Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
15/04/2026, 22:28
General
- Target 2026-04-15_ad18fec8743adeaf765719d6f09af1c7_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
- Size 291KB
- Sample260415-2d5ddabs3q
- SHA256 0fc7ac5b58999851d478fcdb5d467e6c3347193808e5b6a08670aeb64663760f
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba8102
-
http://xytets.com:2345/ll/out.txt
-
http://xytets.com:2345/t.asp?os=home8102
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- UPX dump on OEP (original entry point) 64 IoCs
- Executes dropped EXE 64 IoCs
- UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Windows directory 13 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 48 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 3 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 19 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
- Suspicious use of AdjustPrivilegeToken 20 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_ad18fec8743adeaf765719d6f09af1c7_coinminer_elex_redline-stealer_rhadamanthys_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-15_ad18fec8743adeaf765719d6f09af1c7_coinminer_elex_redline-stealer_rhadamanthys_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home81022⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home8102"3⤵
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/ll/out.txt2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/ll/out.txt"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x368,0x7ff8641ec188,0x7ff8641ec194,0x7ff8641ec1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1748,i,10546036323968468144,8917214164531330398,524288 --field-trial-handle=2184,i,7931609018298503371,12776835716112539329,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1588,i,14967553827709345688,3265936840688420814,262144 --field-trial-handle=2184,i,7931609018298503371,12776835716112539329,262144 --variations-seed-version --mojo-platform-channel-handle=2180 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2484,i,12494451736829230535,16750911247341699122,524288 --field-trial-handle=2184,i,7931609018298503371,12776835716112539329,262144 --variations-seed-version --mojo-platform-channel-handle=2420 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3492,i,5808761714936258278,103816390223081098,2097152 --field-trial-handle=2184,i,7931609018298503371,12776835716112539329,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3516,i,5118860724926843473,1882929713926150606,2097152 --field-trial-handle=2184,i,7931609018298503371,12776835716112539329,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4004,i,11717774919227424477,1989279989511953300,2097152 --field-trial-handle=2184,i,7931609018298503371,12776835716112539329,262144 --variations-seed-version --mojo-platform-channel-handle=4108 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4136,i,3685299536364336684,7730817358679633492,2097152 --field-trial-handle=2184,i,7931609018298503371,12776835716112539329,262144 --variations-seed-version --mojo-platform-channel-handle=4128 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4172,i,6696493794048644635,12773549522878726133,2097152 --field-trial-handle=2184,i,7931609018298503371,12776835716112539329,262144 --variations-seed-version --mojo-platform-channel-handle=4168 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4184,i,9381254978818361143,2597533677414612130,2097152 --field-trial-handle=2184,i,7931609018298503371,12776835716112539329,262144 --variations-seed-version --mojo-platform-channel-handle=4424 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=4764,i,3008023863455140910,632615890298213014,2097152 --field-trial-handle=2184,i,7931609018298503371,12776835716112539329,262144 --variations-seed-version --mojo-platform-channel-handle=4776 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3572,i,9459505016989279376,13327840743701769507,524288 --field-trial-handle=2184,i,7931609018298503371,12776835716112539329,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4224,i,4798536947374430657,11440954464878021922,524288 --field-trial-handle=2184,i,7931609018298503371,12776835716112539329,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4256,i,13578005736669488759,5858189419143928696,524288 --field-trial-handle=2184,i,7931609018298503371,12776835716112539329,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5640,i,8380484011205945000,15273769833464085620,524288 --field-trial-handle=2184,i,7931609018298503371,12776835716112539329,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6256,i,13083449180282392322,5546718735706500030,524288 --field-trial-handle=2184,i,7931609018298503371,12776835716112539329,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6256,i,13083449180282392322,5546718735706500030,524288 --field-trial-handle=2184,i,7931609018298503371,12776835716112539329,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6396,i,18193894286595172367,16399388208236640105,524288 --field-trial-handle=2184,i,7931609018298503371,12776835716112539329,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:144⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.execookie_exporter.exe --cookie-json=11325⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6432,i,10162111139898111189,16281951365642970046,524288 --field-trial-handle=2184,i,7931609018298503371,12776835716112539329,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6032,i,12153521339410401420,13332612325485630148,524288 --field-trial-handle=2184,i,7931609018298503371,12776835716112539329,262144 --variations-seed-version --mojo-platform-channel-handle=6660 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6396,i,1818053663842972821,12825069734973970351,524288 --field-trial-handle=2184,i,7931609018298503371,12776835716112539329,262144 --variations-seed-version --mojo-platform-channel-handle=6676 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6432,i,15236184161456412745,4373991663250125200,524288 --field-trial-handle=2184,i,7931609018298503371,12776835716112539329,262144 --variations-seed-version --mojo-platform-channel-handle=6740 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6744,i,11864515717405584909,5914900865922755535,524288 --field-trial-handle=2184,i,7931609018298503371,12776835716112539329,262144 --variations-seed-version --mojo-platform-channel-handle=6672 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4436,i,13120479391789567987,14191034790895455224,524288 --field-trial-handle=2184,i,7931609018298503371,12776835716112539329,262144 --variations-seed-version --mojo-platform-channel-handle=4116 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4692,i,6571497927447482898,8000243846818902972,524288 --field-trial-handle=2184,i,7931609018298503371,12776835716112539329,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4696,i,5461315474540926941,6024109619156398951,524288 --field-trial-handle=2184,i,7931609018298503371,12776835716112539329,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5712,i,17831422835167871430,16536271704363197444,524288 --field-trial-handle=2184,i,7931609018298503371,12776835716112539329,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6200,i,6937326595579623929,17388330497291194975,524288 --field-trial-handle=2184,i,7931609018298503371,12776835716112539329,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5584,i,1833344312782789116,4549248256181971511,524288 --field-trial-handle=2184,i,7931609018298503371,12776835716112539329,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=868,i,9336587294607590408,11856302883798928606,524288 --field-trial-handle=2184,i,7931609018298503371,12776835716112539329,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6924,i,4424901168372370405,4154354722858576475,524288 --field-trial-handle=2184,i,7931609018298503371,12776835716112539329,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6720,i,15290877921074507174,12030614730408268938,262144 --field-trial-handle=2184,i,7931609018298503371,12776835716112539329,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6184,i,2257969736266947566,629825489880338557,524288 --field-trial-handle=2184,i,7931609018298503371,12776835716112539329,262144 --variations-seed-version --mojo-platform-channel-handle=6756 /prefetch:144⤵
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\trljdztoje.exe ups_run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\trljdztoje.exeC:\Temp\trljdztoje.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_trljdztoje.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_trljdztoje.exeC:\Temp\i_trljdztoje.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\jgbytrljgb.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\jgbytrljgb.exeC:\Temp\jgbytrljgb.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_jgbytrljgb.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_jgbytrljgb.exeC:\Temp\i_jgbytrljgb.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\vqoigaysql.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\vqoigaysql.exeC:\Temp\vqoigaysql.