Analysis
- max time kernel
148s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
25/04/2026, 18:46
General
- Target 2026-04-25_e38d463b1b5aa13f08618e1b17532c33_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
- Size 381KB
- Sample260425-xe2xesaw4q
- SHA256 90f95b3307951fa1000e4b6d1f84d828e1b24f8b61c9ff5860d74f85109e09de
Score
10/10
Malware Config
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Loads dropped DLL 1 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 41 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 19 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 29 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 3 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-25_e38d463b1b5aa13f08618e1b17532c33_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-25_e38d463b1b5aa13f08618e1b17532c33_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\smkecxupmhfzxrpj.exeC:\Temp\smkecxupmhfzxrpj.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ausmkfcxup.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\ausmkfcxup.exeC:\Temp\ausmkfcxup.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ausmkfcxup.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ausmkfcxup.exeC:\Temp\i_ausmkfcxup.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mhezxrpjhb.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\mhezxrpjhb.exeC:\Temp\mhezxrpjhb.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mhezxrpjhb.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_mhezxrpjhb.exeC:\Temp\i_mhezxrpjhb.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ztrmjebzto.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ztrmjebzto.exeC:\Temp\ztrmjebzto.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ztrmjebzto.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ztrmjebzto.exeC:\Temp\i_ztrmjebzto.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ljdbwtomge.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ljdbwtomge.exeC:\Temp\ljdbwtomge.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ljdbwtomge.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ljdbwtomge.exeC:\Temp\i_ljdbwtomge.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\igbytqlgdb.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\igbytqlgdb.exeC:\Temp\igbytqlgdb.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_igbytqlgdb.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_igbytqlgdb.exeC:\Temp\i_igbytqlgdb.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qligaysqli.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\qligaysqli.exeC:\Temp\qligaysqli.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qligaysqli.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_qligaysqli.exeC:\Temp\i_qligaysqli.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\dxvqnifays.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\dxvqnifays.exeC:\Temp\dxvqnifays.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_dxvqnifays.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_dxvqnifays.exeC:\Temp\i_dxvqnifays.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mkicausnkf.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\mkicausnkf.exeC:\Temp\mkicausnkf.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mkicausnkf.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_mkicausnkf.exeC:\Temp\i_mkicausnkf.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pnicausmkf.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\pnicausmkf.exeC:\Temp\pnicausmkf.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pnicausmkf.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_pnicausmkf.exeC:\Temp\i_pnicausmkf.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ezxrpmhczu.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ezxrpmhczu.exeC:\Temp\ezxrpmhczu.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ezxrpmhczu.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ezxrpmhczu.exeC:\Temp\i_ezxrpmhczu.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rmgezwrpjh.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\rmgezwrpjh.exeC:\Temp\rmgezwrpjh.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rmgezwrpjh.exe ups_ins3⤵
-
C:\Temp\i_rmgezwrpjh.exeC:\Temp\i_rmgezwrpjh.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mgbytrljdb.exe ups_run3⤵
-
C:\Temp\mgbytrljdb.exeC:\Temp\mgbytrljdb.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mgbytrljdb.exe ups_ins3⤵
-
C:\Temp\i_mgbytrljdb.exeC:\Temp\i_mgbytrljdb.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jdbwtoljdy.exe ups_run3⤵
-
C:\Temp\jdbwtoljdy.exeC:\Temp\jdbwtoljdy.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jdbwtoljdy.exe ups_ins3⤵
-
