Overview

overview

10

Static

static

10

2026-04-17...op.exe

windows10-2004-x64

10

2026-04-17...op.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260130-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    17/04/2026, 11:10

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-04-17_d3b83a5371aff0b19a125f1ed8d16afa_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
  • Size 291KB
  • Sample260417-m91yhae16w
  • SHA256 af2d288b59b0a390d98bc08b547d1bb672a1ef42d39cd2a5e8538c6b38442c97
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwarediscoverysystexspywaretrojanupx

Malware Config

Extracted

Family

  • systex

C2

  • http://xytets.com:2345/t.asp?os=wangba8102

  • http://xytets.com:2345/ll/out.txt

  • http://xytets.com:2345/t.asp?os=home8102

Signatures

  • Family: Systex

    Systex is a trojan loader written in C++.

    trojansystex
  • UPX dump on OEP (original entry point) 64 IoCs
  • Executes dropped EXE 64 IoCs
  • UPX packed file 64 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Gathers network information 2 TTPs 19 IoCs

    Uses commandline utility to view network configuration.

  • Modifies Internet Explorer settings 1 TTPs 55 IoCs
    adwarespyware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 19 IoCs
  • Suspicious use of AdjustPrivilegeToken 19 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 60 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-04-17_d3b83a5371aff0b19a125f1ed8d16afa_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-04-17_d3b83a5371aff0b19a125f1ed8d16afa_coinminer_elex_redline-stealer_rhadamanthys_stop.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4656
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home8102
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4404
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4404 CREDAT:17410 /prefetch:2
        3⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:4740
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/ll/out.txt
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1040
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1040 CREDAT:17410 /prefetch:2
        3⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:4224
    • C:\temp\CP.exe
      C:\temp\CP.exe C:\Temp\jhcwrpjhbz.exe ups_run
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1328
      • C:\Temp\jhcwrpjhbz.exe
        C:\Temp\jhcwrpjhbz.exe ups_run
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4636
        • C:\temp\CP.exe
          C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
          4⤵
          • Executes dropped EXE
          PID:3768
          • C:\windows\system32\ipconfig.exe
            C:\windows\system32\ipconfig.exe /release
            5⤵
            • Gathers network information
            PID:2004
    • C:\temp\CP.exe
      C:\temp\CP.exe C:\Temp\i_jhcwrpjhbz.exe ups_ins
      2⤵
      • Executes dropped EXE
      PID:3004
      • C:\Temp\i_jhcwrpjhbz.exe
        C:\Temp\i_jhcwrpjhbz.exe ups_ins
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:3240
    • C:\temp\CP.exe
      C:\temp\CP.exe C:\Temp\bwuomgeywr.exe ups_run
      2⤵
      • Executes dropped EXE
      PID:4104
      • C:\Temp\bwuomgeywr.exe
        C:\Temp\bwuomgeywr.exe ups_run
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:472
        • C:\temp\CP.exe
          C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
          4⤵
          • Executes dropped EXE
          PID:444
          • C:\windows\system32\ipconfig.exe
            C:\windows\system32\ipconfig.exe /release
            5⤵
            • Gathers network information
            PID:2320
    • C:\temp\CP.exe
      C:\temp\CP.exe C:\Temp\i_bwuomgeywr.exe ups_ins
      2⤵
      • Executes dropped EXE
      PID:3244
      • C:\Temp\i_bwuomgeywr.exe
        C:\Temp\i_bwuomgeywr.exe ups_ins
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:1624
    • C:\temp\CP.exe
      C:\temp\CP.exe C:\Temp\eywqoigbyt.exe ups_run
      2⤵
      • Executes dropped EXE
      PID:4792
      • C:\Temp\eywqoigbyt.exe
        C:\Temp\eywqoigbyt.exe ups_run
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1664
        • C:\temp\CP.exe
          C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
          4⤵
          • Executes dropped EXE
          PID:4744
          • C:\windows\system32\ipconfig.exe
            C:\windows\system32\ipconfig.exe /release
            5⤵
            • Gathers network information
            PID:4052
    • C:\temp\CP.exe
      C:\temp\CP.exe C:\Temp\i_eywqoigbyt.exe ups_ins
      2⤵
      • Executes dropped EXE
      PID:3480
      • C:\Temp\i_eywqoigbyt.exe
        C:\Temp\i_eywqoigbyt.exe ups_ins
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:4508
    • C:\temp\CP.exe
      C:\temp\CP.exe C:\Temp\gaytqlidbv.exe ups_run
      2⤵
      • Executes dropped EXE
      PID:1068
      • C:\Temp\gaytqlidbv.exe
        C:\Temp\gaytqlidbv.exe ups_run
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:820
        • C:\temp\CP.exe
          C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
          4⤵
          • Executes dropped EXE
          PID:3848
          • C:\windows\system32\ipconfig.exe
            C:\windows\system32\ipconfig.exe /release
            5⤵
            • Gathers network information
            PID:3548
    • C:\temp\CP.exe
      C:\temp\CP.exe C:\Temp\i_gaytqlidbv.exe ups_ins
      2⤵
      • Executes dropped EXE
      PID:3788
      • C:\Temp\i_gaytqlidbv.exe
        C:\Temp\i_gaytqlidbv.exe ups_ins
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:5052
    • C:\temp\CP.exe
      C:\temp\CP.exe C:\Temp\tnlfdxvifa.exe ups_run
      2⤵
      • Executes dropped EXE
      PID:1004
      • C:\Temp\tnlfdxvifa.exe
        C:\Temp\tnlfdxvifa.exe ups_run
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3852
        • C:\temp\CP.exe
          C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
          4⤵
          • Executes dropped EXE
          PID:1892
          • C:\windows\system32\ipconfig.exe
            C:\windows\system32\ipconfig.exe /release
            5⤵
            • Gathers network information
            PID:3884
    • C:\temp\CP.exe
      C:\temp\CP.exe C:\Temp\i_tnlfdxvifa.exe ups_ins
      2⤵
      • Executes dropped EXE
      PID:1184
      • C:\Temp\i_tnlfdxvifa.exe
        C:\Temp\i_tnlfdxvifa.exe ups_ins
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:1292
    • C:\temp\CP.exe
      C:\temp\CP.exe C:\Temp\xvpnifaxsq.exe ups_run
      2⤵
      • Executes dropped EXE
      PID:840
      • C:\Temp\xvpnifaxsq.exe
        C:\Temp\xvpnifaxsq.exe ups_run
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2760
        • C:\temp\CP.exe
          C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
          4⤵
          • Executes dropped EXE
          PID:4112
          • C:\windows\system32\ipconfig.exe
            C:\windows\system32\ipconfig.exe /release
            5⤵
            • Gathers network information
            PID:1748
    • C:\temp\CP.exe
      C:\temp\CP.exe C:\Temp\i_xvpnifaxsq.exe ups_ins
      2⤵
      • Executes dropped EXE
      PID:3284
      • C:\Temp\i_xvpnifaxsq.exe
        C:\Temp\i_xvpnifaxsq.exe ups_ins
