Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
16/04/2026, 21:42
General
- Target 2026-04-16_b6d4261239673eaebcc98d06e61a45d0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
- Size 381KB
- Sample260416-1krv7aev8x
- SHA256 c05b45c47880e502b8766fa1a99fe67425e8fa792700f0266b0565a66d7630b7
Score
10/10
Malware Config
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 13 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 40 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 19 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 29 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 3 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 19 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
- Suspicious use of AdjustPrivilegeToken 18 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-16_b6d4261239673eaebcc98d06e61a45d0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-16_b6d4261239673eaebcc98d06e61a45d0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\wuomhezxrpjhbzur.exeC:\Temp\wuomhezxrpjhbzur.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bzurmkecwo.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\bzurmkecwo.exeC:\Temp\bzurmkecwo.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bzurmkecwo.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_bzurmkecwo.exeC:\Temp\i_bzurmkecwo.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ywrpjhbzto.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ywrpjhbzto.exeC:\Temp\ywrpjhbzto.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ywrpjhbzto.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ywrpjhbzto.exeC:\Temp\i_ywrpjhbzto.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bztrljdytr.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\bztrljdytr.exeC:\Temp\bztrljdytr.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bztrljdytr.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_bztrljdytr.exeC:\Temp\i_bztrljdytr.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\lgeywqoigb.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\lgeywqoigb.exeC:\Temp\lgeywqoigb.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_lgeywqoigb.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_lgeywqoigb.exeC:\Temp\i_lgeywqoigb.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vqoigaysqk.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\vqoigaysqk.exeC:\Temp\vqoigaysqk.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vqoigaysqk.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_vqoigaysqk.exeC:\Temp\i_vqoigaysqk.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xvpnifaxsq.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\xvpnifaxsq.exeC:\Temp\xvpnifaxsq.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xvpnifaxsq.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_xvpnifaxsq.exeC:\Temp\i_xvpnifaxsq.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\kfcxspkica.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\kfcxspkica.exeC:\Temp\kfcxspkica.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_kfcxspkica.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_kfcxspkica.exeC:\Temp\i_kfcxspkica.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ausmkfcxvp.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ausmkfcxvp.exeC:\Temp\ausmkfcxvp.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ausmkfcxvp.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ausmkfcxvp.exeC:\Temp\i_ausmkfcxvp.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\usmkecwupm.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\usmkecwupm.exeC:\Temp\usmkecwupm.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_usmkecwupm.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_usmkecwupm.exeC:\Temp\i_usmkecwupm.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rpjhbwuomg.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\rpjhbwuomg.exeC:\Temp\rpjhbwuomg.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rpjhbwuomg.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_rpjhbwuomg.exeC:\Temp\i_rpjhbwuomg.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\omgeywqojg.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\omgeywqojg.exeC:\Temp\omgeywqojg.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_omgeywqojg.exe ups_ins3⤵
