temp\CreateProcess.exe
                                    C:\temp\CreateProcess.exe C:\Temp\faysqkicav.exe ups_run
                                    3⤵
                                      PID:444
                                      • C:\Temp\faysqkicav.exe
                                        C:\Temp\faysqkicav.exe ups_run
                                        4⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:5992
                                        • C:\temp\CreateProcess.exe
                                          C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                                          5⤵
                                            PID:3588
                                            • C:\windows\system32\ipconfig.exe
                                              C:\windows\system32\ipconfig.exe /release
                                              6⤵
                                              • Gathers network information
                                              PID:2460
                                      • C:\temp\CreateProcess.exe
                                        C:\temp\CreateProcess.exe C:\Temp\i_faysqkicav.exe ups_ins
                                        3⤵
                                          PID:3024
                                          • C:\Temp\i_faysqkicav.exe
                                            C:\Temp\i_faysqkicav.exe ups_ins
                                            4⤵
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:3504
                                        • C:\temp\CreateProcess.exe
                                          C:\temp\CreateProcess.exe C:\Temp\xvpnhfaxsq.exe ups_run
                                          3⤵
                                            PID:6028
                                            • C:\Temp\xvpnhfaxsq.exe
                                              C:\Temp\xvpnhfaxsq.exe ups_run
                                              4⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:3132
                                              • C:\temp\CreateProcess.exe
                                                C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                                                5⤵
                                                  PID:2192
                                                  • C:\windows\system32\ipconfig.exe
                                                    C:\windows\system32\ipconfig.exe /release
                                                    6⤵
                                                    • Gathers network information
                                                    PID:6048
                                            • C:\temp\CreateProcess.exe
                                              C:\temp\CreateProcess.exe C:\Temp\i_xvpnhfaxsq.exe ups_ins
                                              3⤵
                                                PID:5732
                                                • C:\Temp\i_xvpnhfaxsq.exe
                                                  C:\Temp\i_xvpnhfaxsq.exe ups_ins
                                                  4⤵
                                                  • System Location Discovery: System Language Discovery
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:4956
                                              • C:\temp\CreateProcess.exe
                                                C:\temp\CreateProcess.exe C:\Temp\snkfcxvpnh.exe ups_run
                                                3⤵
                                                  PID:5100
                                                  • C:\Temp\snkfcxvpnh.exe
                                                    C:\Temp\snkfcxvpnh.exe ups_run
                                                    4⤵
                                                    • System Location Discovery: System Language Discovery
                                                    PID:4140
                                                    • C:\temp\CreateProcess.exe
                                                      C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                                                      5⤵
                                                        PID:6056
                                                        • C:\windows\system32\ipconfig.exe
                                                          C:\windows\system32\ipconfig.exe /release
                                                          6⤵
                                                          • Gathers network information
                                                          PID:4284
                                                  • C:\temp\CreateProcess.exe
                                                    C:\temp\CreateProcess.exe C:\Temp\i_snkfcxvpnh.exe ups_ins
                                                    3⤵
                                                      PID:4760
                                                      • C:\Temp\i_snkfcxvpnh.exe
                                                        C:\Temp\i_snkfcxvpnh.exe ups_ins
                                                        4⤵
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:3360
                                                    • C:\temp\CreateProcess.exe
                                                      C:\temp\CreateProcess.exe C:\Temp\kecxrpjhcz.exe ups_run
                                                      3⤵
                                                        PID:5260
                                                        • C:\Temp\kecxrpjhcz.exe
                                                          C:\Temp\kecxrpjhcz.exe ups_run
                                                          4⤵
                                                          • System Location Discovery: System Language Discovery
                                                          PID:5460
                                                          • C:\temp\CreateProcess.exe
                                                            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                                                            5⤵
                                                              PID:4868
                                                              • C:\windows\system32\ipconfig.exe
                                                                C:\windows\system32\ipconfig.exe /release
                                                                6⤵
                                                                • Gathers network information
                                                                PID:5052
                                                        • C:\temp\CreateProcess.exe
                                                          C:\temp\CreateProcess.exe C:\Temp\i_kecxrpjhcz.exe ups_ins
                                                          3⤵
                                                            PID:5912
                                                            • C:\Temp\i_kecxrpjhcz.exe
                                                              C:\Temp\i_kecxrpjhcz.exe ups_ins
                                                              4⤵
                                                              • System Location Discovery: System Language Discovery
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:3164
                                                          • C:\temp\CreateProcess.exe
                                                            C:\temp\CreateProcess.exe C:\Temp\ztrmjecwur.exe ups_run
