Analysis
- max time kernel
148s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
06/05/2026, 10:32
General
- Target 2026-05-06_0ae5a17fc14db2c398d87fde9e1f924f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 361KB
- Sample260506-mk6gpabs4k
- SHA256 f2e6a13219e13371d7b1cdae627bbdd7e10056028aeabcbb20f02c0e44322b0a
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba
-
http://xytets.com:2345/t.asp?os=home
-
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 13 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 41 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 19 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 29 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 3 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-06_0ae5a17fc14db2c398d87fde9e1f924f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-06_0ae5a17fc14db2c398d87fde9e1f924f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\uomgeywrojhbztrl.exeC:\Temp\uomgeywrojhbztrl.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\eywrojhbto.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\eywrojhbto.exeC:\Temp\eywrojhbto.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_eywrojhbto.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_eywrojhbto.exeC:\Temp\i_eywrojhbto.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mgeywqojgb.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\mgeywqojgb.exeC:\Temp\mgeywqojgb.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mgeywqojgb.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_mgeywqojgb.exeC:\Temp\i_mgeywqojgb.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\eywqoigbyt.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\eywqoigbyt.exeC:\Temp\eywqoigbyt.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_eywqoigbyt.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_eywqoigbyt.exeC:\Temp\i_eywqoigbyt.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qnigaysqki.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\qnigaysqki.exeC:\Temp\qnigaysqki.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qnigaysqki.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_qnigaysqki.exeC:\Temp\i_qnigaysqki.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\aysqkidavs.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\aysqkidavs.exeC:\Temp\aysqkidavs.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_aysqkidavs.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_aysqkidavs.exeC:\Temp\i_aysqkidavs.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nkfcxvpnhf.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\nkfcxvpnhf.exeC:\Temp\nkfcxvpnhf.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nkfcxvpnhf.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_nkfcxvpnhf.exeC:\Temp\i_nkfcxvpnhf.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mhfzxrpkhc.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\mhfzxrpkhc.exeC:\Temp\mhfzxrpkhc.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mhfzxrpkhc.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_mhfzxrpkhc.exeC:\Temp\i_mhfzxrpkhc.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ecwupmhfzx.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ecwupmhfzx.exeC:\Temp\ecwupmhfzx.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ecwupmhfzx.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ecwupmhfzx.exeC:\Temp\i_ecwupmhfzx.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wuomgecwuo.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\wuomgecwuo.exeC:\Temp\wuomgecwuo.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wuomgecwuo.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_wuomgecwuo.exeC:\Temp\i_wuomgecwuo.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jebwuomgbz.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\jebwuomgbz.exeC:\Temp\jebwuomgbz.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jebwuomgbz.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_jebwuomgbz.exeC:\Temp\i_jebwuomgbz.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\eywrojgbyt.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\eywrojgbyt.exeC:\Temp\eywrojgbyt.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_eywrojgbyt.exe ups_ins3⤵