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_vqoigaysql.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_vqoigaysql.exeC:\Temp\i_vqoigaysql.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\icavsnkfdx.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\icavsnkfdx.exeC:\Temp\icavsnkfdx.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_icavsnkfdx.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_icavsnkfdx.exeC:\Temp\i_icavsnkfdx.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\axsqkicaus.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\axsqkicaus.exeC:\Temp\axsqkicaus.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_axsqkicaus.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_axsqkicaus.exeC:\Temp\i_axsqkicaus.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\smkfcxvpnh.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\smkfcxvpnh.exeC:\Temp\smkfcxvpnh.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_smkfcxvpnh.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_smkfcxvpnh.exeC:\Temp\i_smkfcxvpnh.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\kecwupmhfz.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\kecwupmhfz.exeC:\Temp\kecwupmhfz.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_kecwupmhfz.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_kecwupmhfz.exeC:\Temp\i_kecwupmhfz.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\zuomgezwro.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\zuomgezwro.exeC:\Temp\zuomgezwro.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_zuomgezwro.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_zuomgezwro.exeC:\Temp\i_zuomgezwro.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\wuomgebwto.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\wuomgebwto.exeC:\Temp\wuomgebwto.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_wuomgebwto.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_wuomgebwto.exeC:\Temp\i_wuomgebwto.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\wrljdbvtol.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\wrljdbvtol.exeC:\Temp\wrljdbvtol.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_wrljdbvtol.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_wrljdbvtol.exeC:\Temp\i_wrljdbvtol.exe ups_ins3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\idbvtnlgdb.exe ups_run2⤵
- Executes dropped EXE
-
C:\Temp\idbvtnlgdb.exeC:\Temp\idbvtnlgdb.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_idbvtnlgdb.exe ups_ins2⤵
- Executes dropped EXE
-
C:\Temp\i_idbvtnlgdb.exeC:\Temp\i_idbvtnlgdb.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ysqkidavtn.exe ups_run2⤵
-
C:\Temp\ysqkidavtn.exeC:\Temp\ysqkidavtn.exe ups_run3⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ysqkidavtn.exe ups_ins2⤵
-
C:\Temp\i_ysqkidavtn.exeC:\Temp\i_ysqkidavtn.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\snifaxsqki.exe ups_run2⤵
-
C:\Temp\snifaxsqki.exeC:\Temp\snifaxsqki.exe ups_run3⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_snifaxsqki.exe ups_ins2⤵
-
C:\Temp\i_snifaxsqki.exeC:\Temp\i_snifaxsqki.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\kfzxspkica.exe ups_run2⤵
-
C:\Temp\kfzxspkica.exeC:\Temp\kfzxspkica.exe ups_run3⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_kfzxspkica.exe ups_ins2⤵
-
C:\Temp\i_kfzxspkica.exeC:\Temp\i_kfzxspkica.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\xrpkhcausm.exe ups_run2⤵
-
C:\Temp\xrpkhcausm.exeC:\Temp\xrpkhcausm.exe ups_run3⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_xrpkhcausm.exe ups_ins2⤵
-
C:\Temp\i_xrpkhcausm.exeC:\Temp\i_xrpkhcausm.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\kecwupjhbz.exe ups_run2⤵
-
C:\Temp\kecwupjhbz.exeC:\Temp\kecwupjhbz.exe ups_run3⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_kecwupjhbz.exe ups_ins2⤵
-
C:\Temp\i_kecwupjhbz.exeC:\Temp\i_kecwupjhbz.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ecwuomgezw.exe ups_run2⤵
-
C:\Temp\ecwuomgezw.exeC:\Temp\ecwuomgezw.exe ups_run3⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ecwuomgezw.exe ups_ins2⤵
-
C:\Temp\i_ecwuomgezw.exeC:\Temp\i_ecwuomgezw.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\rljdbwtrlj.exe ups_run2⤵
-
C:\Temp\rljdbwtrlj.exeC:\Temp\rljdbwtrlj.exe ups_run3⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_rljdbwtrlj.exe ups_ins2⤵
-
C:\Temp\i_rljdbwtrlj.exeC:\Temp\i_rljdbwtrlj.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\ljdbvtnlgd.exe ups_run2⤵
