Analysis
- max time kernel
149s - max time network
151s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
15/04/2026, 19:41
General
- Target 2026-04-15_f61bdc1a65f7483e68ac88e22313d162_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 376KB
- Sample260415-yeemkahs7k
- SHA256 cf147cace28eb94721b3ff450fee4f38f5a98ba3c22c0eb311769268e4a5548a
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba
-
http://xytets.com:2345/t.asp?os=home
-
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 1 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 29 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 3 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_f61bdc1a65f7483e68ac88e22313d162_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-15_f61bdc1a65f7483e68ac88e22313d162_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\causmkecxupnhxrp.exeC:\Temp\causmkecxupnhxrp.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ecwupjhbzu.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\ecwupjhbzu.exeC:\Temp\ecwupjhbzu.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ecwupjhbzu.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ecwupjhbzu.exeC:\Temp\i_ecwupjhbzu.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wuomhezwrp.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\wuomhezwrp.exeC:\Temp\wuomhezwrp.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wuomhezwrp.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_wuomhezwrp.exeC:\Temp\i_wuomhezwrp.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ljebwuomge.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ljebwuomge.exeC:\Temp\ljebwuomge.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ljebwuomge.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ljebwuomge.exeC:\Temp\i_ljebwuomge.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bztrljdbwt.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\bztrljdbwt.exeC:\Temp\bztrljdbwt.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bztrljdbwt.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_bztrljdbwt.exeC:\Temp\i_bztrljdbwt.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qoidaysqli.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\qoidaysqli.exeC:\Temp\qoidaysqli.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qoidaysqli.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_qoidaysqli.exeC:\Temp\i_qoidaysqli.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vtnlfdysqk.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\vtnlfdysqk.exeC:\Temp\vtnlfdysqk.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vtnlfdysqk.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_vtnlfdysqk.exeC:\Temp\i_vtnlfdysqk.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nlfdxvpnlf.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\nlfdxvpnlf.exeC:\Temp\nlfdxvpnlf.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nlfdxvpnlf.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_nlfdxvpnlf.exeC:\Temp\i_nlfdxvpnlf.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\kfcxusnkfc.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\kfcxusnkfc.exeC:\Temp\kfcxusnkfc.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_kfcxusnkfc.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_kfcxusnkfc.exeC:\Temp\i_kfcxusnkfc.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\causmkecxr.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\causmkecxr.exeC:\Temp\causmkecxr.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_causmkecxr.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_causmkecxr.exeC:\Temp\i_causmkecxr.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\cwupmhezxr.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\cwupmhezxr.exeC:\Temp\cwupmhezxr.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_cwupmhezxr.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_cwupmhezxr.exeC:\Temp\i_cwupmhezxr.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\urmjecwurm.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\urmjecwurm.exeC:\Temp\urmjecwurm.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_urmjecwurm.exe ups_ins3⤵
-
C:\Temp\i_urmjecwurm.exeC:\Temp\i_urmjecwurm.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ljebwqojgb.exe ups_run3⤵
-
C:\Temp\ljebwqojgb.exeC:\Temp\ljebwqojgb.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ljebwqojgb.exe ups_ins3⤵
-
C:\Temp\i_ljebwqojgb.exeC:\Temp\i_ljebwqojgb.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gaytnlgdyv.exe ups_run3⤵
-
C:\Temp\gaytnlgdyv.exeC:\Temp\gaytnlgdyv.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gaytnlgdyv.exe ups_ins3⤵
-
C:\Temp\i_gaytnlgdyv.exeC:\Temp\i_gaytnlgdyv.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gdyvqoigay.exe ups_run3⤵
-