C:\Temp\i_jdbwtoljdy.exeC:\Temp\i_jdbwtoljdy.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\tnlgdywqoi.exe ups_run3⤵
-
C:\Temp\tnlgdywqoi.exeC:\Temp\tnlgdywqoi.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_tnlgdywqoi.exe ups_ins3⤵
-
C:\Temp\i_tnlgdywqoi.exeC:\Temp\i_tnlgdywqoi.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\lfdxvqnida.exe ups_run3⤵
-
C:\Temp\lfdxvqnida.exeC:\Temp\lfdxvqnida.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_lfdxvqnida.exe ups_ins3⤵
-
C:\Temp\i_lfdxvqnida.exeC:\Temp\i_lfdxvqnida.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\causnkfcxv.exe ups_run3⤵
-
C:\Temp\causnkfcxv.exeC:\Temp\causnkfcxv.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_causnkfcxv.exe ups_ins3⤵
-
C:\Temp\i_causnkfcxv.exeC:\Temp\i_causnkfcxv.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ausmkfcaus.exe ups_run3⤵
-
C:\Temp\ausmkfcaus.exeC:\Temp\ausmkfcaus.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ausmkfcaus.exe ups_ins3⤵
-
C:\Temp\i_ausmkfcaus.exeC:\Temp\i_ausmkfcaus.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\smkecxupnh.exe ups_run3⤵
-
C:\Temp\smkecxupnh.exeC:\Temp\smkecxupnh.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_smkecxupnh.exe ups_ins3⤵
-
C:\Temp\i_smkecxupnh.exeC:\Temp\i_smkecxupnh.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hbzurmjecw.exe ups_run3⤵
-
C:\Temp\hbzurmjecw.exeC:\Temp\hbzurmjecw.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hbzurmjecw.exe ups_ins3⤵
-
C:\Temp\i_hbzurmjecw.exeC:\Temp\i_hbzurmjecw.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Loads dropped DLL
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x328,0x7ff999c0c188,0x7ff999c0c194,0x7ff999c0c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1772,i,3637695584486104534,8552891122963709555,524288 --field-trial-handle=2160,i,8313298881646032642,1816918744910907403,262144 --variations-seed-version --mojo-platform-channel-handle=2196 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1604,i,4960401209437174304,17240284288179816967,262144 --field-trial-handle=2160,i,8313298881646032642,1816918744910907403,262144 --variations-seed-version --mojo-platform-channel-handle=2156 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2552,i,15952109890673403667,17097109865408958851,524288 --field-trial-handle=2160,i,8313298881646032642,1816918744910907403,262144 --variations-seed-version --mojo-platform-channel-handle=2560 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,5397546636889905026,3828096396843975406,2097152 --field-trial-handle=2160,i,8313298881646032642,1816918744910907403,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,15770457621156198936,9214599694678549501,2097152 --field-trial-handle=2160,i,8313298881646032642,1816918744910907403,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4856,i,3446185751985507033,13866643992536471130,2097152 --field-trial-handle=2160,i,8313298881646032642,1816918744910907403,262144 --variations-seed-version --mojo-platform-channel-handle=4868 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=3536,i,7912714271150141955,5790812751657580505,2097152 --field-trial-handle=2160,i,8313298881646032642,1816918744910907403,262144 --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3476,i,8511977470451284077,2690322103389238825,524288 --field-trial-handle=2160,i,8313298881646032642,1816918744910907403,262144 --variations-seed-version --mojo-platform-channel-handle=1592 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3580,i,11208747214293338250,9162400409043608268,524288 --field-trial-handle=2160,i,8313298881646032642,1816918744910907403,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5648,i,16723600737232020318,8506864965900352,524288 --field-trial-handle=2160,i,8313298881646032642,1816918744910907403,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5648,i,16723600737232020318,8506864965900352,524288 --field-trial-handle=2160,i,8313298881646032642,1816918744910907403,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5816,i,12764477628543255669,14408019076638747343,524288 --field-trial-handle=2160,i,8313298881646032642,1816918744910907403,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:144⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.execookie_exporter.exe --cookie-json=11325⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6228,i,8827844920003877013,584283714000007802,524288 --field-trial-handle=2160,i,8313298881646032642,1816918744910907403,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6260,i,7977411729163407466,13021753909975102829,524288 --field-trial-handle=2160,i,8313298881646032642,1816918744910907403,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6204,i,12050976642974891759,4761729646686637083,524288 --field-trial-handle=2160,i,8313298881646032642,1816918744910907403,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6304,i,9381643786558350806,5446744283095190284,524288 --field-trial-handle=2160,i,8313298881646032642,1816918744910907403,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6236,i,10135046056498325578,13810750358550378063,524288 --field-trial-handle=2160,i,8313298881646032642,1816918744910907403,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6468,i,9247421873939240029,15123254739774409993,524288 --field-trial-handle=2160,i,8313298881646032642,1816918744910907403,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,806854357450597343,7111768271440384597,524288 --field-trial-handle=2160,i,8313298881646032642,1816918744910907403,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6416,i,13867299971380921762,11108907636502169321,524288 --field-trial-handle=2160,i,8313298881646032642,1816918744910907403,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5484,i,12833661190772983368,2522676202398556913,524288 --field-trial-handle=2160,i,8313298881646032642,1816918744910907403,262144 --variations-seed-version --mojo-platform-channel-handle=6388 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6636,i,13548722703272656669,7871982244336979139,524288 --field-trial-handle=2160,i,8313298881646032642,1816918744910907403,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5896,i,3837007490910491676,2363997944414453864,262144 --field-trial-handle=2160,i,8313298881646032642,1816918744910907403,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6204,i,15706988123721471696,1305250073815169484,524288 --field-trial-handle=2160,i,8313298881646032642,1816918744910907403,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\smkecxupmhfzxrpj.sysC:\Temp\smkecxupmhfzxrpj.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Temp\zxrpjhbwus.sysC:\Temp\zxrpjhbwus.sys1⤵
- Executes dropped EXE
-
C:\Temp\jecwuomgez.sysC:\Temp\jecwuomgez.sys1⤵
- Executes dropped EXE
-
C:\Temp\hbwuomgeyw.sysC:\Temp\hbwuomgeyw.sys1⤵
- Executes dropped EXE
-
C:\Temp\trljdbwtol.sysC:\Temp\trljdbwtol.sys1⤵
- Executes dropped EXE
-
C:\Temp\ayvqlidbvs.sysC:\Temp\ayvqlidbvs.sys1⤵
- Executes dropped EXE
-
C:\Temp\kicavsnlfd.sysC:\Temp\kicavsnlfd.sys1⤵
- Executes dropped EXE
-
C:\Temp\fdxvpnifax.sysC:\Temp\fdxvpnifax.sys1⤵
- Executes dropped EXE
-
C:\Temp\upnhfzxrpk.sysC:\Temp\upnhfzxrpk.sys1⤵
- Executes dropped EXE
-
C:\Temp\pjhczusmke.sysC:\Temp\pjhczusmke.sys1⤵
- Executes dropped EXE
-
C:\Temp\zwrojhbztr.sysC:\Temp\zwrojhbztr.sys1⤵
- Executes dropped EXE
-
C:\Temp\bztrmjebwu.sysC:\Temp\bztrmjebwu.sys1⤵
-
C:\Temp\rljdbztrlj.sysC:\Temp\rljdbztrlj.sys1⤵
-
C:\Temp\dbvtnlgdyw.sysC:\Temp\dbvtnlgdyw.sys1⤵
-
C:\Temp\vqnidaysqk.sysC:\Temp\vqnidaysqk.sys1⤵
-
C:\Temp\sqkidavtnl.sysC:\Temp\sqkidavtnl.sys1⤵
-
C:\Temp\kicausmkfc.sysC:\Temp\kicausmkfc.sys1⤵
-
C:\Temp\causmhecxu.sysC:\Temp\causmhecxu.sys1⤵
-
C:\Temp\rmkecwupmh.sysC:\Temp\rmkecwupmh.sys1⤵
-
C:\Temp\mhbzwrmgez.sysC:\Temp\mhbzwrmgez.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CreateProcess.exe
ausmkfcxup.exe
ayvqlidbvs.sys
hbwuomgeyw.sys
i_ausmkfcxup.exe
i_igbytqlgdb.exe
i_ljdbwtomge.exe
i_mhezxrpjhb.exe
i_ztrmjebzto.exe
igbytqlgdb.exe
jecwuomgez.sys
ljdbwtomge.exe
mhezxrpjhb.exe
qligaysqli.exe
smkecxupmhfzxrpj.exe
smkecxupmhfzxrpj.sys
trljdbwtol.sys
ztrmjebzto.exe
zxrpjhbwus.sys
autofill_bypass_cache_forms.json
edge_autofill_global_block_list.json
v1FieldTypes.json
settings.dat
settings.dat
BookmarkMergedSurfaceOrdering
BrowsingTopicsState
SiteList-Enterprise.json
HubApps
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Preferences
Preferences
Secure Preferences
sync_diagnostic.log
CURRENT
MANIFEST-000001
domain_actions.dll
data.txt
Local State
Local State
Local State
Local State
Local State
Local State
metadata.json
metadata.json
metadata.json
metadata.json
3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
metadata.json
manifest.json
keys.json
manifest.json
manifest.json
manifest.json
manifest.json
memory/352-286-0x0000000000A00000-0x0000000000A7B000-memory.dmp
memory/744-600-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/848-702-0x00000000009A0000-0x0000000000A1B000-memory.dmp
memory/952-223-0x0000000000990000-0x0000000000A0B000-memory.dmp
memory/1080-690-0x0000000000970000-0x00000000009EB000-memory.dmp
memory/1128-869-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1128-893-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1452-229-0x00000000009A0000-0x0000000000A1B000-memory.dmp
memory/1508-807-0x0000000000860000-0x00000000008DB000-memory.dmp
memory/1520-614-0x00000000009D0000-0x0000000000A4B000-memory.dmp
