Overview

overview

10

Static

static

10

2026-08-09...op.exe

windows10-2004-x64

10

2026-08-09...op.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    09/08/2026, 17:09

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-09_19c1fdb3d97b41153429257c8253c765_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
  • Size 291KB
  • Sample260809-vpmjdasdph
  • SHA256 76ca015c092597d390263b0122d0a8793574e27adb7df25efe3985c8d17d4381
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwarediscoverysystexspywaretrojanupx

Malware Config

Extracted

Family

  • systex

C2

  • http://xytets.com:2345/t.asp?os=wangba8102

  • http://xytets.com:2345/ll/out.txt

  • http://xytets.com:2345/t.asp?os=home8102

Signatures

  • Family: Systex

    Systex is a trojan loader written in C++.

    trojansystex
  • UPX dump on OEP (original entry point) 64 IoCs
  • Executes dropped EXE 64 IoCs
  • UPX packed file 64 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • System Location Discovery: System Language Discovery 1 TTPs 43 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Gathers network information 2 TTPs 20 IoCs

    Uses commandline utility to view network configuration.

  • Modifies Internet Explorer settings 1 TTPs 58 IoCs
    adwarespyware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 19 IoCs
  • Suspicious use of AdjustPrivilegeToken 19 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 63 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-09_19c1fdb3d97b41153429257c8253c765_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-09_19c1fdb3d97b41153429257c8253c765_coinminer_elex_redline-stealer_rhadamanthys_stop.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1300
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home8102
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4172
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4172 CREDAT:17410 /prefetch:2
        3⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:2940
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/ll/out.txt
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1016
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1016 CREDAT:17410 /prefetch:2
        3⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:3320
    • C:\temp\CP.exe
      C:\temp\CP.exe C:\Temp\jhczurmkec.exe ups_run
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1020
      • C:\Temp\jhczurmkec.exe
        C:\Temp\jhczurmkec.exe ups_run
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:3704
        • C:\temp\CP.exe
          C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
          4⤵
          • Executes dropped EXE
          PID:1116
          • C:\windows\system32\ipconfig.exe
            C:\windows\system32\ipconfig.exe /release
            5⤵
            • Gathers network information
            PID:1724
    • C:\temp\CP.exe
      C:\temp\CP.exe C:\Temp\i_jhczurmkec.exe ups_ins
      2⤵
      • Executes dropped EXE
      PID:3744
      • C:\Temp\i_jhczurmkec.exe
        C:\Temp\i_jhczurmkec.exe ups_ins
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:4360
    • C:\temp\CP.exe
      C:\temp\CP.exe C:\Temp\omgezojhbz.exe ups_run
      2⤵
      • Executes dropped EXE
      PID:4748
      • C:\Temp\omgezojhbz.exe
        C:\Temp\omgezojhbz.exe ups_run
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4700
        • C:\temp\CP.exe
          C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
          4⤵
          • Executes dropped EXE
          PID:1764
          • C:\windows\system32\ipconfig.exe
            C:\windows\system32\ipconfig.exe /release
            5⤵
            • Gathers network information
            PID:1880
    • C:\temp\CP.exe
      C:\temp\CP.exe C:\Temp\i_omgezojhbz.exe ups_ins
      2⤵
      • Executes dropped EXE
      PID:1684
      • C:\Temp\i_omgezojhbz.exe
        C:\Temp\i_omgezojhbz.exe ups_ins
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:3080
    • C:\temp\CP.exe
      C:\temp\CP.exe C:\Temp\mgeywrojgb.exe ups_run
      2⤵
      • Executes dropped EXE
      PID:1660
      • C:\Temp\mgeywrojgb.exe
        C:\Temp\mgeywrojgb.exe ups_run
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3988
        • C:\temp\CP.exe
          C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
          4⤵
          • Executes dropped EXE
          PID:3984
          • C:\windows\system32\ipconfig.exe
            C:\windows\system32\ipconfig.exe /release
            5⤵
            • Gathers network information
            PID:4032
    • C:\temp\CP.exe
      C:\temp\CP.exe C:\Temp\i_mgeywrojgb.exe ups_ins
      2⤵
      • Executes dropped EXE
      PID:4872
      • C:\Temp\i_mgeywrojgb.exe
        C:\Temp\i_mgeywrojgb.exe ups_ins
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:1860
    • C:\temp\CP.exe
      C:\temp\CP.exe C:\Temp\rljbytrlgd.exe ups_run
      2⤵
      • Executes dropped EXE
      PID:3192
      • C:\Temp\rljbytrlgd.exe
        C:\Temp\rljbytrlgd.exe ups_run
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3992
        • C:\temp\CP.exe
          C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
          4⤵
          • Executes dropped EXE
          PID:4284
          • C:\windows\system32\ipconfig.exe
            C:\windows\system32\ipconfig.exe /release
            5⤵
            • Gathers network information
            PID:4364
    • C:\temp\CP.exe
      C:\temp\CP.exe C:\Temp\i_rljbytrlgd.exe ups_ins
      2⤵
      • Executes dropped EXE
      PID:1576
      • C:\Temp\i_rljbytrlgd.exe
        C:\Temp\i_rljbytrlgd.exe ups_ins
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:2040
    • C:\temp\CP.exe
      C:\temp\CP.exe C:\Temp\vqoigaysql.exe ups_run
      2⤵
      • Executes dropped EXE
      PID:844
      • C:\Temp\vqoigaysql.exe
        C:\Temp\vqoigaysql.exe ups_run
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3944
        • C:\temp\CP.exe
          C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
          4⤵
          • Executes dropped EXE
          PID:732
          • C:\windows\system32\ipconfig.exe
            C:\windows\system32\ipconfig.exe /release
            5⤵
            • Gathers network information
            PID:3316
    • C:\temp\CP.exe
      C:\temp\CP.exe C:\Temp\i_vqoigaysql.exe ups_ins
      2⤵
      • Executes dropped EXE
      PID:5008
      • C:\Temp\i_vqoigaysql.exe
        C:\Temp\i_vqoigaysql.exe ups_ins
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:3136
    • C:\temp\CP.exe
      C:\temp\CP.exe C:\Temp\fdxvqnigay.exe ups_run
      2⤵
      • Executes dropped EXE
      PID:3080
      • C:\Temp\fdxvqnigay.exe
        C:\Temp\fdxvqnigay.exe ups_run
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3288
        • C:\temp\CP.exe
          C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
          4⤵
          • Executes dropped EXE
          PID:3012
          • C:\windows\system32\ipconfig.exe
            C:\windows\system32\ipconfig.exe /release
            5⤵
            • Gathers network information
            PID:2240
    • C:\temp\CP.exe
      C:\temp\CP.exe C:\Temp\i_fdxvqnigay.exe ups_ins
      2⤵
      • Executes dropped EXE
      PID:3296
      • C:\Temp\i_fdxvqnigay.exe
        C:\Temp\i_fdxvqnigay.exe ups_ins
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:4512
    • C:\temp\CP.exe
      C:\temp\CP.exe C:\Temp\vpnhfaxsqk.exe ups_run
      2⤵
      • Executes dropped EXE
      PID:636
      • C:\Temp\vpnhfaxsqk.exe
        C:\Temp\vpnhfaxsqk.exe ups_run
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1572
        • C:\temp\CP.exe
          C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
          4⤵
          • Executes dropped EXE
