Analysis
- max time kernel
149s - max time network
145s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
04/05/2026, 14:29
General
- Target 2026-05-04_ae8cdeec685edc277b40db3b4dce0b72_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
- Size 291KB
- Sample260504-rt2mbadx3s
- SHA256 35a8033fa1783e2a98994af4cd769f7c82773c49c01129f50466a922bde46240
Malware Config
Extracted
-
systex
-
http://xytets.com:2345/t.asp?os=wangba8102
-
http://xytets.com:2345/ll/out.txt
-
http://xytets.com:2345/t.asp?os=home8102
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Custom signatureUPX dump on OEP (original entry point) 64 IoCs
- Executes dropped EXE 64 IoCs
- Loads dropped DLL 1 IoCs
- UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 40 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 19 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 48 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 3 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 19 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-04_ae8cdeec685edc277b40db3b4dce0b72_coinminer_elex_redline-stealer_rhadamanthys_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-04_ae8cdeec685edc277b40db3b4dce0b72_coinminer_elex_redline-stealer_rhadamanthys_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home81022⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home8102"3⤵
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/ll/out.txt2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/ll/out.txt"3⤵
- Loads dropped DLL
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2dc,0x2e0,0x2e4,0x2d8,0x364,0x7ffb1113c188,0x7ffb1113c194,0x7ffb1113c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1852,i,6132314096996950977,3451011966215202342,524288 --field-trial-handle=1960,i,2508571742826092917,3764296377312072569,262144 --variations-seed-version --mojo-platform-channel-handle=2136 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1564,i,10963870719939860697,2086993364523845120,262144 --field-trial-handle=1960,i,2508571742826092917,3764296377312072569,262144 --variations-seed-version --mojo-platform-channel-handle=1980 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2548,i,15397299436653541812,6808410830831728145,524288 --field-trial-handle=1960,i,2508571742826092917,3764296377312072569,262144 --variations-seed-version --mojo-platform-channel-handle=2532 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,15237738359171103358,12352854788088352732,2097152 --field-trial-handle=1960,i,2508571742826092917,3764296377312072569,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,993637082167756025,11741338689416064626,2097152 --field-trial-handle=1960,i,2508571742826092917,3764296377312072569,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4160,i,13079813042803596509,8100094377306646626,2097152 --field-trial-handle=1960,i,2508571742826092917,3764296377312072569,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5056,i,17387347755904822095,6421390398623503417,524288 --field-trial-handle=1960,i,2508571742826092917,3764296377312072569,262144 --variations-seed-version --mojo-platform-channel-handle=5088 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5052,i,3876803394879515725,3942580576554928103,524288 --field-trial-handle=1960,i,2508571742826092917,3764296377312072569,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5940,i,10680673436699298597,9533156610544269437,524288 --field-trial-handle=1960,i,2508571742826092917,3764296377312072569,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5940,i,10680673436699298597,9533156610544269437,524288 --field-trial-handle=1960,i,2508571742826092917,3764296377312072569,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6028,i,8479942217349760951,12550857940825567264,524288 --field-trial-handle=1960,i,2508571742826092917,3764296377312072569,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:144⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.execookie_exporter.exe --cookie-json=11445⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5940,i,3477374125244277535,15945962041378179818,524288 --field-trial-handle=1960,i,2508571742826092917,3764296377312072569,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5960,i,1464324618106895757,13626531855337704461,524288 --field-trial-handle=1960,i,2508571742826092917,3764296377312072569,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6408,i,9197231001655375909,16692718951646789157,524288 --field-trial-handle=1960,i,2508571742826092917,3764296377312072569,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=724,i,6280085812295521130,12391489879049489642,524288 --field-trial-handle=1960,i,2508571742826092917,3764296377312072569,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6424,i,12397608241141800831,12867768821811153176,524288 --field-trial-handle=1960,i,2508571742826092917,3764296377312072569,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5192,i,13431012587168335873,14648960340639895166,524288 --field-trial-handle=1960,i,2508571742826092917,3764296377312072569,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6640,i,8605226077422006728,422245837535471235,524288 --field-trial-handle=1960,i,2508571742826092917,3764296377312072569,262144 --variations-seed-version --mojo-platform-channel-handle=6644 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5684,i,803130992088174703,4634951209058861649,524288 --field-trial-handle=1960,i,2508571742826092917,3764296377312072569,262144 --variations-seed-version --mojo-platform-channel-handle=6752 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5220,i,1174566813136545477,2277089021486636799,524288 --field-trial-handle=1960,i,2508571742826092917,3764296377312072569,262144 --variations-seed-version --mojo-platform-channel-handle=6840 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5812,i,2536414511754723530,49477216535119434,262144 --field-trial-handle=1960,i,2508571742826092917,3764296377312072569,262144 --variations-seed-version --mojo-platform-channel-handle=6748 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5612,i,15932572513019664756,9622563127370385020,524288 --field-trial-handle=1960,i,2508571742826092917,3764296377312072569,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:144⤵
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\xrpjhczupj.exe ups_run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\xrpjhczupj.exeC:\Temp\xrpjhczupj.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_xrpjhczupj.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_xrpjhczupj.exeC:\Temp\i_xrpjhczupj.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\czurmhezwr.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\czurmhezwr.exeC:\Temp\czurmhezwr.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_czurmhezwr.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_czurmhezwr.exeC:\Temp\i_czurmhezwr.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\bztrljdbwt.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\bztrljdbwt.exeC:\Temp\bztrljdbwt.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_bztrljdbwt.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_bztrljdbwt.exeC:\Temp\i_bztrljdbwt.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\bytrligbyt.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\bytrligbyt.exeC:\Temp\bytrligbyt.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_bytrligbyt.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_bytrligbyt.exeC:\Temp\i_bytrligbyt.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\dywqlidbvt.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\dywqlidbvt.exeC:\Temp\dywqlidbvt.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_dywqlidbvt.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_dywqlidbvt.exeC:\Temp\i_dywqlidbvt.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\axvifaysqk.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\axvifaysqk.exeC:\Temp\axvifaysqk.