Analysis
- max time kernel
150s - max time network
154s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
02/08/2026, 17:41
General
- Target 2026-08-02_8f5b74a1902afe823f160028eae38c83_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
- Size 291KB
- Sample260802-v9qrjayakh
- SHA256 c9d08ef5063bf75d196f3227c351d9c752ce68e72d3091fab44d49d70e17b2f4
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba8102
-
http://xytets.com:2345/ll/out.txt
-
http://xytets.com:2345/t.asp?os=home8102
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- UPX dump on OEP (original entry point) 64 IoCs
- Executes dropped EXE 64 IoCs
- UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 40 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 19 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 6 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 19 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_8f5b74a1902afe823f160028eae38c83_coinminer_elex_redline-stealer_rhadamanthys_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_8f5b74a1902afe823f160028eae38c83_coinminer_elex_redline-stealer_rhadamanthys_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home81022⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home8102"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x314,0x7ffc1c5bc188,0x7ffc1c5bc194,0x7ffc1c5bc1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2152,i,13633739341332706587,5688923573323932265,524288 --field-trial-handle=2364,i,16337294142117273178,10745718469259203594,262144 --variations-seed-version --mojo-platform-channel-handle=2408 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1936,i,7760020597714788564,13787459454508563861,262144 --field-trial-handle=2364,i,16337294142117273178,10745718469259203594,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2660,i,17954094030128767007,4657380753114265464,524288 --field-trial-handle=2364,i,16337294142117273178,10745718469259203594,262144 --variations-seed-version --mojo-platform-channel-handle=2892 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3576,i,7617593559660628448,10674959704505525196,2097152 --field-trial-handle=2364,i,16337294142117273178,10745718469259203594,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3580,i,9133231436715055736,2617571551264629568,2097152 --field-trial-handle=2364,i,16337294142117273178,10745718469259203594,262144 --variations-seed-version --mojo-platform-channel-handle=3720 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4288,i,12690069949661355017,4682417029636136373,2097152 --field-trial-handle=2364,i,16337294142117273178,10745718469259203594,262144 --variations-seed-version --mojo-platform-channel-handle=4456 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4300,i,5283520724816676166,17618265753013213734,2097152 --field-trial-handle=2364,i,16337294142117273178,10745718469259203594,262144 --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4336,i,8432452491089015638,16581980417474903461,2097152 --field-trial-handle=2364,i,16337294142117273178,10745718469259203594,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5500,i,17375519996695480171,15166047519085632238,2097152 --field-trial-handle=2364,i,16337294142117273178,10745718469259203594,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5656,i,2017134408830876448,10961771496559968909,524288 --field-trial-handle=2364,i,16337294142117273178,10745718469259203594,262144 --variations-seed-version --mojo-platform-channel-handle=5660 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4072,i,16152149901716988274,13683278900205520256,524288 --field-trial-handle=2364,i,16337294142117273178,10745718469259203594,262144 --variations-seed-version --mojo-platform-channel-handle=4000 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4060,i,17445123018169419112,1305196423676029772,524288 --field-trial-handle=2364,i,16337294142117273178,10745718469259203594,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6220,i,9456779588799853308,13157544155887779201,524288 --field-trial-handle=2364,i,16337294142117273178,10745718469259203594,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6220,i,9456779588799853308,13157544155887779201,524288 --field-trial-handle=2364,i,16337294142117273178,10745718469259203594,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6484,i,9283150790089159970,14655491300411602748,524288 --field-trial-handle=2364,i,16337294142117273178,10745718469259203594,262144 --variations-seed-version --mojo-platform-channel-handle=6492 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6480,i,18241995892191144604,8097600711659086373,524288 --field-trial-handle=2364,i,16337294142117273178,10745718469259203594,262144 --variations-seed-version --mojo-platform-channel-handle=6648 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6656,i,5538318858696096480,1418653849024416498,524288 --field-trial-handle=2364,i,16337294142117273178,10745718469259203594,262144 --variations-seed-version --mojo-platform-channel-handle=4076 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6484,i,18204101219328454560,2402416087321488948,524288 --field-trial-handle=2364,i,16337294142117273178,10745718469259203594,262144 --variations-seed-version --mojo-platform-channel-handle=6708 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1408,i,2904553169882740446,16490768541592309468,524288 --field-trial-handle=2364,i,16337294142117273178,10745718469259203594,262144 --variations-seed-version --mojo-platform-channel-handle=1392 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1428,i,12159143225376183293,7604144852059117758,524288 --field-trial-handle=2364,i,16337294142117273178,10745718469259203594,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1436,i,17131684976373079883,2919262319450026652,524288 --field-trial-handle=2364,i,16337294142117273178,10745718469259203594,262144 --variations-seed-version --mojo-platform-channel-handle=3948 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5752,i,9335608693753489508,9981557333281903173,524288 --field-trial-handle=2364,i,16337294142117273178,10745718469259203594,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,10930745068775414893,3180257526649835382,524288 --field-trial-handle=2364,i,16337294142117273178,10745718469259203594,262144 --variations-seed-version --mojo-platform-channel-handle=5740 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4064,i,4231833059204180489,12202406287332932216,524288 --field-trial-handle=2364,i,16337294142117273178,10745718469259203594,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1436,i,4828728014536724400,3671394362015222275,524288 --field-trial-handle=2364,i,16337294142117273178,10745718469259203594,262144 --variations-seed-version --mojo-platform-channel-handle=4028 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5376,i,3766329075612296906,17122144621412434044,524288 --field-trial-handle=2364,i,16337294142117273178,10745718469259203594,262144 --variations-seed-version --mojo-platform-channel-handle=5636 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5636,i,17121138096221297081,15463507180515963316,262144 --field-trial-handle=2364,i,16337294142117273178,10745718469259203594,262144 --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,16783522338694769999,16056678994998408571,524288 --field-trial-handle=2364,i,16337294142117273178,10745718469259203594,262144 --variations-seed-version --mojo-platform-channel-handle=3976 /prefetch:144⤵
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/ll/out.txt2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/ll/out.txt"3⤵
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\mhfzxsmkez.exe ups_run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\mhfzxsmkez.exeC:\Temp\mhfzxsmkez.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_mhfzxsmkez.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_mhfzxsmkez.exeC:\Temp\i_mhfzxsmkez.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\omjecwurmg.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\omjecwurmg.exeC:\Temp\omjecwurmg.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_omjecwurmg.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_omjecwurmg.exeC:\Temp\i_omjecwurmg.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ywtomgeywt.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\ywtomgeywt.exeC:\Temp\ywtomgeywt.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ywtomgeywt.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_ywtomgeywt.exeC:\Temp\i_ywtomgeywt.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ytqoigaywq.