memory/1648-58-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1872-837-0x00000000009E0000-0x0000000000A5B000-memory.dmp
memory/2120-585-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2132-584-0x0000000000A30000-0x0000000000AAB000-memory.dmp
memory/2212-892-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2220-278-0x0000000000830000-0x00000000008AB000-memory.dmp
memory/2460-618-0x00000000009D0000-0x0000000000A4B000-memory.dmp
memory/2480-264-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2544-802-0x00000000009F0000-0x0000000000A6B000-memory.dmp
memory/2656-826-0x0000000000A00000-0x0000000000A7B000-memory.dmp
memory/2772-701-0x0000000000980000-0x00000000009FB000-memory.dmp
memory/2836-664-0x0000000000870000-0x00000000008EB000-memory.dmp
memory/2900-896-0x0000000000830000-0x00000000008AB000-memory.dmp
memory/3056-714-0x0000000000960000-0x00000000009DB000-memory.dmp
memory/3156-842-0x0000000000980000-0x00000000009FB000-memory.dmp
memory/3192-879-0x0000000000660000-0x00000000006DB000-memory.dmp
memory/3244-232-0x000001F918740000-0x000001F9188DA000-memory.dmp
memory/3244-528-0x0000000000830000-0x00000000008AB000-memory.dmp
memory/3600-789-0x0000000000590000-0x000000000060B000-memory.dmp
memory/3688-838-0x0000000000880000-0x00000000008FB000-memory.dmp
memory/3708-587-0x00000000009D0000-0x0000000000A4B000-memory.dmp
memory/3712-262-0x0000000000820000-0x000000000089B000-memory.dmp
memory/3716-749-0x00000000009D0000-0x0000000000A4B000-memory.dmp
memory/3828-665-0x0000000000970000-0x00000000009EB000-memory.dmp
memory/4132-602-0x0000000000980000-0x00000000009FB000-memory.dmp
memory/4228-788-0x00000000009E0000-0x0000000000A5B000-memory.dmp
memory/4264-67-0x00000000009A0000-0x0000000000A1B000-memory.dmp
memory/4316-648-0x0000000000990000-0x0000000000A0B000-memory.dmp
memory/4352-891-0x0000000000750000-0x00000000007CB000-memory.dmp
memory/4364-803-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4376-603-0x00000000008B0000-0x000000000092B000-memory.dmp
memory/4384-880-0x0000000000960000-0x00000000009DB000-memory.dmp
memory/4416-617-0x00000000009E0000-0x0000000000A5B000-memory.dmp
memory/4444-579-0x00000000009D0000-0x0000000000A4B000-memory.dmp
memory/4472-843-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4516-199-0x0000000000970000-0x00000000009EB000-memory.dmp
memory/4568-856-0x0000000000690000-0x000000000070B000-memory.dmp
memory/4584-754-0x0000000000980000-0x00000000009FB000-memory.dmp
memory/4588-757-0x00000000009C0000-0x0000000000A3B000-memory.dmp
memory/4600-615-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4612-908-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4632-865-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4632-827-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4904-222-0x0000000000850000-0x00000000008CB000-memory.dmp
memory/5004-551-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5116-755-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5148-895-0x0000000000960000-0x00000000009DB000-memory.dmp
memory/5256-699-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5284-66-0x00000000009B0000-0x0000000000A2B000-memory.dmp
memory/5360-750-0x0000000000970000-0x00000000009EB000-memory.dmp
memory/5404-248-0x0000000000960000-0x00000000009DB000-memory.dmp
memory/5424-907-0x0000000000A10000-0x0000000000A8B000-memory.dmp
memory/5436-868-0x0000000000830000-0x00000000008AB000-memory.dmp
memory/5452-599-0x0000000000980000-0x00000000009FB000-memory.dmp
memory/5488-549-0x00000000009B0000-0x0000000000A2B000-memory.dmp
memory/5564-806-0x0000000000990000-0x0000000000A0B000-memory.dmp
memory/5572-231-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5604-804-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5604-778-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5656-529-0x0000000000620000-0x000000000069B000-memory.dmp
memory/5660-201-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5796-588-0x0000000000970000-0x00000000009EB000-memory.dmp
memory/5816-649-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5816-703-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5828-288-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5828-855-0x00000000009D0000-0x0000000000A4B000-memory.dmp
memory/5828-552-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5908-758-0x0000000000970000-0x00000000009EB000-memory.dmp
memory/5924-715-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5936-247-0x00000000009A0000-0x0000000000A1B000-memory.dmp
memory/5952-777-0x0000000000970000-0x00000000009EB000-memory.dmp
memory/5964-580-0x00000000009D0000-0x0000000000A4B000-memory.dmp
memory/6128-279-0x0000000000970000-0x00000000009EB000-memory.dmp