                                                            3⤵
                                                              PID:3596
                                                              • C:\Temp\ztrmjecwur.exe
                                                                C:\Temp\ztrmjecwur.exe ups_run
                                                                4⤵
                                                                • System Location Discovery: System Language Discovery
                                                                PID:6108
                                                                • C:\temp\CreateProcess.exe
                                                                  C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                                                                  5⤵
                                                                    PID:5256
                                                                    • C:\windows\system32\ipconfig.exe
                                                                      C:\windows\system32\ipconfig.exe /release
                                                                      6⤵
                                                                      • Gathers network information
                                                                      PID:4644
                                                            • C:\Program Files\Internet Explorer\iexplore.exe
                                                              "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
                                                              2⤵
                                                              • Modifies Internet Explorer settings
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:4420
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
                                                                3⤵
                                                                • Drops file in Windows directory
                                                                • Enumerates system info in registry
                                                                • Modifies data under HKEY_USERS
                                                                • Modifies registry class
                                                                • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                • Suspicious use of FindShellTrayWindow
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:6052
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x2f4,0x7ffe169dc188,0x7ffe169dc194,0x7ffe169dc1a0
                                                                  4⤵
                                                                    PID:5644
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1816,i,12630934552744455589,3936203336859782736,524288 --field-trial-handle=2164,i,14251765407805698872,16286695858091989649,262144 --variations-seed-version --mojo-platform-channel-handle=2200 /prefetch:11
                                                                    4⤵
                                                                    • System Time Discovery
                                                                    PID:3260
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1604,i,3870193220125553257,5000640252871973351,262144 --field-trial-handle=2164,i,14251765407805698872,16286695858091989649,262144 --variations-seed-version --mojo-platform-channel-handle=2160 /prefetch:2
                                                                    4⤵
                                                                      PID:492
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2540,i,485835248049259115,303462173875361405,524288 --field-trial-handle=2164,i,14251765407805698872,16286695858091989649,262144 --variations-seed-version --mojo-platform-channel-handle=2704 /prefetch:13
                                                                      4⤵
                                                                        PID:5412
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,1616164153208860775,3029223679891382911,2097152 --field-trial-handle=2164,i,14251765407805698872,16286695858091989649,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
                                                                        4⤵
                                                                          PID:4928
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,16153633079344201738,5218868797101436721,2097152 --field-trial-handle=2164,i,14251765407805698872,16286695858091989649,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
                                                                          4⤵
                                                                            PID:3376
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4872,i,11906176478788213331,5265472927828700803,524288 --field-trial-handle=2164,i,14251765407805698872,16286695858091989649,262144 --variations-seed-version --mojo-platform-channel-handle=4908 /prefetch:14
                                                                            4⤵
                                                                              PID:4224
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4880,i,18322858941510872096,12498115991590869175,524288 --field-trial-handle=2164,i,14251765407805698872,16286695858091989649,262144 --variations-seed-version --mojo-platform-channel-handle=4932 /prefetch:14
                                                                              4⤵
                                                                                PID:5620
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5648,i,9865793849754806019,4576625105616177332,524288 --field-trial-handle=2164,i,14251765407805698872,16286695858091989649,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:14
                                                                                4⤵
                                                                                  PID:4300
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5744,i,16047539628330166873,8947609138830956766,524288 --field-trial-handle=2164,i,14251765407805698872,16286695858091989649,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:14
                                                                                  4⤵
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:5476
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
                                                                                    cookie_exporter.exe --cookie-json=1108
                                                                                    5⤵
                                                                                      PID:5884
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5648,i,9865793849754806019,4576625105616177332,524288 --field-trial-handle=2164,i,14251765407805698872,16286695858091989649,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:14
                                                                                    4⤵
                                                                                      PID:5584
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6240,i,2356011632540082192,6546140704383535590,524288 --field-trial-handle=2164,i,14251765407805698872,16286695858091989649,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:14
                                                                                      4⤵
                                                                                        PID:5968
