Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
16/04/2026, 03:52
General
- Target 2026-04-16_364391356d5c3a6f5536be69ebe135a9_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
- Size 291KB
- Sample260416-ee82mae17k
- SHA256 772485700f1e2b1b014c44cd7bbbaa36881338bf6b1e9f6bc108ee7eb5c6d5ab
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba8102
-
http://xytets.com:2345/ll/out.txt
-
http://xytets.com:2345/t.asp?os=home8102
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Custom signatureUPX dump on OEP (original entry point) 64 IoCs
- Executes dropped EXE 64 IoCs
- UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 30 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 3 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 19 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
- Suspicious use of AdjustPrivilegeToken 20 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-16_364391356d5c3a6f5536be69ebe135a9_coinminer_elex_redline-stealer_rhadamanthys_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-16_364391356d5c3a6f5536be69ebe135a9_coinminer_elex_redline-stealer_rhadamanthys_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home81022⤵
- Modifies Internet Explorer settings
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/ll/out.txt2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/ll/out.txt"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x2f0,0x7ffc5479c188,0x7ffc5479c194,0x7ffc5479c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1932,i,12204984349795438240,10655899111039769933,524288 --field-trial-handle=2116,i,6145197491253761964,15030454242214161109,262144 --variations-seed-version --mojo-platform-channel-handle=2152 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1668,i,9772451136217907751,4841077611368623676,262144 --field-trial-handle=2116,i,6145197491253761964,15030454242214161109,262144 --variations-seed-version --mojo-platform-channel-handle=2064 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2296,i,8987596020328677260,14477612087817238512,524288 --field-trial-handle=2116,i,6145197491253761964,15030454242214161109,262144 --variations-seed-version --mojo-platform-channel-handle=2472 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,6902906853735417141,11995497449243966685,2097152 --field-trial-handle=2116,i,6145197491253761964,15030454242214161109,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,1863449992922655674,2853873026517916826,2097152 --field-trial-handle=2116,i,6145197491253761964,15030454242214161109,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4784,i,3487923745984306745,9179441219361730031,2097152 --field-trial-handle=2116,i,6145197491253761964,15030454242214161109,262144 --variations-seed-version --mojo-platform-channel-handle=4792 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4680,i,17820264950629774949,17710641018390158837,2097152 --field-trial-handle=2116,i,6145197491253761964,15030454242214161109,262144 --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4984,i,10085825073133281419,976822991031588401,524288 --field-trial-handle=2116,i,6145197491253761964,15030454242214161109,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5020,i,17521676021716844741,16480433262935719698,524288 --field-trial-handle=2116,i,6145197491253761964,15030454242214161109,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5728,i,10039071412681069137,12100950391000825555,524288 --field-trial-handle=2116,i,6145197491253761964,15030454242214161109,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5728,i,10039071412681069137,12100950391000825555,524288 --field-trial-handle=2116,i,6145197491253761964,15030454242214161109,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,14882288276756582626,15285004364701102342,524288 --field-trial-handle=2116,i,6145197491253761964,15030454242214161109,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:144⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.execookie_exporter.exe --cookie-json=11325⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5728,i,8176567719053440539,16050915197681958380,524288 --field-trial-handle=2116,i,6145197491253761964,15030454242214161109,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6272,i,7403010601209785816,8335064972851752306,524288 --field-trial-handle=2116,i,6145197491253761964,15030454242214161109,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,6106353403603914562,3532126918985207186,524288 --field-trial-handle=2116,i,6145197491253761964,15030454242214161109,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5984,i,11189480022397996194,6169930040241006771,524288 --field-trial-handle=2116,i,6145197491253761964,15030454242214161109,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5996,i,1032929384575249475,5030501995293622227,524288 --field-trial-handle=2116,i,6145197491253761964,15030454242214161109,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6312,i,17648681731348325202,14171642907149686962,524288 --field-trial-handle=2116,i,6145197491253761964,15030454242214161109,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5696,i,1791476709028583990,4447746848082060564,524288 --field-trial-handle=2116,i,6145197491253761964,15030454242214161109,262144 --variations-seed-version --mojo-platform-channel-handle=3356 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3548,i,7288580374299211329,2683651217385232751,524288 --field-trial-handle=2116,i,6145197491253761964,15030454242214161109,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6332,i,10856492723116496507,6756536062345948612,262144 --field-trial-handle=2116,i,6145197491253761964,15030454242214161109,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5684,i,2635517476702263063,11005588449847362764,524288 --field-trial-handle=2116,i,6145197491253761964,15030454242214161109,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:144⤵
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\pjhbzurmke.exe ups_run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\pjhbzurmke.exeC:\Temp\pjhbzurmke.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_pjhbzurmke.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_pjhbzurmke.exeC:\Temp\i_pjhbzurmke.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\hezojhbzwr.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\hezojhbzwr.exeC:\Temp\hezojhbzwr.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_hezojhbzwr.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_hezojhbzwr.exeC:\Temp\i_hezojhbzwr.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\jebwuojgbz.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\jebwuojgbz.exeC:\Temp\jebwuojgbz.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_jebwuojgbz.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_jebwuojgbz.exeC:\Temp\i_jebwuojgbz.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ytqljdbvtn.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\ytqljdbvtn.exeC:\Temp\ytqljdbvtn.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ytqljdbvtn.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_ytqljdbvtn.exeC:\Temp\i_ytqljdbvtn.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\idbtqlidbv.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\idbtqlidbv.exeC:\Temp\idbtqlidbv.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_idbtqlidbv.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_idbtqlidbv.exeC:\Temp\i_idbtqlidbv.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\aysqkicavs.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\aysqkicavs.exeC:\Temp\aysqkicavs.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_aysqkicavs.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_aysqkicavs.exeC:\Temp\i_aysqkicavs.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\xvpnifdxvp.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\xvpnifdxvp.exeC:\Temp\xvpnifdxvp.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_xvpnifdxvp.