Overview

overview

10

Static

static

10

2026-04-19...op.exe

windows10-2004-x64

10

2026-04-19...op.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260130-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    19/04/2026, 19:53

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-04-19_f8c2303f79bcc3cb6161890fad3d54a2_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
  • Size 291KB
  • Sample260419-yl78fset7t
  • SHA256 8eaafe340e48da9c71f3c14ecf48d88785a3d0e5bdd4dfe70d8c3743b48fb396
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwarediscoverysystexspywaretrojanupx

Malware Config

Extracted

Family

  • systex

C2

  • http://xytets.com:2345/t.asp?os=wangba8102

  • http://xytets.com:2345/ll/out.txt

  • http://xytets.com:2345/t.asp?os=home8102

Signatures

  • Family: Systex

    Systex is a trojan loader written in C++.

    trojansystex
  • UPX dump on OEP (original entry point) 64 IoCs
  • Executes dropped EXE 64 IoCs
  • UPX packed file 64 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • System Location Discovery: System Language Discovery 1 TTPs 44 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Gathers network information 2 TTPs 20 IoCs

    Uses commandline utility to view network configuration.

  • Modifies Internet Explorer settings 1 TTPs 54 IoCs
    adwarespyware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 19 IoCs
  • Suspicious use of AdjustPrivilegeToken 20 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-04-19_f8c2303f79bcc3cb6161890fad3d54a2_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-04-19_f8c2303f79bcc3cb6161890fad3d54a2_coinminer_elex_redline-stealer_rhadamanthys_stop.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4304
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home8102
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:5320
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5320 CREDAT:17410 /prefetch:2
        3⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:3484
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/ll/out.txt
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1292
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1292 CREDAT:17410 /prefetch:2
        3⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:4484
    • C:\temp\CP.exe
      C:\temp\CP.exe C:\Temp\vsnkfaxsqk.exe ups_run
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:4188
      • C:\Temp\vsnkfaxsqk.exe
        C:\Temp\vsnkfaxsqk.exe ups_run
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:5188
        • C:\temp\CP.exe
          C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
          4⤵
          • Executes dropped EXE
          PID:5232
          • C:\windows\system32\ipconfig.exe
            C:\windows\system32\ipconfig.exe /release
            5⤵
            • Gathers network information
            PID:1896
    • C:\temp\CP.exe
      C:\temp\CP.exe C:\Temp\i_vsnkfaxsqk.exe ups_ins
      2⤵
      • Executes dropped EXE
      PID:4132
      • C:\Temp\i_vsnkfaxsqk.exe
        C:\Temp\i_vsnkfaxsqk.exe ups_ins
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:2492
    • C:\temp\CP.exe
      C:\temp\CP.exe C:\Temp\xspkhcausm.exe ups_run
      2⤵
      • Executes dropped EXE
      PID:2008
      • C:\Temp\xspkhcausm.exe
        C:\Temp\xspkhcausm.exe ups_run
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5868
        • C:\temp\CP.exe
          C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
          4⤵
          • Executes dropped EXE
          PID:1604
          • C:\windows\system32\ipconfig.exe
            C:\windows\system32\ipconfig.exe /release
            5⤵
            • Gathers network information
            PID:2744
    • C:\temp\CP.exe
      C:\temp\CP.exe C:\Temp\i_xspkhcausm.exe ups_ins
      2⤵
      • Executes dropped EXE
      PID:1900
      • C:\Temp\i_xspkhcausm.exe
        C:\Temp\i_xspkhcausm.exe ups_ins
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:3932
    • C:\temp\CP.exe
      C:\temp\CP.exe C:\Temp\jhbzurmjec.exe ups_run
      2⤵
      • Executes dropped EXE
      PID:1992
      • C:\Temp\jhbzurmjec.exe
        C:\Temp\jhbzurmjec.exe ups_run
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5688
        • C:\temp\CP.exe
          C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
          4⤵
          • Executes dropped EXE
          PID:1272
          • C:\windows\system32\ipconfig.exe
            C:\windows\system32\ipconfig.exe /release
            5⤵
            • Gathers network information
            PID:472
    • C:\temp\CP.exe
      C:\temp\CP.exe C:\Temp\i_jhbzurmjec.exe ups_ins
      2⤵
      • Executes dropped EXE
      PID:1376
      • C:\Temp\i_jhbzurmjec.exe
        C:\Temp\i_jhbzurmjec.exe ups_ins
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:3596
    • C:\temp\CP.exe
      C:\temp\CP.exe C:\Temp\bztrljebwu.exe ups_run
      2⤵
      • Executes dropped EXE
      PID:5500
      • C:\Temp\bztrljebwu.exe
        C:\Temp\bztrljebwu.exe ups_run
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3032
        • C:\temp\CP.exe
          C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
          4⤵
          • Executes dropped EXE
          PID:3916
          • C:\windows\system32\ipconfig.exe
            C:\windows\system32\ipconfig.exe /release
            5⤵
            • Gathers network information
            PID:3192
    • C:\temp\CP.exe
      C:\temp\CP.exe C:\Temp\i_bztrljebwu.exe ups_ins
      2⤵
      • Executes dropped EXE
      PID:5332
      • C:\Temp\i_bztrljebwu.exe
        C:\Temp\i_bztrljebwu.exe ups_ins
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:5596
    • C:\temp\CP.exe
      C:\temp\CP.exe C:\Temp\wrojgbztrl.exe ups_run
      2⤵
      • Executes dropped EXE
      PID:5780
      • C:\Temp\wrojgbztrl.exe
        C:\Temp\wrojgbztrl.exe ups_run
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3456
        • C:\temp\CP.exe
          C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
          4⤵
          • Executes dropped EXE
          PID:2792
          • C:\windows\system32\ipconfig.exe
            C:\windows\system32\ipconfig.exe /release
            5⤵
            • Gathers network information
            PID:224
    • C:\temp\CP.exe
      C:\temp\CP.exe C:\Temp\i_wrojgbztrl.exe ups_ins
      2⤵
      • Executes dropped EXE
      PID:2540
      • C:\Temp\i_wrojgbztrl.exe
        C:\Temp\i_wrojgbztrl.exe ups_ins
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:3660
    • C:\temp\CP.exe
      C:\temp\CP.exe C:\Temp\lgeywqoigb.exe ups_run
      2⤵
      • Executes dropped EXE
      PID:908
      • C:\Temp\lgeywqoigb.exe
        C:\Temp\lgeywqoigb.exe ups_run
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1952
        • C:\temp\CP.exe
          C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
          4⤵
          • Executes dropped EXE
          PID:1084
          • C:\windows\system32\ipconfig.exe
            C:\windows\system32\ipconfig.exe /release
            5⤵
            • Gathers network information
            PID:3448
    • C:\temp\CP.exe
      C:\temp\CP.exe C:\Temp\i_lgeywqoigb.exe ups_ins
      2⤵
      • Executes dropped EXE
      PID:2340
      • C:\Temp\i_lgeywqoigb.exe
        C:\Temp\i_lgeywqoigb.exe ups_ins
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:5160
    • C:\temp\CP.exe
      C:\temp\CP.exe C:\Temp\vtnlgdyvqo.exe ups_run
      2⤵
      • Executes dropped EXE
      PID:2152
      • C:\Temp\vtnlgdyvqo.exe
        C:\Temp\vtnlgdyvqo.exe ups_run
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3944
        • C:\temp\CP.exe
          C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
          4⤵
          • Executes dropped EXE
          PID:2512
          • C:\windows\system32\ipconfig.exe
            C:\windows\system32\ipconfig.exe /release
            5⤵
            • Gathers network information
            PID:4964
    • C:\temp\CP.exe