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\ytqoigaywq.exeC:\Temp\ytqoigaywq.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ytqoigaywq.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_ytqoigaywq.exeC:\Temp\i_ytqoigaywq.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\igaytqlida.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\igaytqlida.exeC:\Temp\igaytqlida.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_igaytqlida.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_igaytqlida.exeC:\Temp\i_igaytqlida.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\fdavsqkida.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\fdavsqkida.exeC:\Temp\fdavsqkida.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_fdavsqkida.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_fdavsqkida.exeC:\Temp\i_fdavsqkida.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\fzxspkhfax.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\fzxspkhfax.exeC:\Temp\fzxspkhfax.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_fzxspkhfax.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_fzxspkhfax.exeC:\Temp\i_fzxspkhfax.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\nkeczxrpmk.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\nkeczxrpmk.exeC:\Temp\nkeczxrpmk.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_nkeczxrpmk.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_nkeczxrpmk.exeC:\Temp\i_nkeczxrpmk.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ecxupmherp.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\ecxupmherp.exeC:\Temp\ecxupmherp.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ecxupmherp.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_ecxupmherp.exeC:\Temp\i_ecxupmherp.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\rpjhezwroj.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\rpjhezwroj.exeC:\Temp\rpjhezwroj.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_rpjhezwroj.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_rpjhezwroj.exeC:\Temp\i_rpjhezwroj.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\gdbwqojgbz.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\gdbwqojgbz.exeC:\Temp\gdbwqojgbz.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_gdbwqojgbz.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_gdbwqojgbz.exeC:\Temp\i_gdbwqojgbz.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\vtqoigdbvt.exe ups_run2⤵
-
C:\Temp\vtqoigdbvt.exeC:\Temp\vtqoigdbvt.exe ups_run3⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_vtqoigdbvt.exe ups_ins2⤵
-
C:\Temp\i_vtqoigdbvt.exeC:\Temp\i_vtqoigdbvt.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\tqoigbnlfd.exe ups_run2⤵
-
C:\Temp\tqoigbnlfd.exeC:\Temp\tqoigbnlfd.exe ups_run3⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_tqoigbnlfd.exe ups_ins2⤵
-
C:\Temp\i_tqoigbnlfd.exeC:\Temp\i_tqoigbnlfd.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\fdavsqkifd.exe ups_run2⤵
-
C:\Temp\fdavsqkifd.exeC:\Temp\fdavsqkifd.exe ups_run3⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_fdavsqkifd.exe ups_ins2⤵
-
C:\Temp\i_fdavsqkifd.exeC:\Temp\i_fdavsqkifd.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\sqkfdxvsnl.exe ups_run2⤵
-
C:\Temp\sqkfdxvsnl.exeC:\Temp\sqkfdxvsnl.exe ups_run3⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_sqkfdxvsnl.exe ups_ins2⤵
-
C:\Temp\i_sqkfdxvsnl.exeC:\Temp\i_sqkfdxvsnl.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\pnhfzxvsmk.exe ups_run2⤵
-
C:\Temp\pnhfzxvsmk.exeC:\Temp\pnhfzxvsmk.exe ups_run3⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_pnhfzxvsmk.exe ups_ins2⤵
-
C:\Temp\i_pnhfzxvsmk.exeC:\Temp\i_pnhfzxvsmk.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\pkhfzxjhfz.exe ups_run2⤵
-
C:\Temp\pkhfzxjhfz.exeC:\Temp\pkhfzxjhfz.exe ups_run3⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_pkhfzxjhfz.exe ups_ins2⤵
-
C:\Temp\i_pkhfzxjhfz.exeC:\Temp\i_pkhfzxjhfz.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\zurmjhbzur.exe ups_run2⤵
-
C:\Temp\zurmjhbzur.exeC:\Temp\zurmjhbzur.exe ups_run3⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_zurmjhbzur.exe ups_ins2⤵
-
C:\Temp\i_zurmjhbzur.exeC:\Temp\i_zurmjhbzur.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\mjebwtomge.exe ups_run2⤵
