Analysis
- max time kernel
149s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
27/08/2026, 08:45
General
- Target 2026-08-27_c63d805f0da316e7bde9f3a93cac8bab_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
- Size 291KB
- Sample260827-kntaessapf
- SHA256 644baab65e8144897bde260f66d09fc458117fda94a5ef785d320aa2f9e12c3c
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba8102
-
http://xytets.com:2345/ll/out.txt
-
http://xytets.com:2345/t.asp?os=home8102
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- UPX dump on OEP (original entry point) 64 IoCs
- Executes dropped EXE 64 IoCs
- UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 6 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 19 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
- Suspicious use of AdjustPrivilegeToken 20 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-27_c63d805f0da316e7bde9f3a93cac8bab_coinminer_elex_redline-stealer_rhadamanthys_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-27_c63d805f0da316e7bde9f3a93cac8bab_coinminer_elex_redline-stealer_rhadamanthys_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home81022⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home8102"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x354,0x7ff92d78c188,0x7ff92d78c194,0x7ff92d78c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2084,i,1095019858467768534,11296461308338815985,524288 --field-trial-handle=2552,i,9708788862149908114,4652021949974792477,262144 --variations-seed-version --mojo-platform-channel-handle=2588 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1900,i,16356946534086972785,11001712719578108750,262144 --field-trial-handle=2552,i,9708788862149908114,4652021949974792477,262144 --variations-seed-version --mojo-platform-channel-handle=2548 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2632,i,1815738372203390926,18054243918345016769,524288 --field-trial-handle=2552,i,9708788862149908114,4652021949974792477,262144 --variations-seed-version --mojo-platform-channel-handle=2848 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3592,i,3401126387606826319,18273461465927946907,2097152 --field-trial-handle=2552,i,9708788862149908114,4652021949974792477,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3600,i,11617970532822343279,7021964490407068620,2097152 --field-trial-handle=2552,i,9708788862149908114,4652021949974792477,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4344,i,15136924684166614517,17886291978090320191,2097152 --field-trial-handle=2552,i,9708788862149908114,4652021949974792477,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4448,i,16872887455421219270,10143427755937351405,2097152 --field-trial-handle=2552,i,9708788862149908114,4652021949974792477,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4376,i,11336567202360342535,2370670585611261905,2097152 --field-trial-handle=2552,i,9708788862149908114,4652021949974792477,262144 --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5452,i,3783519110614370091,17860476702611137705,524288 --field-trial-handle=2552,i,9708788862149908114,4652021949974792477,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5380,i,13629747493709699269,16402559644469955133,524288 --field-trial-handle=2552,i,9708788862149908114,4652021949974792477,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5472,i,2621564210035178385,6155916503773197892,524288 --field-trial-handle=2552,i,9708788862149908114,4652021949974792477,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6092,i,6811501020663630680,5087167290151731964,524288 --field-trial-handle=2552,i,9708788862149908114,4652021949974792477,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6092,i,6811501020663630680,5087167290151731964,524288 --field-trial-handle=2552,i,9708788862149908114,4652021949974792477,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6472,i,4188382599856374619,9470030758372818606,524288 --field-trial-handle=2552,i,9708788862149908114,4652021949974792477,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6664,i,13152003250317772265,10903970581706366641,524288 --field-trial-handle=2552,i,9708788862149908114,4652021949974792477,262144 --variations-seed-version --mojo-platform-channel-handle=6668 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6864,i,8811085871074187058,16800645806327342863,524288 --field-trial-handle=2552,i,9708788862149908114,4652021949974792477,262144 --variations-seed-version --mojo-platform-channel-handle=6876 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6928,i,4846349021173266915,1658120269951076422,524288 --field-trial-handle=2552,i,9708788862149908114,4652021949974792477,262144 --variations-seed-version --mojo-platform-channel-handle=6812 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4500,i,6773122667086161656,5622578891477826706,524288 --field-trial-handle=2552,i,9708788862149908114,4652021949974792477,262144 --variations-seed-version --mojo-platform-channel-handle=1140 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4760,i,4907983109397079668,2713146708669157251,524288 --field-trial-handle=2552,i,9708788862149908114,4652021949974792477,262144 --variations-seed-version --mojo-platform-channel-handle=1280 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4528,i,6962098873090847204,9621180779661621910,524288 --field-trial-handle=2552,i,9708788862149908114,4652021949974792477,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5476,i,1836926649431687794,14890774384049015505,524288 --field-trial-handle=2552,i,9708788862149908114,4652021949974792477,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6476,i,2330341352299192352,1678612111762148241,524288 --field-trial-handle=2552,i,9708788862149908114,4652021949974792477,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=920,i,17355799609431159508,14066404668654354295,524288 --field-trial-handle=2552,i,9708788862149908114,4652021949974792477,262144 --variations-seed-version --mojo-platform-channel-handle=6532 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6376,i,8620776222407848976,15685759466017469926,262144 --field-trial-handle=2552,i,9708788862149908114,4652021949974792477,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5584,i,13365214448912412650,11792039548708318920,524288 --field-trial-handle=2552,i,9708788862149908114,4652021949974792477,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:144⤵
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/ll/out.txt2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/ll/out.txt"3⤵
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\wuomhezwoj.exe ups_run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\wuomhezwoj.exeC:\Temp\wuomhezwoj.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_wuomhezwoj.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_wuomhezwoj.exeC:\Temp\i_wuomhezwoj.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\jgbywtrlje.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\jgbywtrlje.exeC:\Temp\jgbywtrlje.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_jgbywtrlje.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_jgbywtrlje.exeC:\Temp\i_jgbywtrlje.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\jdywtolgey.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\jdywtolgey.exeC:\Temp\jdywtolgey.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_jdywtolgey.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_jdywtolgey.exeC:\Temp\i_jdywtolgey.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ayvqnljday.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\ayvqnljday.exeC:\Temp\ayvqnljday.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ayvqnljday.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_ayvqnljday.exeC:\Temp\i_ayvqnljday.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\aysqkicavs.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\aysqkicavs.exeC:\Temp\aysqkicavs.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_aysqkicavs.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_aysqkicavs.exeC:\Temp\i_aysqkicavs.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\nhfaxvpnkf.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\nhfaxvpnkf.exeC:\Temp\nhfaxvpnkf.