          PID:3164
          • C:\windows\system32\ipconfig.exe
            C:\windows\system32\ipconfig.exe /release
            5⤵
            • Gathers network information
            PID:2076
    • C:\temp\CP.exe
      C:\temp\CP.exe C:\Temp\i_vpnhfaxsqk.exe ups_ins
      2⤵
      • Executes dropped EXE
      PID:3152
      • C:\Temp\i_vpnhfaxsqk.exe
        C:\Temp\i_vpnhfaxsqk.exe ups_ins
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:4332
    • C:\temp\CP.exe
      C:\temp\CP.exe C:\Temp\hfaxspkica.exe ups_run
      2⤵
      • Executes dropped EXE
      PID:472
      • C:\Temp\hfaxspkica.exe
        C:\Temp\hfaxspkica.exe ups_run
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:744
        • C:\temp\CP.exe
          C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
          4⤵
          • Executes dropped EXE
          PID:3304
          • C:\windows\system32\ipconfig.exe
            C:\windows\system32\ipconfig.exe /release
            5⤵
            • Gathers network information
            PID:4016
    • C:\temp\CP.exe
      C:\temp\CP.exe C:\Temp\i_hfaxspkica.exe ups_ins
      2⤵
      • Executes dropped EXE
      PID:3484
      • C:\Temp\i_hfaxspkica.exe
        C:\Temp\i_hfaxspkica.exe ups_ins
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:1832
    • C:\temp\CP.exe
      C:\temp\CP.exe C:\Temp\smkecwupmh.exe ups_run
      2⤵
      • Executes dropped EXE
      PID:772
      • C:\Temp\smkecwupmh.exe
        C:\Temp\smkecwupmh.exe ups_run
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1204
        • C:\temp\CP.exe
          C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
          4⤵
          • Executes dropped EXE
          PID:3612
          • C:\windows\system32\ipconfig.exe
            C:\windows\system32\ipconfig.exe /release
            5⤵
            • Gathers network information
            PID:4308
    • C:\temp\CP.exe
      C:\temp\CP.exe C:\Temp\i_smkecwupmh.exe ups_ins
      2⤵
      • Executes dropped EXE
      PID:2316
      • C:\Temp\i_smkecwupmh.exe
        C:\Temp\i_smkecwupmh.exe ups_ins
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:3548
    • C:\temp\CP.exe
      C:\temp\CP.exe C:\Temp\hbzurmkecw.exe ups_run
      2⤵
      • Executes dropped EXE
      PID:836
      • C:\Temp\hbzurmkecw.exe
        C:\Temp\hbzurmkecw.exe ups_run
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2036
        • C:\temp\CP.exe
          C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
          4⤵
          • Executes dropped EXE
          PID:972
          • C:\windows\system32\ipconfig.exe
            C:\windows\system32\ipconfig.exe /release
            5⤵
            • Gathers network information
            PID:3356
    • C:\temp\CP.exe
      C:\temp\CP.exe C:\Temp\i_hbzurmkecw.exe ups_ins
      2⤵
      • Executes dropped EXE
      PID:4940
      • C:\Temp\i_hbzurmkecw.exe
        C:\Temp\i_hbzurmkecw.exe ups_ins
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:3520
    • C:\temp\CP.exe
      C:\temp\CP.exe C:\Temp\ztrmjecwuo.exe ups_run
      2⤵
      • Executes dropped EXE
      PID:3064
      • C:\Temp\ztrmjecwuo.exe
        C:\Temp\ztrmjecwuo.exe ups_run
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4644
        • C:\temp\CP.exe
          C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
          4⤵
          • Executes dropped EXE
          PID:4492
          • C:\windows\system32\ipconfig.exe
            C:\windows\system32\ipconfig.exe /release
            5⤵
            • Gathers network information
            PID:3528
    • C:\temp\CP.exe
      C:\temp\CP.exe C:\Temp\i_ztrmjecwuo.exe ups_ins
      2⤵
      • Executes dropped EXE
      PID:2388
      • C:\Temp\i_ztrmjecwuo.exe
        C:\Temp\i_ztrmjecwuo.exe ups_ins
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:1760
    • C:\temp\CP.exe
      C:\temp\CP.exe C:\Temp\jdbvtolgey.exe ups_run
      2⤵
        PID:1348
        • C:\Temp\jdbvtolgey.exe
          C:\Temp\jdbvtolgey.exe ups_run
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1728
          • C:\temp\CP.exe
            C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
            4⤵
              PID:4616
              • C:\windows\system32\ipconfig.exe
                C:\windows\system32\ipconfig.exe /release
                5⤵
                • Gathers network information
                PID:4896
        • C:\temp\CP.exe
          C:\temp\CP.exe C:\Temp\i_jdbvtolgey.exe ups_ins
          2⤵
            PID:4996
            • C:\Temp\i_jdbvtolgey.exe
              C:\Temp\i_jdbvtolgey.exe ups_ins
              3⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              PID:3920
          • C:\temp\CP.exe
            C:\temp\CP.exe C:\Temp\tnlfdyvqoi.exe ups_run
            2⤵
              PID:4892
              • C:\Temp\tnlfdyvqoi.exe
                C:\Temp\tnlfdyvqoi.exe ups_run
                3⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:3664
                • C:\temp\CP.exe
                  C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
                  4⤵
                    PID:2880
                    • C:\windows\system32\ipconfig.exe
                      C:\windows\system32\ipconfig.exe /release
                      5⤵
                      • Gathers network information
                      PID:3968
              • C:\temp\CP.exe
                C:\temp\CP.exe C:\Temp\i_tnlfdyvqoi.exe ups_ins
                2⤵
                  PID:3356
                  • C:\Temp\i_tnlfdyvqoi.exe
                    C:\Temp\i_tnlfdyvqoi.exe ups_ins
                    3⤵
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2552
                • C:\temp\CP.exe
                  C:\temp\CP.exe C:\Temp\gaysqkidav.exe ups_run
                  2⤵
                    PID:312
                    • C:\Temp\gaysqkidav.exe
                      C:\Temp\gaysqkidav.exe ups_run
                      3⤵
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:3520
                      • C:\temp\CP.exe
                        C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
                        4⤵
                          PID:4088
                          • C:\windows\system32\ipconfig.exe
                            C:\windows\system32\ipconfig.exe /release
                            5⤵
                            • Gathers network information
                            PID:916
                    • C:\temp\CP.exe
                      C:\temp\CP.exe C:\Temp\i_gaysqkidav.exe ups_ins
                      2⤵
                        PID:4260
                        • C:\Temp\i_gaysqkidav.exe
                          C:\Temp\i_gaysqkidav.exe ups_ins
                          3⤵
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of AdjustPrivilegeToken
                          PID:4112
                      • C:\temp\CP.exe
                        C:\temp\CP.exe C:\Temp\xvqnigaysq.exe ups_run
                        2⤵
                          PID:1916
                          • C:\Temp\xvqnigaysq.exe
                            C:\Temp\xvqnigaysq.exe ups_run
                            3⤵
                            • System Location Discovery: System Language Discovery
                            • Suspicious use of WriteProcessMemory
                            PID:3440
                            • C:\temp\CP.exe
                              C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
                              4⤵
                                PID:3000
                                • C:\windows\system32\ipconfig.exe
                                  C:\windows\system32\ipconfig.exe /release