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6228,i,4318161339738946525,16427425283254326204,524288 --field-trial-handle=2164,i,14251765407805698872,16286695858091989649,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:14
                                                                                        4⤵
                                                                                          PID:4236
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6180,i,12460041185931025243,14313518913171662223,524288 --field-trial-handle=2164,i,14251765407805698872,16286695858091989649,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:14
                                                                                          4⤵
                                                                                            PID:4840
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6296,i,13595922249096633866,18298249956890580531,524288 --field-trial-handle=2164,i,14251765407805698872,16286695858091989649,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:14
                                                                                            4⤵
                                                                                              PID:5192
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=728,i,17452339846586014860,5310246290465167896,524288 --field-trial-handle=2164,i,14251765407805698872,16286695858091989649,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:14
                                                                                              4⤵
                                                                                                PID:1128
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6200,i,1225149855842719976,10548301888914509454,524288 --field-trial-handle=2164,i,14251765407805698872,16286695858091989649,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:14
                                                                                                4⤵
                                                                                                  PID:2440
                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3040,i,2843893536427385946,1533028954542211101,524288 --field-trial-handle=2164,i,14251765407805698872,16286695858091989649,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:14
                                                                                                  4⤵
                                                                                                    PID:5344
                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6320,i,13083084515194267774,8123439727203294100,524288 --field-trial-handle=2164,i,14251765407805698872,16286695858091989649,262144 --variations-seed-version --mojo-platform-channel-handle=5016 /prefetch:14
                                                                                                    4⤵
                                                                                                      PID:4284
                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5432,i,3250157207497572296,1449724588591193330,262144 --field-trial-handle=2164,i,14251765407805698872,16286695858091989649,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:10
                                                                                                      4⤵
                                                                                                        PID:2864
                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6380,i,11157820664313901401,17386653199536425600,524288 --field-trial-handle=2164,i,14251765407805698872,16286695858091989649,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:14
                                                                                                        4⤵
                                                                                                          PID:2220
                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                                    1⤵
                                                                                                      PID:6100
                                                                                                    • C:\Temp\fcxvpnhfzxspkica.sys
                                                                                                      C:\Temp\fcxvpnhfzxspkica.sys
                                                                                                      1⤵
                                                                                                      • Executes dropped EXE
                                                                                                      PID:3244
                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
                                                                                                      1⤵
                                                                                                        PID:5928
                                                                                                      • C:\Temp\fzxupkhcau.sys
                                                                                                        C:\Temp\fzxupkhcau.sys
                                                                                                        1⤵
                                                                                                        • Executes dropped EXE
                                                                                                        PID:5220
                                                                                                      • C:\Temp\rpjhbzurmj.sys
                                                                                                        C:\Temp\rpjhbzurmj.sys
                                                                                                        1⤵
                                                                                                        • Executes dropped EXE
                                                                                                        PID:3636
                                                                                                      • C:\Temp\jhbztrljeb.sys
                                                                                                        C:\Temp\jhbztrljeb.sys
                                                                                                        1⤵
                                                                                                        • Executes dropped EXE
                                                                                                        PID:2888
                                                                                                      • C:\Temp\jeywuojgbz.sys
                                                                                                        C:\Temp\jeywuojgbz.sys
                                                                                                        1⤵
                                                                                                        • Executes dropped EXE
                                                                                                        PID:5100
                                                                                                      • C:\Temp\wqoigbytrl.sys
                                                                                                        C:\Temp\wqoigbytrl.sys
                                                                                                        1⤵