-
C:\Temp\i_eywrojgbyt.exeC:\Temp\i_eywrojgbyt.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qlidbvtnlf.exe ups_run3⤵
-
C:\Temp\qlidbvtnlf.exeC:\Temp\qlidbvtnlf.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qlidbvtnlf.exe ups_ins3⤵
-
C:\Temp\i_qlidbvtnlf.exeC:\Temp\i_qlidbvtnlf.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\davsnlfdxv.exe ups_run3⤵
-
C:\Temp\davsnlfdxv.exeC:\Temp\davsnlfdxv.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_davsnlfdxv.exe ups_ins3⤵
-
C:\Temp\i_davsnlfdxv.exeC:\Temp\i_davsnlfdxv.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vpnifaxsqk.exe ups_run3⤵
-
C:\Temp\vpnifaxsqk.exeC:\Temp\vpnifaxsqk.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vpnifaxsqk.exe ups_ins3⤵
-
C:\Temp\i_vpnifaxsqk.exeC:\Temp\i_vpnifaxsqk.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pnhfzxvpnh.exe ups_run3⤵
-
C:\Temp\pnhfzxvpnh.exeC:\Temp\pnhfzxvpnh.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pnhfzxvpnh.exe ups_ins3⤵
-
C:\Temp\i_pnhfzxvpnh.exeC:\Temp\i_pnhfzxvpnh.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fzxrpjhczu.exe ups_run3⤵
-
C:\Temp\fzxrpjhczu.exeC:\Temp\fzxrpjhczu.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fzxrpjhczu.exe ups_ins3⤵
-
C:\Temp\i_fzxrpjhczu.exeC:\Temp\i_fzxrpjhczu.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\urmkecwurm.exe ups_run3⤵
-
C:\Temp\urmkecwurm.exeC:\Temp\urmkecwurm.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_urmkecwurm.exe ups_ins3⤵
-
C:\Temp\i_urmkecwurm.exeC:\Temp\i_urmkecwurm.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\geywrojgbz.exe ups_run3⤵
-
C:\Temp\geywrojgbz.exeC:\Temp\geywrojgbz.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_geywrojgbz.exe ups_ins3⤵
-
C:\Temp\i_geywrojgbz.exeC:\Temp\i_geywrojgbz.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\dbwtomgebw.exe ups_run3⤵
-
C:\Temp\dbwtomgebw.exeC:\Temp\dbwtomgebw.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_dbwtomgebw.exe ups_ins3⤵
-
C:\Temp\i_dbwtomgebw.exeC:\Temp\i_dbwtomgebw.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2e0,0x2bc,0x7fff49b5c188,0x7fff49b5c194,0x7fff49b5c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1808,i,9995839413939280221,5451604647495539342,524288 --field-trial-handle=2168,i,13694734777805396016,7335286007493684976,262144 --variations-seed-version --mojo-platform-channel-handle=2192 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1596,i,2915303565779814782,1265672357951421985,262144 --field-trial-handle=2168,i,13694734777805396016,7335286007493684976,262144 --variations-seed-version --mojo-platform-channel-handle=2156 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2472,i,17918587724960656393,6519241820689694411,524288 --field-trial-handle=2168,i,13694734777805396016,7335286007493684976,262144 --variations-seed-version --mojo-platform-channel-handle=2448 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3472,i,16883013499030665839,1796773534715556490,2097152 --field-trial-handle=2168,i,13694734777805396016,7335286007493684976,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3476,i,12855573535736654190,14089389469874764193,2097152 --field-trial-handle=2168,i,13694734777805396016,7335286007493684976,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4116,i,18183435012442795692,12160580781095227013,2097152 --field-trial-handle=2168,i,13694734777805396016,7335286007493684976,262144 --variations-seed-version --mojo-platform-channel-handle=4140 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4200,i,1377623675229112533,17736918926350420409,2097152 --field-trial-handle=2168,i,13694734777805396016,7335286007493684976,262144 --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4256,i,12043335827754529402,3269574274191307103,2097152 --field-trial-handle=2168,i,13694734777805396016,7335286007493684976,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4224,i,8625266124482898493,5685639106167516438,2097152 --field-trial-handle=2168,i,13694734777805396016,7335286007493684976,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5296,i,8855028247315434431,13486247628878505694,524288 --field-trial-handle=2168,i,13694734777805396016,7335286007493684976,262144 --variations-seed-version --mojo-platform-channel-handle=3852 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3544,i,13956378184629106722,11206566842890923494,524288 --field-trial-handle=2168,i,13694734777805396016,7335286007493684976,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3884,i,2376834932276949681,10308879654864976058,524288 --field-trial-handle=2168,i,13694734777805396016,7335286007493684976,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5520,i,409660566520302675,15218500463467607281,524288 --field-trial-handle=2168,i,13694734777805396016,7335286007493684976,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6068,i,11058900973016784495,13592123109820497174,524288 --field-trial-handle=2168,i,13694734777805396016,7335286007493684976,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:144⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.execookie_exporter.exe --cookie-json=11405⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,13873615175632114845,16389241909570599452,524288 --field-trial-handle=2168,i,13694734777805396016,7335286007493684976,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,13873615175632114845,16389241909570599452,524288 --field-trial-handle=2168,i,13694734777805396016,7335286007493684976,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6264,i,4655946945726436662,8954323478082950465,524288 --field-trial-handle=2168,i,13694734777805396016,7335286007493684976,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6424,i,12569493224945053067,15783637589489123481,524288 --field-trial-handle=2168,i,13694734777805396016,7335286007493684976,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6472,i,15622532567708698021,6235926928123553496,524288 --field-trial-handle=2168,i,13694734777805396016,7335286007493684976,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6484,i,14475424014986021907,1884638659762752378,524288 --field-trial-handle=2168,i,13694734777805396016,7335286007493684976,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6564,i,17529058670479134627,4431762040639002908,524288 --field-trial-handle=2168,i,13694734777805396016,7335286007493684976,262144 --variations-seed-version --mojo-platform-channel-handle=6568 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4968,i,8954368446404974111,8080042187217113269,524288 --field-trial-handle=2168,i,13694734777805396016,7335286007493684976,262144 --variations-seed-version --mojo-platform-channel-handle=4952 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4280,i,7980667255524538283,18071027771719181771,524288 --field-trial-handle=2168,i,13694734777805396016,7335286007493684976,262144 --variations-seed-version --mojo-platform-channel-handle=4560 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4396,i,18099605968359166057,13931894901497197585,524288 --field-trial-handle=2168,i,13694734777805396016,7335286007493684976,262144 --variations-seed-version --mojo-platform-channel-handle=4564 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1588,i,2530085310092826406,7133535176499679718,524288 --field-trial-handle=2168,i,13694734777805396016,7335286007493684976,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,18216547179643590396,13790003363846632547,524288 --field-trial-handle=2168,i,13694734777805396016,7335286007493684976,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5800,i,2212199227416826842,9663021127960768599,524288 --field-trial-handle=2168,i,13694734777805396016,7335286007493684976,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=880,i,17416133578731711259,3941794824777890675,524288 --field-trial-handle=2168,i,13694734777805396016,7335286007493684976,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4508,i,15778574613148734150,12009643539271452132,524288 --field-trial-handle=2168,i,13694734777805396016,7335286007493684976,262144 --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5064,i,1090845519638998449,14806394747413302740,262144 --field-trial-handle=2168,i,13694734777805396016,7335286007493684976,262144 --variations-seed-version --mojo-platform-channel-handle=4952 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6052,i,8286933480535987659,1906419454833547368,524288 --field-trial-handle=2168,i,13694734777805396016,7335286007493684976,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\uomgeywrojhbztrl.sysC:\Temp\uomgeywrojhbztrl.sys1⤵
- Executes dropped EXE
-
C:\Temp\eywrojhbzt.sysC:\Temp\eywrojhbzt.sys1⤵
- Executes dropped EXE
-
C:\Temp\ljdbvtolgd.sysC:\Temp\ljdbvtolgd.sys1⤵
- Executes dropped EXE
-
C:\Temp\aywqlidbvt.sysC:\Temp\aywqlidbvt.sys1⤵
- Executes dropped EXE
-
C:\Temp\nigaysqkid.sysC:\Temp\nigaysqkid.sys1⤵
- Executes dropped EXE
-
C:\Temp\faxsqkicau.sysC:\Temp\faxsqkicau.sys1⤵
- Executes dropped EXE
-
C:\Temp\xrpkhcausm.sysC:\Temp\xrpkhcausm.sys1⤵
- Executes dropped EXE
-
C:\Temp\pmhfzxrpke.sysC:\Temp\pmhfzxrpke.sys1⤵
- Executes dropped EXE
-
C:\Temp\hbztrmkecw.sysC:\Temp\hbztrmkecw.sys1⤵
- Executes dropped EXE
-
C:\Temp\bwuomgezwr.sysC:\Temp\bwuomgezwr.sys1⤵
- Executes dropped EXE
-
C:\Temp\ljgbytrljd.sysC:\Temp\ljgbytrljd.sys1⤵
- Executes dropped EXE
-
C:\Temp\bvtolgdywq.sysC:\Temp\bvtolgdywq.sys1⤵
-
C:\Temp\nlfdxvqnig.sysC:\Temp\nlfdxvqnig.sys1⤵
-
C:\Temp\cxvpnhfzxs.sysC:\Temp\cxvpnhfzxs.sys1⤵
-
C:\Temp\upkhcausmh.sysC:\Temp\upkhcausmh.sys1⤵
-
C:\Temp\ecwuomhezw.sysC:\Temp\ecwuomhezw.sys1⤵
-
C:\Temp\ezxrpjhbzu.sysC:\Temp\ezxrpjhbzu.sys1⤵
-
C:\Temp\ojgbztrljd.sysC:\Temp\ojgbztrljd.sys1⤵
-
C:\Temp\gaytqljdbv.sysC:\Temp\gaytqljdbv.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CreateProcess.exe
aysqkidavs.exe
aywqlidbvt.sys
eywqoigbyt.exe
eywrojhbto.exe
eywrojhbzt.sys
i_aysqkidavs.exe
i_eywqoigbyt.exe
i_eywrojhbto.exe
i_mgeywqojgb.exe
i_qnigaysqki.exe
ljdbvtolgd.sys
mgeywqojgb.exe
nigaysqkid.sys
qnigaysqki.exe
uomgeywrojhbztrl.exe
uomgeywrojhbztrl.sys
blocklist
protocols.json
settings.dat
settings.dat
BookmarkMergedSurfaceOrdering
the-real-index
the-real-index~RFe58995d.TMP
SiteList-Enterprise.json
Edge Profile.ico
HubApps
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
Preferences
Preferences
Secure Preferences
sync_diagnostic.log
CURRENT
MANIFEST-000001
OperationConfig
OperationConfig~RFe59359d.TMP
office_endpoints_list.json
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
nav_config.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
591d36a1-f3c9-4534-a15b-670aa70ba2b2.tmp
f5727386-aa8e-4cba-baa5-8efb5ea07592.tmp
778a25e6-762c-403e-86a9-352c1509b8dc.tmp
content_new.js
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
memory/556-177-0x0000000000870000-0x00000000008EB000-memory.dmp
memory/648-530-0x0000000000970000-0x00000000009EB000-memory.dmp
memory/656-670-0x0000000000680000-0x00000000006FB000-memory.dmp
memory/692-853-0x0000000000990000-0x0000000000A0B000-memory.dmp
memory/852-674-0x00000000009A0000-0x0000000000A1B000-memory.dmp
memory/1068-899-0x0000000000980000-0x00000000009FB000-memory.dmp
memory/1068-807-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1076-854-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1088-707-0x0000000000870000-0x00000000008EB000-memory.dmp
memory/1104-645-0x0000000000960000-0x00000000009DB000-memory.dmp
memory/1124-721-0x00000000009D0000-0x0000000000A4B000-memory.dmp
memory/1132-751-0x0000000000850000-0x00000000008CB000-memory.dmp
memory/1244-175-0x0000000000860000-0x00000000008DB000-memory.dmp
memory/1248-822-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1432-634-0x0000000000980000-0x00000000009FB000-memory.dmp
memory/1468-574-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1468-540-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1476-80-0x000001C04E200000-0x000001C04E2AF000-memory.dmp