      C:\temp\CP.exe C:\Temp\i_vtnlgdyvqo.exe ups_ins
      2⤵
      • Executes dropped EXE
      PID:1264
      • C:\Temp\i_vtnlgdyvqo.exe
        C:\Temp\i_vtnlgdyvqo.exe ups_ins
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:1040
    • C:\temp\CP.exe
      C:\temp\CP.exe C:\Temp\xsqkidavsn.exe ups_run
      2⤵
      • Executes dropped EXE
      PID:3224
      • C:\Temp\xsqkidavsn.exe
        C:\Temp\xsqkidavsn.exe ups_run
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2532
        • C:\temp\CP.exe
          C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
          4⤵
          • Executes dropped EXE
          PID:2072
          • C:\windows\system32\ipconfig.exe
            C:\windows\system32\ipconfig.exe /release
            5⤵
            • Gathers network information
            PID:5952
    • C:\temp\CP.exe
      C:\temp\CP.exe C:\Temp\i_xsqkidavsn.exe ups_ins
      2⤵
      • Executes dropped EXE
      PID:5944
      • C:\Temp\i_xsqkidavsn.exe
        C:\Temp\i_xsqkidavsn.exe ups_ins
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:5252
    • C:\temp\CP.exe
      C:\temp\CP.exe C:\Temp\qkicavsnkx.exe ups_run
      2⤵
      • Executes dropped EXE
      PID:4104
      • C:\Temp\qkicavsnkx.exe
        C:\Temp\qkicavsnkx.exe ups_run
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5888
        • C:\temp\CP.exe
          C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
          4⤵
          • Executes dropped EXE
          PID:5820
          • C:\windows\system32\ipconfig.exe
            C:\windows\system32\ipconfig.exe /release
            5⤵
            • Gathers network information
            PID:724
    • C:\temp\CP.exe
      C:\temp\CP.exe C:\Temp\i_qkicavsnkx.exe ups_ins
      2⤵
      • Executes dropped EXE
      PID:1412
      • C:\Temp\i_qkicavsnkx.exe
        C:\Temp\i_qkicavsnkx.exe ups_ins
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:3980
    • C:\temp\CP.exe
      C:\temp\CP.exe C:\Temp\fzxspkicau.exe ups_run
      2⤵
      • Executes dropped EXE
      PID:5372
      • C:\Temp\fzxspkicau.exe
        C:\Temp\fzxspkicau.exe ups_run
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2408
        • C:\temp\CP.exe
          C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
          4⤵
          • Executes dropped EXE
          PID:3912
          • C:\windows\system32\ipconfig.exe
            C:\windows\system32\ipconfig.exe /release
            5⤵
            • Gathers network information
            PID:3696
    • C:\temp\CP.exe
      C:\temp\CP.exe C:\Temp\i_fzxspkicau.exe ups_ins
      2⤵
      • Executes dropped EXE
      PID:644
      • C:\Temp\i_fzxspkicau.exe
        C:\Temp\i_fzxspkicau.exe ups_ins
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:1816
    • C:\temp\CP.exe
      C:\temp\CP.exe C:\Temp\usmkecwupm.exe ups_run
      2⤵
      • Executes dropped EXE
      PID:3984
      • C:\Temp\usmkecwupm.exe
        C:\Temp\usmkecwupm.exe ups_run
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2284
        • C:\temp\CP.exe
          C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
          4⤵
          • Executes dropped EXE
          PID:5284
          • C:\windows\system32\ipconfig.exe
            C:\windows\system32\ipconfig.exe /release
            5⤵
            • Gathers network information
            PID:5612
    • C:\temp\CP.exe
      C:\temp\CP.exe C:\Temp\i_usmkecwupm.exe ups_ins
      2⤵
      • Executes dropped EXE
      PID:5464
      • C:\Temp\i_usmkecwupm.exe
        C:\Temp\i_usmkecwupm.exe ups_ins
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:5456
    • C:\temp\CP.exe
      C:\temp\CP.exe C:\Temp\jhbzuomgez.exe ups_run
      2⤵
        PID:5400
        • C:\Temp\jhbzuomgez.exe
          C:\Temp\jhbzuomgez.exe ups_run
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3040
          • C:\temp\CP.exe
            C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
            4⤵
              PID:5604
              • C:\windows\system32\ipconfig.exe
                C:\windows\system32\ipconfig.exe /release
                5⤵
                • Gathers network information
                PID:1392
        • C:\temp\CP.exe
          C:\temp\CP.exe C:\Temp\i_jhbzuomgez.exe ups_ins
          2⤵
            PID:3492
            • C:\Temp\i_jhbzuomgez.exe
              C:\Temp\i_jhbzuomgez.exe ups_ins
              3⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              PID:3352
          • C:\temp\CP.exe
            C:\temp\CP.exe C:\Temp\jebwuomger.exe ups_run
            2⤵
              PID:2280
              • C:\Temp\jebwuomger.exe
                C:\Temp\jebwuomger.exe ups_run
                3⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:1176
                • C:\temp\CP.exe
                  C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
                  4⤵
                    PID:832
                    • C:\windows\system32\ipconfig.exe
                      C:\windows\system32\ipconfig.exe /release
                      5⤵
                      • Gathers network information
                      PID:2096
              • C:\temp\CP.exe
                C:\temp\CP.exe C:\Temp\i_jebwuomger.exe ups_ins
                2⤵
                  PID:3308
                  • C:\Temp\i_jebwuomger.exe
                    C:\Temp\i_jebwuomger.exe ups_ins
                    3⤵
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3996
                • C:\temp\CP.exe
                  C:\temp\CP.exe C:\Temp\wqoigbytrl.exe ups_run
                  2⤵
                    PID:6020
                    • C:\Temp\wqoigbytrl.exe
                      C:\Temp\wqoigbytrl.exe ups_run
                      3⤵
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:2708
                      • C:\temp\CP.exe
                        C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
                        4⤵
                          PID:4964
                          • C:\windows\system32\ipconfig.exe
                            C:\windows\system32\ipconfig.exe /release
                            5⤵
                            • Gathers network information
                            PID:1908
                    • C:\temp\CP.exe
                      C:\temp\CP.exe C:\Temp\i_wqoigbytrl.exe ups_ins
                      2⤵
                        PID:5148
                        • C:\Temp\i_wqoigbytrl.exe
                          C:\Temp\i_wqoigbytrl.exe ups_ins
                          3⤵
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of AdjustPrivilegeToken
                          PID:3544
                      • C:\temp\CP.exe
                        C:\temp\CP.exe C:\Temp\ljdbvtnlgd.exe ups_run
                        2⤵
                          PID:4800
                          • C:\Temp\ljdbvtnlgd.exe
                            C:\Temp\ljdbvtnlgd.exe ups_run
                            3⤵
                            • System Location Discovery: System Language Discovery
                            • Suspicious use of WriteProcessMemory
                            PID:5952
                            • C:\temp\CP.exe
                              C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
                              4⤵
                                PID:5044
                                • C:\windows\system32\ipconfig.exe
                                  C:\windows\system32\ipconfig.exe /release
                                  5⤵
                                  • Gathers network information
                                  PID:3560
                          • C:\temp\CP.exe
                            C:\temp\CP.exe C:\Temp\i_ljdbvtnlgd.exe ups_ins
                            2⤵
                              PID:5252
                              • C:\Temp\i_ljdbvtnlgd.exe
                                C:\Temp\i_ljdbvtnlgd.exe ups_ins