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_axvifaysqk.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_axvifaysqk.exeC:\Temp\i_axvifaysqk.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\vsnlfdxvpn.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\vsnlfdxvpn.exeC:\Temp\vsnlfdxvpn.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_vsnlfdxvpn.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_vsnlfdxvpn.exeC:\Temp\i_vsnlfdxvpn.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\pnhfaxspki.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\pnhfaxspki.exeC:\Temp\pnhfaxspki.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_pnhfaxspki.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_pnhfaxspki.exeC:\Temp\i_pnhfaxspki.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\rpjhbzurmk.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\rpjhbzurmk.exeC:\Temp\rpjhbzurmk.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_rpjhbzurmk.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_rpjhbzurmk.exeC:\Temp\i_rpjhbzurmk.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\trpjhbztrm.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\trpjhbztrm.exeC:\Temp\trpjhbztrm.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_trpjhbztrm.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_trpjhbztrm.exeC:\Temp\i_trpjhbztrm.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ecwuomgezw.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\ecwuomgezw.exeC:\Temp\ecwuomgezw.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ecwuomgezw.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_ecwuomgezw.exeC:\Temp\i_ecwuomgezw.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ywqoigbytr.exe ups_run2⤵
-
C:\Temp\ywqoigbytr.exeC:\Temp\ywqoigbytr.exe ups_run3⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ywqoigbytr.exe ups_ins2⤵
-
C:\Temp\i_ywqoigbytr.exeC:\Temp\i_ywqoigbytr.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\yvqoidbvtn.exe ups_run2⤵
-
C:\Temp\yvqoidbvtn.exeC:\Temp\yvqoidbvtn.exe ups_run3⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_yvqoidbvtn.exe ups_ins2⤵
-
C:\Temp\i_yvqoidbvtn.exeC:\Temp\i_yvqoidbvtn.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\yvqnigaysq.exe ups_run2⤵
-
C:\Temp\yvqnigaysq.exeC:\Temp\yvqnigaysq.exe ups_run3⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_yvqnigaysq.exe ups_ins2⤵
-
C:\Temp\i_yvqnigaysq.exeC:\Temp\i_yvqnigaysq.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\nicankfdxv.exe ups_run2⤵
-
C:\Temp\nicankfdxv.exeC:\Temp\nicankfdxv.exe ups_run3⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_nicankfdxv.exe ups_ins2⤵
-
C:\Temp\i_nicankfdxv.exeC:\Temp\i_nicankfdxv.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\pmhfxusnkf.exe ups_run2⤵
-
C:\Temp\pmhfxusnkf.exeC:\Temp\pmhfxusnkf.exe ups_run3⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_pmhfxusnkf.exe ups_ins2⤵
-
C:\Temp\i_pmhfxusnkf.exeC:\Temp\i_pmhfxusnkf.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\pmhfzxrpjf.exe ups_run2⤵
-
C:\Temp\pmhfzxrpjf.exeC:\Temp\pmhfzxrpjf.exe ups_run3⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_pmhfzxrpjf.exe ups_ins2⤵
-
C:\Temp\i_pmhfzxrpjf.exeC:\Temp\i_pmhfzxrpjf.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\rpjhbzurmj.exe ups_run2⤵
-
C:\Temp\rpjhbzurmj.exeC:\Temp\rpjhbzurmj.exe ups_run3⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_rpjhbzurmj.exe ups_ins2⤵
-
C:\Temp\i_rpjhbzurmj.exeC:\Temp\i_rpjhbzurmj.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\bwtomgebwt.exe ups_run2⤵
-
C:\Temp\bwtomgebwt.exeC:\Temp\bwtomgebwt.exe ups_run3⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_bwtomgebwt.exe ups_ins2⤵
-
C:\Temp\i_bwtomgebwt.exeC:\Temp\i_bwtomgebwt.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Temp\pjhezxrpjh.sysC:\Temp\pjhezxrpjh.sys1⤵
- Executes dropped EXE
-
C:\Temp\rojgbztrlj.sysC:\Temp\rojgbztrlj.sys1⤵
- Executes dropped EXE
-
C:\Temp\olgeywqojg.sysC:\Temp\olgeywqojg.sys1⤵
- Executes dropped EXE