memory/1584-924-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1592-547-0x0000000000A00000-0x0000000000A7B000-memory.dmp
memory/1628-747-0x00000000009B0000-0x0000000000A2B000-memory.dmp
memory/1640-744-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1672-902-0x0000000000850000-0x00000000008CB000-memory.dmp
memory/1708-649-0x00000000009B0000-0x0000000000A2B000-memory.dmp
memory/1756-884-0x00000000005C0000-0x000000000063B000-memory.dmp
memory/1768-641-0x0000000000980000-0x00000000009FB000-memory.dmp
memory/1824-865-0x0000000000970000-0x00000000009EB000-memory.dmp
memory/1840-650-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1932-817-0x0000000000990000-0x0000000000A0B000-memory.dmp
memory/2088-667-0x0000000000970000-0x00000000009EB000-memory.dmp
memory/2112-821-0x0000000000960000-0x00000000009DB000-memory.dmp
memory/2152-711-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2232-864-0x0000000000990000-0x0000000000A0B000-memory.dmp
memory/2264-768-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2268-888-0x0000000000670000-0x00000000006EB000-memory.dmp
memory/2272-722-0x0000000000880000-0x00000000008FB000-memory.dmp
memory/2308-637-0x0000000000670000-0x00000000006EB000-memory.dmp
memory/2412-536-0x000001DEC4950000-0x000001DEC49FF000-memory.dmp
memory/2428-597-0x00000000009E0000-0x0000000000A5B000-memory.dmp
memory/2496-486-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2512-794-0x00000000009E0000-0x0000000000A5B000-memory.dmp
memory/2648-529-0x00000000008F0000-0x000000000096B000-memory.dmp
memory/2800-668-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2988-706-0x0000000000990000-0x0000000000A0B000-memory.dmp
memory/3024-642-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3024-743-0x0000000000960000-0x00000000009DB000-memory.dmp
memory/3132-54-0x00000228C5530000-0x00000228C55DF000-memory.dmp
memory/3148-538-0x0000000000970000-0x00000000009EB000-memory.dmp
memory/3232-832-0x0000000000990000-0x0000000000A0B000-memory.dmp
memory/3256-887-0x0000000000970000-0x00000000009EB000-memory.dmp
memory/3284-646-0x0000000000980000-0x00000000009FB000-memory.dmp
memory/3372-671-0x0000000000970000-0x00000000009EB000-memory.dmp
memory/3656-818-0x0000000000980000-0x00000000009FB000-memory.dmp
memory/3664-652-0x00000000008B0000-0x000000000092B000-memory.dmp
memory/3688-746-0x0000000000970000-0x00000000009EB000-memory.dmp
memory/3732-795-0x0000000000960000-0x00000000009DB000-memory.dmp
memory/3808-771-0x00000000009B0000-0x0000000000A2B000-memory.dmp
memory/3808-571-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3816-588-0x0000000000960000-0x00000000009DB000-memory.dmp
memory/3832-599-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3872-710-0x0000000000960000-0x00000000009DB000-memory.dmp
memory/4128-770-0x00000000009B0000-0x0000000000A2B000-memory.dmp
memory/4264-531-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4264-73-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4332-806-0x0000000000980000-0x00000000009FB000-memory.dmp
memory/4444-589-0x0000000000890000-0x000000000090B000-memory.dmp
memory/4464-900-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4532-638-0x0000000000990000-0x0000000000A0B000-memory.dmp
memory/4564-619-0x00000000008A0000-0x000000000091B000-memory.dmp
memory/4680-680-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4776-653-0x0000000000590000-0x000000000060B000-memory.dmp
memory/4800-569-0x0000000000960000-0x00000000009DB000-memory.dmp
memory/4808-903-0x0000000000960000-0x00000000009DB000-memory.dmp
memory/4832-923-0x0000000000960000-0x00000000009DB000-memory.dmp
memory/4896-620-0x00000000009B0000-0x0000000000A2B000-memory.dmp
memory/4904-885-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4940-484-0x0000000000680000-0x00000000006FB000-memory.dmp
memory/4964-546-0x0000000000850000-0x00000000008CB000-memory.dmp
memory/5008-784-0x00000000009E0000-0x0000000000A5B000-memory.dmp
memory/5024-833-0x0000000000970000-0x00000000009EB000-memory.dmp
memory/5048-635-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5048-643-0x0000000000010000-0x00000000000AB000-memory.dmp