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:692
    • C:\temp\CP.exe
      C:\temp\CP.exe C:\Temp\usnkfcxvpn.exe ups_run
      2⤵
      • Executes dropped EXE
      PID:5092
      • C:\Temp\usnkfcxvpn.exe
        C:\Temp\usnkfcxvpn.exe ups_run
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4400
        • C:\temp\CP.exe
          C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
          4⤵
          • Executes dropped EXE
          PID:1028
          • C:\windows\system32\ipconfig.exe
            C:\windows\system32\ipconfig.exe /release
            5⤵
            • Gathers network information
            PID:1532
    • C:\temp\CP.exe
      C:\temp\CP.exe C:\Temp\i_usnkfcxvpn.exe ups_ins
      2⤵
      • Executes dropped EXE
      PID:1372
      • C:\Temp\i_usnkfcxvpn.exe
        C:\Temp\i_usnkfcxvpn.exe ups_ins
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:1636
    • C:\temp\CP.exe
      C:\temp\CP.exe C:\Temp\zxrpjhczup.exe ups_run
      2⤵
      • Executes dropped EXE
      PID:4284
      • C:\Temp\zxrpjhczup.exe
        C:\Temp\zxrpjhczup.exe ups_run
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4968
        • C:\temp\CP.exe
          C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
          4⤵
          • Executes dropped EXE
          PID:4736
          • C:\windows\system32\ipconfig.exe
            C:\windows\system32\ipconfig.exe /release
            5⤵
            • Gathers network information
            PID:1644
    • C:\temp\CP.exe
      C:\temp\CP.exe C:\Temp\i_zxrpjhczup.exe ups_ins
      2⤵
      • Executes dropped EXE
      PID:4048
      • C:\Temp\i_zxrpjhczup.exe
        C:\Temp\i_zxrpjhczup.exe ups_ins
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:4412
    • C:\temp\CP.exe
      C:\temp\CP.exe C:\Temp\jhbzurmjec.exe ups_run
      2⤵
      • Executes dropped EXE
      PID:648
      • C:\Temp\jhbzurmjec.exe
        C:\Temp\jhbzurmjec.exe ups_run
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3124
        • C:\temp\CP.exe
          C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
          4⤵
          • Executes dropped EXE
          PID:1660
          • C:\windows\system32\ipconfig.exe
            C:\windows\system32\ipconfig.exe /release
            5⤵
            • Gathers network information
            PID:1380
    • C:\temp\CP.exe
      C:\temp\CP.exe C:\Temp\i_jhbzurmjec.exe ups_ins
      2⤵
      • Executes dropped EXE
      PID:2832
      • C:\Temp\i_jhbzurmjec.exe
        C:\Temp\i_jhbzurmjec.exe ups_ins
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:4652
    • C:\temp\CP.exe
      C:\temp\CP.exe C:\Temp\zuomgeywro.exe ups_run
      2⤵
      • Executes dropped EXE
      PID:1316
      • C:\Temp\zuomgeywro.exe
        C:\Temp\zuomgeywro.exe ups_run
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2192
        • C:\temp\CP.exe
          C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
          4⤵
          • Executes dropped EXE
          PID:2432
          • C:\windows\system32\ipconfig.exe
            C:\windows\system32\ipconfig.exe /release
            5⤵
            • Gathers network information
            PID:1812
    • C:\temp\CP.exe
      C:\temp\CP.exe C:\Temp\i_zuomgeywro.exe ups_ins
      2⤵
      • Executes dropped EXE
      PID:3392
      • C:\Temp\i_zuomgeywro.exe
        C:\Temp\i_zuomgeywro.exe ups_ins
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:4044
    • C:\temp\CP.exe
      C:\temp\CP.exe C:\Temp\jgbztrljdb.exe ups_run
      2⤵
      • Executes dropped EXE
      PID:3272
      • C:\Temp\jgbztrljdb.exe
        C:\Temp\jgbztrljdb.exe ups_run
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4248
        • C:\temp\CP.exe
          C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
          4⤵
          • Executes dropped EXE
          PID:3728
          • C:\windows\system32\ipconfig.exe
            C:\windows\system32\ipconfig.exe /release
            5⤵
            • Gathers network information
            PID:2500
    • C:\temp\CP.exe
      C:\temp\CP.exe C:\Temp\i_jgbztrljdb.exe ups_ins
      2⤵
      • Executes dropped EXE
      PID:1648
      • C:\Temp\i_jgbztrljdb.exe
        C:\Temp\i_jgbztrljdb.exe ups_ins
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:3896
    • C:\temp\CP.exe
      C:\temp\CP.exe C:\Temp\tqljdbvqoi.exe ups_run
      2⤵
        PID:2064
        • C:\Temp\tqljdbvqoi.exe
          C:\Temp\tqljdbvqoi.exe ups_run
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2052
          • C:\temp\CP.exe
            C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
            4⤵
              PID:1248
              • C:\windows\system32\ipconfig.exe
                C:\windows\system32\ipconfig.exe /release
                5⤵
                • Gathers network information
                PID:1824
        • C:\temp\CP.exe
          C:\temp\CP.exe C:\Temp\i_tqljdbvqoi.exe ups_ins
          2⤵
            PID:2400
            • C:\Temp\i_tqljdbvqoi.exe
              C:\Temp\i_tqljdbvqoi.exe ups_ins
              3⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              PID:1872
          • C:\temp\CP.exe
            C:\temp\CP.exe C:\Temp\aysqkidavt.exe ups_run
            2⤵
              PID:3236
              • C:\Temp\aysqkidavt.exe
                C:\Temp\aysqkidavt.exe ups_run
                3⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:4064
                • C:\temp\CP.exe
                  C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
                  4⤵
                    PID:4972
                    • C:\windows\system32\ipconfig.exe
                      C:\windows\system32\ipconfig.exe /release
                      5⤵
                      • Gathers network information
                      PID:4652
              • C:\temp\CP.exe
                C:\temp\CP.exe C:\Temp\i_aysqkidavt.exe ups_ins
                2⤵
                  PID:4696
                  • C:\Temp\i_aysqkidavt.exe
                    C:\Temp\i_aysqkidavt.exe ups_ins
                    3⤵
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2200
                • C:\temp\CP.exe
                  C:\temp\CP.exe C:\Temp\sqkicavpni.exe ups_run
                  2⤵
                    PID:4996
                    • C:\Temp\sqkicavpni.exe
                      C:\Temp\sqkicavpni.exe ups_run
                      3⤵
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:3856
                      • C:\temp\CP.exe
                        C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
                        4⤵
                          PID:540
                          • C:\windows\system32\ipconfig.exe
                            C:\windows\system32\ipconfig.exe /release
                            5⤵
                            • Gathers network information
                            PID:2360
                    • C:\temp\CP.exe
                      C:\temp\CP.exe C:\Temp\i_sqkicavpni.exe ups_ins
                      2⤵
                        PID:2720
                        • C:\Temp\i_sqkicavpni.exe
                          C:\Temp\i_sqkicavpni.exe ups_ins
                          3⤵
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of AdjustPrivilegeToken
                          PID:1532