-
C:\Temp\mjebwtomge.exeC:\Temp\mjebwtomge.exe ups_run3⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_mjebwtomge.exe ups_ins2⤵
-
C:\Temp\i_mjebwtomge.exeC:\Temp\i_mjebwtomge.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\oigebwtomg.exe ups_run2⤵
-
C:\Temp\oigebwtomg.exeC:\Temp\oigebwtomg.exe ups_run3⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Temp\wromgecwur.sysC:\Temp\wromgecwur.sys1⤵
- Executes dropped EXE
-
C:\Temp\hbztrljebw.sysC:\Temp\hbztrljebw.sys1⤵
- Executes dropped EXE
-
C:\Temp\jdbvtoljdb.sysC:\Temp\jdbvtoljdb.sys1⤵
- Executes dropped EXE
-
C:\Temp\lfdaytoifd.sysC:\Temp\lfdaytoifd.sys1⤵
- Executes dropped EXE
-
C:\Temp\nlidavtnif.sysC:\Temp\nlidavtnif.sys1⤵
- Executes dropped EXE
-
C:\Temp\faxspnkica.sysC:\Temp\faxspnkica.sys1⤵
- Executes dropped EXE
-
C:\Temp\nhfzxspkic.sysC:\Temp\nhfzxspkic.sys1⤵
- Executes dropped EXE
-
C:\Temp\hfzxupnhfz.sysC:\Temp\hfzxupnhfz.sys1⤵
- Executes dropped EXE
-
C:\Temp\xuomhezwur.sysC:\Temp\xuomhezwur.sys1⤵
- Executes dropped EXE
-
C:\Temp\gebwtomgeb.sysC:\Temp\gebwtomgeb.sys1⤵
- Executes dropped EXE
-
C:\Temp\eywqomywtr.sysC:\Temp\eywqomywtr.sys1⤵
-
C:\Temp\bywqoigbyt.sysC:\Temp\bywqoigbyt.sys1⤵
-
C:\Temp\ligaysqkid.sysC:\Temp\ligaysqkid.sys1⤵
-
C:\Temp\axsqkicaxs.sysC:\Temp\axsqkicaxs.sys1⤵
-
C:\Temp\xspkicsmkh.sysC:\Temp\xspkicsmkh.sys1⤵
-
C:\Temp\pnhfzxusmk.sysC:\Temp\pnhfzxusmk.sys1⤵
-
C:\Temp\bzxrpjhbzu.sysC:\Temp\bzxrpjhbzu.sys1⤵
-
C:\Temp\omhbzwuomg.sysC:\Temp\omhbzwuomg.sys1⤵
-
C:\Temp\wuomjebomg.sysC:\Temp\wuomjebomg.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CP.exe
fdavsqkida.exe
hbztrljebw.sys
i_igaytqlida.exe
i_mhfzxsmkez.exe
i_omjecwurmg.exe
i_ytqoigaywq.exe
i_ywtomgeywt.exe
igaytqlida.exe
jdbvtoljdb.sys
lfdaytoifd.sys
mhfzxsmkez.exe
nlidavtnif.sys
omjecwurmg.exe
wromgecwur.sys
ytqoigaywq.exe
ywtomgeywt.exe
settings.dat
settings.dat
the-real-index
the-real-index~RFe596f2b.TMP
SiteList-Enterprise.json
Edge Profile.ico
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Preferences
Preferences
Preferences
Secure Preferences
OperationConfig
OperationConfig~RFe5a0ade.TMP
Local State
Local State
Local State
Local State
Local State
Local State
metadata.json
metadata.json
metadata.json
metadata.json
299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
6b87dfab-8989-40e2-97a5-4b965678edff.tmp
metadata.json
f66241b4-b233-4b86-bdcd-3828caf59eae.tmp
content_new.js
memory/772-514-0x0000000000010000-0x0000000000083000-memory.dmp
memory/840-724-0x0000000000170000-0x00000000001BB000-memory.dmp
memory/840-723-0x0000000000170000-0x00000000001BB000-memory.dmp
memory/1136-770-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1204-609-0x00000000002F0000-0x000000000033B000-memory.dmp
memory/1204-608-0x00000000002F0000-0x000000000033B000-memory.dmp
memory/1396-675-0x00000000004E0000-0x000000000052B000-memory.dmp
memory/1396-674-0x00000000004E0000-0x000000000052B000-memory.dmp
memory/1416-583-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1596-696-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1596-646-0x0000000000AE0000-0x0000000000B2B000-memory.dmp
memory/1596-644-0x0000000000AE0000-0x0000000000B2B000-memory.dmp
memory/1608-469-0x0000000000670000-0x00000000006BB000-memory.dmp
memory/1608-480-0x0000000000670000-0x00000000006BB000-memory.dmp
memory/1704-791-0x0000000000450000-0x000000000049B000-memory.dmp
memory/1704-776-0x0000000000450000-0x000000000049B000-memory.dmp
memory/1744-695-0x00000000004B0000-0x00000000004FB000-memory.dmp
memory/1744-678-0x00000000004B0000-0x00000000004FB000-memory.dmp
memory/1808-489-0x00000000008F0000-0x000000000093B000-memory.dmp
memory/1808-486-0x00000000008F0000-0x000000000093B000-memory.dmp
memory/1932-637-0x0000000000CA0000-0x0000000000CEB000-memory.dmp
memory/1932-642-0x0000000000CA0000-0x0000000000CEB000-memory.dmp
memory/1940-630-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1972-733-0x00000000006F0000-0x000000000073B000-memory.dmp
memory/1972-735-0x00000000006F0000-0x000000000073B000-memory.dmp
memory/2132-482-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2212-427-0x00000000009F0000-0x0000000000A3B000-memory.dmp
memory/2212-0-0x00000000009F0000-0x0000000000A3B000-memory.dmp
memory/2244-80-0x0000000000AE0000-0x0000000000B2B000-memory.dmp