                                  5⤵
                                  • Gathers network information
                                  PID:3980
                          • C:\temp\CP.exe
                            C:\temp\CP.exe C:\Temp\i_xvqnigaysq.exe ups_ins
                            2⤵
                              PID:3032
                              • C:\Temp\i_xvqnigaysq.exe
                                C:\Temp\i_xvqnigaysq.exe ups_ins
                                3⤵
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of AdjustPrivilegeToken
                                PID:4788
                            • C:\temp\CP.exe
                              C:\temp\CP.exe C:\Temp\nhfzxspkic.exe ups_run
                              2⤵
                                PID:4932
                                • C:\Temp\nhfzxspkic.exe
                                  C:\Temp\nhfzxspkic.exe ups_run
                                  3⤵
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of WriteProcessMemory
                                  PID:5072
                                  • C:\temp\CP.exe
                                    C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
                                    4⤵
                                      PID:1140
                                      • C:\windows\system32\ipconfig.exe
                                        C:\windows\system32\ipconfig.exe /release
                                        5⤵
                                        • Gathers network information
                                        PID:2224
                                • C:\temp\CP.exe
                                  C:\temp\CP.exe C:\Temp\i_nhfzxspkic.exe ups_ins
                                  2⤵
                                    PID:5032
                                    • C:\Temp\i_nhfzxspkic.exe
                                      C:\Temp\i_nhfzxspkic.exe ups_ins
                                      3⤵
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:4064
                                  • C:\temp\CP.exe
                                    C:\temp\CP.exe C:\Temp\fzxrpkhcau.exe ups_run
                                    2⤵
                                      PID:1580
                                      • C:\Temp\fzxrpkhcau.exe
                                        C:\Temp\fzxrpkhcau.exe ups_run
                                        3⤵
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious use of WriteProcessMemory
                                        PID:5104
                                        • C:\temp\CP.exe
                                          C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
                                          4⤵
                                            PID:3548
                                            • C:\windows\system32\ipconfig.exe
                                              C:\windows\system32\ipconfig.exe /release
                                              5⤵
                                              • Gathers network information
                                              PID:3136
                                      • C:\temp\CP.exe
                                        C:\temp\CP.exe C:\Temp\i_fzxrpkhcau.exe ups_ins
                                        2⤵
                                          PID:2152
                                          • C:\Temp\i_fzxrpkhcau.exe
                                            C:\Temp\i_fzxrpkhcau.exe ups_ins
                                            3⤵
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:3328
                                        • C:\temp\CP.exe
                                          C:\temp\CP.exe C:\Temp\pjhczurmke.exe ups_run
                                          2⤵
                                            PID:3996
                                            • C:\Temp\pjhczurmke.exe
                                              C:\Temp\pjhczurmke.exe ups_run
                                              3⤵
                                              • System Location Discovery: System Language Discovery
                                              • Suspicious use of WriteProcessMemory
                                              PID:2012
                                              • C:\temp\CP.exe
                                                C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
                                                4⤵
                                                  PID:2528
                                                  • C:\windows\system32\ipconfig.exe
                                                    C:\windows\system32\ipconfig.exe /release
                                                    5⤵
                                                    • Gathers network information
                                                    PID:2836
                                            • C:\temp\CP.exe
                                              C:\temp\CP.exe C:\Temp\i_pjhczurmke.exe ups_ins
                                              2⤵
                                                PID:4516
                                                • C:\Temp\i_pjhczurmke.exe
                                                  C:\Temp\i_pjhczurmke.exe ups_ins
                                                  3⤵
                                                  • System Location Discovery: System Language Discovery
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:8
                                              • C:\temp\CP.exe
                                                C:\temp\CP.exe C:\Temp\hbzurmjecw.exe ups_run
                                                2⤵
                                                  PID:916
                                                  • C:\Temp\hbzurmjecw.exe
                                                    C:\Temp\hbzurmjecw.exe ups_run
                                                    3⤵
                                                    • System Location Discovery: System Language Discovery
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:4224
                                                    • C:\temp\CP.exe
                                                      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
                                                      4⤵
                                                        PID:632
                                                        • C:\windows\system32\ipconfig.exe
                                                          C:\windows\system32\ipconfig.exe /release
                                                          5⤵
                                                          • Gathers network information
                                                          PID:2032
                                                  • C:\temp\CP.exe
                                                    C:\temp\CP.exe C:\Temp\i_hbzurmjecw.exe ups_ins
                                                    2⤵
                                                      PID:2976
                                                      • C:\Temp\i_hbzurmjecw.exe
                                                        C:\Temp\i_hbzurmjecw.exe ups_ins
                                                        3⤵
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:4500
                                                    • C:\temp\CP.exe
                                                      C:\temp\CP.exe C:\Temp\trljebwuom.exe ups_run