                      • C:\temp\CP.exe
                        C:\temp\CP.exe C:\Temp\cxvpnhfzxs.exe ups_run
                        2⤵
                          PID:696
                          • C:\Temp\cxvpnhfzxs.exe
                            C:\Temp\cxvpnhfzxs.exe ups_run
                            3⤵
                            • System Location Discovery: System Language Discovery
                            • Suspicious use of WriteProcessMemory
                            PID:2136
                            • C:\temp\CP.exe
                              C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
                              4⤵
                                PID:392
                                • C:\windows\system32\ipconfig.exe
                                  C:\windows\system32\ipconfig.exe /release
                                  5⤵
                                  • Gathers network information
                                  PID:1848
                          • C:\temp\CP.exe
                            C:\temp\CP.exe C:\Temp\i_cxvpnhfzxs.exe ups_ins
                            2⤵
                              PID:3068
                              • C:\Temp\i_cxvpnhfzxs.exe
                                C:\Temp\i_cxvpnhfzxs.exe ups_ins
                                3⤵
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of AdjustPrivilegeToken
                                PID:2180
                            • C:\temp\CP.exe
                              C:\temp\CP.exe C:\Temp\nhfzxrpkhc.exe ups_run
                              2⤵
                                PID:2012
                                • C:\Temp\nhfzxrpkhc.exe
                                  C:\Temp\nhfzxrpkhc.exe ups_run
                                  3⤵
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of WriteProcessMemory
                                  PID:4724
                                  • C:\temp\CP.exe
                                    C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
                                    4⤵
                                      PID:4468
                                      • C:\windows\system32\ipconfig.exe
                                        C:\windows\system32\ipconfig.exe /release
                                        5⤵
                                        • Gathers network information
                                        PID:4292
                                • C:\temp\CP.exe
                                  C:\temp\CP.exe C:\Temp\i_nhfzxrpkhc.exe ups_ins
                                  2⤵
                                    PID:2128
                                    • C:\Temp\i_nhfzxrpkhc.exe
                                      C:\Temp\i_nhfzxrpkhc.exe ups_ins
                                      3⤵
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:3644
                                  • C:\temp\CP.exe
                                    C:\temp\CP.exe C:\Temp\zuomhezwrp.exe ups_run
                                    2⤵
                                      PID:4432
                                      • C:\Temp\zuomhezwrp.exe
                                        C:\Temp\zuomhezwrp.exe ups_run
                                        3⤵
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious use of WriteProcessMemory
                                        PID:2892
                                        • C:\temp\CP.exe
                                          C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
                                          4⤵
                                            PID:1872
                                            • C:\windows\system32\ipconfig.exe
                                              C:\windows\system32\ipconfig.exe /release
                                              5⤵
                                              • Gathers network information
                                              PID:3840
                                      • C:\temp\CP.exe
                                        C:\temp\CP.exe C:\Temp\i_zuomhezwrp.exe ups_ins
                                        2⤵
                                          PID:1380
                                          • C:\Temp\i_zuomhezwrp.exe
                                            C:\Temp\i_zuomhezwrp.exe ups_ins
                                            3⤵
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:4216
                                        • C:\temp\CP.exe
                                          C:\temp\CP.exe C:\Temp\omgezwrpjh.exe ups_run
                                          2⤵
                                            PID:3492
                                            • C:\Temp\omgezwrpjh.exe
                                              C:\Temp\omgezwrpjh.exe ups_run
                                              3⤵
                                              • System Location Discovery: System Language Discovery
                                              • Suspicious use of WriteProcessMemory
                                              PID:4700
                                              • C:\temp\CP.exe
                                                C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
                                                4⤵
                                                  PID:520
                                                  • C:\windows\system32\ipconfig.exe
                                                    C:\windows\system32\ipconfig.exe /release
                                                    5⤵
                                                    • Gathers network information
                                                    PID:660
                                            • C:\temp\CP.exe
                                              C:\temp\CP.exe C:\Temp\i_omgezwrpjh.exe ups_ins
                                              2⤵
                                                PID:992
                                                • C:\Temp\i_omgezwrpjh.exe
                                                  C:\Temp\i_omgezwrpjh.exe ups_ins
                                                  3⤵
                                                  • System Location Discovery: System Language Discovery
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:3400
                                              • C:\temp\CP.exe
                                                C:\temp\CP.exe C:\Temp\bztrljebwu.exe ups_run
                                                2⤵
                                                  PID:4260
                                                  • C:\Temp\bztrljebwu.exe
                                                    C:\Temp\bztrljebwu.exe ups_run
                                                    3⤵
                                                    • System Location Discovery: System Language Discovery
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:632
                                                    • C:\temp\CP.exe