-
C:\Temp\i_omgeywqojg.exeC:\Temp\i_omgeywqojg.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ljdywtoigd.exe ups_run3⤵
-
C:\Temp\ljdywtoigd.exeC:\Temp\ljdywtoigd.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ljdywtoigd.exe ups_ins3⤵
-
C:\Temp\i_ljdywtoigd.exeC:\Temp\i_ljdywtoigd.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\oidbvqoiga.exe ups_run3⤵
-
C:\Temp\oidbvqoiga.exeC:\Temp\oidbvqoiga.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_oidbvqoiga.exe ups_ins3⤵
-
C:\Temp\i_oidbvqoiga.exeC:\Temp\i_oidbvqoiga.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ayvqkifavs.exe ups_run3⤵
-
C:\Temp\ayvqkifavs.exeC:\Temp\ayvqkifavs.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ayvqkifavs.exe ups_ins3⤵
-
C:\Temp\i_ayvqkifavs.exeC:\Temp\i_ayvqkifavs.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\icausnkfdx.exe ups_run3⤵
-
C:\Temp\icausnkfdx.exeC:\Temp\icausnkfdx.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_icausnkfdx.exe ups_ins3⤵
-
C:\Temp\i_icausnkfdx.exeC:\Temp\i_icausnkfdx.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fzxupmhezx.exe ups_run3⤵
-
C:\Temp\fzxupmhezx.exeC:\Temp\fzxupmhezx.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fzxupmhezx.exe ups_ins3⤵
-
C:\Temp\i_fzxupmhezx.exeC:\Temp\i_fzxupmhezx.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pmhfrpkecw.exe ups_run3⤵
-
C:\Temp\pmhfrpkecw.exeC:\Temp\pmhfrpkecw.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pmhfrpkecw.exe ups_ins3⤵
-
C:\Temp\i_pmhfrpkecw.exeC:\Temp\i_pmhfrpkecw.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zwrpmhbztr.exe ups_run3⤵
-
C:\Temp\zwrpmhbztr.exeC:\Temp\zwrpmhbztr.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zwrpmhbztr.exe ups_ins3⤵
-
C:\Temp\i_zwrpmhbztr.exeC:\Temp\i_zwrpmhbztr.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bwtomgeywq.exe ups_run3⤵
-
C:\Temp\bwtomgeywq.exeC:\Temp\bwtomgeywq.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x2f0,0x7ffbc219c188,0x7ffbc219c194,0x7ffbc219c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1596,i,12727962657522714805,5993066780007004021,262144 --field-trial-handle=2472,i,9996697906573134858,9136250717116053265,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1864,i,7842346069160531268,9435208122178004682,524288 --field-trial-handle=2472,i,9996697906573134858,9136250717116053265,262144 --variations-seed-version --mojo-platform-channel-handle=2568 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2296,i,2855829595547070410,17531489549780588721,524288 --field-trial-handle=2472,i,9996697906573134858,9136250717116053265,262144 --variations-seed-version --mojo-platform-channel-handle=3124 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3476,i,5612464289322693886,11451795616038757024,2097152 --field-trial-handle=2472,i,9996697906573134858,9136250717116053265,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3480,i,17775913528432132041,2798354586212810254,2097152 --field-trial-handle=2472,i,9996697906573134858,9136250717116053265,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4112,i,10151677057632399219,7385838596333004673,2097152 --field-trial-handle=2472,i,9996697906573134858,9136250717116053265,262144 --variations-seed-version --mojo-platform-channel-handle=4120 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4140,i,6009508127615883695,3875837864090892871,2097152 --field-trial-handle=2472,i,9996697906573134858,9136250717116053265,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4272,i,7924381671122046202,5321876853333069743,2097152 --field-trial-handle=2472,i,9996697906573134858,9136250717116053265,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4320,i,9203055937320152590,15422141069819917305,2097152 --field-trial-handle=2472,i,9996697906573134858,9136250717116053265,262144 --variations-seed-version --mojo-platform-channel-handle=4424 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5292,i,11236877008447988373,9768355919998649088,524288 --field-trial-handle=2472,i,9996697906573134858,9136250717116053265,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5308,i,11063757875208848306,12817113559702682119,524288 --field-trial-handle=2472,i,9996697906573134858,9136250717116053265,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3908,i,15265326525519173739,5736256778493868501,524288 --field-trial-handle=2472,i,9996697906573134858,9136250717116053265,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3896,i,8807334311499178864,1217878136508594659,524288 --field-trial-handle=2472,i,9996697906573134858,9136250717116053265,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,12649343601549616884,16355483422610896739,524288 --field-trial-handle=2472,i,9996697906573134858,9136250717116053265,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,12649343601549616884,16355483422610896739,524288 --field-trial-handle=2472,i,9996697906573134858,9136250717116053265,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6184,i,14176420231089353490,7979564334014488803,524288 --field-trial-handle=2472,i,9996697906573134858,9136250717116053265,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:144⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.execookie_exporter.exe --cookie-json=11365⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6440,i,4587933322696952228,12086238048737395309,524288 --field-trial-handle=2472,i,9996697906573134858,9136250717116053265,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6444,i,7175604801152194191,10690658156067097980,524288 --field-trial-handle=2472,i,9996697906573134858,9136250717116053265,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6444,i,7210089381811915177,3112883486030312575,524288 --field-trial-handle=2472,i,9996697906573134858,9136250717116053265,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6728,i,8107443554758507578,2800801264896144863,524288 --field-trial-handle=2472,i,9996697906573134858,9136250717116053265,262144 --variations-seed-version --mojo-platform-channel-handle=6820 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6716,i,8019280451358588816,7122389627352275257,524288 --field-trial-handle=2472,i,9996697906573134858,9136250717116053265,262144 --variations-seed-version --mojo-platform-channel-handle=6748 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4416,i,10286025077971225789,12950311644811236129,524288 --field-trial-handle=2472,i,9996697906573134858,9136250717116053265,262144 --variations-seed-version --mojo-platform-channel-handle=1628 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6648,i,6227347710360330215,2076457140853248232,524288 --field-trial-handle=2472,i,9996697906573134858,9136250717116053265,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4316,i,3237234920747977054,14590379312739330336,524288 --field-trial-handle=2472,i,9996697906573134858,9136250717116053265,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5508,i,3794399614913059405,11939754156746824974,524288 --field-trial-handle=2472,i,9996697906573134858,9136250717116053265,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5404,i,16893733557950859187,11028071610755703808,524288 --field-trial-handle=2472,i,9996697906573134858,9136250717116053265,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6792,i,8994714578022779508,8767112156011977812,524288 --field-trial-handle=2472,i,9996697906573134858,9136250717116053265,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3892,i,5693845554780093697,3191506182570605806,524288 --field-trial-handle=2472,i,9996697906573134858,9136250717116053265,262144 --variations-seed-version --mojo-platform-channel-handle=6852 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6216,i,12574558852735422632,6221149689884829889,524288 --field-trial-handle=2472,i,9996697906573134858,9136250717116053265,262144 --variations-seed-version --mojo-platform-channel-handle=6904 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6448,i,15123861768028953712,3428948115708616552,262144 --field-trial-handle=2472,i,9996697906573134858,9136250717116053265,262144 --variations-seed-version --mojo-platform-channel-handle=3892 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5724,i,18102726368430709619,11870213940248132729,524288 --field-trial-handle=2472,i,9996697906573134858,9136250717116053265,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\wuomhezxrpjhbzur.sysC:\Temp\wuomhezxrpjhbzur.sys1⤵