-
C:\Temp\vtnlgdywqo.sysC:\Temp\vtnlgdywqo.sys1⤵
- Executes dropped EXE
-
C:\Temp\qnigaysqki.sysC:\Temp\qnigaysqki.sys1⤵
- Executes dropped EXE
-
C:\Temp\lfaxsqkica.sysC:\Temp\lfaxsqkica.sys1⤵
- Executes dropped EXE
-
C:\Temp\fcxupnhcau.sysC:\Temp\fcxupnhcau.sys1⤵
- Executes dropped EXE
-
C:\Temp\cwupmhfzxr.sysC:\Temp\cwupmhfzxr.sys1⤵
- Executes dropped EXE
-
C:\Temp\rmkecwusmh.sysC:\Temp\rmkecwusmh.sys1⤵
- Executes dropped EXE
-
C:\Temp\wrojhbztrm.sysC:\Temp\wrojhbztrm.sys1⤵
- Executes dropped EXE
-
C:\Temp\ljeywqolgd.sysC:\Temp\ljeywqolgd.sys1⤵
-
C:\Temp\oigbytqljd.sysC:\Temp\oigbytqljd.sys1⤵
-
C:\Temp\vqoigaysql.sysC:\Temp\vqoigaysql.sys1⤵
-
C:\Temp\xvqnifaysq.sysC:\Temp\xvqnifaysq.sys1⤵
-
C:\Temp\fdxvpnhfax.sysC:\Temp\fdxvpnhfax.sys1⤵
-
C:\Temp\fzxspkhcau.sysC:\Temp\fzxspkhcau.sys1⤵
-
C:\Temp\ecwuomhezx.sysC:\Temp\ecwuomhezx.sys1⤵
-
C:\Temp\urmkecwuom.sysC:\Temp\urmkecwuom.sys1⤵
-
C:\Temp\dbwtomgeyw.sysC:\Temp\dbwtomgeyw.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CP.exe
axvifaysqk.exe
bytrligbyt.exe
bztrljdbwt.exe
czurmhezwr.exe
dywqlidbvt.exe
i_axvifaysqk.exe
i_bytrligbyt.exe
i_bztrljdbwt.exe
i_czurmhezwr.exe
i_dywqlidbvt.exe
i_xrpjhczupj.exe
lfaxsqkica.sys
olgeywqojg.sys
pjhezxrpjh.sys
qnigaysqki.sys
rojgbztrlj.sys
vtnlgdywqo.sys
xrpjhczupj.exe
autofill_bypass_cache_forms.json
edge_autofill_global_block_list.json
v1FieldTypes.json
settings.dat
settings.dat
BookmarkMergedSurfaceOrdering
BrowsingTopicsState
SiteList-Enterprise.json
HubApps
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Preferences
Preferences
Secure Preferences
sync_diagnostic.log
CURRENT
MANIFEST-000001
domain_actions.dll
Local State
Local State
Local State
Local State
Local State
Local State
Local State
metadata.json
metadata.json
metadata.json
metadata.json
3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
metadata.json
manifest.json
keys.json
manifest.json
manifest.json
manifest.json
memory/196-914-0x0000000000010000-0x0000000000083000-memory.dmp
memory/244-624-0x0000000000010000-0x0000000000083000-memory.dmp
memory/244-644-0x0000000000010000-0x0000000000083000-memory.dmp
memory/480-558-0x0000000000710000-0x000000000075B000-memory.dmp
memory/480-561-0x0000000000710000-0x000000000075B000-memory.dmp
memory/480-849-0x00000000009F0000-0x0000000000A3B000-memory.dmp
memory/480-859-0x00000000009F0000-0x0000000000A3B000-memory.dmp
memory/612-231-0x0000000000830000-0x00000000008F2000-memory.dmp
memory/716-595-0x0000000000960000-0x0000000000A22000-memory.dmp
memory/760-703-0x0000000000980000-0x00000000009CB000-memory.dmp
memory/760-705-0x0000000000980000-0x00000000009CB000-memory.dmp
memory/792-206-0x0000000000890000-0x0000000000952000-memory.dmp
memory/996-865-0x0000000000970000-0x0000000000A32000-memory.dmp
memory/1112-634-0x0000000000B30000-0x0000000000B7B000-memory.dmp
memory/1112-636-0x0000000000B30000-0x0000000000B7B000-memory.dmp
memory/1164-617-0x00000000009E0000-0x0000000000A2B000-memory.dmp
memory/1164-615-0x00000000009E0000-0x0000000000A2B000-memory.dmp
memory/1184-648-0x0000000000550000-0x000000000059B000-memory.dmp
memory/1184-646-0x0000000000550000-0x000000000059B000-memory.dmp
memory/1432-616-0x0000000000870000-0x0000000000932000-memory.dmp
memory/1500-622-0x0000000000420000-0x000000000046B000-memory.dmp
memory/1500-620-0x0000000000420000-0x000000000046B000-memory.dmp
memory/1624-603-0x0000000000980000-0x0000000000A42000-memory.dmp
memory/1756-649-0x00000000009C0000-0x0000000000A82000-memory.dmp
memory/1856-787-0x00000000008F0000-0x000000000093B000-memory.dmp
memory/1856-789-0x00000000008F0000-0x000000000093B000-memory.dmp
memory/1904-887-0x00000000008B0000-0x0000000000972000-memory.dmp
memory/2008-590-0x0000000000080000-0x00000000000CB000-memory.dmp
memory/2008-594-0x0000000000080000-0x00000000000CB000-memory.dmp
memory/2032-700-0x0000000000240000-0x000000000028B000-memory.dmp
memory/2032-698-0x0000000000240000-0x000000000028B000-memory.dmp
memory/2056-948-0x00000000009C0000-0x0000000000A82000-memory.dmp
