Analysis
- max time kernel
149s - max time network
153s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
15/04/2026, 22:17
General
- Target 2026-04-15_c6689a879686ad732f50738ad9b7ffc4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 376KB
- Sample260415-17ppcadv5w
- SHA256 55f4bdeb64c1be21138f942834dc68aea4915f51a09993e51befea436235fe90
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba
-
http://xytets.com:2345/t.asp?os=home
-
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 9 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 41 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 19 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 29 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 3 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_c6689a879686ad732f50738ad9b7ffc4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-15_c6689a879686ad732f50738ad9b7ffc4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\ztrmjebwuomgezwr.exeC:\Temp\ztrmjebwuomgezwr.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jebwuomebr.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\jebwuomebr.exeC:\Temp\jebwuomebr.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jebwuomebr.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_jebwuomebr.exeC:\Temp\i_jebwuomebr.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\dywqoigayt.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\dywqoigayt.exeC:\Temp\dywqoigayt.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_dywqoigayt.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_dywqoigayt.exeC:\Temp\i_dywqoigayt.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qlidbvtnlg.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\qlidbvtnlg.exeC:\Temp\qlidbvtnlg.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qlidbvtnlg.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_qlidbvtnlg.exeC:\Temp\i_qlidbvtnlg.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\lidavlfdxv.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\lidavlfdxv.exeC:\Temp\lidavlfdxv.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_lidavlfdxv.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_lidavlfdxv.exeC:\Temp\i_lidavlfdxv.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ysqkicavsn.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ysqkicavsn.exeC:\Temp\ysqkicavsn.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ysqkicavsn.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ysqkicavsn.exeC:\Temp\i_ysqkicavsn.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nhfzxspnhc.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\nhfzxspnhc.exeC:\Temp\nhfzxspnhc.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nhfzxspnhc.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_nhfzxspnhc.exeC:\Temp\i_nhfzxspnhc.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fzxrpjhczu.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\fzxrpjhczu.exeC:\Temp\fzxrpjhczu.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fzxrpjhczu.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_fzxrpjhczu.exeC:\Temp\i_fzxrpjhczu.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hbzusecwuo.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\hbzusecwuo.exeC:\Temp\hbzusecwuo.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hbzusecwuo.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_hbzusecwuo.exeC:\Temp\i_hbzusecwuo.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\trljebwuom.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\trljebwuom.exeC:\Temp\trljebwuom.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_trljebwuom.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_trljebwuom.exeC:\Temp\i_trljebwuom.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ljebwtomge.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ljebwtomge.exeC:\Temp\ljebwtomge.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ljebwtomge.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ljebwtomge.exeC:\Temp\i_ljebwtomge.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bvtnlfdyvq.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\bvtnlfdyvq.exeC:\Temp\bvtnlfdyvq.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bvtnlfdyvq.exe ups_ins3⤵
-
C:\Temp\i_bvtnlfdyvq.exeC:\Temp\i_bvtnlfdyvq.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\avtnlxvqni.exe ups_run3⤵
-
C:\Temp\avtnlxvqni.exeC:\Temp\avtnlxvqni.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_avtnlxvqni.exe ups_ins3⤵
-
C:\Temp\i_avtnlxvqni.exeC:\Temp\i_avtnlxvqni.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\sqkicavpni.exe ups_run3⤵
-
C:\Temp\sqkicavpni.exeC:\Temp\sqkicavpni.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_sqkicavpni.exe ups_ins3⤵
-
C:\Temp\i_sqkicavpni.exeC:\Temp\i_sqkicavpni.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\kfcxvpnhfz.exe ups_run3⤵
-
C:\Temp\kfcxvpnhfz.exeC:\Temp\kfcxvpnhfz.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_kfcxvpnhfz.exe ups_ins3⤵
-
C:\Temp\i_kfcxvpnhfz.exeC:\Temp\i_kfcxvpnhfz.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\cxrpkhcaus.exe ups_run3⤵
-
C:\Temp\cxrpkhcaus.exeC:\Temp\cxrpkhcaus.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_cxrpkhcaus.exe ups_ins3⤵
-