                                                                                                        • Executes dropped EXE
                                                                                                        PID:4820
                                                                                                      • C:\Temp\olgdyvqlid.sys
                                                                                                        C:\Temp\olgdyvqlid.sys
                                                                                                        1⤵
                                                                                                        • Executes dropped EXE
                                                                                                        PID:6092
                                                                                                      • C:\Temp\davtnlfdxv.sys
                                                                                                        C:\Temp\davtnlfdxv.sys
                                                                                                        1⤵
                                                                                                        • Executes dropped EXE
                                                                                                        PID:1072
                                                                                                      • C:\Temp\axsnkfdxvp.sys
                                                                                                        C:\Temp\axsnkfdxvp.sys
                                                                                                        1⤵
                                                                                                        • Executes dropped EXE
                                                                                                        PID:2080
                                                                                                      • C:\Temp\nhcausmkfc.sys
                                                                                                        C:\Temp\nhcausmkfc.sys
                                                                                                        1⤵
                                                                                                        • Executes dropped EXE
                                                                                                        PID:3340
                                                                                                      • C:\Temp\fzxrpjhczu.sys
                                                                                                        C:\Temp\fzxrpjhczu.sys
                                                                                                        1⤵
                                                                                                        • Executes dropped EXE
                                                                                                        PID:3588
                                                                                                      • C:\Temp\tomgezxroj.sys
                                                                                                        C:\Temp\tomgezxroj.sys
                                                                                                        1⤵
                                                                                                          PID:4472
                                                                                                        • C:\Temp\uomgezwrpj.sys
                                                                                                          C:\Temp\uomgezwrpj.sys
                                                                                                          1⤵
                                                                                                            PID:5480
                                                                                                          • C:\Temp\jdbwtoljeb.sys
                                                                                                            C:\Temp\jdbwtoljeb.sys
                                                                                                            1⤵
                                                                                                              PID:4516
                                                                                                            • C:\Temp\yvqoigbytq.sys
                                                                                                              C:\Temp\yvqoigbytq.sys
                                                                                                              1⤵
                                                                                                                PID:2924
                                                                                                              • C:\Temp\qoigaysqli.sys
                                                                                                                C:\Temp\qoigaysqli.sys
                                                                                                                1⤵
                                                                                                                  PID:3868
                                                                                                                • C:\Temp\snigavsnlf.sys
                                                                                                                  C:\Temp\snigavsnlf.sys
                                                                                                                  1⤵
                                                                                                                    PID:4008
                                                                                                                  • C:\Temp\zxspkicaus.sys
                                                                                                                    C:\Temp\zxspkicaus.sys
                                                                                                                    1⤵
                                                                                                                      PID:4724
                                                                                                                    • C:\Temp\usmkecxupk.sys
                                                                                                                      C:\Temp\usmkecxupk.sys
                                                                                                                      1⤵
                                                                                                                        PID:2052
                                                                                                                      • C:\Temp\jhbzurmjec.sys
                                                                                                                        C:\Temp\jhbzurmjec.sys
                                                                                                                        1⤵
                                                                                                                          PID:2656