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_xvpnifdxvp.exeC:\Temp\i_xvpnifdxvp.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\pkecxupnhf.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\pkecxupnhf.exeC:\Temp\pkecxupnhf.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_pkecxupnhf.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_pkecxupnhf.exeC:\Temp\i_pkecxupnhf.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\czusmkecwu.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\czusmkecwu.exeC:\Temp\czusmkecwu.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_czusmkecwu.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_czusmkecwu.exeC:\Temp\i_czusmkecwu.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\omhezxrpjh.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\omhezxrpjh.exeC:\Temp\omhezxrpjh.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_omhezxrpjh.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_omhezxrpjh.exeC:\Temp\i_omhezxrpjh.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ljebwuojhb.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\ljebwuojhb.exeC:\Temp\ljebwuojhb.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ljebwuojhb.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_ljebwuojhb.exeC:\Temp\i_ljebwuojhb.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\bwtoigbytr.exe ups_run2⤵
-
C:\Temp\bwtoigbytr.exeC:\Temp\bwtoigbytr.exe ups_run3⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_bwtoigbytr.exe ups_ins2⤵
-
C:\Temp\i_bwtoigbytr.exeC:\Temp\i_bwtoigbytr.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\qoigbytqlj.exe ups_run2⤵
-
C:\Temp\qoigbytqlj.exeC:\Temp\qoigbytqlj.exe ups_run3⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_qoigbytqlj.exe ups_ins2⤵
-
C:\Temp\i_qoigbytqlj.exeC:\Temp\i_qoigbytqlj.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\davtnlfdxv.exe ups_run2⤵
-
C:\Temp\davtnlfdxv.exeC:\Temp\davtnlfdxv.exe ups_run3⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_davtnlfdxv.exe ups_ins2⤵
-
C:\Temp\i_davtnlfdxv.exeC:\Temp\i_davtnlfdxv.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ysqkicavsn.exe ups_run2⤵
-
C:\Temp\ysqkicavsn.exeC:\Temp\ysqkicavsn.exe ups_run3⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ysqkicavsn.exe ups_ins2⤵
-
C:\Temp\i_ysqkicavsn.exeC:\Temp\i_ysqkicavsn.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\kicxvpnhfa.exe ups_run2⤵
-
C:\Temp\kicxvpnhfa.exeC:\Temp\kicxvpnhfa.exe ups_run3⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_kicxvpnhfa.exe ups_ins2⤵
-
C:\Temp\i_kicxvpnhfa.exeC:\Temp\i_kicxvpnhfa.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\upnhfzusmk.exe ups_run2⤵
-
C:\Temp\upnhfzusmk.exeC:\Temp\upnhfzusmk.exe ups_run3⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_upnhfzusmk.exe ups_ins2⤵
-
C:\Temp\i_upnhfzusmk.exeC:\Temp\i_upnhfzusmk.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\jecwuomgez.exe ups_run2⤵
-
C:\Temp\jecwuomgez.exeC:\Temp\jecwuomgez.exe ups_run3⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_jecwuomgez.exe ups_ins2⤵
-
C:\Temp\i_jecwuomgez.exeC:\Temp\i_jecwuomgez.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\bwuomhezwr.exe ups_run2⤵
-
C:\Temp\bwuomhezwr.exeC:\Temp\bwuomhezwr.exe ups_run3⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_bwuomhezwr.exe ups_ins2⤵
-
C:\Temp\i_bwuomhezwr.exeC:\Temp\i_bwuomhezwr.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\uomgeywroj.exe ups_run2⤵
-
C:\Temp\uomgeywroj.exeC:\Temp\uomgeywroj.exe ups_run3⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_uomgeywroj.exe ups_ins2⤵
-
C:\Temp\i_uomgeywroj.exeC:\Temp\i_uomgeywroj.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Temp\uomgezwrpj.sysC:\Temp\uomgezwrpj.sys1⤵
- Executes dropped EXE
-
C:\Temp\rojgbztrlj.sysC:\Temp\rojgbztrlj.sys1⤵
- Executes dropped EXE
-
C:\Temp\gbytqljdbv.sysC:\Temp\gbytqljdbv.sys1⤵
- Executes dropped EXE
-
C:\Temp\qlidbvtnli.sysC:\Temp\qlidbvtnli.sys1⤵
- Executes dropped EXE
-