                                3⤵
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of AdjustPrivilegeToken
                                PID:5424
                            • C:\temp\CP.exe
                              C:\temp\CP.exe C:\Temp\davtnlfdyv.exe ups_run
                              2⤵
                                PID:1112
                                • C:\Temp\davtnlfdyv.exe
                                  C:\Temp\davtnlfdyv.exe ups_run
                                  3⤵
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of WriteProcessMemory
                                  PID:5184
                                  • C:\temp\CP.exe
                                    C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
                                    4⤵
                                      PID:4524
                                      • C:\windows\system32\ipconfig.exe
                                        C:\windows\system32\ipconfig.exe /release
                                        5⤵
                                        • Gathers network information
                                        PID:2180
                                • C:\temp\CP.exe
                                  C:\temp\CP.exe C:\Temp\i_davtnlfdyv.exe ups_ins
                                  2⤵
                                    PID:4348
                                    • C:\Temp\i_davtnlfdyv.exe
                                      C:\Temp\i_davtnlfdyv.exe ups_ins
                                      3⤵
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:1964
                                  • C:\temp\CP.exe
                                    C:\temp\CP.exe C:\Temp\xvpnifankf.exe ups_run
                                    2⤵
                                      PID:3804
                                      • C:\Temp\xvpnifankf.exe
                                        C:\Temp\xvpnifankf.exe ups_run
                                        3⤵
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious use of WriteProcessMemory
                                        PID:1772
                                        • C:\temp\CP.exe
                                          C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
                                          4⤵
                                            PID:4676
                                            • C:\windows\system32\ipconfig.exe
                                              C:\windows\system32\ipconfig.exe /release
                                              5⤵
                                              • Gathers network information
                                              PID:5968
                                      • C:\temp\CP.exe
                                        C:\temp\CP.exe C:\Temp\i_xvpnifankf.exe ups_ins
                                        2⤵
                                          PID:5872
                                          • C:\Temp\i_xvpnifankf.exe
                                            C:\Temp\i_xvpnifankf.exe ups_ins
                                            3⤵
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:3784
                                        • C:\temp\CP.exe
                                          C:\temp\CP.exe C:\Temp\mkfcxvpnhf.exe ups_run
                                          2⤵
                                            PID:3608
                                            • C:\Temp\mkfcxvpnhf.exe
                                              C:\Temp\mkfcxvpnhf.exe ups_run
                                              3⤵
                                              • System Location Discovery: System Language Discovery
                                              • Suspicious use of WriteProcessMemory
                                              PID:5580
                                              • C:\temp\CP.exe
                                                C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
                                                4⤵
                                                  PID:5764
                                                  • C:\windows\system32\ipconfig.exe
                                                    C:\windows\system32\ipconfig.exe /release
                                                    5⤵
                                                    • Gathers network information
                                                    PID:5452
                                            • C:\temp\CP.exe
                                              C:\temp\CP.exe C:\Temp\i_mkfcxvpnhf.exe ups_ins
                                              2⤵
                                                PID:388
                                                • C:\Temp\i_mkfcxvpnhf.exe
                                                  C:\Temp\i_mkfcxvpnhf.exe ups_ins
                                                  3⤵
                                                  • System Location Discovery: System Language Discovery
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:5456
                                              • C:\temp\CP.exe
                                                C:\temp\CP.exe C:\Temp\czusmkecwu.exe ups_run
                                                2⤵
                                                  PID:1588
                                                  • C:\Temp\czusmkecwu.exe
                                                    C:\Temp\czusmkecwu.exe ups_run
                                                    3⤵
                                                    • System Location Discovery: System Language Discovery
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:1960
                                                    • C:\temp\CP.exe
                                                      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
                                                      4⤵
                                                        PID:1392
                                                        • C:\windows\system32\ipconfig.exe
                                                          C:\windows\system32\ipconfig.exe /release
                                                          5⤵
                                                          • Gathers network information
                                                          PID:2500
                                                  • C:\temp\CP.exe
                                                    C:\temp\CP.exe C:\Temp\i_czusmkecwu.exe ups_ins
                                                    2⤵
                                                      PID:3500
                                                      • C:\Temp\i_czusmkecwu.exe
                                                        C:\Temp\i_czusmkecwu.exe ups_ins
                                                        3⤵
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:4508
                                                    • C:\temp\CP.exe
                                                      C:\temp\CP.exe C:\Temp\wrpjhbzurm.exe ups_run
                                                      2⤵
                                                        PID:2356
                                                        • C:\Temp\wrpjhbzurm.exe
                                                          C:\Temp\wrpjhbzurm.exe ups_run
                                                          3⤵
                                                          • System Location Discovery: System Language Discovery
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:5484
                                                          • C:\temp\CP.exe
                                                            C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