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_nhfaxvpnkf.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_nhfaxvpnkf.exeC:\Temp\i_nhfaxvpnkf.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\nhfcaupnkf.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\nhfcaupnkf.exeC:\Temp\nhfcaupnkf.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_nhfcaupnkf.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_nhfcaupnkf.exeC:\Temp\i_nhfcaupnkf.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\kecxupmhfz.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\kecxupmhfz.exeC:\Temp\kecxupmhfz.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_kecxupmhfz.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_kecxupmhfz.exeC:\Temp\i_kecxupmhfz.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\hezwromkec.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\hezwromkec.exeC:\Temp\hezwromkec.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_hezwromkec.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_hezwromkec.exeC:\Temp\i_hezwromkec.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\trljdbzwro.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\trljdbzwro.exeC:\Temp\trljdbzwro.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_trljdbzwro.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_trljdbzwro.exeC:\Temp\i_trljdbzwro.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\wtomgebwtq.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\wtomgebwtq.exeC:\Temp\wtomgebwtq.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_wtomgebwtq.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_wtomgebwtq.exeC:\Temp\i_wtomgebwtq.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\rljdbwtolg.exe ups_run2⤵
-
C:\Temp\rljdbwtolg.exeC:\Temp\rljdbwtolg.exe ups_run3⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_rljdbwtolg.exe ups_ins2⤵
-
C:\Temp\i_rljdbwtolg.exeC:\Temp\i_rljdbwtolg.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\davsqnlfdy.exe ups_run2⤵
-
C:\Temp\davsqnlfdy.exeC:\Temp\davsqnlfdy.exe ups_run3⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_davsqnlfdy.exe ups_ins2⤵
-
C:\Temp\i_davsqnlfdy.exeC:\Temp\i_davsqnlfdy.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\icausqkica.exe ups_run2⤵
-
C:\Temp\icausqkica.exeC:\Temp\icausqkica.exe ups_run3⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_icausqkica.exe ups_ins2⤵
-
C:\Temp\i_icausqkica.exeC:\Temp\i_icausqkica.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\kfdxvpnhfa.exe ups_run2⤵
-
C:\Temp\kfdxvpnhfa.exeC:\Temp\kfdxvpnhfa.exe ups_run3⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_kfdxvpnhfa.exe ups_ins2⤵
-
C:\Temp\i_kfdxvpnhfa.exeC:\Temp\i_kfdxvpnhfa.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\iczxupmkec.exe ups_run2⤵
-
C:\Temp\iczxupmkec.exeC:\Temp\iczxupmkec.exe ups_run3⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_iczxupmkec.exe ups_ins2⤵
-
C:\Temp\i_iczxupmkec.exeC:\Temp\i_iczxupmkec.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\xrpjebzurm.exe ups_run2⤵
-
C:\Temp\xrpjebzurm.exeC:\Temp\xrpjebzurm.exe ups_run3⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_xrpjebzurm.exe ups_ins2⤵
-
C:\Temp\i_xrpjebzurm.exeC:\Temp\i_xrpjebzurm.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\omjebzwrom.exe ups_run2⤵
-
C:\Temp\omjebzwrom.exeC:\Temp\omjebzwrom.exe ups_run3⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_omjebzwrom.exe ups_ins2⤵
-
C:\Temp\i_omjebzwrom.exeC:\Temp\i_omjebzwrom.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\trljdbwtom.exe ups_run2⤵
-
C:\Temp\trljdbwtom.exeC:\Temp\trljdbwtom.exe ups_run3⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_trljdbwtom.exe ups_ins2⤵
-
C:\Temp\i_trljdbwtom.exeC:\Temp\i_trljdbwtom.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\jgbywqolgd.exe ups_run2⤵
-
C:\Temp\jgbywqolgd.exeC:\Temp\jgbywqolgd.exe ups_run3⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_jgbywqolgd.exe ups_ins2⤵
-
C:\Temp\i_jgbywqolgd.exeC:\Temp\i_jgbywqolgd.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Temp\bwuomgebzt.sysC:\Temp\bwuomgebzt.sys1⤵
