Analysis
- max time kernel
149s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260617-en - resource tags
- submitted
29/06/2026, 04:41
General
- Target 2026-06-27_9bc0075c89411e9db4024dc722f7daf6_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
- Size 291KB
- Sample260629-fa5zvads7x
- SHA256 1f2fc206bb5b24452cac4a3038bd47c69861f0a9804330c500f57504702d5a83
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba8102
-
http://xytets.com:2345/ll/out.txt
-
http://xytets.com:2345/t.asp?os=home8102
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- UPX dump on OEP (original entry point) 64 IoCs
- Executes dropped EXE 64 IoCs
- UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Windows directory 10 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 6 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 19 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
- Suspicious use of AdjustPrivilegeToken 20 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-27_9bc0075c89411e9db4024dc722f7daf6_coinminer_elex_redline-stealer_rhadamanthys_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-27_9bc0075c89411e9db4024dc722f7daf6_coinminer_elex_redline-stealer_rhadamanthys_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home81022⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home8102"3⤵
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/ll/out.txt2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/ll/out.txt"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x2bc,0x7ff90533c188,0x7ff90533c194,0x7ff90533c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2144,i,13435885336153219654,1128828451104563587,524288 --field-trial-handle=2552,i,9875429226132590867,4539301358009774094,262144 --variations-seed-version --mojo-platform-channel-handle=2632 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1964,i,10793490857320257531,4591022529722012919,262144 --field-trial-handle=2552,i,9875429226132590867,4539301358009774094,262144 --variations-seed-version --mojo-platform-channel-handle=2548 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2656,i,4934669626082159370,73648549374039088,524288 --field-trial-handle=2552,i,9875429226132590867,4539301358009774094,262144 --variations-seed-version --mojo-platform-channel-handle=2824 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3632,i,11531503693283802837,7851833089837914402,2097152 --field-trial-handle=2552,i,9875429226132590867,4539301358009774094,262144 --variations-seed-version --mojo-platform-channel-handle=3844 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3636,i,14459113112925683223,14484095689202317005,2097152 --field-trial-handle=2552,i,9875429226132590867,4539301358009774094,262144 --variations-seed-version --mojo-platform-channel-handle=3832 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4264,i,5447669512317801610,18364636362327589314,2097152 --field-trial-handle=2552,i,9875429226132590867,4539301358009774094,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4276,i,8073883483773975119,7469127817611811976,2097152 --field-trial-handle=2552,i,9875429226132590867,4539301358009774094,262144 --variations-seed-version --mojo-platform-channel-handle=3848 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4428,i,853532160092313938,7706440819625935439,2097152 --field-trial-handle=2552,i,9875429226132590867,4539301358009774094,262144 --variations-seed-version --mojo-platform-channel-handle=4092 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3988,i,4264657281160466208,4888484474301850417,524288 --field-trial-handle=2552,i,9875429226132590867,4539301358009774094,262144 --variations-seed-version --mojo-platform-channel-handle=3940 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5544,i,17623980368740684948,14361268429928560001,524288 --field-trial-handle=2552,i,9875429226132590867,4539301358009774094,262144 --variations-seed-version --mojo-platform-channel-handle=5672 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5528,i,17370281643033927227,13839304101694497872,524288 --field-trial-handle=2552,i,9875429226132590867,4539301358009774094,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6248,i,16177061811933001002,15501470170706922562,524288 --field-trial-handle=2552,i,9875429226132590867,4539301358009774094,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6248,i,16177061811933001002,15501470170706922562,524288 --field-trial-handle=2552,i,9875429226132590867,4539301358009774094,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6492,i,8960718560400765544,14689638865448347577,524288 --field-trial-handle=2552,i,9875429226132590867,4539301358009774094,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6860,i,5878785411404869434,6860477355805896960,524288 --field-trial-handle=2552,i,9875429226132590867,4539301358009774094,262144 --variations-seed-version --mojo-platform-channel-handle=6868 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3560,i,7967755157763451070,16694821651083721730,524288 --field-trial-handle=2552,i,9875429226132590867,4539301358009774094,262144 --variations-seed-version --mojo-platform-channel-handle=1276 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4272,i,9957935252446008200,7952901464435621902,524288 --field-trial-handle=2552,i,9875429226132590867,4539301358009774094,262144 --variations-seed-version --mojo-platform-channel-handle=4900 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4500,i,17071396089744177304,16130505671896951785,524288 --field-trial-handle=2552,i,9875429226132590867,4539301358009774094,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5548,i,3458907241372713716,13215880202697378655,524288 --field-trial-handle=2552,i,9875429226132590867,4539301358009774094,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6404,i,16132494523280345773,7343692552043831883,524288 --field-trial-handle=2552,i,9875429226132590867,4539301358009774094,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5724,i,6698429821516330265,2417195166204556561,524288 --field-trial-handle=2552,i,9875429226132590867,4539301358009774094,262144 --variations-seed-version --mojo-platform-channel-handle=6692 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6408,i,12396484244213985029,8840602554562081188,524288 --field-trial-handle=2552,i,9875429226132590867,4539301358009774094,262144 --variations-seed-version --mojo-platform-channel-handle=6596 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6336,i,17732943374708472353,8235162292285230533,262144 --field-trial-handle=2552,i,9875429226132590867,4539301358009774094,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6836,i,14839516782589159152,17343730736759420286,524288 --field-trial-handle=2552,i,9875429226132590867,4539301358009774094,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:144⤵
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ecxvpnhcap.exe ups_run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\ecxvpnhcap.exeC:\Temp\ecxvpnhcap.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ecxvpnhcap.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_ecxvpnhcap.exeC:\Temp\i_ecxvpnhcap.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\zurpjhfzxr.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\zurpjhfzxr.exeC:\Temp\zurpjhfzxr.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_zurpjhfzxr.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_zurpjhfzxr.exeC:\Temp\i_zurpjhfzxr.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ecwuomgebz.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\ecwuomgebz.exeC:\Temp\ecwuomgebz.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ecwuomgebz.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_ecwuomgebz.exeC:\Temp\i_ecwuomgebz.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\wtrljgeywr.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\wtrljgeywr.exeC:\Temp\wtrljgeywr.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_wtrljgeywr.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_wtrljgeywr.exeC:\Temp\i_wtrljgeywr.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\idbvtnlgdy.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\idbvtnlgdy.exeC:\Temp\idbvtnlgdy.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_idbvtnlgdy.