                                                                                                                        Network

                                                                                                                              MITRE ATT&CK Enterprise v16

                                                                                                                              Replay Monitor

                                                                                                                              Loading Replay Monitor...

                                                                                                                              Downloads

                                                                                                                              CreateProcess.exe
                                                                                                                              • Path C:\Temp\CreateProcess.exe
                                                                                                                              • Size 3KB
                                                                                                                              • SHA256 c9d7d7b251f8d669316f3d598624f0bb6b3184b4a11231154c40e493c9f685c2
                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                              Submit Download

                                                                                                                              bztrmjecwu.exe
                                                                                                                              • Path C:\Temp\bztrmjecwu.exe
                                                                                                                              • Size 722KB
                                                                                                                              • SHA256 883d442cead9f1b4446c41edf93850bca78860cdfa15a4687417e11bb076b7a9
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              fcxvpnhfzxspkica.exe
                                                                                                                              • Path C:\Temp\fcxvpnhfzxspkica.exe
                                                                                                                              • Size 722KB
                                                                                                                              • SHA256 5ffdf22ef14f6c70fd455bbd87024a7429b42559a6d504410a81c9e8d0b0fed6
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              fcxvpnhfzxspkica.sys
                                                                                                                              • Path C:\Temp\fcxvpnhfzxspkica.sys
                                                                                                                              • Size 293KB
                                                                                                                              • SHA256 ecdb8f74a75aaf6585407b85fd371d861a18458387a81993bcc183b8cacbccf8
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              fzxupkhcau.sys
                                                                                                                              • Path C:\Temp\fzxupkhcau.sys
                                                                                                                              • Size 293KB
                                                                                                                              • SHA256 35f751f0664b616a321dd2b4a832c7cb864763b0516cb54359f6394f8bfcb630
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              i_bztrmjecwu.exe
                                                                                                                              • Path C:\Temp\i_bztrmjecwu.exe
                                                                                                                              • Size 722KB
                                                                                                                              • SHA256 0cfd8618ff4edac6e9b47917342e8a269ac9294fdcecf6e4b0cb7a8bf985ba60
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              i_kecwuomhez.exe
                                                                                                                              • Path C:\Temp\i_kecwuomhez.exe
                                                                                                                              • Size 722KB
                                                                                                                              • SHA256 9378373686dd31b4f328387aa373efb71cf02adcd8f0ef0be0af46bc12edf8b8
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              i_lgbytqljdb.exe
                                                                                                                              • Path C:\Temp\i_lgbytqljdb.exe
                                                                                                                              • Size 722KB
                                                                                                                              • SHA256 b34135a64beac08d97a8a3f5e0d7a390d5b9fe6ffab1d1638d07434090ba0ad7
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              i_rljdbwtomg.exe
                                                                                                                              • Path C:\Temp\i_rljdbwtomg.exe
                                                                                                                              • Size 722KB
                                                                                                                              • SHA256 0c0d3b3e519a14a7aafca8d1a4ff108b848afb9931066a31b238416de7074f05
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              i_snhfaukfap.exe
                                                                                                                              • Path C:\Temp\i_snhfaukfap.exe
                                                                                                                              • Size 722KB
                                                                                                                              • SHA256 baae6618b9ff49f8ac52b4ceae499c0f84fbab83854656edc97ab4284e9df670
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              i_upmhfzxrpk.exe
                                                                                                                              • Path C:\Temp\i_upmhfzxrpk.exe
                                                                                                                              • Size 722KB
                                                                                                                              • SHA256 c5f471e41f864528c0d3ba4331a861614c807727240ad22e27e933f428df6022
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              jeywuojgbz.sys
                                                                                                                              • Path C:\Temp\jeywuojgbz.sys
                                                                                                                              • Size 293KB
                                                                                                                              • SHA256 04f89d884a1a159a4973565f7ed1abf1978de6c994b5728e564db395b41c1294
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              jhbztrljeb.sys
                                                                                                                              • Path C:\Temp\jhbztrljeb.sys
                                                                                                                              • Size 293KB
                                                                                                                              • SHA256 61e2b476941d25d723ab0e6a044ab20d8bfe55549603e7e89a3de37dab289f5e
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              kecwuomhez.exe
                                                                                                                              • Path C:\Temp\kecwuomhez.exe
                                                                                                                              • Size 722KB
                                                                                                                              • SHA256 f829b36224c83b319c3ed31d87ba203c94b3774b7e40de6fb5a0081d3b13f75d
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              lgbytqljdb.exe
                                                                                                                              • Path C:\Temp\lgbytqljdb.exe
                                                                                                                              • Size 722KB
                                                                                                                              • SHA256 1f48de8e56584ebd60ec20c163cad443f320d6507b7e723d8553fd407ac89312
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              rljdbwtomg.exe
                                                                                                                              • Path C:\Temp\rljdbwtomg.exe
                                                                                                                              • Size 722KB
                                                                                                                              • SHA256 4644d380774cf8d9ebd0fdd475ffd2bf1a4ce10033e3c6a220e5d92422b79305
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              rpjhbzurmj.sys
                                                                                                                              • Path C:\Temp\rpjhbzurmj.sys
                                                                                                                              • Size 293KB
                                                                                                                              • SHA256 45744e5640f9da35e9e9e0a5f3fe0f8afe696a08141a25c6276ae81057aca14e
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              snhfaukfap.exe
                                                                                                                              • Path C:\Temp\snhfaukfap.exe
                                                                                                                              • Size 722KB
                                                                                                                              • SHA256 ecf26a3f03bcb3a3406241721d7abf00bf22da38839c6bc0e8ac4c7e4bf7b987
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              upmhfzxrpk.exe
                                                                                                                              • Path C:\Temp\upmhfzxrpk.exe
                                                                                                                              • Size 722KB
                                                                                                                              • SHA256 53b3389fa3bca174b533591eda0752cd0dce30be7198a58f4599a50bfd80ed59
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              wqoigbytrl.sys
                                                                                                                              • Path C:\Temp\wqoigbytrl.sys
                                                                                                                              • Size 293KB
                                                                                                                              • SHA256 18e576773862a65024599bf1cc5b965a3944d0865b3efcf35ea3b961aad9ffac
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              settings.dat
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                              • Size 280B
                                                                                                                              • SHA256 7b9dac8593d827b7b825086ba5eeec776b808b8429eb90a6b645c319ec8f1435
                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                              Submit Download

