Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
10/05/2026, 12:59
General
- Target 2026-05-10_d3d9c88a722d3163e5888eb6de39f529_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
- Size 291KB
- Sample260510-p8a2ssct9m
- SHA256 5efd8f9f288751ce94d56ac85a78e92c2bef4fee18c51c9d45721af8ab45afef
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba8102
-
http://xytets.com:2345/ll/out.txt
-
http://xytets.com:2345/t.asp?os=home8102
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Custom signatureUPX dump on OEP (original entry point) 64 IoCs
- Executes dropped EXE 64 IoCs
- Loads dropped DLL 1 IoCs
- UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 40 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 19 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 48 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 3 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 19 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_d3d9c88a722d3163e5888eb6de39f529_coinminer_elex_redline-stealer_rhadamanthys_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-10_d3d9c88a722d3163e5888eb6de39f529_coinminer_elex_redline-stealer_rhadamanthys_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home81022⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home8102"3⤵
- Loads dropped DLL
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x1ec,0x7ffc04ccc188,0x7ffc04ccc194,0x7ffc04ccc1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1688,i,13652866501413872193,12230681684364198685,262144 --field-trial-handle=2180,i,13323976757649563847,5113509928944206120,262144 --variations-seed-version --mojo-platform-channel-handle=2128 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1900,i,13267672668665233914,15063002691179555125,524288 --field-trial-handle=2180,i,13323976757649563847,5113509928944206120,262144 --variations-seed-version --mojo-platform-channel-handle=2216 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2440,i,12620807113098437246,5953778063214782612,524288 --field-trial-handle=2180,i,13323976757649563847,5113509928944206120,262144 --variations-seed-version --mojo-platform-channel-handle=3156 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,17316381905864287535,17570483289783951418,2097152 --field-trial-handle=2180,i,13323976757649563847,5113509928944206120,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,11694618127659853814,7643320425403536091,2097152 --field-trial-handle=2180,i,13323976757649563847,5113509928944206120,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4200,i,16910360265884830916,10823036506135103001,2097152 --field-trial-handle=2180,i,13323976757649563847,5113509928944206120,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5076,i,12678524700344029629,16117059161574077916,524288 --field-trial-handle=2180,i,13323976757649563847,5113509928944206120,262144 --variations-seed-version --mojo-platform-channel-handle=5104 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5080,i,1355311013681448673,5107957477255278709,524288 --field-trial-handle=2180,i,13323976757649563847,5113509928944206120,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5936,i,11625583874906289308,14369071457548677844,524288 --field-trial-handle=2180,i,13323976757649563847,5113509928944206120,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5936,i,11625583874906289308,14369071457548677844,524288 --field-trial-handle=2180,i,13323976757649563847,5113509928944206120,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5668,i,8529965939396026481,7179171122870637323,524288 --field-trial-handle=2180,i,13323976757649563847,5113509928944206120,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:144⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.execookie_exporter.exe --cookie-json=10845⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6160,i,4237873786563338630,13186868002554115122,524288 --field-trial-handle=2180,i,13323976757649563847,5113509928944206120,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6452,i,11394144295060266247,3798776299959983451,524288 --field-trial-handle=2180,i,13323976757649563847,5113509928944206120,262144 --variations-seed-version --mojo-platform-channel-handle=728 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6020,i,17686967674064921214,15755356592594847363,524288 --field-trial-handle=2180,i,13323976757649563847,5113509928944206120,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6468,i,17336437625119913559,8239466360218365501,524288 --field-trial-handle=2180,i,13323976757649563847,5113509928944206120,262144 --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6472,i,17892908757428168830,9590844551907037101,524288 --field-trial-handle=2180,i,13323976757649563847,5113509928944206120,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5252,i,8590872748553425453,14050027701446264398,524288 --field-trial-handle=2180,i,13323976757649563847,5113509928944206120,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5380,i,11596441008630326280,7657098584120183121,524288 --field-trial-handle=2180,i,13323976757649563847,5113509928944206120,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6388,i,16567294818135447853,12184166617369156026,524288 --field-trial-handle=2180,i,13323976757649563847,5113509928944206120,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=864,i,10049292003356332648,13098321118124571851,524288 --field-trial-handle=2180,i,13323976757649563847,5113509928944206120,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5656,i,6716410674973362965,14598174587800695486,262144 --field-trial-handle=2180,i,13323976757649563847,5113509928944206120,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6416,i,4875594749361048265,17326436561990698089,524288 --field-trial-handle=2180,i,13323976757649563847,5113509928944206120,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:144⤵
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/ll/out.txt2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/ll/out.txt"3⤵
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\fcxvpnfdxv.exe ups_run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\fcxvpnfdxv.exeC:\Temp\fcxvpnfdxv.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_fcxvpnfdxv.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_fcxvpnfdxv.exeC:\Temp\i_fcxvpnfdxv.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\zxspkhcaus.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\zxspkhcaus.exeC:\Temp\zxspkhcaus.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_zxspkhcaus.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_zxspkhcaus.exeC:\Temp\i_zxspkhcaus.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\xrmjecwuom.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\xrmjecwuom.exeC:\Temp\xrmjecwuom.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_xrmjecwuom.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_xrmjecwuom.exeC:\Temp\i_xrmjecwuom.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\mgeywrojgb.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\mgeywrojgb.exeC:\Temp\mgeywrojgb.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_mgeywrojgb.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_mgeywrojgb.exeC:\Temp\i_mgeywrojgb.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\bwtoigbytr.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\bwtoigbytr.exeC:\Temp\bwtoigbytr.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_bwtoigbytr.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_bwtoigbytr.exeC:\Temp\i_bwtoigbytr.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\bwqoigbytr.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\bwqoigbytr.exeC:\Temp\bwqoigbytr.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_bwqoigbytr.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_bwqoigbytr.exeC:\Temp\i_bwqoigbytr.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\igaysnlfdy.