                                                            4⤵
                                                              PID:4072
                                                              • C:\windows\system32\ipconfig.exe
                                                                C:\windows\system32\ipconfig.exe /release
                                                                5⤵
                                                                • Gathers network information
                                                                PID:2100
                                                        • C:\temp\CP.exe
                                                          C:\temp\CP.exe C:\Temp\i_wrpjhbzurm.exe ups_ins
                                                          2⤵
                                                            PID:5652
                                                            • C:\Temp\i_wrpjhbzurm.exe
                                                              C:\Temp\i_wrpjhbzurm.exe ups_ins
                                                              3⤵
                                                              • System Location Discovery: System Language Discovery
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:1060
                                                        • C:\Temp\hfzxspkica.sys
                                                          C:\Temp\hfzxspkica.sys
                                                          1⤵
                                                          • Executes dropped EXE
                                                          PID:3956
                                                        • C:\Temp\xrpjhczusm.sys
                                                          C:\Temp\xrpjhczusm.sys
                                                          1⤵
                                                          • Executes dropped EXE
                                                          PID:4140
                                                        • C:\Temp\wrpjhbzurm.sys
                                                          C:\Temp\wrpjhbzurm.sys
                                                          1⤵
                                                          • Executes dropped EXE
                                                          PID:4136
                                                        • C:\Temp\geywrojgbz.sys
                                                          C:\Temp\geywrojgbz.sys
                                                          1⤵
                                                          • Executes dropped EXE
                                                          PID:5452
                                                        • C:\Temp\tqljdbvtol.sys
                                                          C:\Temp\tqljdbvtol.sys
                                                          1⤵
                                                          • Executes dropped EXE
                                                          PID:1892
                                                        • C:\Temp\igaysqlidb.sys
                                                          C:\Temp\igaysqlidb.sys
                                                          1⤵
                                                          • Executes dropped EXE
                                                          PID:4428
                                                        • C:\Temp\snlfdxvqni.sys
                                                          C:\Temp\snlfdxvqni.sys
                                                          1⤵
                                                          • Executes dropped EXE
                                                          PID:5852
                                                        • C:\Temp\avsnkfdxvp.sys
                                                          C:\Temp\avsnkfdxvp.sys
                                                          1⤵
                                                          • Executes dropped EXE
                                                          PID:5940
                                                        • C:\Temp\mkfcxupnhf.sys
                                                          C:\Temp\mkfcxupnhf.sys
                                                          1⤵
                                                          • Executes dropped EXE
                                                          PID:4136
                                                        • C:\Temp\ecwupmhfzx.sys
                                                          C:\Temp\ecwupmhfzx.sys
                                                          1⤵
                                                          • Executes dropped EXE
                                                          PID:1324
                                                        • C:\Temp\fzxrpjhczu.sys
                                                          C:\Temp\fzxrpjhczu.sys
                                                          1⤵
                                                            PID:2732
                                                          • C:\Temp\rpjhbztrmj.sys
                                                            C:\Temp\rpjhbztrmj.sys
                                                            1⤵
                                                              PID:5484
                                                            • C:\Temp\geywqojgby.sys
                                                              C:\Temp\geywqojgby.sys
                                                              1⤵
                                                                PID:4660
                                                              • C:\Temp\ytnlgdywqo.sys
                                                                C:\Temp\ytnlgdywqo.sys
                                                                1⤵
                                                                  PID:5644
                                                                • C:\Temp\vtnlgdyvqo.sys
                                                                  C:\Temp\vtnlgdyvqo.sys
                                                                  1⤵
                                                                    PID:6048
                                                                  • C:\Temp\lfdxvqnifa.sys
                                                                    C:\Temp\lfdxvqnifa.sys
                                                                    1⤵
                                                                      PID:5912
                                                                    • C:\Temp\ausnkfdxvp.sys
                                                                      C:\Temp\ausnkfdxvp.sys
                                                                      1⤵
                                                                        PID:560
                                                                      • C:\Temp\mkecwupmhf.sys
                                                                        C:\Temp\mkecwupmhf.sys
                                                                        1⤵
                                                                          PID:2868
                                                                        • C:\Temp\pmhfzxrpjh.sys
                                                                          C:\Temp\pmhfzxrpjh.sys
                                                                          1⤵
                                                                            PID:3352