                                                                                                                              settings.dat
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                              • Size 280B
                                                                                                                              • SHA256 c17dc8315075bb661bddf6b1efa879b9a3c39af13982f986bd287f5bc861cbdf
                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                              Submit Download

                                                                                                                              BookmarkMergedSurfaceOrdering
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
                                                                                                                              • Size 6B
                                                                                                                              • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                              Submit Download

                                                                                                                              BrowsingTopicsState
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
                                                                                                                              • Size 649B
                                                                                                                              • SHA256 56b1a16a9e442f2f9246e625ffccc189d993bd1717a1a6c0d2602b2befffd046
                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                              Submit Download

                                                                                                                              SiteList-Enterprise.json
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                                                                                              • Size 2B
                                                                                                                              • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                              Submit Download

                                                                                                                              HubApps
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
                                                                                                                              • Size 106KB
                                                                                                                              • SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              1a11355e-03a2-45af-90d1-88dabeca7959.tmp
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\1a11355e-03a2-45af-90d1-88dabeca7959.tmp
                                                                                                                              • Size 40B
                                                                                                                              • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                              Submit Download

                                                                                                                              Network Persistent State
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                              • Size 2KB
                                                                                                                              • SHA256 073c1d29f9ac7a8c01c45c5613966107000b2024cb576bb2cfba63082fd18855
                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                              Submit Download

                                                                                                                              SCT Auditing Pending Reports
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                                                              • Size 2B
                                                                                                                              • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                              Submit Download