                                                      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
                                                      4⤵
                                                        PID:2952
                                                        • C:\windows\system32\ipconfig.exe
                                                          C:\windows\system32\ipconfig.exe /release
                                                          5⤵
                                                          • Gathers network information
                                                          PID:2440
                                                  • C:\temp\CP.exe
                                                    C:\temp\CP.exe C:\Temp\i_bztrljebwu.exe ups_ins
                                                    2⤵
                                                      PID:2332
                                                      • C:\Temp\i_bztrljebwu.exe
                                                        C:\Temp\i_bztrljebwu.exe ups_ins
                                                        3⤵
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:3896
                                                  • C:\Temp\ojgbztrlje.sys
                                                    C:\Temp\ojgbztrlje.sys
                                                    1⤵
                                                    • Executes dropped EXE
                                                    PID:4200
                                                  • C:\Temp\rlgeywqojg.sys
                                                    C:\Temp\rlgeywqojg.sys
                                                    1⤵
                                                    • Executes dropped EXE
                                                    PID:3572
                                                  • C:\Temp\ywqoigbytq.sys
                                                    C:\Temp\ywqoigbytq.sys
                                                    1⤵
                                                    • Executes dropped EXE
                                                    PID:3220
                                                  • C:\Temp\gavtnlfdyv.sys
                                                    C:\Temp\gavtnlfdyv.sys
                                                    1⤵
                                                    • Executes dropped EXE
                                                    PID:2764
                                                  • C:\Temp\lfdxvpnifa.sys
                                                    C:\Temp\lfdxvpnifa.sys
                                                    1⤵
                                                    • Executes dropped EXE
                                                    PID:3312
                                                  • C:\Temp\hcausnkfdx.sys
                                                    C:\Temp\hcausnkfdx.sys
                                                    1⤵
                                                    • Executes dropped EXE
                                                    PID:4496
                                                  • C:\Temp\pjhczusmke.sys
                                                    C:\Temp\pjhczusmke.sys
                                                    1⤵
                                                    • Executes dropped EXE
                                                    PID:3504
                                                  • C:\Temp\ecwupmhfzx.sys
                                                    C:\Temp\ecwupmhfzx.sys
                                                    1⤵
                                                    • Executes dropped EXE
                                                    PID:2316
                                                  • C:\Temp\jebwuomgez.sys
                                                    C:\Temp\jebwuomgez.sys
                                                    1⤵
                                                    • Executes dropped EXE
                                                    PID:4932
                                                  • C:\Temp\wrojgbztrl.sys
                                                    C:\Temp\wrojgbztrl.sys
                                                    1⤵
                                                    • Executes dropped EXE
                                                    PID:3680
                                                  • C:\Temp\gbytrljdbv.sys
                                                    C:\Temp\gbytrljdbv.sys
                                                    1⤵
                                                      PID:3528
                                                    • C:\Temp\ytnlgdyvqo.sys
                                                      C:\Temp\ytnlgdyvqo.sys
                                                      1⤵
                                                        PID:4688
                                                      • C:\Temp\fdxvqnigay.sys
                                                        C:\Temp\fdxvqnigay.sys
                                                        1⤵
                                                          PID:4936
                                                        • C:\Temp\pkicausnkf.sys
                                                          C:\Temp\pkicausnkf.sys
                                                          1⤵
                                                            PID:2804
                                                          • C:\Temp\xupnhfzxsp.sys
                                                            C:\Temp\xupnhfzxsp.sys
                                                            1⤵
                                                              PID:2764
                                                            • C:\Temp\upkhczusmk.sys
                                                              C:\Temp\upkhczusmk.sys
                                                              1⤵
                                                                PID:2224
                                                              • C:\Temp\bwuomgezwr.sys
                                                                C:\Temp\bwuomgezwr.sys
                                                                1⤵
                                                                  PID:3908
                                                                • C:\Temp\ojgbztrljd.sys
                                                                  C:\Temp\ojgbztrljd.sys
                                                                  1⤵
                                                                    PID:5080
                                                                  • C:\Temp\oigaytqljd.sys
                                                                    C:\Temp\oigaytqljd.sys
                                                                    1⤵
                                                                      PID:5040