                                                                          Network

                                                                                MITRE ATT&CK Enterprise v16

                                                                                Replay Monitor

                                                                                Loading Replay Monitor...

                                                                                Downloads

                                                                                CP.exe
                                                                                • Path C:\Temp\CP.exe
                                                                                • Size 4KB
                                                                                • SHA256 50b00a0816849edcc24eec9cfdd5443dbf33409ae05ee84202bfbcd00094485a
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                bztrljebwu.exe
                                                                                • Path C:\Temp\bztrljebwu.exe
                                                                                • Size 291KB
                                                                                • SHA256 4fa843eec21dfd50e754e4d3a754a32ceabbcfba8da25ec862c72f25a0cc3f8d
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                geywrojgbz.sys
                                                                                • Path C:\Temp\geywrojgbz.sys
                                                                                • Size 141KB
                                                                                • SHA256 aca5b218a6bfc4bc01ddd1b47516e7fae585f709b38e884ad22b7a3079c3f5b8
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                hfzxspkica.sys
                                                                                • Path C:\Temp\hfzxspkica.sys
                                                                                • Size 141KB
                                                                                • SHA256 ebeb0731adcfcd0fc4af8ffcf778a711d7809b7f31fa0234fca121fd52d8e2fb
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                i_bztrljebwu.exe
                                                                                • Path C:\Temp\i_bztrljebwu.exe
                                                                                • Size 291KB
                                                                                • SHA256 0eb13bd6b69e8ca0bc53a65a687598024856ef3fabcb8640fc4914cba4bf2d73
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                i_jhbzurmjec.exe
                                                                                • Path C:\Temp\i_jhbzurmjec.exe
                                                                                • Size 291KB
                                                                                • SHA256 e6524a537c0a4ce6d577336e4557de9c1b499eaaa2542d25b7998403316dd861
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                i_lgeywqoigb.exe
                                                                                • Path C:\Temp\i_lgeywqoigb.exe
                                                                                • Size 291KB
                                                                                • SHA256 3bd00e241057cd56e68a8504c9fd5021f5bb6e0c39b1ff8d1a51518e365b3886
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                i_vsnkfaxsqk.exe
                                                                                • Path C:\Temp\i_vsnkfaxsqk.exe
                                                                                • Size 291KB
                                                                                • SHA256 a26bbebc6aaa1719ae06ae1ff0c0e1943e3f4cd600e0d7aa40d956949f42c66b
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                i_vtnlgdyvqo.exe
                                                                                • Path C:\Temp\i_vtnlgdyvqo.exe
                                                                                • Size 291KB
                                                                                • SHA256 731b6ff2a9b5b687066aad619e770f28b0504b9f3074ab759efe857c3f10c21d
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                i_wrojgbztrl.exe
                                                                                • Path C:\Temp\i_wrojgbztrl.exe
                                                                                • Size 291KB
                                                                                • SHA256 d24addebe695baf9ccd2c4e72c04db4817f2ada1122399ae7041f2edbb753af7
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                i_xspkhcausm.exe
                                                                                • Path C:\Temp\i_xspkhcausm.exe
                                                                                • Size 291KB
                                                                                • SHA256 49f78caad60721c82ee6d97a77d7fe9db7834aaec264f7e5a0677cda0f8ad458
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                igaysqlidb.sys
                                                                                • Path C:\Temp\igaysqlidb.sys
                                                                                • Size 141KB
                                                                                • SHA256 31f0cda7ccafb84833fc4c8e0d2340a4764b70605f8424555cce22f1b5f7fef1
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                jhbzurmjec.exe
                                                                                • Path C:\Temp\jhbzurmjec.exe
                                                                                • Size 291KB
                                                                                • SHA256 679d08605fe84388e9610d55673604ff1157fcad4079957f063ea65c5f43b075
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                lgeywqoigb.exe
                                                                                • Path C:\Temp\lgeywqoigb.exe
                                                                                • Size 291KB
                                                                                • SHA256 7ce03824744c2df380556d73016d1b1cb2a279813410ac69cc8588669934aa16
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                snlfdxvqni.sys
                                                                                • Path C:\Temp\snlfdxvqni.sys
                                                                                • Size 141KB
                                                                                • SHA256 9eaa0cdc80d0a10d57c917e5edf54f0930272b844c1ed5e9d74e4b1f62968405
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                tqljdbvtol.sys
                                                                                • Path C:\Temp\tqljdbvtol.sys
                                                                                • Size 141KB
                                                                                • SHA256 f56f957007bb1070a45d6d45d43f535177329210fd1a5c65d0b7ec3acde365fb
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                vsnkfaxsqk.exe
                                                                                • Path C:\Temp\vsnkfaxsqk.exe
                                                                                • Size 291KB
                                                                                • SHA256 8f4735dc95bdd0b644a88e0f36c2e73c12ce4ac4a47d909e5f7a2bae41901606
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                vtnlgdyvqo.exe
                                                                                • Path C:\Temp\vtnlgdyvqo.exe
                                                                                • Size 291KB
                                                                                • SHA256 5bd86bd3388afb2119909e9a97dfc69c636d428c1d830d44e6221b14c30015b8
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                wrojgbztrl.exe
                                                                                • Path C:\Temp\wrojgbztrl.exe
                                                                                • Size 291KB
                                                                                • SHA256 84df80171d6fa57a73e2f99a54400fe92f3d2b8585306472a03447dc09a4109d
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                wrpjhbzurm.sys
                                                                                • Path C:\Temp\wrpjhbzurm.sys
                                                                                • Size 141KB
                                                                                • SHA256 d013f5b4529084c49fd76247cafe09e60922e2bc1be4f1d72f542b607fa45812
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                xrpjhczusm.sys
                                                                                • Path C:\Temp\xrpjhczusm.sys
                                                                                • Size 141KB
                                                                                • SHA256 c5bf8ccf09569fa9fb4947dfc7d5680ccc005ea144969549bebb7a4b3181bed2
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                xspkhcausm.exe
                                                                                • Path C:\Temp\xspkhcausm.exe
                                                                                • Size 291KB
                                                                                • SHA256 3cca5b6609ea7e15ae6df7c72e82ff6306733878700350ed872866397837aa82
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
                                                                                • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
                                                                                • Size 471B
                                                                                • SHA256 4f410233f8b83b34f2032a2a0e04809460a9aca36a9e349fa91b4383126e3c56
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
                                                                                • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
                                                                                • Size 416B
                                                                                • SHA256 893a16444c213376a9b05086872f4173a06b038baf45bc708af9845530226938
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
                                                                                • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
                                                                                • Size 416B
                                                                                • SHA256 0ddc3577fd7dd13f8034cc3757edf3c631307f79c6a4ee652587e5c4c9e2395f
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                RecoveryStore.{723FB4A3-3C29-11F1-A918-C67DC819AE91}.dat
                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{723FB4A3-3C29-11F1-A918-C67DC819AE91}.dat
                                                                                • Size 3KB
                                                                                • SHA256 70a0fe9a8cc4fe1c08d9a78f24b59ae37602b198cebc80c10668e33278940fce
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                RecoveryStore.{724219DE-3C29-11F1-A918-C67DC819AE91}.dat
                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{724219DE-3C29-11F1-A918-C67DC819AE91}.dat
                                                                                • Size 5KB
                                                                                • SHA256 3e92bc01aae3f7381780067205db2f05544c695aa99ebb1cc6c8ad8cfc78227a
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                suggestions[1].en-US
                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\YGIM0760\suggestions[1].en-US
                                                                                • Size 17KB
                                                                                • SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                memory/388-291-0x0000000000810000-0x00000000008CF000-memory.dmp
                                                                                Download