- Executes dropped EXE
-
C:\Temp\jdbztrljdb.sysC:\Temp\jdbztrljdb.sys1⤵
- Executes dropped EXE
-
C:\Temp\aysqlidbvt.sysC:\Temp\aysqlidbvt.sys1⤵
- Executes dropped EXE
-
C:\Temp\faxvtnlfda.sysC:\Temp\faxvtnlfda.sys1⤵
- Executes dropped EXE
-
C:\Temp\gaxsqkicav.sysC:\Temp\gaxsqkicav.sys1⤵
- Executes dropped EXE
-
C:\Temp\kicaxspnkf.sysC:\Temp\kicaxspnkf.sys1⤵
- Executes dropped EXE
-
C:\Temp\khcausmkec.sysC:\Temp\khcausmkec.sys1⤵
- Executes dropped EXE
-
C:\Temp\jhbztrpmhe.sysC:\Temp\jhbztrpmhe.sys1⤵
- Executes dropped EXE
-
C:\Temp\gecwuomgez.sysC:\Temp\gecwuomgez.sys1⤵
- Executes dropped EXE
-
C:\Temp\ztrljgeywu.sysC:\Temp\ztrljgeywu.sys1⤵
- Executes dropped EXE
-
C:\Temp\ligeywqoig.sysC:\Temp\ligeywqoig.sys1⤵
-
C:\Temp\idavtnlfda.sysC:\Temp\idavtnlfda.sys1⤵
-
C:\Temp\qkigdxvsnl.sysC:\Temp\qkigdxvsnl.sys1⤵
-
C:\Temp\nkfdxvpnlf.sysC:\Temp\nkfdxvpnlf.sys1⤵
-
C:\Temp\fcauspkhfc.sysC:\Temp\fcauspkhfc.sys1⤵
-
C:\Temp\ezxrpjhczu.sysC:\Temp\ezxrpjhczu.sys1⤵
-
C:\Temp\wrpmhezxuo.sysC:\Temp\wrpmhezxuo.sys1⤵
-
C:\Temp\ztrojgeywr.sysC:\Temp\ztrojgeywr.sys1⤵
-
C:\Temp\gdbvtolgdb.sysC:\Temp\gdbvtolgdb.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CP.exe
aysqkicavs.exe
aysqlidbvt.sys
ayvqnljday.exe
bwuomgebzt.sys
faxvtnlfda.sys
gaxsqkicav.sys
i_aysqkicavs.exe
i_ayvqnljday.exe
i_jdywtolgey.exe
i_jgbywtrlje.exe
i_wuomhezwoj.exe
jdbztrljdb.sys
jdywtolgey.exe
jgbywtrlje.exe
nhfaxvpnkf.exe
wuomhezwoj.exe
settings.dat
settings.dat
the-real-index
the-real-index~RFe598708.TMP
SiteList-Enterprise.json
Edge Profile.ico
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Preferences
Preferences
Preferences
Secure Preferences
OperationConfig
OperationConfig~RFe5a2973.TMP
Local State
Local State
Local State
Local State
Local State
Local State
metadata.json
metadata.json
metadata.json
56a4c99c-9158-4a79-b3d6-b5f1a030fd5e.tmp
e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
metadata.json~RFe595e53.TMP
c4289720-dc60-43df-be28-59ec6f9b4e96.tmp
content_new.js
memory/796-505-0x0000000000EC0000-0x0000000000F0B000-memory.dmp
memory/796-508-0x0000000000EC0000-0x0000000000F0B000-memory.dmp
memory/968-732-0x0000000000520000-0x000000000056B000-memory.dmp
memory/968-733-0x0000000000520000-0x000000000056B000-memory.dmp
memory/1620-605-0x0000000000FA0000-0x0000000000FEB000-memory.dmp
memory/1620-607-0x0000000000FA0000-0x0000000000FEB000-memory.dmp
memory/1724-698-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1724-682-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1780-701-0x0000000000BF0000-0x0000000000C3B000-memory.dmp
memory/1780-700-0x0000000000BF0000-0x0000000000C3B000-memory.dmp
memory/1800-581-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1880-542-0x0000000000640000-0x000000000068B000-memory.dmp
memory/1880-539-0x0000000000640000-0x000000000068B000-memory.dmp
memory/1960-517-0x0000000000E30000-0x0000000000E7B000-memory.dmp
memory/1960-514-0x0000000000E30000-0x0000000000E7B000-memory.dmp
memory/2240-738-0x0000000000EE0000-0x0000000000F2B000-memory.dmp
memory/2240-735-0x0000000000EE0000-0x0000000000F2B000-memory.dmp
memory/2316-781-0x00000000007F0000-0x000000000083B000-memory.dmp
memory/2316-782-0x00000000007F0000-0x000000000083B000-memory.dmp
memory/2344-632-0x0000000000450000-0x000000000049B000-memory.dmp
memory/2344-631-0x0000000000450000-0x000000000049B000-memory.dmp
memory/2428-685-0x0000000000610000-0x000000000065B000-memory.dmp
memory/2428-684-0x0000000000610000-0x000000000065B000-memory.dmp
memory/2532-510-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2532-528-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2572-670-0x0000000000FC0000-0x000000000100B000-memory.dmp
memory/2572-681-0x0000000000FC0000-0x000000000100B000-memory.dmp
memory/2596-0-0x0000000000E40000-0x0000000000E8B000-memory.dmp
memory/2596-423-0x0000000000E40000-0x0000000000E8B000-memory.dmp
memory/2664-478-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2768-703-0x0000000000710000-0x000000000075B000-memory.dmp
memory/2768-705-0x0000000000710000-0x000000000075B000-memory.dmp