memory/2068-744-0x0000000000A00000-0x0000000000AC2000-memory.dmp
memory/2208-532-0x0000000000970000-0x0000000000A32000-memory.dmp
memory/2244-239-0x000001FF83BF0000-0x000001FF83C4D000-memory.dmp
memory/2316-565-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2316-534-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2432-969-0x0000000000820000-0x00000000008E2000-memory.dmp
memory/2436-618-0x0000000000980000-0x0000000000A42000-memory.dmp
memory/2656-71-0x0000000000960000-0x0000000000A22000-memory.dmp
memory/2696-706-0x0000000000990000-0x0000000000A52000-memory.dmp
memory/2708-637-0x0000000000970000-0x0000000000A32000-memory.dmp
memory/2764-908-0x0000000000980000-0x0000000000A42000-memory.dmp
memory/2800-817-0x0000000000970000-0x0000000000A32000-memory.dmp
memory/2820-814-0x0000000000970000-0x00000000009BB000-memory.dmp
memory/2820-816-0x0000000000970000-0x00000000009BB000-memory.dmp
memory/2864-546-0x00000000009F0000-0x0000000000AB2000-memory.dmp
memory/2956-641-0x0000000000D20000-0x0000000000D6B000-memory.dmp
memory/2956-639-0x0000000000D20000-0x0000000000D6B000-memory.dmp
memory/2968-288-0x0000000000B20000-0x0000000000B6B000-memory.dmp
memory/2968-284-0x0000000000B20000-0x0000000000B6B000-memory.dmp
memory/3004-864-0x0000000000B80000-0x0000000000BCB000-memory.dmp
memory/3004-862-0x0000000000B80000-0x0000000000BCB000-memory.dmp
memory/3064-287-0x0000000000960000-0x0000000000A22000-memory.dmp
memory/3080-635-0x0000000000990000-0x0000000000A52000-memory.dmp
memory/3108-602-0x00000000002E0000-0x000000000032B000-memory.dmp
memory/3108-599-0x00000000002E0000-0x000000000032B000-memory.dmp
memory/3184-260-0x0000000000830000-0x00000000008F2000-memory.dmp
memory/3288-913-0x0000000000A00000-0x0000000000AC2000-memory.dmp
memory/3336-253-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3380-868-0x00000000009B0000-0x00000000009FB000-memory.dmp
memory/3380-886-0x00000000009B0000-0x00000000009FB000-memory.dmp
memory/3384-232-0x00000000000C0000-0x000000000010B000-memory.dmp
memory/3384-229-0x00000000000C0000-0x000000000010B000-memory.dmp
memory/3412-804-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3536-885-0x0000000000820000-0x00000000008E2000-memory.dmp
memory/3660-776-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3664-802-0x0000000000E00000-0x0000000000E4B000-memory.dmp
memory/3664-676-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3664-792-0x0000000000E00000-0x0000000000E4B000-memory.dmp
memory/3664-643-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3696-860-0x0000000000970000-0x0000000000A32000-memory.dmp
memory/3856-775-0x0000000000960000-0x0000000000A22000-memory.dmp
memory/3888-233-0x0000000000980000-0x0000000000A42000-memory.dmp
memory/3904-893-0x0000000000960000-0x0000000000A22000-memory.dmp
memory/3908-941-0x0000000000A80000-0x0000000000ACB000-memory.dmp
memory/3908-939-0x0000000000A80000-0x0000000000ACB000-memory.dmp
memory/3984-912-0x0000000000EC0000-0x0000000000F0B000-memory.dmp
memory/3984-910-0x0000000000EC0000-0x0000000000F0B000-memory.dmp
memory/4148-670-0x0000000000970000-0x0000000000A32000-memory.dmp
memory/4200-116-0x0000028D1BCE0000-0x0000028D1C09B000-memory.dmp
memory/4200-119-0x0000028D1DBD0000-0x0000028D1DC2D000-memory.dmp
memory/4220-790-0x0000000000970000-0x0000000000A32000-memory.dmp
memory/4256-738-0x0000000000990000-0x0000000000A52000-memory.dmp
memory/4260-0-0x00000000005A0000-0x00000000005EB000-memory.dmp
memory/4260-207-0x00000000005A0000-0x00000000005EB000-memory.dmp
memory/4268-623-0x0000000000A00000-0x0000000000AC2000-memory.dmp
memory/4272-707-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4356-262-0x0000000000880000-0x0000000000942000-memory.dmp
memory/4412-593-0x00000000009D0000-0x0000000000A92000-memory.dmp
memory/4476-935-0x0000000000820000-0x00000000008E2000-memory.dmp
memory/4624-815-0x0000000000990000-0x0000000000A52000-memory.dmp
memory/4664-764-0x0000000000DC0000-0x0000000000E0B000-memory.dmp
memory/4664-774-0x0000000000DC0000-0x0000000000E0B000-memory.dmp