C:\Temp\gdyvqoigay.exeC:\Temp\gdyvqoigay.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gdyvqoigay.exe ups_ins3⤵
-
C:\Temp\i_gdyvqoigay.exeC:\Temp\i_gdyvqoigay.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nlfdxvqnig.exe ups_run3⤵
-
C:\Temp\nlfdxvqnig.exeC:\Temp\nlfdxvqnig.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nlfdxvqnig.exe ups_ins3⤵
-
C:\Temp\i_nlfdxvqnig.exeC:\Temp\i_nlfdxvqnig.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xvpnhcaxsq.exe ups_run3⤵
-
C:\Temp\xvpnhcaxsq.exeC:\Temp\xvpnhcaxsq.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xvpnhcaxsq.exe ups_ins3⤵
-
C:\Temp\i_xvpnhcaxsq.exeC:\Temp\i_xvpnhcaxsq.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mhfzxrpjhc.exe ups_run3⤵
-
C:\Temp\mhfzxrpjhc.exeC:\Temp\mhfzxrpjhc.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mhfzxrpjhc.exe ups_ins3⤵
-
C:\Temp\i_mhfzxrpjhc.exeC:\Temp\i_mhfzxrpjhc.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nhfzusmkhc.exe ups_run3⤵
-
C:\Temp\nhfzusmkhc.exeC:\Temp\nhfzusmkhc.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nhfzusmkhc.exe ups_ins3⤵
-
C:\Temp\i_nhfzusmkhc.exeC:\Temp\i_nhfzusmkhc.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zuomgezwrp.exe ups_run3⤵
-
C:\Temp\zuomgezwrp.exeC:\Temp\zuomgezwrp.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zuomgezwrp.exe ups_ins3⤵
-
C:\Temp\i_zuomgezwrp.exeC:\Temp\i_zuomgezwrp.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mgeywrojgb.exe ups_run3⤵
-
C:\Temp\mgeywrojgb.exeC:\Temp\mgeywrojgb.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x34c,0x7ffb42c7c188,0x7ffb42c7c194,0x7ffb42c7c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1796,i,15113666820259121665,11533302538433888711,524288 --field-trial-handle=2284,i,15780938454777766487,7039129900705065953,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1600,i,2419721440602458547,10677216757665389274,262144 --field-trial-handle=2284,i,15780938454777766487,7039129900705065953,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2352,i,9919665426519934796,6092975309150748108,524288 --field-trial-handle=2284,i,15780938454777766487,7039129900705065953,262144 --variations-seed-version --mojo-platform-channel-handle=2816 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3480,i,16791389870718804025,8629849954594239432,2097152 --field-trial-handle=2284,i,15780938454777766487,7039129900705065953,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,5355367051205039588,7176052139519539897,2097152 --field-trial-handle=2284,i,15780938454777766487,7039129900705065953,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4056,i,9364073269737083844,5269463120160978721,2097152 --field-trial-handle=2284,i,15780938454777766487,7039129900705065953,262144 --variations-seed-version --mojo-platform-channel-handle=4148 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4068,i,17030952853504890295,10505059626625875083,2097152 --field-trial-handle=2284,i,15780938454777766487,7039129900705065953,262144 --variations-seed-version --mojo-platform-channel-handle=4152 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4088,i,11637636606383397943,15541780682828734353,2097152 --field-trial-handle=2284,i,15780938454777766487,7039129900705065953,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4116,i,12423269056988411232,12839288694200368083,2097152 --field-trial-handle=2284,i,15780938454777766487,7039129900705065953,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4500,i,15697122239518052918,13250692159954142778,524288 --field-trial-handle=2284,i,15780938454777766487,7039129900705065953,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3588,i,13502986258791313513,6252964165234376221,524288 --field-trial-handle=2284,i,15780938454777766487,7039129900705065953,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3644,i,46247058217394315,15820459198878838967,524288 --field-trial-handle=2284,i,15780938454777766487,7039129900705065953,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3612,i,13280745295000999700,391271113786073881,524288 --field-trial-handle=2284,i,15780938454777766487,7039129900705065953,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6040,i,14433903568937728133,12739345482355833843,524288 --field-trial-handle=2284,i,15780938454777766487,7039129900705065953,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6040,i,14433903568937728133,12739345482355833843,524288 --field-trial-handle=2284,i,15780938454777766487,7039129900705065953,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6204,i,1237909884752973516,11496700032035295034,524288 --field-trial-handle=2284,i,15780938454777766487,7039129900705065953,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:144⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.execookie_exporter.exe --cookie-json=11285⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6236,i,16200659534933710317,8680566402684499930,524288 --field-trial-handle=2284,i,15780938454777766487,7039129900705065953,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6420,i,13201841782959518003,15947865652613619719,524288 --field-trial-handle=2284,i,15780938454777766487,7039129900705065953,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6404,i,11641343067252338293,17120377873976795823,524288 --field-trial-handle=2284,i,15780938454777766487,7039129900705065953,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6220,i,3001979051392690337,4095341187083121628,524288 --field-trial-handle=2284,i,15780938454777766487,7039129900705065953,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6304,i,13813877496120993178,18040451989221825429,524288 --field-trial-handle=2284,i,15780938454777766487,7039129900705065953,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,18322666365359932147,3106464644464192572,524288 --field-trial-handle=2284,i,15780938454777766487,7039129900705065953,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,10785581544546066890,9397707497073520513,524288 --field-trial-handle=2284,i,15780938454777766487,7039129900705065953,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6140,i,12001340343220084520,17030873037886184821,524288 --field-trial-handle=2284,i,15780938454777766487,7039129900705065953,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3596,i,15936085145349694745,10179872393989423300,524288 --field-trial-handle=2284,i,15780938454777766487,7039129900705065953,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2860,i,6551715349638195732,12193772654941859812,524288 --field-trial-handle=2284,i,15780938454777766487,7039129900705065953,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4876,i,8412507638496943476,16504493777678113158,262144 --field-trial-handle=2284,i,15780938454777766487,7039129900705065953,262144 --variations-seed-version --mojo-platform-channel-handle=6524 /prefetch:104⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\causmkecxupnhxrp.sysC:\Temp\causmkecxupnhxrp.sys1⤵
- Executes dropped EXE
-
C:\Temp\ecwrpjhbzt.sysC:\Temp\ecwrpjhbzt.sys1⤵
- Executes dropped EXE
-
C:\Temp\uomgeywroj.sysC:\Temp\uomgeywroj.sys1⤵
- Executes dropped EXE
-
C:\Temp\igeywqoigb.sysC:\Temp\igeywqoigb.sys1⤵
- Executes dropped EXE
-
C:\Temp\igbytrljdb.sysC:\Temp\igbytrljdb.sys1⤵
- Executes dropped EXE
-
C:\Temp\dyvqnigdyv.sysC:\Temp\dyvqnigdyv.sys1⤵
- Executes dropped EXE
-
C:\Temp\ysqkicavsn.sysC:\Temp\ysqkicavsn.sys1⤵
- Executes dropped EXE
-
C:\Temp\snkfcxvpnh.sysC:\Temp\snkfcxvpnh.sys1⤵
- Executes dropped EXE
-
C:\Temp\usmkfcxupn.sysC:\Temp\usmkfcxupn.sys1⤵
- Executes dropped EXE
-
C:\Temp\jhbzurmkec.sysC:\Temp\jhbzurmkec.sys1⤵
- Executes dropped EXE
-
C:\Temp\bztrljebwu.sysC:\Temp\bztrljebwu.sys1⤵
- Executes dropped EXE
-
C:\Temp\trljdbwtol.sysC:\Temp\trljdbwtol.sys1⤵
-
C:\Temp\ytrljdbvto.sysC:\Temp\ytrljdbvto.sys1⤵
-
C:\Temp\qljdbvtnlg.sysC:\Temp\qljdbvtnlg.sys1⤵
-
C:\Temp\avsnlfdyvq.sysC:\Temp\avsnlfdyvq.sys1⤵
-
C:\Temp\hfaxsqkica.sysC:\Temp\hfaxsqkica.sys1⤵
-
C:\Temp\caxspkicau.sysC:\Temp\caxspkicau.sys1⤵
-
C:\Temp\upmhfzxrpj.sysC:\Temp\upmhfzxrpj.sys1⤵
-
C:\Temp\hezxrpjhbz.sysC:\Temp\hezxrpjhbz.sys1⤵
-
C:\Temp\wrojhbztrm.sysC:\Temp\wrojhbztrm.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CreateProcess.exe
bztrljdbwt.exe
causmkecxupnhxrp.exe
causmkecxupnhxrp.sys
ecwrpjhbzt.sys
ecwupjhbzu.exe
i_bztrljdbwt.exe
i_ecwupjhbzu.exe
i_ljebwuomge.exe
i_qoidaysqli.exe
i_wuomhezwrp.exe
igbytrljdb.sys
igeywqoigb.sys
ljebwuomge.exe
qoidaysqli.exe
uomgeywroj.sys
wuomhezwrp.exe
blocklist
settings.dat
settings.dat
BookmarkMergedSurfaceOrdering
the-real-index
the-real-index~RFe586aea.TMP
SiteList-Enterprise.json
Edge Profile.ico
HubApps
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
Preferences
Preferences
Secure Preferences
sync_diagnostic.log
CURRENT
MANIFEST-000001
OperationConfig
OperationConfig~RFe59065f.TMP
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
metadata.json
0158709a-be6c-4719-9175-f95f4ac49e8f.tmp
8aba7784-eb8f-4717-8fa4-dc97b41ef312.tmp
b70765da-48fd-426a-b2f9-10060df1b9f5.tmp
fcad2884-9897-43b8-83cf-389909235424.tmp
content_new.js
memory/408-864-0x0000000000670000-0x0000000000695000-memory.dmp
memory/420-581-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/428-757-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/428-784-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/576-748-0x0000000000970000-0x0000000000995000-memory.dmp
memory/644-688-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/644-728-0x0000000000A70000-0x0000000000A95000-memory.dmp
memory/900-767-0x0000000000670000-0x0000000000695000-memory.dmp