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_idbvtnlgdy.exeC:\Temp\i_idbvtnlgdy.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\nlidbvtnli.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\nlidbvtnli.exeC:\Temp\nlidbvtnli.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_nlidbvtnli.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_nlidbvtnli.exeC:\Temp\i_nlidbvtnli.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\vqnifaysqn.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\vqnifaysqn.exeC:\Temp\vqnifaysqn.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_vqnifaysqn.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_vqnifaysqn.exeC:\Temp\i_vqnifaysqn.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\hfzxvpnhfa.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\hfzxvpnhfa.exeC:\Temp\hfzxvpnhfa.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_hfzxvpnhfa.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_hfzxvpnhfa.exeC:\Temp\i_hfzxvpnhfa.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\xrpkhczusp.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\xrpkhczusp.exeC:\Temp\xrpkhczusp.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_xrpkhczusp.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_xrpkhczusp.exeC:\Temp\i_xrpkhczusp.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\zxrpjhczur.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\zxrpjhczur.exeC:\Temp\zxrpjhczur.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_zxrpjhczur.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_zxrpjhczur.exeC:\Temp\i_zxrpjhczur.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\mkezwuomhe.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\mkezwuomhe.exeC:\Temp\mkezwuomhe.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_mkezwuomhe.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_mkezwuomhe.exeC:\Temp\i_mkezwuomhe.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\jhbztrljdb.exe ups_run2⤵
-
C:\Temp\jhbztrljdb.exeC:\Temp\jhbztrljdb.exe ups_run3⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_jhbztrljdb.exe ups_ins2⤵
-
C:\Temp\i_jhbztrljdb.exeC:\Temp\i_jhbztrljdb.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\bvtoljebwt.exe ups_run2⤵
-
C:\Temp\bvtoljebwt.exeC:\Temp\bvtoljebwt.exe ups_run3⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_bvtoljebwt.exe ups_ins2⤵
-
C:\Temp\i_bvtoljebwt.exeC:\Temp\i_bvtoljebwt.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\dbvtolgdyv.exe ups_run2⤵
-
C:\Temp\dbvtolgdyv.exeC:\Temp\dbvtolgdyv.exe ups_run3⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_dbvtolgdyv.exe ups_ins2⤵
-
C:\Temp\i_dbvtolgdyv.exeC:\Temp\i_dbvtolgdyv.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\tqlidaysqk.exe ups_run2⤵
-
C:\Temp\tqlidaysqk.exeC:\Temp\tqlidaysqk.exe ups_run3⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_tqlidaysqk.exe ups_ins2⤵
-
C:\Temp\i_tqlidaysqk.exeC:\Temp\i_tqlidaysqk.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\snlfdxvsnl.exe ups_run2⤵
-
C:\Temp\snlfdxvsnl.exeC:\Temp\snlfdxvsnl.exe ups_run3⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_snlfdxvsnl.exe ups_ins2⤵
-
C:\Temp\i_snlfdxvsnl.exeC:\Temp\i_snlfdxvsnl.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\hfvpnhfcxs.exe ups_run2⤵
-
C:\Temp\hfvpnhfcxs.exeC:\Temp\hfvpnhfcxs.exe ups_run3⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_hfvpnhfcxs.exe ups_ins2⤵
-
C:\Temp\i_hfvpnhfcxs.exeC:\Temp\i_hfvpnhfcxs.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\hczusmkfcx.exe ups_run2⤵
-
C:\Temp\hczusmkfcx.exeC:\Temp\hczusmkfcx.exe ups_run3⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_hczusmkfcx.exe ups_ins2⤵
-
C:\Temp\i_hczusmkfcx.exeC:\Temp\i_hczusmkfcx.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\czusmhecwu.exe ups_run2⤵
-
C:\Temp\czusmhecwu.exeC:\Temp\czusmhecwu.exe ups_run3⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_czusmhecwu.exe ups_ins2⤵
-
C:\Temp\i_czusmhecwu.exeC:\Temp\i_czusmhecwu.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\urljebwuom.exe ups_run2⤵
-