memory/2244-74-0x0000000000AE0000-0x0000000000B2B000-memory.dmp
memory/2284-767-0x0000000000810000-0x000000000085B000-memory.dmp
memory/2284-769-0x0000000000810000-0x000000000085B000-memory.dmp
memory/2308-537-0x00000000000F0000-0x000000000013B000-memory.dmp
memory/2308-534-0x00000000000F0000-0x000000000013B000-memory.dmp
memory/2360-657-0x0000000000800000-0x000000000084B000-memory.dmp
memory/2360-658-0x0000000000800000-0x000000000084B000-memory.dmp
memory/2480-575-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2660-773-0x0000000000230000-0x000000000027B000-memory.dmp
memory/2660-774-0x0000000000230000-0x000000000027B000-memory.dmp
memory/3264-562-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3336-521-0x0000000000BA0000-0x0000000000BEB000-memory.dmp
memory/3336-518-0x0000000000BA0000-0x0000000000BEB000-memory.dmp
memory/3668-629-0x0000000000A80000-0x0000000000ACB000-memory.dmp
memory/3668-611-0x0000000000A80000-0x0000000000ACB000-memory.dmp
memory/3776-701-0x0000000000E60000-0x0000000000EAB000-memory.dmp
memory/3776-711-0x0000000000E60000-0x0000000000EAB000-memory.dmp
memory/3872-509-0x0000000000230000-0x000000000027B000-memory.dmp
memory/3872-512-0x0000000000230000-0x000000000027B000-memory.dmp
memory/3928-602-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3960-760-0x0000000000BE0000-0x0000000000C2B000-memory.dmp
memory/3960-742-0x0000000000BE0000-0x0000000000C2B000-memory.dmp
memory/4084-736-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4172-721-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4172-712-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4208-660-0x0000000000B00000-0x0000000000B4B000-memory.dmp
memory/4208-670-0x0000000000B00000-0x0000000000B4B000-memory.dmp
memory/4280-717-0x0000000000720000-0x000000000076B000-memory.dmp
memory/4280-719-0x0000000000720000-0x000000000076B000-memory.dmp
memory/4408-566-0x00000000002F0000-0x000000000033B000-memory.dmp
memory/4408-569-0x00000000002F0000-0x000000000033B000-memory.dmp
memory/4624-714-0x0000000000500000-0x000000000054B000-memory.dmp
memory/4624-715-0x0000000000500000-0x000000000054B000-memory.dmp
memory/4672-765-0x0000000000A80000-0x0000000000ACB000-memory.dmp
memory/4672-764-0x0000000000A80000-0x0000000000ACB000-memory.dmp
memory/4724-549-0x0000000000EA0000-0x0000000000EEB000-memory.dmp
memory/4724-552-0x0000000000EA0000-0x0000000000EEB000-memory.dmp
memory/4752-429-0x0000000000970000-0x00000000009BB000-memory.dmp
memory/4752-425-0x0000000000970000-0x00000000009BB000-memory.dmp
memory/4780-738-0x0000000000550000-0x000000000059B000-memory.dmp
memory/4780-739-0x0000000000550000-0x000000000059B000-memory.dmp
memory/4824-588-0x0000000000180000-0x00000000001CB000-memory.dmp
memory/4824-601-0x0000000000180000-0x00000000001CB000-memory.dmp
memory/4832-528-0x0000000000240000-0x000000000028B000-memory.dmp
memory/4832-525-0x0000000000240000-0x000000000028B000-memory.dmp
memory/4852-698-0x0000000000F20000-0x0000000000F6B000-memory.dmp
memory/4852-699-0x0000000000F20000-0x0000000000F6B000-memory.dmp
memory/4960-672-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5268-530-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5284-582-0x0000000000130000-0x000000000017B000-memory.dmp
memory/5284-580-0x0000000000130000-0x000000000017B000-memory.dmp
memory/5384-794-0x00000000006A0000-0x00000000006EB000-memory.dmp
memory/5724-586-0x0000000000D40000-0x0000000000D8B000-memory.dmp
memory/5724-585-0x0000000000D40000-0x0000000000D8B000-memory.dmp
memory/5724-433-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5748-577-0x0000000000CF0000-0x0000000000D3B000-memory.dmp
memory/5748-578-0x0000000000CF0000-0x0000000000D3B000-memory.dmp
memory/5776-465-0x0000000000170000-0x00000000001BB000-memory.dmp
memory/5776-462-0x0000000000170000-0x00000000001BB000-memory.dmp
memory/5868-720-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5880-574-0x0000000000B00000-0x0000000000B4B000-memory.dmp
memory/5880-572-0x0000000000B00000-0x0000000000B4B000-memory.dmp
memory/5924-771-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5924-761-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5940-647-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5940-671-0x0000000000010000-0x0000000000083000-memory.dmp
memory/6068-792-0x0000000000010000-0x0000000000083000-memory.dmp