- Executes dropped EXE
-
C:\Temp\xrpjecwmge.sysC:\Temp\xrpjecwmge.sys1⤵
- Executes dropped EXE
-
C:\Temp\wqojgbywrl.sysC:\Temp\wqojgbywrl.sys1⤵
- Executes dropped EXE
-
C:\Temp\vtolgeywqo.sysC:\Temp\vtolgeywqo.sys1⤵
- Executes dropped EXE
-
C:\Temp\idbytnlfdy.sysC:\Temp\idbytnlfdy.sys1⤵
- Executes dropped EXE
-
C:\Temp\ifaxsqkica.sysC:\Temp\ifaxsqkica.sys1⤵
- Executes dropped EXE
-
C:\Temp\dxvpnlfdxv.sysC:\Temp\dxvpnlfdxv.sys1⤵
- Executes dropped EXE
-
C:\Temp\kicausmkfc.sysC:\Temp\kicausmkfc.sys1⤵
- Executes dropped EXE
-
C:\Temp\cwuomkecwu.sysC:\Temp\cwuomkecwu.sys1⤵
- Executes dropped EXE
-
C:\Temp\ebwuomjezw.sysC:\Temp\ebwuomjezw.sys1⤵
- Executes dropped EXE
-
C:\Temp\bwtomgeywq.sysC:\Temp\bwtomgeywq.sys1⤵
- Executes dropped EXE
-
C:\Temp\dbwtoljeyw.sysC:\Temp\dbwtoljeyw.sys1⤵
-
C:\Temp\dbvtnlgayt.sysC:\Temp\dbvtnlgayt.sys1⤵
-
C:\Temp\qkidxvtnkf.sysC:\Temp\qkidxvtnkf.sys1⤵
-
C:\Temp\spkicausmk.sysC:\Temp\spkicausmk.sys1⤵
-
C:\Temp\xvpnhcaxsp.sysC:\Temp\xvpnhcaxsp.sys1⤵
-
C:\Temp\cxupnhfzxr.sysC:\Temp\cxupnhfzxr.sys1⤵
-
C:\Temp\cwrpjhbztr.sysC:\Temp\cwrpjhbztr.sys1⤵
-
C:\Temp\ljdbwtomge.sysC:\Temp\ljdbwtomge.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
bztrljdytr.exe
bzurmkecwo.exe
i_bztrljdytr.exe
i_bzurmkecwo.exe
i_lgeywqoigb.exe
i_vqoigaysqk.exe
i_ywrpjhbzto.exe
idbytnlfdy.sys
lgeywqoigb.exe
vqoigaysqk.exe
vtolgeywqo.sys
wqojgbywrl.sys
wuomhezxrpjhbzur.exe
wuomhezxrpjhbzur.sys
xrpjecwmge.sys
ywrpjhbzto.exe
blocklist
protocols.json
settings.dat
settings.dat
916d780e-852c-4152-abf5-6922bcb8d0aa.tmp
BookmarkMergedSurfaceOrdering
the-real-index
SiteList-Enterprise.json
Edge Profile.ico
HubApps
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
Preferences
Secure Preferences
sync_diagnostic.log
CURRENT
MANIFEST-000001
OperationConfig
OperationConfig~RFe591255.TMP
office_endpoints_list.json
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
nav_config.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
cc7bd910-e23c-473b-8140-0070fcf7684a.tmp
f61c869f-ed1e-4a06-99d9-e26eefd1f73e.tmp
e6645bd4-3642-41f5-b757-f537d27fb24e.tmp
content_new.js
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
CreateProcess.exe
memory/240-860-0x0000000000830000-0x00000000008AB000-memory.dmp
memory/348-665-0x00000000009F0000-0x0000000000A6B000-memory.dmp
memory/604-864-0x00000000009C0000-0x0000000000A3B000-memory.dmp
memory/648-624-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/648-833-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/648-648-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/648-858-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/776-582-0x00000000009D0000-0x0000000000A4B000-memory.dmp
memory/808-620-0x0000000000960000-0x00000000009DB000-memory.dmp
memory/864-896-0x0000000000980000-0x00000000009FB000-memory.dmp
memory/900-813-0x0000000000A30000-0x0000000000AAB000-memory.dmp
memory/912-840-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/912-866-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/928-900-0x0000000000990000-0x0000000000A0B000-memory.dmp
memory/940-540-0x00000000009A0000-0x0000000000A1B000-memory.dmp
memory/956-755-0x00000000009A0000-0x0000000000A1B000-memory.dmp
memory/1048-747-0x0000000000970000-0x00000000009EB000-memory.dmp
memory/1076-619-0x0000000000960000-0x00000000009DB000-memory.dmp
memory/1092-528-0x00000270EDB50000-0x00000270EDC3A000-memory.dmp
memory/1132-617-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1328-623-0x0000000000870000-0x00000000008EB000-memory.dmp