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\igaysnlfdy.exeC:\Temp\igaysnlfdy.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_igaysnlfdy.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_igaysnlfdy.exeC:\Temp\i_igaysnlfdy.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\fdxvpnifav.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\fdxvpnifav.exeC:\Temp\fdxvpnifav.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_fdxvpnifav.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_fdxvpnifav.exeC:\Temp\i_fdxvpnifav.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\cxvpnkfdxv.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\cxvpnkfdxv.exeC:\Temp\cxvpnkfdxv.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_cxvpnkfdxv.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_cxvpnkfdxv.exeC:\Temp\i_cxvpnkfdxv.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\khcausmkec.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\khcausmkec.exeC:\Temp\khcausmkec.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_khcausmkec.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_khcausmkec.exeC:\Temp\i_khcausmkec.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\pjhczusmhb.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\pjhczusmhb.exeC:\Temp\pjhczusmhb.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_pjhczusmhb.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_pjhczusmhb.exeC:\Temp\i_pjhczusmhb.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\mjecwuomge.exe ups_run2⤵
-
C:\Temp\mjecwuomge.exeC:\Temp\mjecwuomge.exe ups_run3⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_mjecwuomge.exe ups_ins2⤵
-
C:\Temp\i_mjecwuomge.exeC:\Temp\i_mjecwuomge.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\jdbwtolgey.exe ups_run2⤵
-
C:\Temp\jdbwtolgey.exeC:\Temp\jdbwtolgey.exe ups_run3⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_jdbwtolgey.exe ups_ins2⤵
-
C:\Temp\i_jdbwtolgey.exeC:\Temp\i_jdbwtolgey.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\bytqljdbvt.exe ups_run2⤵
-
C:\Temp\bytqljdbvt.exeC:\Temp\bytqljdbvt.exe ups_run3⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_bytqljdbvt.exe ups_ins2⤵
-
C:\Temp\i_bytqljdbvt.exeC:\Temp\i_bytqljdbvt.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\qoigaysqlg.exe ups_run2⤵
-
C:\Temp\qoigaysqlg.exeC:\Temp\qoigaysqlg.exe ups_run3⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_qoigaysqlg.exe ups_ins2⤵
-
C:\Temp\i_qoigaysqlg.exeC:\Temp\i_qoigaysqlg.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\yvqnifaysq.exe ups_run2⤵
-
C:\Temp\yvqnifaysq.exeC:\Temp\yvqnifaysq.exe ups_run3⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_yvqnifaysq.exe ups_ins2⤵
-
C:\Temp\i_yvqnifaysq.exeC:\Temp\i_yvqnifaysq.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\avsnhfdxvp.exe ups_run2⤵
-
C:\Temp\avsnhfdxvp.exeC:\Temp\avsnhfdxvp.exe ups_run3⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_avsnhfdxvp.exe ups_ins2⤵
-
C:\Temp\i_avsnhfdxvp.exeC:\Temp\i_avsnhfdxvp.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\kecwupmhfz.exe ups_run2⤵
-
C:\Temp\kecwupmhfz.exeC:\Temp\kecwupmhfz.exe ups_run3⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_kecwupmhfz.exe ups_ins2⤵
-
C:\Temp\i_kecwupmhfz.exeC:\Temp\i_kecwupmhfz.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\fzxrmkhczu.exe ups_run2⤵
-
C:\Temp\fzxrmkhczu.exeC:\Temp\fzxrmkhczu.exe ups_run3⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_fzxrmkhczu.exe ups_ins2⤵
-
C:\Temp\i_fzxrmkhczu.exeC:\Temp\i_fzxrmkhczu.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Temp\mkecaxspki.sysC:\Temp\mkecaxspki.sys1⤵
- Executes dropped EXE
-
C:\Temp\bzurmkecwu.sysC:\Temp\bzurmkecwu.sys1⤵
- Executes dropped EXE
-
C:\Temp\ezxromhezm.sysC:\Temp\ezxromhezm.sys1⤵
- Executes dropped EXE
-
C:\Temp\wrojhbztrl.sysC:\Temp\wrojhbztrl.sys1⤵
- Executes dropped EXE
-
C:\Temp\ldbytrljdb.sysC:\Temp\ldbytrljdb.sys1⤵