C:\Temp\i_cxrpkhcaus.exeC:\Temp\i_cxrpkhcaus.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\cxrpjhurmh.exe ups_run3⤵
-
C:\Temp\cxrpjhurmh.exeC:\Temp\cxrpjhurmh.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_cxrpjhurmh.exe ups_ins3⤵
-
C:\Temp\i_cxrpjhurmh.exeC:\Temp\i_cxrpjhurmh.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rmjecwuomg.exe ups_run3⤵
-
C:\Temp\rmjecwuomg.exeC:\Temp\rmjecwuomg.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rmjecwuomg.exe ups_ins3⤵
-
C:\Temp\i_rmjecwuomg.exeC:\Temp\i_rmjecwuomg.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jdbwtomgey.exe ups_run3⤵
-
C:\Temp\jdbwtomgey.exeC:\Temp\jdbwtomgey.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jdbwtomgey.exe ups_ins3⤵
-
C:\Temp\i_jdbwtomgey.exeC:\Temp\i_jdbwtomgey.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bytrljdbvt.exe ups_run3⤵
-
C:\Temp\bytrljdbvt.exeC:\Temp\bytrljdbvt.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bytrljdbvt.exe ups_ins3⤵
-
C:\Temp\i_bytrljdbvt.exeC:\Temp\i_bytrljdbvt.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vtnlgdyoig.exe ups_run3⤵
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x368,0x7ff8a9abc188,0x7ff8a9abc194,0x7ff8a9abc1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1796,i,8451871767983258757,6589843749457800816,524288 --field-trial-handle=2168,i,1252024414531176081,6574201088247906362,262144 --variations-seed-version --mojo-platform-channel-handle=2196 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1624,i,15570935737493282323,11122808760022721566,262144 --field-trial-handle=2168,i,1252024414531176081,6574201088247906362,262144 --variations-seed-version --mojo-platform-channel-handle=2164 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2556,i,14542106295470751728,7134649693089374378,524288 --field-trial-handle=2168,i,1252024414531176081,6574201088247906362,262144 --variations-seed-version --mojo-platform-channel-handle=2568 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,9578128037885033904,11881038869587933758,2097152 --field-trial-handle=2168,i,1252024414531176081,6574201088247906362,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3508,i,16627475421230049859,2302776511832085281,2097152 --field-trial-handle=2168,i,1252024414531176081,6574201088247906362,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4148,i,3360039586316489855,17469516731707699601,2097152 --field-trial-handle=2168,i,1252024414531176081,6574201088247906362,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4164,i,15924802776395688044,16682713031427068756,2097152 --field-trial-handle=2168,i,1252024414531176081,6574201088247906362,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4240,i,17975166290810746222,16709297154948115522,2097152 --field-trial-handle=2168,i,1252024414531176081,6574201088247906362,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4232,i,11477681113154317802,8372733001898565589,2097152 --field-trial-handle=2168,i,1252024414531176081,6574201088247906362,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3780,i,2431220418109471478,4880982683924185435,524288 --field-trial-handle=2168,i,1252024414531176081,6574201088247906362,262144 --variations-seed-version --mojo-platform-channel-handle=3784 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5292,i,1469911621157569286,11424580975174196687,524288 --field-trial-handle=2168,i,1252024414531176081,6574201088247906362,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5348,i,17189398047829448747,9518028925798107335,524288 --field-trial-handle=2168,i,1252024414531176081,6574201088247906362,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4368,i,1511462854229306729,3032082909623750306,524288 --field-trial-handle=2168,i,1252024414531176081,6574201088247906362,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,3109831849872735843,8886054290009740370,524288 --field-trial-handle=2168,i,1252024414531176081,6574201088247906362,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,3109831849872735843,8886054290009740370,524288 --field-trial-handle=2168,i,1252024414531176081,6574201088247906362,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6092,i,4146298438680625775,4443530818523513121,524288 --field-trial-handle=2168,i,1252024414531176081,6574201088247906362,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:144⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.execookie_exporter.exe --cookie-json=11445⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6216,i,9205583013418013802,3049476912082619752,524288 --field-trial-handle=2168,i,1252024414531176081,6574201088247906362,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6284,i,7053732311626341388,9018584585194559181,524288 --field-trial-handle=2168,i,1252024414531176081,6574201088247906362,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6412,i,14087245659631564481,16706039498734746434,524288 --field-trial-handle=2168,i,1252024414531176081,6574201088247906362,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,2377623026271523156,9207146869356666000,524288 --field-trial-handle=2168,i,1252024414531176081,6574201088247906362,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6712,i,2883788464505479779,16347541113233569511,524288 --field-trial-handle=2168,i,1252024414531176081,6574201088247906362,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4340,i,17649226284315209116,9020159756408037227,524288 --field-trial-handle=2168,i,1252024414531176081,6574201088247906362,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4332,i,14655235541918100970,4191702697294331145,524288 --field-trial-handle=2168,i,1252024414531176081,6574201088247906362,262144 --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4460,i,9690444397201715241,14661309695179978687,524288 --field-trial-handle=2168,i,1252024414531176081,6574201088247906362,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5536,i,7313726746908457347,12859206033184555193,524288 --field-trial-handle=2168,i,1252024414531176081,6574201088247906362,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6224,i,16895556023118270433,5281648585719025849,524288 --field-trial-handle=2168,i,1252024414531176081,6574201088247906362,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4336,i,6324969129370232422,6215243813199015,524288 --field-trial-handle=2168,i,1252024414531176081,6574201088247906362,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5512,i,5414333808852629960,4905948730974387355,524288 --field-trial-handle=2168,i,1252024414531176081,6574201088247906362,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3788,i,8003303741184835844,7455049440658789080,262144 --field-trial-handle=2168,i,1252024414531176081,6574201088247906362,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6484,i,4913871733912194932,18216152512612463513,524288 --field-trial-handle=2168,i,1252024414531176081,6574201088247906362,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\ztrmjebwuomgezwr.sysC:\Temp\ztrmjebwuomgezwr.sys1⤵
- Executes dropped EXE
-
C:\Temp\omgbvtoljd.sysC:\Temp\omgbvtoljd.sys1⤵
- Executes dropped EXE
-
C:\Temp\gdywqoigsq.sysC:\Temp\gdywqoigsq.sys1⤵
- Executes dropped EXE
-
C:\Temp\ytnlfdyvqn.sysC:\Temp\ytnlfdyvqn.sys1⤵
- Executes dropped EXE
-
C:\Temp\hfaxsqkica.sysC:\Temp\hfaxsqkica.sys1⤵
- Executes dropped EXE
-
C:\Temp\xsqkicxvpn.sysC:\Temp\xsqkicxvpn.sys1⤵
- Executes dropped EXE
-
C:\Temp\usmkfcxmhf.sysC:\Temp\usmkfcxmhf.sys1⤵
- Executes dropped EXE
-
C:\Temp\smkecwupmh.sysC:\Temp\smkecwupmh.sys1⤵
- Executes dropped EXE
-
C:\Temp\hbzurmjecw.sysC:\Temp\hbzurmjecw.sys1⤵
- Executes dropped EXE
-
C:\Temp\wqojgbztrl.sysC:\Temp\wqojgbztrl.sys1⤵
- Executes dropped EXE
-
C:\Temp\toigbytjdb.sysC:\Temp\toigbytjdb.sys1⤵
- Executes dropped EXE
-
C:\Temp\ljdyvqoiga.sysC:\Temp\ljdyvqoiga.sys1⤵
-
C:\Temp\davtnlfdxv.sysC:\Temp\davtnlfdxv.sys1⤵
-
C:\Temp\spkicausnk.sysC:\Temp\spkicausnk.sys1⤵
-
C:\Temp\vpnhfzxspc.sysC:\Temp\vpnhfzxspc.sys1⤵
-
C:\Temp\kecwupmhez.sysC:\Temp\kecwupmhez.sys1⤵
-
C:\Temp\ztrmjecwuo.sysC:\Temp\ztrmjecwuo.sys1⤵
-
C:\Temp\tomgeywqoj.sysC:\Temp\tomgeywqoj.sys1⤵
-
C:\Temp\tolgeywqoi.sysC:\Temp\tolgeywqoi.sys1⤵
-
C:\Temp\jdbvtnlgdy.sysC:\Temp\jdbvtnlgdy.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CreateProcess.exe
dywqoigayt.exe
gdywqoigsq.sys
hfaxsqkica.sys
i_dywqoigayt.exe
i_jebwuomebr.exe
i_lidavlfdxv.exe
i_qlidbvtnlg.exe
i_ysqkicavsn.exe
jebwuomebr.exe
lidavlfdxv.exe
omgbvtoljd.sys
qlidbvtnlg.exe
ysqkicavsn.exe
ytnlfdyvqn.sys
ztrmjebwuomgezwr.exe
ztrmjebwuomgezwr.sys
blocklist
protocols.json
settings.dat
settings.dat
5150427f-0241-4b63-aae2-f9400c5910fe.tmp
the-real-index
the-real-index~RFe58a989.TMP
SiteList-Enterprise.json
Edge Profile.ico
HubApps
6b18a859-8b53-4a5d-89f7-9db332a261fa.tmp
Network Persistent State
SCT Auditing Pending Reports
Preferences
Preferences
Secure Preferences
sync_diagnostic.log
CURRENT
MANIFEST-000001
a5691259-6228-4fd9-b29f-c9b93733d82f.tmp
office_endpoints_list.json
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
nav_config.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
c7e945b1-d25c-4e4a-8515-09ea2fc9cf2f.tmp
d0695418-4a26-4063-a001-68dae6e3f7b8.tmp
content_new.js
faed1e1c-3df7-453a-a79b-ae8a647d8319.tmp
manifest.json
manifest.json
manifest.json
manifest.json
memory/220-576-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/444-782-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/796-613-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/796-629-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1064-77-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1076-733-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1356-666-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1804-608-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2360-709-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2644-564-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3108-808-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3820-596-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3820-610-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3960-747-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3960-812-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4180-721-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4220-628-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4220-479-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4780-528-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4800-694-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4800-633-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5044-770-0x0000000000010000-0x00000000000AB000-memory.dmp