                                                      2⤵
                                                        PID:644
                                                        • C:\Temp\trljebwuom.exe
                                                          C:\Temp\trljebwuom.exe ups_run
                                                          3⤵
                                                          • System Location Discovery: System Language Discovery
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:1904
                                                          • C:\temp\CP.exe
                                                            C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
                                                            4⤵
                                                              PID:1428
                                                              • C:\windows\system32\ipconfig.exe
                                                                C:\windows\system32\ipconfig.exe /release
                                                                5⤵
                                                                • Gathers network information
                                                                PID:4016
                                                      • C:\Temp\cwuomgezwr.sys
                                                        C:\Temp\cwuomgezwr.sys
                                                        1⤵
                                                        • Executes dropped EXE
                                                        PID:4584
                                                      • C:\Temp\wrojhbztrm.sys
                                                        C:\Temp\wrojhbztrm.sys
                                                        1⤵
                                                        • Executes dropped EXE
                                                        PID:2316
                                                      • C:\Temp\bwtolgeywq.sys
                                                        C:\Temp\bwtolgeywq.sys
                                                        1⤵
                                                        • Executes dropped EXE
                                                        PID:4052
                                                      • C:\Temp\gaysqlidbv.sys
                                                        C:\Temp\gaysqlidbv.sys
                                                        1⤵
                                                        • Executes dropped EXE
                                                        PID:3476
                                                      • C:\Temp\bvtnlfdyvq.sys
                                                        C:\Temp\bvtnlfdyvq.sys
                                                        1⤵
                                                        • Executes dropped EXE
                                                        PID:4440
                                                      • C:\Temp\faysqkicav.sys
                                                        C:\Temp\faysqkicav.sys
                                                        1⤵
                                                        • Executes dropped EXE
                                                        PID:4484
                                                      • C:\Temp\smkfcxvpnh.sys
                                                        C:\Temp\smkfcxvpnh.sys
                                                        1⤵
                                                        • Executes dropped EXE
                                                        PID:2040
                                                      • C:\Temp\cwupmhfzxr.sys
                                                        C:\Temp\cwupmhfzxr.sys
                                                        1⤵
                                                        • Executes dropped EXE
                                                        PID:208
                                                      • C:\Temp\zuomhezxrp.sys
                                                        C:\Temp\zuomhezxrp.sys
                                                        1⤵
                                                        • Executes dropped EXE
                                                        PID:4960
                                                      • C:\Temp\jecwuomgez.sys
                                                        C:\Temp\jecwuomgez.sys
                                                        1⤵
                                                        • Executes dropped EXE
                                                        PID:4520
                                                      • C:\Temp\tomgeywqoj.sys
                                                        C:\Temp\tomgeywqoj.sys
                                                        1⤵
                                                          PID:4788
                                                        • C:\Temp\dbvtolgdyw.sys
                                                          C:\Temp\dbvtolgdyw.sys
                                                          1⤵
                                                            PID:4404
                                                          • C:\Temp\vtnlfdyvqn.sys
                                                            C:\Temp\vtnlfdyvqn.sys
                                                            1⤵
                                                              PID:1040
                                                            • C:\Temp\lgaysqkida.sys
                                                              C:\Temp\lgaysqkida.sys
                                                              1⤵
                                                                PID:4856
                                                              • C:\Temp\xsqkicausn.sys
                                                                C:\Temp\xsqkicausn.sys
                                                                1⤵
                                                                  PID:1880
                                                                • C:\Temp\mkecxupnhf.sys
                                                                  C:\Temp\mkecxupnhf.sys
                                                                  1⤵
                                                                    PID:4308
                                                                  • C:\Temp\ecwupmhfzx.sys
                                                                    C:\Temp\ecwupmhfzx.sys
                                                                    1⤵
                                                                      PID:4032
                                                                    • C:\Temp\rmjecwuomh.sys
                                                                      C:\Temp\rmjecwuomh.sys
                                                                      1⤵
                                                                        PID:1228
                                                                      • C:\Temp\ebwuomgeyw.sys
                                                                        C:\Temp\ebwuomgeyw.sys
                                                                        1⤵
                                                                          PID:4572