                                                                                memory/560-281-0x0000000000010000-0x0000000000083000-memory.dmp
                                                                                Download

                                                                                memory/644-203-0x0000000000650000-0x000000000070F000-memory.dmp
                                                                                Download

                                                                                memory/832-229-0x00000000007D0000-0x000000000088F000-memory.dmp
                                                                                Download

                                                                                memory/908-127-0x0000000000880000-0x000000000093F000-memory.dmp
                                                                                Download

                                                                                memory/1040-157-0x0000000000FC0000-0x000000000100B000-memory.dmp
                                                                                Download

                                                                                memory/1040-154-0x0000000000FC0000-0x000000000100B000-memory.dmp
                                                                                Download

                                                                                memory/1084-125-0x0000000000460000-0x000000000051F000-memory.dmp
                                                                                Download

                                                                                memory/1112-264-0x0000000000890000-0x000000000094F000-memory.dmp
                                                                                Download

                                                                                memory/1176-228-0x0000000000C00000-0x0000000000C4B000-memory.dmp
                                                                                Download

                                                                                memory/1176-230-0x0000000000C00000-0x0000000000C4B000-memory.dmp
                                                                                Download

                                                                                memory/1264-158-0x0000000000640000-0x00000000006FF000-memory.dmp
                                                                                Download

                                                                                memory/1272-56-0x00000000007A0000-0x000000000085F000-memory.dmp
                                                                                Download

                                                                                memory/1324-204-0x0000000000010000-0x0000000000083000-memory.dmp
                                                                                Download

                                                                                memory/1376-66-0x0000000000850000-0x000000000090F000-memory.dmp
                                                                                Download

                                                                                memory/1392-295-0x00000000008C0000-0x000000000097F000-memory.dmp
                                                                                Download

                                                                                memory/1412-192-0x0000000000460000-0x000000000051F000-memory.dmp
                                                                                Download

                                                                                memory/1588-297-0x0000000000840000-0x00000000008FF000-memory.dmp
                                                                                Download

                                                                                memory/1604-37-0x00000000007B0000-0x000000000086F000-memory.dmp
                                                                                Download

                                                                                memory/1772-272-0x0000000000950000-0x000000000099B000-memory.dmp
                                                                                Download

                                                                                memory/1772-274-0x0000000000950000-0x000000000099B000-memory.dmp
                                                                                Download

                                                                                memory/1816-200-0x00000000001E0000-0x000000000022B000-memory.dmp
                                                                                Download

                                                                                memory/1816-202-0x00000000001E0000-0x000000000022B000-memory.dmp
                                                                                Download

                                                                                memory/1892-118-0x0000000000010000-0x0000000000083000-memory.dmp
                                                                                Download

                                                                                memory/1900-47-0x0000000000880000-0x000000000093F000-memory.dmp
                                                                                Download

                                                                                memory/1952-122-0x0000000000130000-0x000000000017B000-memory.dmp
                                                                                Download

                                                                                memory/1952-126-0x0000000000130000-0x000000000017B000-memory.dmp
                                                                                Download

                                                                                memory/1960-296-0x00000000005D0000-0x000000000061B000-memory.dmp
                                                                                Download

                                                                                memory/1960-294-0x00000000005D0000-0x000000000061B000-memory.dmp
                                                                                Download

                                                                                memory/1964-268-0x0000000000550000-0x000000000059B000-memory.dmp
                                                                                Download

                                                                                memory/1964-266-0x0000000000550000-0x000000000059B000-memory.dmp
                                                                                Download

                                                                                memory/1992-58-0x0000000000900000-0x00000000009BF000-memory.dmp
                                                                                Download

                                                                                memory/2008-39-0x0000000000890000-0x000000000094F000-memory.dmp
                                                                                Download

                                                                                memory/2072-164-0x00000000008B0000-0x000000000096F000-memory.dmp
                                                                                Download

                                                                                memory/2152-149-0x0000000000890000-0x000000000094F000-memory.dmp
                                                                                Download

                                                                                memory/2280-231-0x0000000000890000-0x000000000094F000-memory.dmp
                                                                                Download

                                                                                memory/2284-208-0x0000000000610000-0x000000000065B000-memory.dmp
                                                                                Download

                                                                                memory/2284-206-0x0000000000610000-0x000000000065B000-memory.dmp
                                                                                Download

                                                                                memory/2340-138-0x0000000000910000-0x00000000009CF000-memory.dmp
                                                                                Download

                                                                                memory/2356-308-0x00000000008A0000-0x000000000095F000-memory.dmp
                                                                                Download

                                                                                memory/2408-195-0x0000000000460000-0x00000000004AB000-memory.dmp
                                                                                Download

                                                                                memory/2408-197-0x0000000000460000-0x00000000004AB000-memory.dmp
                                                                                Download

                                                                                memory/2492-23-0x0000000000E40000-0x0000000000E8B000-memory.dmp
                                                                                Download

                                                                                memory/2492-26-0x0000000000E40000-0x0000000000E8B000-memory.dmp
                                                                                Download

                                                                                memory/2512-147-0x00000000007C0000-0x000000000087F000-memory.dmp
                                                                                Download

                                                                                memory/2532-165-0x00000000005F0000-0x000000000063B000-memory.dmp
                                                                                Download

                                                                                memory/2532-163-0x00000000005F0000-0x000000000063B000-memory.dmp
                                                                                Download

                                                                                memory/2540-116-0x00000000008F0000-0x00000000009AF000-memory.dmp
                                                                                Download