- Executes dropped EXE
-
C:\Temp\qoigaysqli.sysC:\Temp\qoigaysqli.sys1⤵
- Executes dropped EXE
-
C:\Temp\nkidxvpnif.sysC:\Temp\nkidxvpnif.sys1⤵
- Executes dropped EXE
-
C:\Temp\vpnhfaxsqk.sysC:\Temp\vpnhfaxsqk.sys1⤵
- Executes dropped EXE
-
C:\Temp\xusmkfcxsp.sysC:\Temp\xusmkfcxsp.sys1⤵
- Executes dropped EXE
-
C:\Temp\wuomhezxrp.sysC:\Temp\wuomhezxrp.sys1⤵
- Executes dropped EXE
-
C:\Temp\zxrmjeczur.sysC:\Temp\zxrmjeczur.sys1⤵
-
C:\Temp\ywrojhtrlj.sysC:\Temp\ywrojhtrlj.sys1⤵
-
C:\Temp\vtomgeywqo.sysC:\Temp\vtomgeywqo.sys1⤵
-
C:\Temp\bvtnlgdyvq.sysC:\Temp\bvtnlgdyvq.sys1⤵
-
C:\Temp\nidavtnlfd.sysC:\Temp\nidavtnlfd.sys1⤵
-
C:\Temp\nkfdxvpnhf.sysC:\Temp\nkfdxvpnhf.sys1⤵
-
C:\Temp\causmkfaxs.sysC:\Temp\causmkfaxs.sys1⤵
-
C:\Temp\mkecxupnhf.sysC:\Temp\mkecxupnhf.sys1⤵
-
C:\Temp\wuomhezwro.sysC:\Temp\wuomhezwro.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CP.exe
bwqoigbytr.exe
bwtoigbytr.exe
bzurmkecwu.sys
ezxromhezm.sys
fcxvpnfdxv.exe
i_bwqoigbytr.exe
i_bwtoigbytr.exe
i_fcxvpnfdxv.exe
i_mgeywrojgb.exe
i_xrmjecwuom.exe
i_zxspkhcaus.exe
ldbytrljdb.sys
mgeywrojgb.exe
mkecaxspki.sys
qoigaysqli.sys
wrojhbztrl.sys
xrmjecwuom.exe
zxspkhcaus.exe
settings.dat
settings.dat
BookmarkMergedSurfaceOrdering
BrowsingTopicsState
SiteList-Enterprise.json
HubApps
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Preferences
Preferences
Secure Preferences
sync_diagnostic.log
CURRENT
MANIFEST-000001
domain_actions.dll
Local State
Local State
Local State
Local State
Local State
Local State
Local State
metadata.json
metadata.json
metadata.json
metadata.json
3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
metadata.json
manifest.json
manifest.json
keys.json
manifest.json
memory/340-66-0x0000000000E70000-0x0000000000EBB000-memory.dmp
memory/340-70-0x0000000000E70000-0x0000000000EBB000-memory.dmp
memory/724-647-0x0000000000D80000-0x0000000000DCB000-memory.dmp
memory/724-648-0x0000000000D80000-0x0000000000DCB000-memory.dmp
memory/764-759-0x0000000000010000-0x0000000000083000-memory.dmp
memory/796-857-0x0000000000010000-0x0000000000083000-memory.dmp
memory/912-541-0x0000000000490000-0x00000000004DB000-memory.dmp
memory/912-543-0x0000000000490000-0x00000000004DB000-memory.dmp
memory/1004-883-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1008-204-0x0000000000490000-0x00000000004DB000-memory.dmp
memory/1008-197-0x0000000000490000-0x00000000004DB000-memory.dmp
memory/1160-691-0x0000000000A50000-0x0000000000A9B000-memory.dmp
memory/1160-693-0x0000000000A50000-0x0000000000A9B000-memory.dmp
memory/1276-270-0x00000000005D0000-0x000000000061B000-memory.dmp
memory/1276-267-0x00000000005D0000-0x000000000061B000-memory.dmp
memory/1296-206-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1764-840-0x0000000000B30000-0x0000000000B7B000-memory.dmp
memory/1764-838-0x0000000000B30000-0x0000000000B7B000-memory.dmp
memory/1772-827-0x0000000000D30000-0x0000000000D7B000-memory.dmp
memory/1772-836-0x0000000000D30000-0x0000000000D7B000-memory.dmp
memory/1776-229-0x0000000000FA0000-0x0000000000FEB000-memory.dmp
memory/1776-226-0x0000000000FA0000-0x0000000000FEB000-memory.dmp
memory/1792-715-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1792-758-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1824-233-0x000001F19C250000-0x000001F19C36E000-memory.dmp
memory/1888-877-0x00000000004F0000-0x000000000053B000-memory.dmp
memory/1888-878-0x00000000004F0000-0x000000000053B000-memory.dmp
memory/1952-806-0x0000000000BF0000-0x0000000000C3B000-memory.dmp
memory/1952-804-0x0000000000BF0000-0x0000000000C3B000-memory.dmp
memory/2080-524-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2080-272-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2632-637-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2632-659-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2696-704-0x00000000009A0000-0x00000000009EB000-memory.dmp
memory/2696-705-0x00000000009A0000-0x00000000009EB000-memory.dmp