memory/2896-573-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2940-644-0x0000000000440000-0x000000000048B000-memory.dmp
memory/2940-643-0x0000000000440000-0x000000000048B000-memory.dmp
memory/3036-739-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3036-755-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3180-723-0x00000000005C0000-0x000000000060B000-memory.dmp
memory/3180-724-0x00000000005C0000-0x000000000060B000-memory.dmp
memory/3276-570-0x00000000003D0000-0x000000000041B000-memory.dmp
memory/3276-572-0x00000000003D0000-0x000000000041B000-memory.dmp
memory/3352-567-0x0000000000740000-0x000000000078B000-memory.dmp
memory/3352-564-0x0000000000740000-0x000000000078B000-memory.dmp
memory/3376-485-0x0000000000220000-0x000000000026B000-memory.dmp
memory/3376-482-0x0000000000220000-0x000000000026B000-memory.dmp
memory/3412-591-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3464-532-0x0000000000E70000-0x0000000000EBB000-memory.dmp
memory/3464-535-0x0000000000E70000-0x0000000000EBB000-memory.dmp
memory/3576-526-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3576-578-0x00000000009C0000-0x0000000000A0B000-memory.dmp
memory/3576-580-0x00000000009C0000-0x0000000000A0B000-memory.dmp
memory/3820-425-0x0000000000620000-0x000000000066B000-memory.dmp
memory/3820-421-0x0000000000620000-0x000000000066B000-memory.dmp
memory/4112-758-0x0000000000090000-0x00000000000DB000-memory.dmp
memory/4112-759-0x0000000000090000-0x00000000000DB000-memory.dmp
memory/4136-761-0x00000000009D0000-0x0000000000A1B000-memory.dmp
memory/4136-779-0x00000000009D0000-0x0000000000A1B000-memory.dmp
memory/4212-730-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4232-588-0x0000000000250000-0x000000000029B000-memory.dmp
memory/4232-586-0x0000000000250000-0x000000000029B000-memory.dmp
memory/4244-726-0x0000000000670000-0x00000000006BB000-memory.dmp
memory/4244-728-0x0000000000670000-0x00000000006BB000-memory.dmp
memory/4264-544-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4324-729-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4476-742-0x0000000000090000-0x00000000000DB000-memory.dmp
memory/4476-750-0x0000000000090000-0x00000000000DB000-memory.dmp
memory/4576-687-0x0000000000F30000-0x0000000000F7B000-memory.dmp
memory/4576-689-0x0000000000F30000-0x0000000000F7B000-memory.dmp
memory/4580-427-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4596-660-0x0000000000FF0000-0x000000000103B000-memory.dmp
memory/4596-659-0x0000000000FF0000-0x000000000103B000-memory.dmp
memory/4620-656-0x00000000000A0000-0x00000000000EB000-memory.dmp
memory/4620-654-0x00000000000A0000-0x00000000000EB000-memory.dmp
memory/4724-752-0x0000000000C40000-0x0000000000C8B000-memory.dmp
memory/4724-754-0x0000000000C40000-0x0000000000C8B000-memory.dmp
memory/4744-608-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4796-461-0x0000000000460000-0x00000000004AB000-memory.dmp
memory/4796-458-0x0000000000460000-0x00000000004AB000-memory.dmp
memory/4840-576-0x0000000000700000-0x000000000074B000-memory.dmp
memory/4840-575-0x0000000000700000-0x000000000074B000-memory.dmp
memory/4944-634-0x0000000000060000-0x00000000000AB000-memory.dmp
memory/4944-636-0x0000000000060000-0x00000000000AB000-memory.dmp
memory/5092-657-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5124-521-0x0000000000290000-0x00000000002DB000-memory.dmp
memory/5124-524-0x0000000000290000-0x00000000002DB000-memory.dmp
memory/5308-697-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5536-465-0x00000000000D0000-0x000000000011B000-memory.dmp
memory/5536-476-0x00000000000D0000-0x000000000011B000-memory.dmp
memory/5632-637-0x0000000000010000-0x0000000000083000-memory.dmp
memory/5672-226-0x0000000000EF0000-0x0000000000F3B000-memory.dmp
memory/5672-128-0x0000000000EF0000-0x0000000000F3B000-memory.dmp
memory/5720-603-0x00000000004D0000-0x000000000051B000-memory.dmp
memory/5720-602-0x00000000004D0000-0x000000000051B000-memory.dmp
memory/5836-584-0x0000000000040000-0x000000000008B000-memory.dmp
memory/5836-583-0x0000000000040000-0x000000000008B000-memory.dmp
memory/5916-756-0x0000000000010000-0x0000000000083000-memory.dmp