C:\Temp\tnlfdyvqoi.sysC:\Temp\tnlfdyvqoi.sys1⤵
- Executes dropped EXE
-
C:\Temp\idavsnlfdx.sysC:\Temp\idavsnlfdx.sys1⤵
- Executes dropped EXE
-
C:\Temp\axspkicaus.sysC:\Temp\axspkicaus.sys1⤵
- Executes dropped EXE
-
C:\Temp\mhfzxrpkhc.sysC:\Temp\mhfzxrpkhc.sys1⤵
- Executes dropped EXE
-
C:\Temp\ecwupmhezx.sysC:\Temp\ecwupmhezx.sys1⤵
- Executes dropped EXE
-
C:\Temp\wrpjhbztrm.sysC:\Temp\wrpjhbztrm.sys1⤵
- Executes dropped EXE
-
C:\Temp\ljdbwtomge.sysC:\Temp\ljdbwtomge.sys1⤵
-
C:\Temp\bvtnlgdywq.sysC:\Temp\bvtnlgdywq.sys1⤵
-
C:\Temp\ywqoigavtn.sysC:\Temp\ywqoigavtn.sys1⤵
-
C:\Temp\faysqkicav.sysC:\Temp\faysqkicav.sys1⤵
-
C:\Temp\usnkfdxvpn.sysC:\Temp\usnkfdxvpn.sys1⤵
-
C:\Temp\czxrmkfcxu.sysC:\Temp\czxrmkfcxu.sys1⤵
-
C:\Temp\causmkecxu.sysC:\Temp\causmkecxu.sys1⤵
-
C:\Temp\mkecwrpjhb.sysC:\Temp\mkecwrpjhb.sys1⤵
-
C:\Temp\bwtomgeywq.sysC:\Temp\bwtomgeywq.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
aysqkicavs.exe
gbytqljdbv.sys
hezojhbzwr.exe
i_aysqkicavs.exe
i_hezojhbzwr.exe
i_idbtqlidbv.exe
i_jebwuojgbz.exe
i_pjhbzurmke.exe
i_ytqljdbvtn.exe
idavsnlfdx.sys
idbtqlidbv.exe
jebwuojgbz.exe
pjhbzurmke.exe
qlidbvtnli.sys
rojgbztrlj.sys
tnlfdyvqoi.sys
uomgezwrpj.sys
ytqljdbvtn.exe
autofill_bypass_cache_forms.json
edge_autofill_global_block_list.json
v1FieldTypes.json
settings.dat
settings.dat
BookmarkMergedSurfaceOrdering
BrowsingTopicsState
SiteList-Enterprise.json
HubApps
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Preferences
Preferences
Secure Preferences
sync_diagnostic.log
CURRENT
MANIFEST-000001
Local State
Local State
Local State
Local State
Local State
metadata.json
metadata.json
metadata.json
3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
metadata.json
manifest.json
keys.json
manifest.json
manifest.json
CP.exe
memory/912-575-0x0000000000880000-0x00000000008CB000-memory.dmp
memory/912-578-0x0000000000880000-0x00000000008CB000-memory.dmp
memory/1416-659-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1540-617-0x0000000000450000-0x000000000049B000-memory.dmp
memory/1540-616-0x0000000000450000-0x000000000049B000-memory.dmp
memory/1656-846-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1668-231-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1692-832-0x0000000000AB0000-0x0000000000AFB000-memory.dmp
memory/1692-833-0x0000000000AB0000-0x0000000000AFB000-memory.dmp
memory/1724-847-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1724-806-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1724-515-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1724-263-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1836-580-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2064-689-0x00000000009B0000-0x00000000009FB000-memory.dmp
memory/2064-688-0x00000000009B0000-0x00000000009FB000-memory.dmp
memory/2076-608-0x00000000002D0000-0x000000000031B000-memory.dmp
memory/2076-607-0x00000000002D0000-0x000000000031B000-memory.dmp
memory/2084-584-0x0000000000FC0000-0x000000000100B000-memory.dmp
memory/2084-583-0x0000000000FC0000-0x000000000100B000-memory.dmp
memory/2096-638-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2208-776-0x0000000000680000-0x00000000006CB000-memory.dmp
memory/2208-775-0x0000000000680000-0x00000000006CB000-memory.dmp
memory/2284-792-0x0000000000A40000-0x0000000000A8B000-memory.dmp
memory/2284-791-0x0000000000A40000-0x0000000000A8B000-memory.dmp
memory/2328-68-0x0000000000890000-0x00000000008DB000-memory.dmp
memory/2328-192-0x0000000000890000-0x00000000008DB000-memory.dmp
memory/2432-610-0x0000000000610000-0x000000000065B000-memory.dmp
memory/2432-612-0x0000000000610000-0x000000000065B000-memory.dmp
memory/2876-200-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2900-693-0x0000000000E00000-0x0000000000E4B000-memory.dmp
memory/2900-691-0x0000000000E00000-0x0000000000E4B000-memory.dmp
memory/2936-63-0x00000000009B0000-0x00000000009FB000-memory.dmp
memory/2936-61-0x00000000009B0000-0x00000000009FB000-memory.dmp
memory/3248-637-0x0000000000860000-0x00000000008AB000-memory.dmp
