Analysis
- max time kernel
149s - max time network
141s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
06/05/2026, 10:31
General
- Target 2026-05-06_08260b94e4bba69e387eeec6e7c1fc6d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 361KB
- Sample260506-mkrnjabs2p
- SHA256 01c91876cece5c340ace498b56b84b424e2eb96ce13c530877ba1f5affdca508
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba
-
http://xytets.com:2345/t.asp?os=home
-
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 9 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 41 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 19 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 29 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 3 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-06_08260b94e4bba69e387eeec6e7c1fc6d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-06_08260b94e4bba69e387eeec6e7c1fc6d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\upnhfzxrpkhcausm.exeC:\Temp\upnhfzxrpkhcausm.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fzxsmkecws.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\fzxsmkecws.exeC:\Temp\fzxsmkecws.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fzxsmkecws.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_fzxsmkecws.exeC:\Temp\i_fzxsmkecws.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zurmkecwuo.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\zurmkecwuo.exeC:\Temp\zurmkecwuo.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zurmkecwuo.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_zurmkecwuo.exeC:\Temp\i_zurmkecwuo.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ztrljebztr.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ztrljebztr.exeC:\Temp\ztrljebztr.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ztrljebztr.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ztrljebztr.exeC:\Temp\i_ztrljebztr.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jgbvtolgey.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\jgbvtolgey.exeC:\Temp\jgbvtolgey.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jgbvtolgey.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_jgbvtolgey.exeC:\Temp\i_jgbvtolgey.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qlidbvtnlg.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\qlidbvtnlg.exeC:\Temp\qlidbvtnlg.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qlidbvtnlg.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_qlidbvtnlg.exeC:\Temp\i_qlidbvtnlg.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bvtnlfdyvq.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\bvtnlfdyvq.exeC:\Temp\bvtnlfdyvq.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bvtnlfdyvq.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_bvtnlfdyvq.exeC:\Temp\i_bvtnlfdyvq.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\faxsqkfdxv.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\faxsqkfdxv.exeC:\Temp\faxsqkfdxv.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_faxsqkfdxv.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_faxsqkfdxv.exeC:\Temp\i_faxsqkfdxv.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nhfzxspkic.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\nhfzxspkic.exeC:\Temp\nhfzxspkic.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nhfzxspkic.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_nhfzxspkic.exeC:\Temp\i_nhfzxspkic.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rpkhczusmk.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\rpkhczusmk.exeC:\Temp\rpkhczusmk.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rpkhczusmk.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_rpkhczusmk.exeC:\Temp\i_rpkhczusmk.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hfzurmkecw.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\hfzurmkecw.exeC:\Temp\hfzurmkecw.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hfzurmkecw.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_hfzurmkecw.exeC:\Temp\i_hfzurmkecw.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rpjhbztrmg.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\rpjhbztrmg.exeC:\Temp\rpjhbztrmg.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rpjhbztrmg.exe ups_ins3⤵
-
C:\Temp\i_rpjhbztrmg.exeC:\Temp\i_rpjhbztrmg.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\dbztrljebv.exe ups_run3⤵
-