memory/928-594-0x0000000000980000-0x00000000009A5000-memory.dmp
memory/992-799-0x0000000000990000-0x00000000009B5000-memory.dmp
memory/1040-608-0x0000000000680000-0x00000000006A5000-memory.dmp
memory/1084-531-0x0000000000BC0000-0x0000000000BE5000-memory.dmp
memory/1176-803-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1256-588-0x0000000000690000-0x00000000006B5000-memory.dmp
memory/1268-215-0x0000000000880000-0x00000000008A5000-memory.dmp
memory/1304-630-0x0000000000980000-0x00000000009A5000-memory.dmp
memory/1332-486-0x0000000000730000-0x0000000000755000-memory.dmp
memory/1468-779-0x0000000000670000-0x0000000000695000-memory.dmp
memory/1496-676-0x0000000000970000-0x0000000000995000-memory.dmp
memory/1588-780-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1660-802-0x0000000000970000-0x0000000000995000-memory.dmp
memory/1664-853-0x00000000009B0000-0x00000000009D5000-memory.dmp
memory/1676-822-0x0000000000970000-0x0000000000995000-memory.dmp
memory/1680-587-0x0000000000980000-0x00000000009A5000-memory.dmp
memory/1696-540-0x0000000000BC0000-0x0000000000BE5000-memory.dmp
memory/1700-549-0x0000000000980000-0x00000000009A5000-memory.dmp
memory/1840-823-0x0000000000670000-0x0000000000695000-memory.dmp
memory/1844-532-0x0000000000680000-0x00000000006A5000-memory.dmp
memory/1848-782-0x0000000000990000-0x00000000009B5000-memory.dmp
memory/1860-714-0x0000000000670000-0x0000000000695000-memory.dmp
memory/1868-695-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1876-542-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1988-752-0x0000000000BC0000-0x0000000000BE5000-memory.dmp
memory/2092-648-0x0000000000780000-0x00000000007A5000-memory.dmp
memory/2156-694-0x0000000000970000-0x0000000000995000-memory.dmp
memory/2160-596-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2192-691-0x0000000000970000-0x0000000000995000-memory.dmp
memory/2476-756-0x0000000000830000-0x0000000000855000-memory.dmp
memory/2480-726-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2516-859-0x0000000000990000-0x00000000009B5000-memory.dmp
memory/2584-827-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2600-649-0x0000000000BB0000-0x0000000000BD5000-memory.dmp
memory/2748-798-0x0000000000830000-0x0000000000855000-memory.dmp
memory/2768-768-0x0000000000990000-0x00000000009B5000-memory.dmp
memory/2964-607-0x0000000000570000-0x0000000000595000-memory.dmp
memory/3016-751-0x0000000000980000-0x00000000009A5000-memory.dmp
memory/3108-725-0x0000000000B90000-0x0000000000BB5000-memory.dmp
memory/3120-729-0x00000000009A0000-0x00000000009C5000-memory.dmp
memory/3148-856-0x0000000000970000-0x0000000000995000-memory.dmp
memory/3160-796-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3160-820-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3176-865-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3288-548-0x0000000000640000-0x0000000000665000-memory.dmp
memory/3364-633-0x0000000000970000-0x0000000000995000-memory.dmp
memory/3384-652-0x0000000000990000-0x00000000009B5000-memory.dmp
memory/3412-533-0x0000018990050000-0x00000189901EA000-memory.dmp
memory/3488-671-0x00000000005B0000-0x00000000005D5000-memory.dmp
memory/3712-850-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3712-861-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3792-830-0x0000000000770000-0x0000000000795000-memory.dmp
memory/3940-76-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3972-867-0x0000000000680000-0x00000000006A5000-memory.dmp
memory/4040-783-0x0000000000990000-0x00000000009B5000-memory.dmp
memory/4048-631-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4072-488-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4156-833-0x0000000000540000-0x0000000000565000-memory.dmp
memory/4164-749-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4208-690-0x0000000000970000-0x0000000000995000-memory.dmp
memory/4216-857-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4224-795-0x0000000000970000-0x0000000000995000-memory.dmp
memory/4256-852-0x0000000000990000-0x00000000009B5000-memory.dmp
memory/4280-826-0x0000000000990000-0x00000000009B5000-memory.dmp
memory/4288-214-0x0000000000980000-0x00000000009A5000-memory.dmp
memory/4328-672-0x0000000000670000-0x0000000000695000-memory.dmp
memory/4388-868-0x0000000000560000-0x0000000000585000-memory.dmp
memory/4424-829-0x0000000000990000-0x00000000009B5000-memory.dmp
memory/4440-634-0x0000000000970000-0x0000000000995000-memory.dmp
memory/4448-646-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4556-653-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4564-579-0x0000000000980000-0x00000000009A5000-memory.dmp
memory/4588-645-0x0000000000B90000-0x0000000000BB5000-memory.dmp
memory/5016-860-0x0000000000980000-0x00000000009A5000-memory.dmp
memory/5048-713-0x0000000000600000-0x0000000000625000-memory.dmp