memory/1480-704-0x0000000000860000-0x00000000008DB000-memory.dmp
memory/1660-861-0x0000000000980000-0x00000000009FB000-memory.dmp
memory/1760-756-0x0000000000840000-0x00000000008BB000-memory.dmp
memory/1764-676-0x0000000000970000-0x00000000009EB000-memory.dmp
memory/1908-725-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1908-752-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2028-165-0x0000000000840000-0x00000000008BB000-memory.dmp
memory/2068-616-0x0000000000960000-0x00000000009DB000-memory.dmp
memory/2248-602-0x00000000008C0000-0x000000000093B000-memory.dmp
memory/2268-903-0x0000000000A00000-0x0000000000A7B000-memory.dmp
memory/2360-533-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2360-79-0x000001E4A3200000-0x000001E4A32EA000-memory.dmp
memory/2400-787-0x0000000000870000-0x00000000008EB000-memory.dmp
memory/2452-745-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2452-702-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2460-939-0x0000000000850000-0x00000000008CB000-memory.dmp
memory/2708-677-0x00000000009E0000-0x0000000000A5B000-memory.dmp
memory/2732-751-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3028-809-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3060-635-0x00000000009F0000-0x0000000000A6B000-memory.dmp
memory/3080-776-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3080-810-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3112-899-0x00000000009C0000-0x0000000000A3B000-memory.dmp
memory/3136-812-0x0000000000990000-0x0000000000A0B000-memory.dmp
memory/3156-884-0x0000000000870000-0x00000000008EB000-memory.dmp
memory/3288-586-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3288-724-0x0000000000970000-0x00000000009EB000-memory.dmp
memory/3452-601-0x0000000000680000-0x00000000006FB000-memory.dmp
memory/3456-832-0x0000000000960000-0x00000000009DB000-memory.dmp
memory/3544-522-0x0000000000630000-0x00000000006AB000-memory.dmp
memory/3560-567-0x0000000000970000-0x00000000009EB000-memory.dmp
memory/3584-920-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3640-808-0x0000000000970000-0x00000000009EB000-memory.dmp
memory/3760-169-0x00000000008B0000-0x000000000092B000-memory.dmp
memory/3784-539-0x0000000000820000-0x000000000089B000-memory.dmp
memory/3864-839-0x0000000000980000-0x00000000009FB000-memory.dmp
memory/3900-650-0x0000000000980000-0x00000000009FB000-memory.dmp
memory/3912-479-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3932-576-0x00000000009C0000-0x0000000000A3B000-memory.dmp
memory/3936-477-0x0000000000830000-0x00000000008AB000-memory.dmp
memory/3960-885-0x0000000000660000-0x00000000006DB000-memory.dmp
memory/3964-569-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3980-836-0x0000000000990000-0x0000000000A0B000-memory.dmp
memory/3984-64-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4008-746-0x00000000009B0000-0x0000000000A2B000-memory.dmp
memory/4112-634-0x0000000000960000-0x00000000009DB000-memory.dmp
memory/4192-639-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4212-775-0x00000000009B0000-0x0000000000A2B000-memory.dmp
memory/4228-705-0x0000000000960000-0x00000000009DB000-memory.dmp
memory/4256-835-0x00000000008D0000-0x000000000094B000-memory.dmp
memory/4284-750-0x00000000009A0000-0x0000000000A1B000-memory.dmp
memory/4392-523-0x0000000000890000-0x000000000090B000-memory.dmp
memory/4420-786-0x00000000008B0000-0x000000000092B000-memory.dmp
memory/4484-865-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4608-531-0x00000000008B0000-0x000000000092B000-memory.dmp
memory/4680-701-0x0000000000660000-0x00000000006DB000-memory.dmp
memory/4708-897-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4756-638-0x00000000009D0000-0x0000000000A4B000-memory.dmp
memory/4824-575-0x00000000008B0000-0x000000000092B000-memory.dmp
memory/4872-940-0x00000000009A0000-0x0000000000A1B000-memory.dmp
memory/4908-666-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4960-651-0x00000000009C0000-0x0000000000A3B000-memory.dmp