                                                                    Network

                                                                          MITRE ATT&CK Enterprise v16

                                                                          Replay Monitor

                                                                          Loading Replay Monitor...

                                                                          Downloads

                                                                          CP.exe
                                                                          • Path C:\Temp\CP.exe
                                                                          • Size 4KB
                                                                          • SHA256 50b00a0816849edcc24eec9cfdd5443dbf33409ae05ee84202bfbcd00094485a
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          bwuomgeywr.exe
                                                                          • Path C:\Temp\bwuomgeywr.exe
                                                                          • Size 291KB
                                                                          • SHA256 d23022eabe162dcee7671b519ac2c46e29fb1b89621cd031701524615ea90ace
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          eywqoigbyt.exe
                                                                          • Path C:\Temp\eywqoigbyt.exe
                                                                          • Size 291KB
                                                                          • SHA256 ccd4145c49613f44de38add0efc2abb02ca942b285b41a795804eefbb588dbe4
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          gavtnlfdyv.sys
                                                                          • Path C:\Temp\gavtnlfdyv.sys
                                                                          • Size 141KB
                                                                          • SHA256 b0693686d97c401b82fa4291438d8e9e0e5053d78993d230df199a4baa73334a
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          gaytqlidbv.exe
                                                                          • Path C:\Temp\gaytqlidbv.exe
                                                                          • Size 291KB
                                                                          • SHA256 e9f81e9e13407f70b924dfdbecd7e3f8f589cf6facb0bf83877a2193e77994e8
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          hcausnkfdx.sys
                                                                          • Path C:\Temp\hcausnkfdx.sys
                                                                          • Size 141KB
                                                                          • SHA256 99b29cba852e8f8b0c578220e8b9b893745c3a1d4143cfb538147085bb4d8407
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          i_bwuomgeywr.exe
                                                                          • Path C:\Temp\i_bwuomgeywr.exe
                                                                          • Size 291KB
                                                                          • SHA256 23d8e599766b0dd09f1ea6d60f8b4f2441004f51cf1e30937d11150857d5c6f1
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          i_eywqoigbyt.exe
                                                                          • Path C:\Temp\i_eywqoigbyt.exe
                                                                          • Size 291KB
                                                                          • SHA256 0dea485889f30c35bcc5cc7e4f93341cef29b98f12dd57813eb071622dec5e1e
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          i_gaytqlidbv.exe
                                                                          • Path C:\Temp\i_gaytqlidbv.exe
                                                                          • Size 291KB
                                                                          • SHA256 04d9decf43bfbafeb4b9a2bf814f192cd2035cc3da2fb271183c23af7c3709a5
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          i_jhcwrpjhbz.exe
                                                                          • Path C:\Temp\i_jhcwrpjhbz.exe
                                                                          • Size 291KB
                                                                          • SHA256 fca9bacf60789b226cd933d1cf5137711e256d6904f2ae2b76affe8a51754094
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          i_tnlfdxvifa.exe
                                                                          • Path C:\Temp\i_tnlfdxvifa.exe
                                                                          • Size 291KB
                                                                          • SHA256 2974655af19d56367e6d334b20072a282a820d4a5ae09d7a7d50f3f97269f481
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          i_usnkfcxvpn.exe
                                                                          • Path C:\Temp\i_usnkfcxvpn.exe
                                                                          • Size 291KB
                                                                          • SHA256 7ce0c0692101862a1a56dae61404914a62633f584ff6b9f28b10d5ec5373cf3e
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          i_xvpnifaxsq.exe
                                                                          • Path C:\Temp\i_xvpnifaxsq.exe
                                                                          • Size 291KB
                                                                          • SHA256 fac90b9b8a4c35de316a56a244a648f868a5fb9396a7f77fafb8074249c9af4a
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          jhcwrpjhbz.exe
                                                                          • Path C:\Temp\jhcwrpjhbz.exe
                                                                          • Size 291KB
                                                                          • SHA256 ea0f7f6feb6b6afbc43123d7958fb087fe580b2801b6a3481da6587b669ef33a
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          lfdxvpnifa.sys
                                                                          • Path C:\Temp\lfdxvpnifa.sys
                                                                          • Size 141KB
                                                                          • SHA256 635d25eec38e0134e4acbd5aa0bfcb8297cb3160b8b24279e05a2bf49c9e3910
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          ojgbztrlje.sys
                                                                          • Path C:\Temp\ojgbztrlje.sys
                                                                          • Size 141KB
                                                                          • SHA256 811926be0724e74002a6c2c0aed2528b32fa94439c72658908306b60fa3c29e1
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          pjhczusmke.sys
                                                                          • Path C:\Temp\pjhczusmke.sys
                                                                          • Size 141KB
                                                                          • SHA256 70fa2a316a9d52e9c8da523075cd7a893f346c74a6e1808b996d58e0b0df137b
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          rlgeywqojg.sys
                                                                          • Path C:\Temp\rlgeywqojg.sys
                                                                          • Size 141KB
                                                                          • SHA256 622af0e1950db31117b32c9f4ead73b548feb17933b3c50336d6d748e66beab5
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          tnlfdxvifa.exe
                                                                          • Path C:\Temp\tnlfdxvifa.exe
                                                                          • Size 291KB
                                                                          • SHA256 8d2e009398cd699ad0e44a741a04b0847b3cd947cea8d5e00bca5519c45d03c5
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          usnkfcxvpn.exe
                                                                          • Path C:\Temp\usnkfcxvpn.exe
                                                                          • Size 291KB
                                                                          • SHA256 70ffc3a247e5feb88e5fe2c4c3e3e33e677006b7ac050a62669a29f4be1aeb87
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          xvpnifaxsq.exe
                                                                          • Path C:\Temp\xvpnifaxsq.exe
                                                                          • Size 291KB
                                                                          • SHA256 c022bc8ff5394852a5765a9b94dc9470de4119ae73aad7b1c26471092af0cd45
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          ywqoigbytq.sys
                                                                          • Path C:\Temp\ywqoigbytq.sys
                                                                          • Size 141KB
                                                                          • SHA256 567fd7caf1b864c42f76c1ce02207b25fe4b2769c6362b4e7f48f3c61bbbec27
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          zxrpjhczup.exe
                                                                          • Path C:\Temp\zxrpjhczup.exe
                                                                          • Size 291KB
                                                                          • SHA256 de9db9cd908d77c65efe77ec06adc27a8b7c1d16f76fea4ace38c8439ab5df6f
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          8A7891822FCFF127E4EADADE9757112B
                                                                          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8A7891822FCFF127E4EADADE9757112B
                                                                          • Size 246B
                                                                          • SHA256 d6f5912d4529c4e9dd6773be4c73a13408040d705b26c360577d11ad3005ca29
                                                                          • MD5 SHA1 SHA512 TLSH
                                                                          Submit Download

                                                                          RecoveryStore.{111C315C-3A4E-11F1-A84F-FA499A6DE3DE}.dat
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{111C315C-3A4E-11F1-A84F-FA499A6DE3DE}.dat
                                                                          • Size 3KB
                                                                          • SHA256 33e79203f4e53ab8cf3e260bdf52f6629ec8e1557d7f23403bf065fe3f324c8f
                                                                          • MD5 SHA1 SHA512 TLSH
                                                                          Submit Download