                                                                                memory/2708-241-0x00000000007E0000-0x000000000082B000-memory.dmp
                                                                                Download

                                                                                memory/2708-239-0x00000000007E0000-0x000000000082B000-memory.dmp
                                                                                Download

                                                                                memory/2732-215-0x0000000000010000-0x0000000000083000-memory.dmp
                                                                                Download

                                                                                memory/2792-106-0x0000000000770000-0x000000000082F000-memory.dmp
                                                                                Download

                                                                                memory/2868-292-0x0000000000010000-0x0000000000083000-memory.dmp
                                                                                Download

                                                                                memory/3032-72-0x0000000000EE0000-0x0000000000F2B000-memory.dmp
                                                                                Download

                                                                                memory/3032-76-0x0000000000EE0000-0x0000000000F2B000-memory.dmp
                                                                                Download

                                                                                memory/3040-217-0x0000000000550000-0x000000000059B000-memory.dmp
                                                                                Download

                                                                                memory/3040-219-0x0000000000550000-0x000000000059B000-memory.dmp
                                                                                Download

                                                                                memory/3224-166-0x00000000008D0000-0x000000000098F000-memory.dmp
                                                                                Download

                                                                                memory/3308-236-0x00000000008F0000-0x00000000009AF000-memory.dmp
                                                                                Download

                                                                                memory/3352-224-0x0000000000800000-0x000000000084B000-memory.dmp
                                                                                Download

                                                                                memory/3352-222-0x0000000000800000-0x000000000084B000-memory.dmp
                                                                                Download

                                                                                memory/3456-103-0x0000000000050000-0x000000000009B000-memory.dmp
                                                                                Download

                                                                                memory/3456-107-0x0000000000050000-0x000000000009B000-memory.dmp
                                                                                Download

                                                                                memory/3492-225-0x0000000000560000-0x000000000061F000-memory.dmp
                                                                                Download

                                                                                memory/3500-302-0x0000000000860000-0x000000000091F000-memory.dmp
                                                                                Download

                                                                                memory/3544-246-0x0000000000EE0000-0x0000000000F2B000-memory.dmp
                                                                                Download

                                                                                memory/3544-244-0x0000000000EE0000-0x0000000000F2B000-memory.dmp
                                                                                Download

                                                                                memory/3596-63-0x0000000000640000-0x000000000068B000-memory.dmp
                                                                                Download

                                                                                memory/3596-65-0x0000000000640000-0x000000000068B000-memory.dmp
                                                                                Download

                                                                                memory/3608-286-0x00000000008A0000-0x000000000095F000-memory.dmp
                                                                                Download

                                                                                memory/3660-113-0x0000000000010000-0x000000000005B000-memory.dmp
                                                                                Download

                                                                                memory/3660-115-0x0000000000010000-0x000000000005B000-memory.dmp
                                                                                Download

                                                                                memory/3784-279-0x0000000000410000-0x000000000045B000-memory.dmp
                                                                                Download

                                                                                memory/3784-277-0x0000000000410000-0x000000000045B000-memory.dmp
                                                                                Download

                                                                                memory/3804-275-0x0000000000890000-0x000000000094F000-memory.dmp
                                                                                Download

                                                                                memory/3912-196-0x0000000000710000-0x00000000007CF000-memory.dmp
                                                                                Download

                                                                                memory/3916-75-0x0000000000720000-0x00000000007DF000-memory.dmp
                                                                                Download

                                                                                memory/3932-44-0x0000000000290000-0x00000000002DB000-memory.dmp
                                                                                Download

                                                                                memory/3932-46-0x0000000000290000-0x00000000002DB000-memory.dmp
                                                                                Download

                                                                                memory/3944-148-0x0000000000F30000-0x0000000000F7B000-memory.dmp
                                                                                Download

                                                                                memory/3944-144-0x0000000000F30000-0x0000000000F7B000-memory.dmp
                                                                                Download

                                                                                memory/3956-30-0x0000000000010000-0x0000000000083000-memory.dmp
                                                                                Download

                                                                                memory/3980-179-0x00000000001A0000-0x00000000001EB000-memory.dmp
                                                                                Download

                                                                                memory/3980-191-0x00000000001A0000-0x00000000001EB000-memory.dmp
                                                                                Download

                                                                                memory/3984-209-0x0000000000950000-0x0000000000A0F000-memory.dmp
                                                                                Download

                                                                                memory/3996-235-0x0000000000250000-0x000000000029B000-memory.dmp
                                                                                Download

                                                                                memory/3996-233-0x0000000000250000-0x000000000029B000-memory.dmp
                                                                                Download

                                                                                memory/4072-306-0x0000000000930000-0x00000000009EF000-memory.dmp
                                                                                Download

                                                                                memory/4104-177-0x00000000008D0000-0x000000000098F000-memory.dmp
                                                                                Download

                                                                                memory/4132-27-0x0000000000570000-0x000000000062F000-memory.dmp
                                                                                Download

                                                                                memory/4136-68-0x0000000000010000-0x0000000000083000-memory.dmp
                                                                                Download

                                                                                memory/4136-193-0x0000000000010000-0x0000000000083000-memory.dmp
                                                                                Download

                                                                                memory/4140-49-0x0000000000010000-0x0000000000083000-memory.dmp
                                                                                Download

                                                                                memory/4188-19-0x0000000000760000-0x000000000081F000-memory.dmp
                                                                                Download

                                                                                memory/4304-0-0x00000000000A0000-0x00000000000EB000-memory.dmp
                                                                                Download

                                                                                memory/4304-28-0x00000000000A0000-0x00000000000EB000-memory.dmp
                                                                                Download

                                                                                memory/4348-269-0x0000000000880000-0x000000000093F000-memory.dmp
                                                                                Download

                                                                                memory/4428-140-0x0000000000010000-0x0000000000083000-memory.dmp
                                                                                Download

                                                                                memory/4508-299-0x0000000000DD0000-0x0000000000E1B000-memory.dmp
                                                                                Download

                                                                                memory/4508-301-0x0000000000DD0000-0x0000000000E1B000-memory.dmp
                                                                                Download

                                                                                memory/4524-262-0x0000000000950000-0x0000000000A0F000-memory.dmp
                                                                                Download