                                                                        Network

                                                                              MITRE ATT&CK Enterprise v16

                                                                              Replay Monitor

                                                                              Loading Replay Monitor...

                                                                              Downloads

                                                                              CP.exe
                                                                              • Path C:\Temp\CP.exe
                                                                              • Size 4KB
                                                                              • SHA256 50b00a0816849edcc24eec9cfdd5443dbf33409ae05ee84202bfbcd00094485a
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              bvtnlfdyvq.sys
                                                                              • Path C:\Temp\bvtnlfdyvq.sys
                                                                              • Size 141KB
                                                                              • SHA256 cc6f292582454116169b8f1556e5ebf22f1b8e8e2e10c35565efaaeab8d25df1
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              bwtolgeywq.sys
                                                                              • Path C:\Temp\bwtolgeywq.sys
                                                                              • Size 141KB
                                                                              • SHA256 e44a8fa73c2123a7e98fa83a2c44643873f3dec4339c204eed5d82d153ac2369
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              cwuomgezwr.sys
                                                                              • Path C:\Temp\cwuomgezwr.sys
                                                                              • Size 141KB
                                                                              • SHA256 740f6fd5985379c5d77c31418676845ec0de69b89ecb728563a12b9be9eedbfe
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              faysqkicav.sys
                                                                              • Path C:\Temp\faysqkicav.sys
                                                                              • Size 141KB
                                                                              • SHA256 cad233cf014f3e920265b68669f1c67b4b551045c5527438fef3a9bf50337dad
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              fdxvqnigay.exe
                                                                              • Path C:\Temp\fdxvqnigay.exe
                                                                              • Size 291KB
                                                                              • SHA256 8e053fc5731b80db1152cf07f1bca3d6d399a429a5c8eb314e827d45b3a8f2eb
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              gaysqlidbv.sys
                                                                              • Path C:\Temp\gaysqlidbv.sys
                                                                              • Size 141KB
                                                                              • SHA256 75d8ec60414f64c200a2f0b0bb93e0fe4235022956f1c19264c10ebd372c5ee8
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              hfaxspkica.exe
                                                                              • Path C:\Temp\hfaxspkica.exe
                                                                              • Size 291KB
                                                                              • SHA256 389c8433f6ecab44ee7dbda83478d35342a943a6bba12905feebbd9d45b40965
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              i_fdxvqnigay.exe
                                                                              • Path C:\Temp\i_fdxvqnigay.exe
                                                                              • Size 291KB
                                                                              • SHA256 fcd35ee765ccf79157f2c53a9dc4b8c1f723674333fe714f1c16598dfe086979
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              i_jhczurmkec.exe
                                                                              • Path C:\Temp\i_jhczurmkec.exe
                                                                              • Size 291KB
                                                                              • SHA256 99c625a92f791a808661c304f5aa318038d687cb894fabadb0b4f6f8d9322468
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              i_mgeywrojgb.exe
                                                                              • Path C:\Temp\i_mgeywrojgb.exe
                                                                              • Size 291KB
                                                                              • SHA256 238867e1e67095e8f4757fb64e962ef503a59e1b10fae042190d5cbe1b6cf0ac
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              i_omgezojhbz.exe
                                                                              • Path C:\Temp\i_omgezojhbz.exe
                                                                              • Size 291KB
                                                                              • SHA256 b066db89af8291e34bafd1064d8c168d4d0840e010b4f70cfcfaeef7edc76b0c
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              i_rljbytrlgd.exe
                                                                              • Path C:\Temp\i_rljbytrlgd.exe
                                                                              • Size 291KB
                                                                              • SHA256 ba61339ad7019955135444aaf6464f740018832cd5cafd56f1f6134f626ea1bc
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              i_vpnhfaxsqk.exe
                                                                              • Path C:\Temp\i_vpnhfaxsqk.exe
                                                                              • Size 291KB
                                                                              • SHA256 d2a2c841238417f38032c84a44f8dc3c5cd4dfcab6e25eb849caf1ca0c8812ea
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              i_vqoigaysql.exe
                                                                              • Path C:\Temp\i_vqoigaysql.exe
                                                                              • Size 291KB
                                                                              • SHA256 92fbde0a0a6586efc25c912306709f44322cdcbcb5bb6c5597bd78fa467f1395
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              jhczurmkec.exe
                                                                              • Path C:\Temp\jhczurmkec.exe
                                                                              • Size 291KB