C:\Temp\dbztrljebv.exeC:\Temp\dbztrljebv.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_dbztrljebv.exe ups_ins3⤵
-
C:\Temp\i_dbztrljebv.exeC:\Temp\i_dbztrljebv.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wqoigaytql.exe ups_run3⤵
-
C:\Temp\wqoigaytql.exeC:\Temp\wqoigaytql.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wqoigaytql.exe ups_ins3⤵
-
C:\Temp\i_wqoigaytql.exeC:\Temp\i_wqoigaytql.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\tnlgdysnlx.exe ups_run3⤵
-
C:\Temp\tnlgdysnlx.exeC:\Temp\tnlgdysnlx.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_tnlgdysnlx.exe ups_ins3⤵
-
C:\Temp\i_tnlgdysnlx.exeC:\Temp\i_tnlgdysnlx.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xvqnifaysq.exe ups_run3⤵
-
C:\Temp\xvqnifaysq.exeC:\Temp\xvqnifaysq.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xvqnifaysq.exe ups_ins3⤵
-
C:\Temp\i_xvqnifaysq.exeC:\Temp\i_xvqnifaysq.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\kicausnkfc.exe ups_run3⤵
-
C:\Temp\kicausnkfc.exeC:\Temp\kicausnkfc.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_kicausnkfc.exe ups_ins3⤵
-
C:\Temp\i_kicausnkfc.exeC:\Temp\i_kicausnkfc.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\upmhfzxrpj.exe ups_run3⤵
-
C:\Temp\upmhfzxrpj.exeC:\Temp\upmhfzxrpj.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_upmhfzxrpj.exe ups_ins3⤵
-
C:\Temp\i_upmhfzxrpj.exeC:\Temp\i_upmhfzxrpj.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mkeuomkecw.exe ups_run3⤵
-
C:\Temp\mkeuomkecw.exeC:\Temp\mkeuomkecw.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mkeuomkecw.exe ups_ins3⤵
-
C:\Temp\i_mkeuomkecw.exeC:\Temp\i_mkeuomkecw.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bzurmjecwu.exe ups_run3⤵
-
C:\Temp\bzurmjecwu.exeC:\Temp\bzurmjecwu.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bzurmjecwu.exe ups_ins3⤵
-
C:\Temp\i_bzurmjecwu.exeC:\Temp\i_bzurmjecwu.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x2f0,0x7ff9e555c188,0x7ff9e555c194,0x7ff9e555c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,13278036015693220148,12190330574235885266,262144 --field-trial-handle=2352,i,8556846756999274106,10512610889214415935,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1764,i,4476640402095557757,15323423938452673244,524288 --field-trial-handle=2352,i,8556846756999274106,10512610889214415935,262144 --variations-seed-version --mojo-platform-channel-handle=2404 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2556,i,3795170174854266730,5943574460933981299,524288 --field-trial-handle=2352,i,8556846756999274106,10512610889214415935,262144 --variations-seed-version --mojo-platform-channel-handle=2820 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3520,i,6558166963416195648,13224242171900140223,2097152 --field-trial-handle=2352,i,8556846756999274106,10512610889214415935,262144 --variations-seed-version --mojo-platform-channel-handle=3264 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3528,i,2419332191275354982,16459746083613172837,2097152 --field-trial-handle=2352,i,8556846756999274106,10512610889214415935,262144 --variations-seed-version --mojo-platform-channel-handle=3348 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4116,i,16092409645605185197,13635488738254483341,2097152 --field-trial-handle=2352,i,8556846756999274106,10512610889214415935,262144 --variations-seed-version --mojo-platform-channel-handle=4128 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4188,i,11638638970326504986,4687715216275283708,2097152 --field-trial-handle=2352,i,8556846756999274106,10512610889214415935,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4272,i,7746346879232896902,13447893406400676482,2097152 --field-trial-handle=2352,i,8556846756999274106,10512610889214415935,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4284,i,7317360305689358415,9397489074272154292,2097152 --field-trial-handle=2352,i,8556846756999274106,10512610889214415935,262144 --variations-seed-version --mojo-platform-channel-handle=4768 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3692,i,15202258088695536160,11867239086198196560,524288 --field-trial-handle=2352,i,8556846756999274106,10512610889214415935,262144 --variations-seed-version --mojo-platform-channel-handle=3264 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5344,i,17105142600135114163,4383008987269208168,524288 --field-trial-handle=2352,i,8556846756999274106,10512610889214415935,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4196,i,15486463555940318182,16686979211487577322,524288 --field-trial-handle=2352,i,8556846756999274106,10512610889214415935,262144 --variations-seed-version --mojo-platform-channel-handle=4160 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4112,i,2572614548728662612,11413678647444172482,524288 --field-trial-handle=2352,i,8556846756999274106,10512610889214415935,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,3431692817439507308,10115836297499833772,524288 --field-trial-handle=2352,i,8556846756999274106,10512610889214415935,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:144⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.execookie_exporter.exe --cookie-json=11285⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,13211765417889518895,10991761285488182826,524288 --field-trial-handle=2352,i,8556846756999274106,10512610889214415935,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,13211765417889518895,10991761285488182826,524288 --field-trial-handle=2352,i,8556846756999274106,10512610889214415935,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6092,i,15727483843696076423,3308154842925526525,524288 --field-trial-handle=2352,i,8556846756999274106,10512610889214415935,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6056,i,6402790630623572972,5288835327566574062,524288 --field-trial-handle=2352,i,8556846756999274106,10512610889214415935,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,4412737182614979172,12469002528281082703,524288 --field-trial-handle=2352,i,8556846756999274106,10512610889214415935,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6500,i,2041765651717012769,7929574927125429585,524288 --field-trial-handle=2352,i,8556846756999274106,10512610889214415935,262144 --variations-seed-version --mojo-platform-channel-handle=6504 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6876,i,15280993300420176528,6402353682469128977,524288 --field-trial-handle=2352,i,8556846756999274106,10512610889214415935,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5264,i,8212404402118190704,7506888007040911746,524288 --field-trial-handle=2352,i,8556846756999274106,10512610889214415935,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5228,i,12579045994202846729,14303638489031455028,524288 --field-trial-handle=2352,i,8556846756999274106,10512610889214415935,262144 --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4296,i,15923114796417057792,10092000548448838382,524288 --field-trial-handle=2352,i,8556846756999274106,10512610889214415935,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4112,i,122892463285531261,16579968823321128862,524288 --field-trial-handle=2352,i,8556846756999274106,10512610889214415935,262144 --variations-seed-version --mojo-platform-channel-handle=1240 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5420,i,2973391362127115681,441359554897192088,524288 --field-trial-handle=2352,i,8556846756999274106,10512610889214415935,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=868,i,2020498121953965257,15652088848558807521,524288 --field-trial-handle=2352,i,8556846756999274106,10512610889214415935,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5048,i,7898424603814874743,1161480326034540386,524288 --field-trial-handle=2352,i,8556846756999274106,10512610889214415935,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5552,i,12638785054164766191,1273190829593041686,262144 --field-trial-handle=2352,i,8556846756999274106,10512610889214415935,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5656,i,2313943003615885148,13245692438204519881,524288 --field-trial-handle=2352,i,8556846756999274106,10512610889214415935,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\upnhfzxrpkhcausm.sysC:\Temp\upnhfzxrpkhcausm.sys1⤵
- Executes dropped EXE
-
C:\Temp\mhbzurmjec.sysC:\Temp\mhbzurmjec.sys1⤵
- Executes dropped EXE
-
C:\Temp\jecwuomgey.sysC:\Temp\jecwuomgey.sys1⤵
- Executes dropped EXE
-
C:\Temp\wtomgeywqo.sysC:\Temp\wtomgeywqo.sys1⤵
- Executes dropped EXE
-
C:\Temp\lgeywqoigb.sysC:\Temp\lgeywqoigb.sys1⤵
- Executes dropped EXE
-
C:\Temp\lidbvtnlfd.sysC:\Temp\lidbvtnlfd.sys1⤵
- Executes dropped EXE
-
C:\Temp\sqkidavsnl.sysC:\Temp\sqkidavsnl.sys1⤵
- Executes dropped EXE
-
C:\Temp\xvpnhfaxsp.sysC:\Temp\xvpnhfaxsp.sys1⤵
- Executes dropped EXE
-
C:\Temp\pnhfzxspkh.sysC:\Temp\pnhfzxspkh.sys1⤵
- Executes dropped EXE
-
C:\Temp\rpjhczusmk.sysC:\Temp\rpjhczusmk.sys1⤵