                                                                                memory/4660-237-0x0000000000010000-0x0000000000083000-memory.dmp
                                                                                Download

                                                                                memory/4676-273-0x00000000008E0000-0x000000000099F000-memory.dmp
                                                                                Download

                                                                                memory/4800-253-0x00000000008F0000-0x00000000009AF000-memory.dmp
                                                                                Download

                                                                                memory/4964-240-0x00000000004E0000-0x000000000059F000-memory.dmp
                                                                                Download

                                                                                memory/5044-251-0x0000000000860000-0x000000000091F000-memory.dmp
                                                                                Download

                                                                                memory/5148-247-0x0000000000870000-0x000000000092F000-memory.dmp
                                                                                Download

                                                                                memory/5160-132-0x0000000000700000-0x000000000074B000-memory.dmp
                                                                                Download

                                                                                memory/5160-137-0x0000000000700000-0x000000000074B000-memory.dmp
                                                                                Download

                                                                                memory/5184-263-0x00000000005C0000-0x000000000060B000-memory.dmp
                                                                                Download

                                                                                memory/5184-261-0x00000000005C0000-0x000000000060B000-memory.dmp
                                                                                Download

                                                                                memory/5188-15-0x0000000000740000-0x000000000078B000-memory.dmp
                                                                                Download

                                                                                memory/5188-18-0x0000000000740000-0x000000000078B000-memory.dmp
                                                                                Download

                                                                                memory/5232-17-0x0000000000750000-0x000000000080F000-memory.dmp
                                                                                Download

                                                                                memory/5252-258-0x0000000000910000-0x00000000009CF000-memory.dmp
                                                                                Download

                                                                                memory/5252-168-0x0000000000610000-0x000000000065B000-memory.dmp
                                                                                Download

                                                                                memory/5252-170-0x0000000000610000-0x000000000065B000-memory.dmp
                                                                                Download

                                                                                memory/5284-207-0x0000000000860000-0x000000000091F000-memory.dmp
                                                                                Download

                                                                                memory/5332-95-0x0000000000590000-0x000000000064F000-memory.dmp
                                                                                Download

                                                                                memory/5372-198-0x00000000008F0000-0x00000000009AF000-memory.dmp
                                                                                Download

                                                                                memory/5400-220-0x0000000000880000-0x000000000093F000-memory.dmp
                                                                                Download

                                                                                memory/5424-255-0x0000000000480000-0x00000000004CB000-memory.dmp
                                                                                Download

                                                                                memory/5424-257-0x0000000000480000-0x00000000004CB000-memory.dmp
                                                                                Download

                                                                                memory/5452-97-0x0000000000010000-0x0000000000083000-memory.dmp
                                                                                Download

                                                                                memory/5456-290-0x0000000000900000-0x000000000094B000-memory.dmp
                                                                                Download

                                                                                memory/5456-288-0x0000000000900000-0x000000000094B000-memory.dmp
                                                                                Download

                                                                                memory/5456-211-0x00000000006F0000-0x000000000073B000-memory.dmp
                                                                                Download

                                                                                memory/5456-213-0x00000000006F0000-0x000000000073B000-memory.dmp
                                                                                Download

                                                                                memory/5464-214-0x00000000008F0000-0x00000000009AF000-memory.dmp
                                                                                Download

                                                                                memory/5484-226-0x0000000000010000-0x0000000000083000-memory.dmp
                                                                                Download

                                                                                memory/5500-77-0x00000000008E0000-0x000000000099F000-memory.dmp
                                                                                Download

                                                                                memory/5580-283-0x00000000002F0000-0x000000000033B000-memory.dmp
                                                                                Download

                                                                                memory/5580-285-0x00000000002F0000-0x000000000033B000-memory.dmp
                                                                                Download

                                                                                memory/5596-82-0x0000000000460000-0x00000000004AB000-memory.dmp
                                                                                Download

                                                                                memory/5596-94-0x0000000000460000-0x00000000004AB000-memory.dmp
                                                                                Download

                                                                                memory/5604-218-0x0000000000740000-0x00000000007FF000-memory.dmp
                                                                                Download

                                                                                memory/5644-248-0x0000000000010000-0x0000000000083000-memory.dmp
                                                                                Download

                                                                                memory/5688-53-0x0000000000880000-0x00000000008CB000-memory.dmp
                                                                                Download

                                                                                memory/5688-57-0x0000000000880000-0x00000000008CB000-memory.dmp
                                                                                Download

                                                                                memory/5764-284-0x00000000008C0000-0x000000000097F000-memory.dmp
                                                                                Download

                                                                                memory/5780-108-0x0000000000680000-0x000000000073F000-memory.dmp
                                                                                Download

                                                                                memory/5820-175-0x0000000000880000-0x000000000093F000-memory.dmp
                                                                                Download

                                                                                memory/5852-160-0x0000000000010000-0x0000000000083000-memory.dmp
                                                                                Download

                                                                                memory/5868-38-0x00000000000C0000-0x000000000010B000-memory.dmp
                                                                                Download

                                                                                memory/5868-35-0x00000000000C0000-0x000000000010B000-memory.dmp
                                                                                Download

                                                                                memory/5872-280-0x0000000000850000-0x000000000090F000-memory.dmp
                                                                                Download

                                                                                memory/5888-176-0x00000000004E0000-0x000000000052B000-memory.dmp
                                                                                Download

                                                                                memory/5888-174-0x00000000004E0000-0x000000000052B000-memory.dmp
                                                                                Download

                                                                                memory/5912-270-0x0000000000010000-0x0000000000083000-memory.dmp
                                                                                Download

                                                                                memory/5940-172-0x0000000000010000-0x0000000000083000-memory.dmp
                                                                                Download

                                                                                memory/5944-171-0x00000000008C0000-0x000000000097F000-memory.dmp
                                                                                Download

                                                                                memory/5952-252-0x0000000000970000-0x00000000009BB000-memory.dmp
                                                                                Download

                                                                                memory/5952-250-0x0000000000970000-0x00000000009BB000-memory.dmp
                                                                                Download

                                                                                memory/6020-242-0x00000000006C0000-0x000000000077F000-memory.dmp
                                                                                Download

                                                                                memory/6048-259-0x0000000000010000-0x0000000000083000-memory.dmp
                                                                                Download