-
C:\Temp\ljdbvtnlgd.exeC:\Temp\ljdbvtnlgd.exe ups_run3⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_ljdbvtnlgd.exe ups_ins2⤵
-
C:\Temp\i_ljdbvtnlgd.exeC:\Temp\i_ljdbvtnlgd.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\yvtnlfdxvq.exe ups_run2⤵
-
C:\Temp\yvtnlfdxvq.exeC:\Temp\yvtnlfdxvq.exe ups_run3⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CP.exeC:\temp\CP.exe C:\windows\system32\ipconfig.exe /release4⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release5⤵
- Gathers network information
-
-
-
-
-
C:\temp\CP.exeC:\temp\CP.exe C:\Temp\i_yvtnlfdxvq.exe ups_ins2⤵
-
C:\Temp\i_yvtnlfdxvq.exeC:\Temp\i_yvtnlfdxvq.exe ups_ins3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\oljdbvtrlg.sysC:\Temp\oljdbvtrlg.sys1⤵
- Executes dropped EXE
-
C:\Temp\gbvtnlgdyv.sysC:\Temp\gbvtnlgdyv.sys1⤵
- Executes dropped EXE
-
C:\Temp\aysqkidavt.sysC:\Temp\aysqkidavt.sys1⤵
- Executes dropped EXE
-
C:\Temp\kidavsnlfd.sysC:\Temp\kidavsnlfd.sys1⤵
- Executes dropped EXE
-
C:\Temp\zxspkicaus.sysC:\Temp\zxspkicaus.sys1⤵
- Executes dropped EXE
-
C:\Temp\rpjecwusmh.sysC:\Temp\rpjecwusmh.sys1⤵
- Executes dropped EXE
-
C:\Temp\pmhezxrpjh.sysC:\Temp\pmhezxrpjh.sys1⤵
- Executes dropped EXE
-
C:\Temp\jecwuomgez.sysC:\Temp\jecwuomgez.sys1⤵
- Executes dropped EXE
-
C:\Temp\ytqojgbztr.sysC:\Temp\ytqojgbztr.sys1⤵
- Executes dropped EXE
-
C:\Temp\tnlgdyvqoi.sysC:\Temp\tnlgdyvqoi.sys1⤵
- Executes dropped EXE
-
C:\Temp\nigaywqoig.sysC:\Temp\nigaywqoig.sys1⤵
-
C:\Temp\avsnlfdxvp.sysC:\Temp\avsnlfdxvp.sys1⤵
-
C:\Temp\sqkifaxsqk.sysC:\Temp\sqkifaxsqk.sys1⤵
-
C:\Temp\hfzxrpjhcz.sysC:\Temp\hfzxrpjhcz.sys1⤵
-
C:\Temp\zuspkhczus.sysC:\Temp\zuspkhczus.sys1⤵
-
C:\Temp\pjecwuomhe.sysC:\Temp\pjecwuomhe.sys1⤵
-
C:\Temp\ywrojgbztr.sysC:\Temp\ywrojgbztr.sys1⤵
-
C:\Temp\wqoigbytql.sysC:\Temp\wqoigbytql.sys1⤵
-
C:\Temp\qlidbvtnlf.sysC:\Temp\qlidbvtnlf.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
axsqkicaus.exe
aysqkidavt.sys
gbvtnlgdyv.sys
i_axsqkicaus.exe
i_icavsnkfdx.exe
i_jgbytrljgb.exe
i_trljdztoje.exe
i_vqoigaysql.exe
icavsnkfdx.exe
jgbytrljgb.exe
kidavsnlfd.sys
oljdbvtrlg.sys
trljdztoje.exe
vqoigaysql.exe
zxspkicaus.sys
protocols.json
settings.dat
BookmarkMergedSurfaceOrdering
the-real-index
SiteList-Enterprise.json
Edge Profile.ico
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
Preferences
Preferences
Secure Preferences
sync_diagnostic.log
c56d455f-a6c1-4ee4-849e-b2d83daeabd2.tmp
office_endpoints_list.json
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
nav_config.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
25f82db7-e346-40e9-acde-50052cdf26d5.tmp
f972c549-e1fe-4e90-99b6-f6943bad6a95.tmp
25a24b1d-89a0-4dcb-bd3e-47b284773194.tmp
content_new.js
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
CP.exe
memory/428-276-0x0000000000B40000-0x0000000000B8B000-memory.dmp
memory/428-252-0x0000000000B40000-0x0000000000B8B000-memory.dmp
memory/568-497-0x00000256A90D0000-0x00000256A91A6000-memory.dmp
memory/568-648-0x00000000005F0000-0x000000000063B000-memory.dmp
memory/568-649-0x00000000005F0000-0x000000000063B000-memory.dmp
memory/576-630-0x00000000008E0000-0x000000000092B000-memory.dmp
memory/576-613-0x00000000008E0000-0x000000000092B000-memory.dmp
memory/644-862-0x0000000000B60000-0x0000000000BAB000-memory.dmp
memory/644-880-0x0000000000B60000-0x0000000000BAB000-memory.dmp
memory/688-690-0x00000000004C0000-0x000000000050B000-memory.dmp
memory/688-688-0x00000000004C0000-0x000000000050B000-memory.dmp
memory/780-894-0x0000000000B70000-0x0000000000BBB000-memory.dmp
memory/780-896-0x0000000000B70000-0x0000000000BBB000-memory.dmp
memory/872-600-0x0000000000550000-0x000000000059B000-memory.dmp
memory/872-602-0x0000000000550000-0x000000000059B000-memory.dmp
memory/948-738-0x0000000000CF0000-0x0000000000D3B000-memory.dmp
memory/948-741-0x0000000000CF0000-0x0000000000D3B000-memory.dmp
memory/1004-489-0x0000000000370000-0x00000000003BB000-memory.dmp
memory/1004-491-0x0000000000370000-0x00000000003BB000-memory.dmp
memory/1068-815-0x00000000000F0000-0x000000000013B000-memory.dmp
memory/1068-813-0x00000000000F0000-0x000000000013B000-memory.dmp
memory/1124-724-0x0000000000A50000-0x0000000000A9B000-memory.dmp
memory/1124-712-0x0000000000A50000-0x0000000000A9B000-memory.dmp
memory/1188-776-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1344-646-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1656-526-0x00000000004E0000-0x000000000052B000-memory.dmp
memory/1656-542-0x00000000004E0000-0x000000000052B000-memory.dmp