                                                                              • SHA256 04f8b5cd9fc8461bac6ab9d53612dd779912ae8ecfbca0cef2b9c6b97e78b428
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              mgeywrojgb.exe
                                                                              • Path C:\Temp\mgeywrojgb.exe
                                                                              • Size 291KB
                                                                              • SHA256 199cff53b7602711d59d581cf545f146426401a1abd66fb6741e469c9b8a0cd4
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              omgezojhbz.exe
                                                                              • Path C:\Temp\omgezojhbz.exe
                                                                              • Size 291KB
                                                                              • SHA256 a69bbc9fedcbd3e57fa3294efc0dd316b7ff644bcd22b7c5468e354ad2ef9dcb
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              rljbytrlgd.exe
                                                                              • Path C:\Temp\rljbytrlgd.exe
                                                                              • Size 291KB
                                                                              • SHA256 a1c192b62af98029e1f6955d663db2d637c9e0c9df2974c011b12445575f5b6b
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              smkfcxvpnh.sys
                                                                              • Path C:\Temp\smkfcxvpnh.sys
                                                                              • Size 141KB
                                                                              • SHA256 986cf22250f36bb4270a69cb214c16d270d5f512705ade36d8de5abe39d7243d
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              vpnhfaxsqk.exe
                                                                              • Path C:\Temp\vpnhfaxsqk.exe
                                                                              • Size 291KB
                                                                              • SHA256 bcb7630dc1e45e8de01bf121f2a392c4e0694699875d25e031c9ba77b6fa62bf
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              vqoigaysql.exe
                                                                              • Path C:\Temp\vqoigaysql.exe
                                                                              • Size 291KB
                                                                              • SHA256 696e8dd40c9fa5c21c1ac68aa38d19f5ce4b385a3469314da4d4deeabf26405a
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              wrojhbztrm.sys
                                                                              • Path C:\Temp\wrojhbztrm.sys
                                                                              • Size 141KB
                                                                              • SHA256 c406b0a43e8ef4ab9a580d967b3900101391ce75ff3ee723aeb1a5efbb165ed4
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
                                                                              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
                                                                              • Size 471B
                                                                              • SHA256 b6fd7591c4a27973ec150915ee89be0a402ac65c33854932505027be356b21d1
                                                                              • MD5 SHA1 SHA512 TLSH
                                                                              Submit Download

                                                                              E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
                                                                              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
                                                                              • Size 416B
                                                                              • SHA256 f6b6e780e86ebb6cae51146bcae8a08d732515aa95765e53223897e3519d2690
                                                                              • MD5 SHA1 SHA512 TLSH
                                                                              Submit Download

                                                                              RecoveryStore.{26F07FEC-9415-11F1-B995-C2D11B6ECFEC}.dat
                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{26F07FEC-9415-11F1-B995-C2D11B6ECFEC}.dat
                                                                              • Size 5KB
                                                                              • SHA256 a8863b5fc776bb02b90cf7cdbeb4877bb003e5a318d41b5a17779977dc046e31
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              RecoveryStore.{26F549C8-9415-11F1-B995-C2D11B6ECFEC}.dat
                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{26F549C8-9415-11F1-B995-C2D11B6ECFEC}.dat
                                                                              • Size 3KB
                                                                              • SHA256 6d8fb06d70c366cb4623eab0f04708e202281532bceb3256fd52ddb2487e3a38
                                                                              • MD5 SHA1 SHA512 TLSH
                                                                              Submit Download

                                                                              suggestions[1].en-US
                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\FVK2FCOF\suggestions[1].en-US
                                                                              • Size 17KB
                                                                              • SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              memory/8-228-0x0000000000E90000-0x0000000000EDB000-memory.dmp
                                                                              Download

                                                                              memory/8-226-0x0000000000E90000-0x0000000000EDB000-memory.dmp
                                                                              Download

                                                                              memory/208-139-0x0000000000010000-0x0000000000083000-memory.dmp
                                                                              Download

                                                                              memory/744-132-0x0000000000E60000-0x0000000000EAB000-memory.dmp
                                                                              Download

                                                                              memory/744-134-0x0000000000E60000-0x0000000000EAB000-memory.dmp
                                                                              Download

                                                                              memory/1040-189-0x0000000000010000-0x0000000000083000-memory.dmp
                                                                              Download