                                                                          RecoveryStore.{111C586C-3A4E-11F1-A84F-FA499A6DE3DE}.dat
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{111C586C-3A4E-11F1-A84F-FA499A6DE3DE}.dat
                                                                          • Size 5KB
                                                                          • SHA256 d32fa893ffbe9f8a141f0661965e27c35102659d18305cd0438c43104a8dfc24
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          suggestions[1].en-US
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\C1SB1QVV\suggestions[1].en-US
                                                                          • Size 17KB
                                                                          • SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          memory/392-242-0x0000000000410000-0x000000000048A000-memory.dmp
                                                                          Download

                                                                          memory/444-32-0x0000000000670000-0x00000000006EA000-memory.dmp
                                                                          Download

                                                                          memory/472-33-0x0000000000B20000-0x0000000000B6B000-memory.dmp
                                                                          Download

                                                                          memory/472-29-0x0000000000B20000-0x0000000000B6B000-memory.dmp
                                                                          Download

                                                                          memory/520-277-0x00000000008D0000-0x000000000094A000-memory.dmp
                                                                          Download

                                                                          memory/540-231-0x0000000000850000-0x00000000008CA000-memory.dmp
                                                                          Download

                                                                          memory/632-289-0x0000000000BB0000-0x0000000000BFB000-memory.dmp
                                                                          Download

                                                                          memory/632-287-0x0000000000BB0000-0x0000000000BFB000-memory.dmp
                                                                          Download

                                                                          memory/648-168-0x0000000000840000-0x00000000008BA000-memory.dmp
                                                                          Download

                                                                          memory/692-118-0x00000000004D0000-0x000000000051B000-memory.dmp
                                                                          Download

                                                                          memory/692-125-0x00000000004D0000-0x000000000051B000-memory.dmp
                                                                          Download

                                                                          memory/696-244-0x0000000000670000-0x00000000006EA000-memory.dmp
                                                                          Download

                                                                          memory/820-67-0x0000000000F50000-0x0000000000F9B000-memory.dmp
                                                                          Download

                                                                          memory/820-70-0x0000000000F50000-0x0000000000F9B000-memory.dmp
                                                                          Download

                                                                          memory/840-114-0x0000000000490000-0x000000000050A000-memory.dmp
                                                                          Download

                                                                          memory/992-284-0x0000000000880000-0x00000000008FA000-memory.dmp
                                                                          Download

                                                                          memory/1004-95-0x0000000000630000-0x00000000006AA000-memory.dmp
                                                                          Download

                                                                          memory/1028-135-0x0000000000410000-0x000000000048A000-memory.dmp
                                                                          Download

                                                                          memory/1068-71-0x0000000000630000-0x00000000006AA000-memory.dmp
                                                                          Download

                                                                          memory/1184-103-0x00000000005A0000-0x000000000061A000-memory.dmp
                                                                          Download

                                                                          memory/1248-209-0x0000000000890000-0x000000000090A000-memory.dmp
                                                                          Download

                                                                          memory/1292-102-0x0000000000030000-0x000000000007B000-memory.dmp
                                                                          Download

                                                                          memory/1292-100-0x0000000000030000-0x000000000007B000-memory.dmp
                                                                          Download

                                                                          memory/1316-189-0x00000000008A0000-0x000000000091A000-memory.dmp
                                                                          Download

                                                                          memory/1328-14-0x0000000000750000-0x00000000007CA000-memory.dmp
                                                                          Download

                                                                          memory/1372-145-0x0000000000630000-0x00000000006AA000-memory.dmp
                                                                          Download

                                                                          memory/1380-272-0x0000000000870000-0x00000000008EA000-memory.dmp
                                                                          Download

                                                                          memory/1532-235-0x0000000000770000-0x00000000007BB000-memory.dmp
                                                                          Download

                                                                          memory/1532-237-0x0000000000770000-0x00000000007BB000-memory.dmp
                                                                          Download

                                                                          memory/1624-41-0x0000000000460000-0x00000000004AB000-memory.dmp
                                                                          Download

                                                                          memory/1624-39-0x0000000000460000-0x00000000004AB000-memory.dmp
                                                                          Download

                                                                          memory/1636-144-0x00000000005B0000-0x00000000005FB000-memory.dmp
                                                                          Download

                                                                          memory/1636-141-0x00000000005B0000-0x00000000005FB000-memory.dmp
                                                                          Download

                                                                          memory/1648-205-0x0000000000540000-0x00000000005BA000-memory.dmp
                                                                          Download

                                                                          memory/1660-166-0x0000000000550000-0x00000000005CA000-memory.dmp
                                                                          Download

                                                                          memory/1664-48-0x0000000000F70000-0x0000000000FBB000-memory.dmp
                                                                          Download

                                                                          memory/1664-52-0x0000000000F70000-0x0000000000FBB000-memory.dmp
                                                                          Download

                                                                          memory/1872-265-0x0000000000760000-0x00000000007DA000-memory.dmp
                                                                          Download

                                                                          memory/1872-215-0x0000000000590000-0x00000000005DB000-memory.dmp
                                                                          Download

                                                                          memory/1872-213-0x0000000000590000-0x00000000005DB000-memory.dmp
                                                                          Download

                                                                          memory/1892-93-0x0000000000760000-0x00000000007DA000-memory.dmp
                                                                          Download

                                                                          memory/2012-256-0x0000000000520000-0x000000000059A000-memory.dmp
                                                                          Download

                                                                          memory/2052-208-0x0000000000AB0000-0x0000000000AFB000-memory.dmp
                                                                          Download

                                                                          memory/2052-210-0x0000000000AB0000-0x0000000000AFB000-memory.dmp
                                                                          Download

                                                                          memory/2064-211-0x0000000000880000-0x00000000008FA000-memory.dmp
                                                                          Download

                                                                          memory/2128-261-0x0000000000530000-0x00000000005AA000-memory.dmp
                                                                          Download

                                                                          memory/2136-241-0x0000000000F40000-0x0000000000F8B000-memory.dmp
                                                                          Download

                                                                          memory/2136-243-0x0000000000F40000-0x0000000000F8B000-memory.dmp
                                                                          Download

                                                                          memory/2180-246-0x0000000000960000-0x00000000009AB000-memory.dmp
                                                                          Download