memory/1712-447-0x00000000007F0000-0x000000000083B000-memory.dmp
memory/1712-449-0x00000000007F0000-0x000000000083B000-memory.dmp
memory/1744-677-0x0000000000C40000-0x0000000000C8B000-memory.dmp
memory/1744-686-0x0000000000C40000-0x0000000000C8B000-memory.dmp
memory/1760-603-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1880-611-0x0000000000010000-0x0000000000083000-memory.dmp
memory/1884-548-0x0000000000FA0000-0x0000000000FEB000-memory.dmp
memory/1884-551-0x0000000000FA0000-0x0000000000FEB000-memory.dmp
memory/2052-816-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2092-857-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2104-800-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2116-598-0x0000000000C90000-0x0000000000CDB000-memory.dmp
memory/2116-597-0x0000000000C90000-0x0000000000CDB000-memory.dmp
memory/2224-573-0x0000000000720000-0x000000000076B000-memory.dmp
memory/2224-576-0x0000000000720000-0x000000000076B000-memory.dmp
memory/2324-694-0x0000000000440000-0x000000000048B000-memory.dmp
memory/2324-693-0x0000000000440000-0x000000000048B000-memory.dmp
memory/2332-881-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2488-0-0x00000000008F0000-0x000000000093B000-memory.dmp
memory/2488-450-0x00000000008F0000-0x000000000093B000-memory.dmp
memory/2492-811-0x0000000000800000-0x000000000084B000-memory.dmp
memory/2492-810-0x0000000000800000-0x000000000084B000-memory.dmp
memory/2520-856-0x00000000007C0000-0x000000000080B000-memory.dmp
memory/2520-851-0x00000000007C0000-0x000000000080B000-memory.dmp
memory/2524-555-0x0000000000EC0000-0x0000000000F0B000-memory.dmp
memory/2524-558-0x0000000000EC0000-0x0000000000F0B000-memory.dmp
memory/2596-544-0x0000000000010000-0x0000000000083000-memory.dmp
memory/2828-569-0x0000000000F30000-0x0000000000F7B000-memory.dmp
memory/2828-566-0x0000000000F30000-0x0000000000F7B000-memory.dmp
memory/2984-725-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3036-778-0x0000000000EA0000-0x0000000000EEB000-memory.dmp
memory/3036-779-0x0000000000EA0000-0x0000000000EEB000-memory.dmp
memory/3228-560-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3232-775-0x0000000000C50000-0x0000000000C9B000-memory.dmp
memory/3232-763-0x0000000000C50000-0x0000000000C9B000-memory.dmp
memory/3304-452-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3388-653-0x0000000000500000-0x000000000054B000-memory.dmp
memory/3388-507-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3388-651-0x0000000000500000-0x000000000054B000-memory.dmp
memory/3428-897-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3444-645-0x0000000000C70000-0x0000000000CBB000-memory.dmp
memory/3444-632-0x0000000000C70000-0x0000000000CBB000-memory.dmp
memory/3584-907-0x00000000001C0000-0x000000000020B000-memory.dmp
memory/3584-908-0x00000000001C0000-0x000000000020B000-memory.dmp
memory/3720-606-0x0000000000E70000-0x0000000000EBB000-memory.dmp
memory/3720-605-0x0000000000E70000-0x0000000000EBB000-memory.dmp
memory/3756-512-0x0000000000250000-0x000000000029B000-memory.dmp
memory/3756-514-0x0000000000250000-0x000000000029B000-memory.dmp
memory/3880-799-0x00000000006F0000-0x000000000073B000-memory.dmp
memory/3880-659-0x0000000000010000-0x0000000000083000-memory.dmp
memory/3880-797-0x00000000006F0000-0x000000000073B000-memory.dmp
memory/3920-860-0x0000000000550000-0x000000000059B000-memory.dmp
memory/3920-859-0x0000000000550000-0x000000000059B000-memory.dmp
memory/4064-760-0x0000000000100000-0x000000000014B000-memory.dmp
memory/4064-761-0x0000000000100000-0x000000000014B000-memory.dmp
memory/4088-608-0x0000000000ED0000-0x0000000000F1B000-memory.dmp
memory/4088-610-0x0000000000ED0000-0x0000000000F1B000-memory.dmp
memory/4124-728-0x0000000000610000-0x000000000065B000-memory.dmp
memory/4124-727-0x0000000000610000-0x000000000065B000-memory.dmp
memory/4320-929-0x00000000001C0000-0x000000000020B000-memory.dmp
memory/4320-910-0x00000000001C0000-0x000000000020B000-memory.dmp
memory/4468-884-0x0000000000750000-0x000000000079B000-memory.dmp
memory/4468-883-0x0000000000750000-0x000000000079B000-memory.dmp
memory/4548-691-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4664-758-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4724-578-0x0000000000010000-0x0000000000083000-memory.dmp
memory/4832-501-0x0000000000E10000-0x0000000000E5B000-memory.dmp
memory/4832-505-0x0000000000E10000-0x0000000000E5B000-memory.dmp
memory/4864-819-0x0000000000D60000-0x0000000000DAB000-memory.dmp
memory/4864-818-0x0000000000D60000-0x0000000000DAB000-memory.dmp