                                                                                                                              Preferences
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                              • Size 15KB
                                                                                                                              • SHA256 6cb469952b5bf9318e7519ca996fe5446a6b26b67fe560c12d97dc3c05055c92
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              Preferences
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                              • Size 16KB
                                                                                                                              • SHA256 b33a521d4328f0a844a20a808f842cd9f7f10202abe3ea1226fd05d7a0464544
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              Secure Preferences
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                                                                              • Size 36KB
                                                                                                                              • SHA256 7dd4eab46bbd4ddf4f45d9adfad9c5ad5a7a94c8be0034591d6a69bd232744e9
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              sync_diagnostic.log
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                                                                              • Size 22KB
                                                                                                                              • SHA256 8478e5de5a211e78269360e5bb62955ac0ec8e3c7a64d43661fd9e2c16a4f4b0
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              Local State
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                              • Size 24KB
                                                                                                                              • SHA256 8e28753a03637ffe1a05c0a35025ab1ee06e831795e439a08dbe793d3efab055
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              Local State
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                              • Size 27KB
                                                                                                                              • SHA256 c3d52da4f2718df5b5385cedced1497289b3484155f712e92e19f1a9544c3d93
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              Local State
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                              • Size 28KB
                                                                                                                              • SHA256 17d62bfbeacf7ee2318afe640901bf8ad8fcfd20239e9eb386dfa36a29b3fdc4
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              Local State
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                              • Size 28KB
                                                                                                                              • SHA256 81af04bf98f86979baeaa1507e33dc4b8f47690daf5fb8c29295881d73b0d931
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              Local State
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                              • Size 28KB
                                                                                                                              • SHA256 d1946b0545c4b119f3c582ca77b0ca0bd255fedc6c6047ea47d9d298202ec850
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              typosquatting_list.pb
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.6.4.1\typosquatting_list.pb
                                                                                                                              • Size 555KB
                                                                                                                              • SHA256 a2c4864e010b437f2fc6e371c334b6b37ae3d99366d7586b8b93d3f84c264c3e
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              ranked_dicts
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ZxcvbnData\3.2.0.0\ranked_dicts
                                                                                                                              • Size 865KB
                                                                                                                              • SHA256 5820d0bf9cfc363ff929492b1eb6df430039f4ac0e212a5b5411f7c2614f79d0
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              metadata.json
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                              • Size 2KB
                                                                                                                              • SHA256 1c4ee5c150a40794418733957c3946be68222a7a662f94adc765403ba8fd5de4
                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                              Submit Download

                                                                                                                              metadata.json
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                              • Size 2KB
                                                                                                                              • SHA256 9113632c613f943941972635495a78bbfc36a4ab4cf9c9f64d2e51bc3dfa0005
                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                              Submit Download

                                                                                                                              metadata.json
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                              • Size 2KB
                                                                                                                              • SHA256 c6d80be0a11a2a5c72279672eba63f12542ecffd843f32ae97e171967ec45bf1
                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                              Submit Download

                                                                                                                              d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
                                                                                                                              • Size 147KB
                                                                                                                              • SHA256 d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              metadata.json
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
                                                                                                                              • Size 132B
                                                                                                                              • SHA256 d6bb12722d8ec159af735b3270f83013e8b8e2df54df596eac54c458b11d445e
                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                              Submit Download

                                                                                                                              manifest.json
                                                                                                                              • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6052_1123750361\manifest.json
                                                                                                                              • Size 69B
                                                                                                                              • SHA256 c0622dadf4ec10ce5f4a64e3f24956b750345dcc194d0bd3ff73cfce1bf6081e
                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                              Submit Download

                                                                                                                              manifest.json
                                                                                                                              • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6052_1821473469\manifest.json
                                                                                                                              • Size 117B
                                                                                                                              • SHA256 1249e6113fdeebcd2284a0e72cb188d8624e06b03a142f8b4c4f49886b0e95ec
                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                              Submit Download

                                                                                                                              data.txt
                                                                                                                              • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6052_341084509\data.txt
                                                                                                                              • Size 146KB
                                                                                                                              • SHA256 ca6b9158b966a4245500d5ba10ea6e123b65f82a4cac4e207cdc21a96406114b
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              manifest.json
                                                                                                                              • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6052_341084509\manifest.json
                                                                                                                              • Size 53B
                                                                                                                              • SHA256 76daf0ebbaf97179fc4ab99dd6cace2b80ede8e39dd50c153e97e6649f6f5773
                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                              Submit Download

                                                                                                                              memory/1072-544-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/2052-778-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/2080-556-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/2656-782-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/2888-227-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/2888-478-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/2924-699-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/2924-669-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/3244-64-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/3340-605-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/3340-568-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/3588-593-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/3636-207-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/3636-233-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/3868-681-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/4008-703-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/4008-758-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/4472-609-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/4516-649-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/4724-749-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/4820-500-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/5100-241-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/5220-172-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/5480-635-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/6092-532-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                              Download