memory/3248-635-0x0000000000860000-0x00000000008AB000-memory.dmp
memory/3252-718-0x0000000000850000-0x000000000089B000-memory.dmp
memory/3252-719-0x0000000000850000-0x000000000089B000-memory.dmp
memory/3272-215-0x0000000000C40000-0x0000000000C8B000-memory.dmp
memory/3272-217-0x0000000000C40000-0x0000000000C8B000-memory.dmp
memory/3420-870-0x00000000002F0000-0x000000000033B000-memory.dmp
memory/3420-868-0x00000000002F0000-0x000000000033B000-memory.dmp
memory/3676-0-0x0000000000280000-0x00000000002CB000-memory.dmp
memory/3676-193-0x0000000000280000-0x00000000002CB000-memory.dmp
memory/3924-261-0x0000000000CB0000-0x0000000000CFB000-memory.dmp
memory/3924-250-0x0000000000CB0000-0x0000000000CFB000-memory.dmp
memory/3984-236-0x00000000006E0000-0x000000000072B000-memory.dmp
memory/3984-238-0x00000000006E0000-0x000000000072B000-memory.dmp
memory/4088-788-0x0000000000C40000-0x0000000000C8B000-memory.dmp
memory/4088-786-0x0000000000C40000-0x0000000000C8B000-memory.dmp
memory/4152-551-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4152-581-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4196-229-0x0000000000FA0000-0x0000000000FEB000-memory.dmp
memory/4196-227-0x0000000000FA0000-0x0000000000FEB000-memory.dmp
memory/4256-613-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4288-694-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4360-520-0x0000000000C60000-0x0000000000CAB000-memory.dmp
memory/4360-522-0x0000000000C60000-0x0000000000CAB000-memory.dmp
memory/4504-749-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4572-752-0x00000000005A0000-0x00000000005EB000-memory.dmp
memory/4572-751-0x00000000005A0000-0x00000000005EB000-memory.dmp
memory/4680-849-0x0000000000CF0000-0x0000000000D3B000-memory.dmp
memory/4680-858-0x0000000000CF0000-0x0000000000D3B000-memory.dmp
memory/4760-280-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4940-843-0x0000000000770000-0x00000000007BB000-memory.dmp
memory/4940-845-0x0000000000770000-0x00000000007BB000-memory.dmp
memory/4964-762-0x0000000000B30000-0x0000000000B7B000-memory.dmp
memory/4964-764-0x0000000000B30000-0x0000000000B7B000-memory.dmp
memory/4984-765-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5072-563-0x0000000000F90000-0x0000000000FDB000-memory.dmp
memory/5072-566-0x0000000000F90000-0x0000000000FDB000-memory.dmp
memory/5212-270-0x00000000001E0000-0x000000000022B000-memory.dmp
memory/5212-268-0x00000000001E0000-0x000000000022B000-memory.dmp
memory/5232-871-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5376-789-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5380-278-0x00000000003C0000-0x000000000040B000-memory.dmp
memory/5380-274-0x00000000003C0000-0x000000000040B000-memory.dmp
memory/5536-697-0x00000000003A0000-0x00000000003EB000-memory.dmp
memory/5536-696-0x00000000003A0000-0x00000000003EB000-memory.dmp
memory/5584-716-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5612-640-0x00000000003C0000-0x000000000040B000-memory.dmp
memory/5612-641-0x00000000003C0000-0x000000000040B000-memory.dmp
memory/5660-614-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5660-605-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5696-72-0x0000024803920000-0x0000024803CDB000-memory.dmp
memory/5748-805-0x0000000000430000-0x000000000047B000-memory.dmp
memory/5748-802-0x0000000000430000-0x000000000047B000-memory.dmp
memory/5932-602-0x0000000000040000-0x000000000008B000-memory.dmp
memory/5932-604-0x0000000000040000-0x000000000008B000-memory.dmp
memory/5932-729-0x00000000008A0000-0x00000000008EB000-memory.dmp
memory/5932-748-0x00000000008A0000-0x00000000008EB000-memory.dmp
memory/5976-549-0x0000000000990000-0x00000000009DB000-memory.dmp
memory/5976-542-0x0000000000990000-0x00000000009DB000-memory.dmp
memory/5984-648-0x0000000000A50000-0x0000000000A9B000-memory.dmp
memory/5984-658-0x0000000000A50000-0x0000000000A9B000-memory.dmp
memory/6052-712-0x00000000009C0000-0x0000000000A0B000-memory.dmp
memory/6052-715-0x00000000009C0000-0x0000000000A0B000-memory.dmp