                                                                          memory/2180-248-0x0000000000960000-0x00000000009AB000-memory.dmp
                                                                          Download

                                                                          memory/2192-186-0x0000000000390000-0x00000000003DB000-memory.dmp
                                                                          Download

                                                                          memory/2192-188-0x0000000000390000-0x00000000003DB000-memory.dmp
                                                                          Download

                                                                          memory/2200-224-0x0000000000100000-0x000000000014B000-memory.dmp
                                                                          Download

                                                                          memory/2200-226-0x0000000000100000-0x000000000014B000-memory.dmp
                                                                          Download

                                                                          memory/2224-262-0x0000000000010000-0x0000000000083000-memory.dmp
                                                                          Download

                                                                          memory/2224-274-0x0000000000010000-0x0000000000083000-memory.dmp
                                                                          Download

                                                                          memory/2316-163-0x0000000000010000-0x0000000000083000-memory.dmp
                                                                          Download

                                                                          memory/2332-295-0x0000000000860000-0x00000000008DA000-memory.dmp
                                                                          Download

                                                                          memory/2400-216-0x0000000000870000-0x00000000008EA000-memory.dmp
                                                                          Download

                                                                          memory/2432-187-0x0000000000890000-0x000000000090A000-memory.dmp
                                                                          Download

                                                                          memory/2720-238-0x0000000000640000-0x00000000006BA000-memory.dmp
                                                                          Download

                                                                          memory/2760-113-0x0000000000870000-0x00000000008BB000-memory.dmp
                                                                          Download

                                                                          memory/2760-110-0x0000000000870000-0x00000000008BB000-memory.dmp
                                                                          Download

                                                                          memory/2764-250-0x0000000000010000-0x0000000000083000-memory.dmp
                                                                          Download

                                                                          memory/2764-84-0x0000000000010000-0x0000000000083000-memory.dmp
                                                                          Download

                                                                          memory/2804-251-0x0000000000010000-0x0000000000083000-memory.dmp
                                                                          Download

                                                                          memory/2804-239-0x0000000000010000-0x0000000000083000-memory.dmp
                                                                          Download

                                                                          memory/2832-183-0x00000000008E0000-0x000000000095A000-memory.dmp
                                                                          Download

                                                                          memory/2892-266-0x0000000000660000-0x00000000006AB000-memory.dmp
                                                                          Download

                                                                          memory/2892-264-0x0000000000660000-0x00000000006AB000-memory.dmp
                                                                          Download

                                                                          memory/2952-288-0x0000000000410000-0x000000000048A000-memory.dmp
                                                                          Download

                                                                          memory/3004-22-0x0000000000410000-0x000000000048A000-memory.dmp
                                                                          Download

                                                                          memory/3068-249-0x0000000000890000-0x000000000090A000-memory.dmp
                                                                          Download

                                                                          memory/3124-167-0x0000000000880000-0x00000000008CB000-memory.dmp
                                                                          Download

                                                                          memory/3124-165-0x0000000000880000-0x00000000008CB000-memory.dmp
                                                                          Download

                                                                          memory/3220-63-0x0000000000010000-0x0000000000083000-memory.dmp
                                                                          Download

                                                                          memory/3236-222-0x0000000000870000-0x00000000008EA000-memory.dmp
                                                                          Download

                                                                          memory/3240-19-0x0000000000010000-0x000000000005B000-memory.dmp
                                                                          Download

                                                                          memory/3240-21-0x0000000000010000-0x000000000005B000-memory.dmp
                                                                          Download

                                                                          memory/3244-42-0x00000000004E0000-0x000000000055A000-memory.dmp
                                                                          Download

                                                                          memory/3272-200-0x00000000008B0000-0x000000000092A000-memory.dmp
                                                                          Download

                                                                          memory/3284-126-0x0000000000520000-0x000000000059A000-memory.dmp
                                                                          Download

                                                                          memory/3312-105-0x0000000000010000-0x0000000000083000-memory.dmp
                                                                          Download

                                                                          memory/3392-194-0x0000000000590000-0x000000000060A000-memory.dmp
                                                                          Download

                                                                          memory/3400-281-0x0000000000310000-0x000000000035B000-memory.dmp
                                                                          Download

                                                                          memory/3400-283-0x0000000000310000-0x000000000035B000-memory.dmp
                                                                          Download

                                                                          memory/3480-61-0x0000000000410000-0x000000000048A000-memory.dmp
                                                                          Download

                                                                          memory/3492-279-0x0000000000860000-0x00000000008DA000-memory.dmp
                                                                          Download

                                                                          memory/3504-147-0x0000000000010000-0x0000000000083000-memory.dmp
                                                                          Download

                                                                          memory/3528-206-0x0000000000010000-0x0000000000083000-memory.dmp
                                                                          Download

                                                                          memory/3572-44-0x0000000000010000-0x0000000000083000-memory.dmp
                                                                          Download

                                                                          memory/3644-258-0x0000000000B80000-0x0000000000BCB000-memory.dmp
                                                                          Download

                                                                          memory/3644-260-0x0000000000B80000-0x0000000000BCB000-memory.dmp
                                                                          Download

                                                                          memory/3680-195-0x0000000000010000-0x0000000000083000-memory.dmp
                                                                          Download

                                                                          memory/3728-198-0x00000000004E0000-0x000000000055A000-memory.dmp
                                                                          Download

                                                                          memory/3768-12-0x0000000000530000-0x00000000005AA000-memory.dmp
                                                                          Download

                                                                          memory/3788-82-0x0000000000460000-0x00000000004DA000-memory.dmp
                                                                          Download

                                                                          memory/3848-69-0x0000000000880000-0x00000000008FA000-memory.dmp
                                                                          Download

                                                                          memory/3852-90-0x0000000000AB0000-0x0000000000AFB000-memory.dmp
                                                                          Download

                                                                          memory/3852-94-0x0000000000AB0000-0x0000000000AFB000-memory.dmp
                                                                          Download

                                                                          memory/3856-230-0x00000000002C0000-0x000000000030B000-memory.dmp
                                                                          Download