memory/4676-907-0x0000000000700000-0x000000000074B000-memory.dmp
memory/4676-905-0x0000000000700000-0x000000000074B000-memory.dmp
memory/4852-677-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4864-250-0x0000000000960000-0x00000000009AB000-memory.dmp
memory/4864-237-0x0000000000960000-0x00000000009AB000-memory.dmp
memory/4892-701-0x0000000000960000-0x0000000000A22000-memory.dmp
memory/4932-209-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4936-261-0x0000000000490000-0x00000000004DB000-memory.dmp
memory/4936-257-0x0000000000490000-0x00000000004DB000-memory.dmp
memory/4956-562-0x00000000009D0000-0x0000000000A92000-memory.dmp
memory/4996-699-0x0000000000960000-0x0000000000A22000-memory.dmp
memory/5040-544-0x0000000000860000-0x0000000000922000-memory.dmp
memory/5052-725-0x0000000000250000-0x000000000029B000-memory.dmp
memory/5052-727-0x0000000000250000-0x000000000029B000-memory.dmp
memory/5092-647-0x00000000008D0000-0x0000000000992000-memory.dmp
memory/5108-275-0x0000000000600000-0x000000000064B000-memory.dmp
memory/5108-277-0x0000000000600000-0x000000000064B000-memory.dmp
memory/5116-251-0x0000000000990000-0x0000000000A52000-memory.dmp
memory/5132-605-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5228-894-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5228-735-0x0000000000BA0000-0x0000000000BEB000-memory.dmp
memory/5228-737-0x0000000000BA0000-0x0000000000BEB000-memory.dmp
memory/5228-866-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5280-946-0x0000000000840000-0x0000000000902000-memory.dmp
memory/5296-742-0x0000000000830000-0x00000000008F2000-memory.dmp
memory/5304-642-0x0000000000820000-0x00000000008E2000-memory.dmp
memory/5332-726-0x0000000000970000-0x0000000000A32000-memory.dmp
memory/5344-822-0x0000000000970000-0x0000000000A32000-memory.dmp
memory/5392-821-0x00000000005F0000-0x000000000063B000-memory.dmp
memory/5392-819-0x00000000005F0000-0x000000000063B000-memory.dmp
memory/5400-542-0x0000000000650000-0x000000000069B000-memory.dmp
memory/5400-545-0x0000000000650000-0x000000000069B000-memory.dmp
memory/5480-289-0x0000000000850000-0x0000000000912000-memory.dmp
memory/5536-564-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5612-743-0x0000000000B10000-0x0000000000B5B000-memory.dmp
memory/5612-741-0x0000000000B10000-0x0000000000B5B000-memory.dmp
memory/5628-777-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5628-739-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5664-847-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5688-803-0x0000000000960000-0x0000000000A22000-memory.dmp
memory/5700-278-0x0000000000960000-0x0000000000A22000-memory.dmp
memory/5704-728-0x0000000000990000-0x0000000000A52000-memory.dmp
memory/5704-280-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5720-198-0x0000000000160000-0x00000000001AB000-memory.dmp
memory/5720-205-0x0000000000160000-0x00000000001AB000-memory.dmp
memory/5784-858-0x0000000000960000-0x0000000000A22000-memory.dmp
memory/5832-936-0x0000000000630000-0x000000000067B000-memory.dmp
memory/5832-926-0x0000000000630000-0x000000000067B000-memory.dmp
memory/5852-293-0x0000000000AF0000-0x0000000000B3B000-memory.dmp
memory/5852-531-0x0000000000AF0000-0x0000000000B3B000-memory.dmp
memory/5864-669-0x0000000000610000-0x000000000065B000-memory.dmp
memory/5864-659-0x0000000000610000-0x000000000065B000-memory.dmp
memory/5864-942-0x0000000000990000-0x0000000000A52000-memory.dmp
memory/5912-70-0x0000000000080000-0x00000000000CB000-memory.dmp
memory/5912-67-0x0000000000080000-0x00000000000CB000-memory.dmp
memory/5928-906-0x0000000000990000-0x0000000000A52000-memory.dmp
memory/6000-937-0x0000000000960000-0x0000000000A22000-memory.dmp
memory/6048-69-0x0000000000870000-0x0000000000932000-memory.dmp
memory/6060-788-0x0000000000820000-0x00000000008E2000-memory.dmp
memory/6100-890-0x0000000000D00000-0x0000000000D4B000-memory.dmp
memory/6100-892-0x0000000000D00000-0x0000000000D4B000-memory.dmp
memory/6112-895-0x0000000000010000-0x0000000000083000-memory.dmp