                                                                              memory/1204-141-0x0000000000CC0000-0x0000000000D0B000-memory.dmp
                                                                              Download

                                                                              memory/1204-142-0x0000000000CC0000-0x0000000000D0B000-memory.dmp
                                                                              Download

                                                                              memory/1228-229-0x0000000000010000-0x0000000000083000-memory.dmp
                                                                              Download

                                                                              memory/1300-0-0x00000000005B0000-0x00000000005FB000-memory.dmp
                                                                              Download

                                                                              memory/1300-20-0x00000000005B0000-0x00000000005FB000-memory.dmp
                                                                              Download

                                                                              memory/1572-117-0x00000000008F0000-0x000000000093B000-memory.dmp
                                                                              Download

                                                                              memory/1572-119-0x00000000008F0000-0x000000000093B000-memory.dmp
                                                                              Download

                                                                              memory/1728-176-0x00000000005D0000-0x000000000061B000-memory.dmp
                                                                              Download

                                                                              memory/1728-175-0x00000000005D0000-0x000000000061B000-memory.dmp
                                                                              Download

                                                                              memory/1760-170-0x00000000007C0000-0x000000000080B000-memory.dmp
                                                                              Download

                                                                              memory/1760-172-0x00000000007C0000-0x000000000080B000-memory.dmp
                                                                              Download

                                                                              memory/1832-138-0x00000000008A0000-0x00000000008EB000-memory.dmp
                                                                              Download

                                                                              memory/1832-136-0x00000000008A0000-0x00000000008EB000-memory.dmp
                                                                              Download

                                                                              memory/1860-49-0x0000000000240000-0x000000000028B000-memory.dmp
                                                                              Download

                                                                              memory/1860-52-0x0000000000240000-0x000000000028B000-memory.dmp
                                                                              Download

                                                                              memory/1880-205-0x0000000000010000-0x0000000000083000-memory.dmp
                                                                              Download

                                                                              memory/2012-224-0x00000000008F0000-0x000000000093B000-memory.dmp
                                                                              Download

                                                                              memory/2012-223-0x00000000008F0000-0x000000000093B000-memory.dmp
                                                                              Download

                                                                              memory/2036-149-0x0000000000970000-0x00000000009BB000-memory.dmp
                                                                              Download

                                                                              memory/2036-150-0x0000000000970000-0x00000000009BB000-memory.dmp
                                                                              Download

                                                                              memory/2040-128-0x0000000000010000-0x0000000000083000-memory.dmp
                                                                              Download

                                                                              memory/2040-73-0x0000000000070000-0x00000000000BB000-memory.dmp
                                                                              Download

                                                                              memory/2040-65-0x0000000000070000-0x00000000000BB000-memory.dmp
                                                                              Download

                                                                              memory/2316-38-0x0000000000010000-0x0000000000083000-memory.dmp
                                                                              Download

                                                                              memory/2552-188-0x0000000000460000-0x00000000004AB000-memory.dmp
                                                                              Download

                                                                              memory/2552-186-0x0000000000460000-0x00000000004AB000-memory.dmp
                                                                              Download

                                                                              memory/3080-33-0x0000000000DC0000-0x0000000000E0B000-memory.dmp
                                                                              Download

                                                                              memory/3080-36-0x0000000000DC0000-0x0000000000E0B000-memory.dmp
                                                                              Download

                                                                              memory/3136-91-0x0000000000A00000-0x0000000000A4B000-memory.dmp
                                                                              Download

                                                                              memory/3136-89-0x0000000000A00000-0x0000000000A4B000-memory.dmp
                                                                              Download

                                                                              memory/3288-98-0x0000000000990000-0x00000000009DB000-memory.dmp
                                                                              Download

                                                                              memory/3288-100-0x0000000000990000-0x00000000009DB000-memory.dmp
                                                                              Download

                                                                              memory/3328-218-0x0000000000060000-0x00000000000AB000-memory.dmp
                                                                              Download

                                                                              memory/3328-220-0x0000000000060000-0x00000000000AB000-memory.dmp
                                                                              Download

                                                                              memory/3440-199-0x00000000008B0000-0x00000000008FB000-memory.dmp
                                                                              Download

                                                                              memory/3440-200-0x00000000008B0000-0x00000000008FB000-memory.dmp
                                                                              Download

                                                                              memory/3476-75-0x0000000000010000-0x0000000000083000-memory.dmp
                                                                              Download

                                                                              memory/3520-154-0x0000000000C20000-0x0000000000C6B000-memory.dmp
                                                                              Download

                                                                              memory/3520-152-0x0000000000C20000-0x0000000000C6B000-memory.dmp
                                                                              Download

                                                                              memory/3520-191-0x0000000000170000-0x00000000001BB000-memory.dmp
                                                                              Download

                                                                              memory/3520-192-0x0000000000170000-0x00000000001BB000-memory.dmp
                                                                              Download

                                                                              memory/3548-146-0x0000000000B50000-0x0000000000B9B000-memory.dmp
                                                                              Download

                                                                              memory/3548-144-0x0000000000B50000-0x0000000000B9B000-memory.dmp
                                                                              Download

                                                                              memory/3664-184-0x00000000009D0000-0x0000000000A1B000-memory.dmp
                                                                              Download

                                                                              memory/3664-183-0x00000000009D0000-0x0000000000A1B000-memory.dmp
                                                                              Download