C:\Temp\urljebwuom.exeC:\Temp\urljebwuom.exe ups_run3⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_urljebwuom.exe ups_ins2⤵
-
C:\Temp\i_urljebwuom.exeC:\Temp\i_urljebwuom.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Temp\czurmkecwu.sysC:\Temp\czurmkecwu.sys1⤵
- Executes dropped EXE
-
C:\Temp\hezwuomjec.sysC:\Temp\hezwuomjec.sys1⤵
- Executes dropped EXE
-
C:\Temp\jhtrljdbwt.sysC:\Temp\jhtrljdbwt.sys1⤵
- Executes dropped EXE
-
C:\Temp\vtoljdbywq.sysC:\Temp\vtoljdbywq.sys1⤵
- Executes dropped EXE
-
C:\Temp\nlfdbvtnlg.sysC:\Temp\nlfdbvtnlg.sys1⤵
- Executes dropped EXE
-
C:\Temp\xvsqnigays.sysC:\Temp\xvsqnigays.sys1⤵
- Executes dropped EXE
-
C:\Temp\xnifaysqki.sysC:\Temp\xnifaysqki.sys1⤵
- Executes dropped EXE
-
C:\Temp\ifzxvsqkhf.sysC:\Temp\ifzxvsqkhf.sys1⤵
- Executes dropped EXE
-
C:\Temp\zxrpmhecxu.sysC:\Temp\zxrpmhecxu.sys1⤵
- Executes dropped EXE
-
C:\Temp\urmkecwuom.sysC:\Temp\urmkecwuom.sys1⤵
- Executes dropped EXE
-
C:\Temp\gebztrmjeb.sysC:\Temp\gebztrmjeb.sys1⤵
-
C:\Temp\jebwtrljge.sysC:\Temp\jebwtrljge.sys1⤵
-
C:\Temp\aytqljdbvt.sysC:\Temp\aytqljdbvt.sys1⤵
-
C:\Temp\ysqlidavsq.sysC:\Temp\ysqlidavsq.sys1⤵
-
C:\Temp\aysqfaxvpn.sysC:\Temp\aysqfaxvpn.sys1⤵
-
C:\Temp\sqkicavsnk.sysC:\Temp\sqkicavsnk.sys1⤵
-
C:\Temp\czxupnhfcx.sysC:\Temp\czxupnhfcx.sys1⤵
-
C:\Temp\eczurmkecw.sysC:\Temp\eczurmkecw.sys1⤵
-
C:\Temp\zwurmjwuom.sysC:\Temp\zwurmjwuom.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CP.exe
czurmkecwu.sys
ecwuomgebz.exe
ecxvpnhcap.exe
hezwuomjec.sys
i_ecwuomgebz.exe
i_ecxvpnhcap.exe
i_idbvtnlgdy.exe
i_nlidbvtnli.exe
i_wtrljgeywr.exe
i_zurpjhfzxr.exe
idbvtnlgdy.exe
jhtrljdbwt.sys
nlfdbvtnlg.sys
nlidbvtnli.exe
vtoljdbywq.sys
wtrljgeywr.exe
zurpjhfzxr.exe
settings.dat
settings.dat
553bf3cb-e0b7-4e66-be74-401f69ade30c.tmp
BookmarkMergedSurfaceOrdering
the-real-index
SiteList-Enterprise.json
Edge Profile.ico
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Preferences
Preferences
Secure Preferences
sync_diagnostic.log
Local State
Local State
Local State
Local State
Local State
metadata.json
metadata.json
metadata.json
metadata.json
c00cebc0-2c01-482d-8d3a-bb85769034a9.tmp
content_new.js
memory/824-195-0x0000000000390000-0x00000000003DB000-memory.dmp
memory/824-200-0x0000000000390000-0x00000000003DB000-memory.dmp
memory/1320-371-0x0000000000140000-0x000000000018B000-memory.dmp
memory/1320-369-0x0000000000140000-0x000000000018B000-memory.dmp
memory/1400-548-0x00000000005F0000-0x000000000063B000-memory.dmp
memory/1400-538-0x00000000005F0000-0x000000000063B000-memory.dmp
memory/1700-500-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1816-458-0x0000000000970000-0x00000000009BB000-memory.dmp
memory/1816-460-0x0000000000970000-0x00000000009BB000-memory.dmp
memory/2008-503-0x00000000003B0000-0x00000000003FB000-memory.dmp
memory/2008-502-0x00000000003B0000-0x00000000003FB000-memory.dmp
memory/2072-463-0x0000000000080000-0x00000000000CB000-memory.dmp
memory/2072-472-0x0000000000080000-0x00000000000CB000-memory.dmp
memory/2436-203-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2460-549-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2476-290-0x0000000000590000-0x00000000005DB000-memory.dmp
memory/2476-287-0x0000000000590000-0x00000000005DB000-memory.dmp
memory/2508-364-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2512-311-0x0000000000C90000-0x0000000000CDB000-memory.dmp
memory/2512-314-0x0000000000C90000-0x0000000000CDB000-memory.dmp
memory/2680-484-0x0000000001000000-0x000000000104B000-memory.dmp
memory/2680-567-0x0000000000A80000-0x0000000000ACB000-memory.dmp
memory/2680-482-0x0000000001000000-0x000000000104B000-memory.dmp
memory/2924-353-0x0000000000940000-0x000000000098B000-memory.dmp
memory/2924-355-0x0000000000940000-0x000000000098B000-memory.dmp
memory/2956-201-0x00000000008C0000-0x000000000090B000-memory.dmp
memory/2956-0-0x00000000008C0000-0x000000000090B000-memory.dmp
memory/3000-431-0x0000000000800000-0x000000000084B000-memory.dmp
memory/3000-432-0x0000000000800000-0x000000000084B000-memory.dmp
memory/3016-367-0x00000000001A0000-0x00000000001EB000-memory.dmp
memory/3016-366-0x00000000001A0000-0x00000000001EB000-memory.dmp
memory/3204-219-0x0000000000720000-0x000000000076B000-memory.dmp