memory/2788-808-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2788-799-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2940-587-0x00000000000B0000-0x00000000000FB000-memory.dmp
memory/2940-585-0x00000000000B0000-0x00000000000FB000-memory.dmp
memory/3008-276-0x00000000009C0000-0x0000000000A0B000-memory.dmp
memory/3008-279-0x00000000009C0000-0x0000000000A0B000-memory.dmp
memory/3100-591-0x0000000000AB0000-0x0000000000AFB000-memory.dmp
memory/3100-592-0x0000000000AB0000-0x0000000000AFB000-memory.dmp
memory/3180-757-0x0000000000C70000-0x0000000000CBB000-memory.dmp
memory/3180-747-0x0000000000C70000-0x0000000000CBB000-memory.dmp
memory/3228-798-0x0000000000470000-0x00000000004BB000-memory.dmp
memory/3228-796-0x0000000000470000-0x00000000004BB000-memory.dmp
memory/3244-761-0x0000000000920000-0x000000000096B000-memory.dmp
memory/3244-762-0x0000000000920000-0x000000000096B000-memory.dmp
memory/3420-807-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3756-578-0x0000000000F00000-0x0000000000F4B000-memory.dmp
memory/3756-580-0x0000000000F00000-0x0000000000F4B000-memory.dmp
memory/3876-613-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4164-550-0x0000000000B50000-0x0000000000B9B000-memory.dmp
memory/4164-548-0x0000000000B50000-0x0000000000B9B000-memory.dmp
memory/4220-255-0x00000000009D0000-0x0000000000A1B000-memory.dmp
memory/4220-252-0x00000000009D0000-0x0000000000A1B000-memory.dmp
memory/4336-801-0x0000000000DF0000-0x0000000000E3B000-memory.dmp
memory/4336-802-0x0000000000DF0000-0x0000000000E3B000-memory.dmp
memory/4492-523-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4492-653-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4772-727-0x0000000000FA0000-0x0000000000FEB000-memory.dmp
memory/4772-726-0x0000000000FA0000-0x0000000000FEB000-memory.dmp
memory/4788-616-0x00000000000D0000-0x000000000011B000-memory.dmp
memory/4788-615-0x00000000000D0000-0x000000000011B000-memory.dmp
memory/4800-248-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4864-207-0x00000000004E0000-0x000000000052B000-memory.dmp
memory/4864-0-0x00000000004E0000-0x000000000052B000-memory.dmp
memory/4900-694-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4980-610-0x0000000000CE0000-0x0000000000D2B000-memory.dmp
memory/4980-612-0x0000000000CE0000-0x0000000000D2B000-memory.dmp
memory/5012-234-0x00000000005C0000-0x000000000060B000-memory.dmp
memory/5012-246-0x00000000005C0000-0x000000000060B000-memory.dmp
memory/5108-841-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5172-589-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5220-880-0x0000000000680000-0x00000000006CB000-memory.dmp
memory/5220-882-0x0000000000680000-0x00000000006CB000-memory.dmp
memory/5520-650-0x0000000000840000-0x000000000088B000-memory.dmp
memory/5520-652-0x0000000000840000-0x000000000088B000-memory.dmp
memory/5608-856-0x00000000003E0000-0x000000000042B000-memory.dmp
memory/5608-846-0x00000000003E0000-0x000000000042B000-memory.dmp
memory/5668-777-0x0000000000F10000-0x0000000000F5B000-memory.dmp
memory/5668-778-0x0000000000F10000-0x0000000000F5B000-memory.dmp
memory/5684-283-0x00000000006A0000-0x00000000006EB000-memory.dmp
memory/5684-521-0x00000000006A0000-0x00000000006EB000-memory.dmp
memory/5688-775-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5700-618-0x0000000000C10000-0x0000000000C5B000-memory.dmp
memory/5700-636-0x0000000000C10000-0x0000000000C5B000-memory.dmp
memory/5872-774-0x0000000000020000-0x000000000006B000-memory.dmp
memory/5872-764-0x0000000000020000-0x000000000006B000-memory.dmp
memory/5900-568-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5948-843-0x00000000009E0000-0x0000000000A2B000-memory.dmp
memory/5948-844-0x00000000009E0000-0x0000000000A2B000-memory.dmp
memory/5976-712-0x0000000000E10000-0x0000000000E5B000-memory.dmp
memory/5976-714-0x0000000000E10000-0x0000000000E5B000-memory.dmp
memory/6056-689-0x0000000000D70000-0x0000000000DBB000-memory.dmp
memory/6056-680-0x0000000000D70000-0x0000000000DBB000-memory.dmp