                                                                          memory/3856-232-0x00000000002C0000-0x000000000030B000-memory.dmp
                                                                          Download

                                                                          memory/3896-204-0x00000000007E0000-0x000000000082B000-memory.dmp
                                                                          Download

                                                                          memory/3896-202-0x00000000007E0000-0x000000000082B000-memory.dmp
                                                                          Download

                                                                          memory/3908-273-0x0000000000010000-0x0000000000083000-memory.dmp
                                                                          Download

                                                                          memory/4044-193-0x0000000000960000-0x00000000009AB000-memory.dmp
                                                                          Download

                                                                          memory/4044-191-0x0000000000960000-0x00000000009AB000-memory.dmp
                                                                          Download

                                                                          memory/4048-162-0x0000000000760000-0x00000000007DA000-memory.dmp
                                                                          Download

                                                                          memory/4064-219-0x0000000000CC0000-0x0000000000D0B000-memory.dmp
                                                                          Download

                                                                          memory/4064-221-0x0000000000CC0000-0x0000000000D0B000-memory.dmp
                                                                          Download

                                                                          memory/4104-34-0x0000000000880000-0x00000000008FA000-memory.dmp
                                                                          Download

                                                                          memory/4112-112-0x0000000000720000-0x000000000079A000-memory.dmp
                                                                          Download

                                                                          memory/4200-25-0x0000000000010000-0x0000000000083000-memory.dmp
                                                                          Download

                                                                          memory/4216-271-0x00000000003C0000-0x000000000040B000-memory.dmp
                                                                          Download

                                                                          memory/4216-269-0x00000000003C0000-0x000000000040B000-memory.dmp
                                                                          Download

                                                                          memory/4248-199-0x0000000000760000-0x00000000007AB000-memory.dmp
                                                                          Download

                                                                          memory/4248-197-0x0000000000760000-0x00000000007AB000-memory.dmp
                                                                          Download

                                                                          memory/4260-290-0x0000000000750000-0x00000000007CA000-memory.dmp
                                                                          Download

                                                                          memory/4284-156-0x0000000000680000-0x00000000006FA000-memory.dmp
                                                                          Download

                                                                          memory/4400-136-0x0000000000890000-0x00000000008DB000-memory.dmp
                                                                          Download

                                                                          memory/4400-133-0x0000000000890000-0x00000000008DB000-memory.dmp
                                                                          Download

                                                                          memory/4412-161-0x0000000000AD0000-0x0000000000B1B000-memory.dmp
                                                                          Download

                                                                          memory/4412-159-0x0000000000AD0000-0x0000000000B1B000-memory.dmp
                                                                          Download

                                                                          memory/4432-267-0x0000000000860000-0x00000000008DA000-memory.dmp
                                                                          Download

                                                                          memory/4468-254-0x0000000000750000-0x00000000007CA000-memory.dmp
                                                                          Download

                                                                          memory/4496-128-0x0000000000010000-0x0000000000083000-memory.dmp
                                                                          Download

                                                                          memory/4508-60-0x0000000000460000-0x00000000004AB000-memory.dmp
                                                                          Download

                                                                          memory/4508-57-0x0000000000460000-0x00000000004AB000-memory.dmp
                                                                          Download

                                                                          memory/4636-9-0x0000000000190000-0x00000000001DB000-memory.dmp
                                                                          Download

                                                                          memory/4636-13-0x0000000000190000-0x00000000001DB000-memory.dmp
                                                                          Download

                                                                          memory/4652-180-0x0000000000070000-0x00000000000BB000-memory.dmp
                                                                          Download

                                                                          memory/4652-182-0x0000000000070000-0x00000000000BB000-memory.dmp
                                                                          Download

                                                                          memory/4656-23-0x00000000007E0000-0x000000000082B000-memory.dmp
                                                                          Download

                                                                          memory/4656-0-0x00000000007E0000-0x000000000082B000-memory.dmp
                                                                          Download

                                                                          memory/4688-217-0x0000000000010000-0x0000000000083000-memory.dmp
                                                                          Download

                                                                          memory/4696-227-0x0000000000460000-0x00000000004DA000-memory.dmp
                                                                          Download

                                                                          memory/4700-276-0x00000000009A0000-0x00000000009EB000-memory.dmp
                                                                          Download

                                                                          memory/4700-278-0x00000000009A0000-0x00000000009EB000-memory.dmp
                                                                          Download

                                                                          memory/4724-255-0x0000000000AE0000-0x0000000000B2B000-memory.dmp
                                                                          Download

                                                                          memory/4724-253-0x0000000000AE0000-0x0000000000B2B000-memory.dmp
                                                                          Download

                                                                          memory/4736-154-0x0000000000790000-0x000000000080A000-memory.dmp
                                                                          Download

                                                                          memory/4744-51-0x0000000000550000-0x00000000005CA000-memory.dmp
                                                                          Download

                                                                          memory/4792-53-0x00000000008A0000-0x000000000091A000-memory.dmp
                                                                          Download

                                                                          memory/4932-184-0x0000000000010000-0x0000000000083000-memory.dmp
                                                                          Download

                                                                          memory/4936-228-0x0000000000010000-0x0000000000083000-memory.dmp
                                                                          Download

                                                                          memory/4968-155-0x0000000000C10000-0x0000000000C5B000-memory.dmp
                                                                          Download

                                                                          memory/4968-152-0x0000000000C10000-0x0000000000C5B000-memory.dmp
                                                                          Download

                                                                          memory/4972-220-0x0000000000540000-0x00000000005BA000-memory.dmp
                                                                          Download

                                                                          memory/4996-233-0x0000000000520000-0x000000000059A000-memory.dmp
                                                                          Download

                                                                          memory/5052-75-0x0000000000190000-0x00000000001DB000-memory.dmp
                                                                          Download

                                                                          memory/5052-81-0x0000000000190000-0x00000000001DB000-memory.dmp
                                                                          Download

                                                                          memory/5080-285-0x0000000000010000-0x0000000000083000-memory.dmp
                                                                          Download

                                                                          memory/5092-137-0x0000000000860000-0x00000000008DA000-memory.dmp
                                                                          Download