memory/3204-232-0x0000000000720000-0x000000000076B000-memory.dmp
memory/3260-306-0x0000000000A30000-0x0000000000A7B000-memory.dmp
memory/3260-303-0x0000000000A30000-0x0000000000A7B000-memory.dmp
memory/3344-252-0x0000000000A00000-0x0000000000A4B000-memory.dmp
memory/3344-241-0x0000000000A00000-0x0000000000A4B000-memory.dmp
memory/3348-372-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3356-316-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3356-348-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3364-536-0x0000000000EC0000-0x0000000000F0B000-memory.dmp
memory/3364-535-0x0000000000EC0000-0x0000000000F0B000-memory.dmp
memory/3384-405-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3400-487-0x0000000000D80000-0x0000000000DCB000-memory.dmp
memory/3400-488-0x0000000000D80000-0x0000000000DCB000-memory.dmp
memory/3464-530-0x0000000000FB0000-0x0000000000FFB000-memory.dmp
memory/3464-532-0x0000000000FB0000-0x0000000000FFB000-memory.dmp
memory/3548-533-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3568-407-0x00000000006D0000-0x000000000071B000-memory.dmp
memory/3568-408-0x00000000006D0000-0x000000000071B000-memory.dmp
memory/3660-294-0x0000000000810000-0x000000000085B000-memory.dmp
memory/3660-297-0x0000000000810000-0x000000000085B000-memory.dmp
memory/3820-429-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4068-485-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4068-434-0x0000000000AF0000-0x0000000000B3B000-memory.dmp
memory/4068-445-0x0000000000AF0000-0x0000000000B3B000-memory.dmp
memory/4152-490-0x0000000000590000-0x00000000005DB000-memory.dmp
memory/4152-499-0x0000000000590000-0x00000000005DB000-memory.dmp
memory/4204-350-0x0000000000580000-0x00000000005CB000-memory.dmp
memory/4204-351-0x0000000000580000-0x00000000005CB000-memory.dmp
memory/4360-281-0x0000000000AF0000-0x0000000000B3B000-memory.dmp
memory/4360-273-0x0000000000AF0000-0x0000000000B3B000-memory.dmp
memory/4420-299-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4420-356-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4560-420-0x0000000000DF0000-0x0000000000E3B000-memory.dmp
memory/4560-418-0x0000000000DF0000-0x0000000000E3B000-memory.dmp
memory/4740-564-0x00000000000E0000-0x000000000012B000-memory.dmp
memory/4740-565-0x00000000000E0000-0x000000000012B000-memory.dmp
memory/4792-508-0x00000000003B0000-0x00000000003FB000-memory.dmp
memory/4792-505-0x00000000003B0000-0x00000000003FB000-memory.dmp
memory/4912-336-0x0000000000A40000-0x0000000000A8B000-memory.dmp
memory/4912-339-0x0000000000A40000-0x0000000000A8B000-memory.dmp
memory/5076-509-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5088-390-0x0000000000B80000-0x0000000000BCB000-memory.dmp
memory/5088-391-0x0000000000B80000-0x0000000000BCB000-memory.dmp
memory/5176-261-0x0000000000EC0000-0x0000000000F0B000-memory.dmp
memory/5176-258-0x0000000000EC0000-0x0000000000F0B000-memory.dmp
memory/5336-73-0x0000000000ED0000-0x0000000000F1B000-memory.dmp
memory/5336-70-0x0000000000ED0000-0x0000000000F1B000-memory.dmp
memory/5368-446-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5416-527-0x0000000000520000-0x000000000056B000-memory.dmp
memory/5416-528-0x0000000000520000-0x000000000056B000-memory.dmp
memory/5480-347-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5544-404-0x00000000002B0000-0x00000000002FB000-memory.dmp
memory/5544-398-0x00000000002B0000-0x00000000002FB000-memory.dmp
memory/5792-456-0x0000000000700000-0x000000000074B000-memory.dmp
memory/5792-455-0x0000000000700000-0x000000000074B000-memory.dmp
memory/5836-461-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5920-359-0x00000000003D0000-0x000000000041B000-memory.dmp
memory/5920-358-0x00000000003D0000-0x000000000041B000-memory.dmp
memory/5952-254-0x0000000000010000-0x0000000000083000-memory.dmp
memory/6052-363-0x0000000000C50000-0x0000000000C9B000-memory.dmp
memory/6052-361-0x0000000000C50000-0x0000000000C9B000-memory.dmp
memory/6088-283-0x0000000000010000-0x0000000000083000-memory.dmp
memory/6124-346-0x0000000000850000-0x000000000089B000-memory.dmp
memory/6124-343-0x0000000000850000-0x000000000089B000-memory.dmp