                                                                              memory/3704-12-0x00000000006A0000-0x00000000006EB000-memory.dmp
                                                                              Download

                                                                              memory/3704-10-0x00000000006A0000-0x00000000006EB000-memory.dmp
                                                                              Download

                                                                              memory/3920-178-0x0000000000CB0000-0x0000000000CFB000-memory.dmp
                                                                              Download

                                                                              memory/3920-180-0x0000000000CB0000-0x0000000000CFB000-memory.dmp
                                                                              Download

                                                                              memory/3944-81-0x0000000000CE0000-0x0000000000D2B000-memory.dmp
                                                                              Download

                                                                              memory/3944-84-0x0000000000CE0000-0x0000000000D2B000-memory.dmp
                                                                              Download

                                                                              memory/3988-45-0x0000000000A40000-0x0000000000A8B000-memory.dmp
                                                                              Download

                                                                              memory/3988-43-0x0000000000A40000-0x0000000000A8B000-memory.dmp
                                                                              Download

                                                                              memory/3992-61-0x00000000009E0000-0x0000000000A2B000-memory.dmp
                                                                              Download

                                                                              memory/3992-59-0x00000000009E0000-0x0000000000A2B000-memory.dmp
                                                                              Download

                                                                              memory/4032-221-0x0000000000010000-0x0000000000083000-memory.dmp
                                                                              Download

                                                                              memory/4052-54-0x0000000000010000-0x0000000000083000-memory.dmp
                                                                              Download

                                                                              memory/4064-212-0x0000000000D60000-0x0000000000DAB000-memory.dmp
                                                                              Download

                                                                              memory/4064-210-0x0000000000D60000-0x0000000000DAB000-memory.dmp
                                                                              Download

                                                                              memory/4112-196-0x0000000000C00000-0x0000000000C4B000-memory.dmp
                                                                              Download

                                                                              memory/4112-194-0x0000000000C00000-0x0000000000C4B000-memory.dmp
                                                                              Download

                                                                              memory/4224-232-0x0000000000500000-0x000000000054B000-memory.dmp
                                                                              Download

                                                                              memory/4224-231-0x0000000000500000-0x000000000054B000-memory.dmp
                                                                              Download

                                                                              memory/4308-213-0x0000000000010000-0x0000000000083000-memory.dmp
                                                                              Download

                                                                              memory/4332-126-0x0000000000BA0000-0x0000000000BEB000-memory.dmp
                                                                              Download

                                                                              memory/4332-124-0x0000000000BA0000-0x0000000000BEB000-memory.dmp
                                                                              Download

                                                                              memory/4360-19-0x0000000000B40000-0x0000000000B8B000-memory.dmp
                                                                              Download

                                                                              memory/4360-17-0x0000000000B40000-0x0000000000B8B000-memory.dmp
                                                                              Download

                                                                              memory/4404-181-0x0000000000010000-0x0000000000083000-memory.dmp
                                                                              Download

                                                                              memory/4440-93-0x0000000000010000-0x0000000000083000-memory.dmp
                                                                              Download

                                                                              memory/4484-112-0x0000000000010000-0x0000000000083000-memory.dmp
                                                                              Download

                                                                              memory/4500-236-0x0000000000E90000-0x0000000000EDB000-memory.dmp
                                                                              Download

                                                                              memory/4500-234-0x0000000000E90000-0x0000000000EDB000-memory.dmp
                                                                              Download

                                                                              memory/4512-110-0x0000000000FC0000-0x000000000100B000-memory.dmp
                                                                              Download

                                                                              memory/4512-105-0x0000000000FC0000-0x000000000100B000-memory.dmp
                                                                              Download

                                                                              memory/4520-155-0x0000000000010000-0x0000000000083000-memory.dmp
                                                                              Download

                                                                              memory/4584-22-0x0000000000010000-0x0000000000083000-memory.dmp
                                                                              Download

                                                                              memory/4644-157-0x0000000000230000-0x000000000027B000-memory.dmp
                                                                              Download

                                                                              memory/4644-158-0x0000000000230000-0x000000000027B000-memory.dmp
                                                                              Download

                                                                              memory/4700-29-0x0000000000B50000-0x0000000000B9B000-memory.dmp
                                                                              Download

                                                                              memory/4700-26-0x0000000000B50000-0x0000000000B9B000-memory.dmp
                                                                              Download

                                                                              memory/4788-202-0x0000000000B90000-0x0000000000BDB000-memory.dmp
                                                                              Download

                                                                              memory/4788-173-0x0000000000010000-0x0000000000083000-memory.dmp
                                                                              Download

                                                                              memory/4788-204-0x0000000000B90000-0x0000000000BDB000-memory.dmp
                                                                              Download

                                                                              memory/4856-197-0x0000000000010000-0x0000000000083000-memory.dmp
                                                                              Download

                                                                              memory/4960-147-0x0000000000010000-0x0000000000083000-memory.dmp
                                                                              Download

                                                                              memory/5072-207-0x00000000008F0000-0x000000000093B000-memory.dmp
                                                                              Download

                                                                              memory/5072-208-0x00000000008F0000-0x000000000093B000-memory.dmp
                                                                              Download

                                                                              memory/5104-216-0x0000000000570000-0x00000000005BB000-memory.dmp
                                                                              Download

                                                                              memory/5104-215-0x0000000000570000-0x00000000005BB000-memory.dmp
                                                                              Download