- Executes dropped EXE
-
C:\Temp\eywrojhbzt.sysC:\Temp\eywrojhbzt.sys1⤵
- Executes dropped EXE
-
C:\Temp\rojgbztrlj.sysC:\Temp\rojgbztrlj.sys1⤵
-
C:\Temp\oigbytqljd.sysC:\Temp\oigbytqljd.sys1⤵
-
C:\Temp\dbvtnlgdys.sysC:\Temp\dbvtnlgdys.sys1⤵
-
C:\Temp\lfdxvqniga.sysC:\Temp\lfdxvqniga.sys1⤵
-
C:\Temp\usmkfcxvpn.sysC:\Temp\usmkfcxvpn.sys1⤵
-
C:\Temp\pnicausmzx.sysC:\Temp\pnicausmzx.sys1⤵
-
C:\Temp\cxupnhfzxr.sysC:\Temp\cxupnhfzxr.sys1⤵
-
C:\Temp\pjhcwuomge.sysC:\Temp\pjhcwuomge.sys1⤵
-
C:\Temp\ywqojgbztr.sysC:\Temp\ywqojgbztr.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CreateProcess.exe
fzxsmkecws.exe
i_fzxsmkecws.exe
i_jgbvtolgey.exe
i_qlidbvtnlg.exe
i_ztrljebztr.exe
i_zurmkecwuo.exe
jecwuomgey.sys
jgbvtolgey.exe
lgeywqoigb.sys
mhbzurmjec.sys
qlidbvtnlg.exe
upnhfzxrpkhcausm.exe
upnhfzxrpkhcausm.sys
wtomgeywqo.sys
ztrljebztr.exe
zurmkecwuo.exe
8e0e1679-683c-4bf0-89be-785d423dd65a.tmp
blocklist
protocols.json
settings.dat
settings.dat
537d2665-7ea7-4c91-8c51-151950a74b29.tmp
BookmarkMergedSurfaceOrdering
the-real-index
the-real-index~RFe5866c4.TMP
SiteList-Enterprise.json
Edge Profile.ico
HubApps
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
Preferences
Secure Preferences
sync_diagnostic.log
CURRENT
MANIFEST-000001
OperationConfig
OperationConfig~RFe5902c5.TMP
office_endpoints_list.json
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
nav_config.json
metadata.json
metadata.json
metadata.json
metadata.json
de20c93a-a7ca-4bd8-9b58-7aff8ba6bab9.tmp
aecaa8fd-7ef4-46dc-9d2b-fafc4c4cc059.tmp
0595d97a-6de9-4aa2-a044-7c0fa98f4aaf.tmp
85e57348-4456-4133-80fe-bdda1c59dcf2.tmp
content_new.js
c7b5c31a-1090-4261-bb42-036c1c57ffd2.tmp
manifest.json
manifest.json
manifest.json
manifest.json
memory/236-659-0x0000000000990000-0x0000000000AA2000-memory.dmp
memory/760-660-0x0000000000A70000-0x0000000000B82000-memory.dmp
memory/768-890-0x0000000000820000-0x0000000000932000-memory.dmp
memory/824-593-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/912-568-0x0000000000A40000-0x0000000000B52000-memory.dmp
memory/1012-801-0x00000000008D0000-0x00000000009E2000-memory.dmp
memory/1052-838-0x00000000009E0000-0x0000000000AF2000-memory.dmp
memory/1056-539-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1064-591-0x0000000000980000-0x0000000000A92000-memory.dmp
memory/1192-880-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1204-716-0x0000000000A30000-0x0000000000B42000-memory.dmp
memory/1308-864-0x0000000000960000-0x0000000000A72000-memory.dmp
memory/1612-485-0x0000000000B40000-0x0000000000C52000-memory.dmp
memory/1636-626-0x0000000000AE0000-0x0000000000BF2000-memory.dmp
memory/1712-931-0x0000000000970000-0x0000000000A82000-memory.dmp
memory/1728-487-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1756-759-0x00000000009A0000-0x0000000000AB2000-memory.dmp
memory/1772-841-0x00000000008C0000-0x00000000009D2000-memory.dmp
memory/2028-865-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2072-842-0x00000000009A0000-0x0000000000AB2000-memory.dmp
memory/2092-634-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2104-725-0x00000000008E0000-0x00000000009F2000-memory.dmp
memory/2116-755-0x0000000000970000-0x0000000000A82000-memory.dmp
memory/2204-867-0x0000000000980000-0x0000000000A92000-memory.dmp
memory/2224-908-0x00000000009E0000-0x0000000000AF2000-memory.dmp
memory/2256-649-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2316-798-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2388-775-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2388-799-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2480-576-0x0000000000840000-0x0000000000952000-memory.dmp
memory/2488-698-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2504-180-0x0000000000900000-0x0000000000A12000-memory.dmp
memory/2512-570-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2512-604-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2516-868-0x0000000000840000-0x0000000000952000-memory.dmp
memory/2540-577-0x0000000000960000-0x0000000000A72000-memory.dmp
memory/2600-717-0x0000000000980000-0x0000000000A92000-memory.dmp
memory/2624-839-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2676-611-0x00000000008A0000-0x00000000009B2000-memory.dmp
memory/2700-545-0x0000000000A10000-0x0000000000B22000-memory.dmp
memory/2724-636-0x0000000000970000-0x0000000000A82000-memory.dmp
memory/2748-774-0x0000000000980000-0x0000000000A92000-memory.dmp
memory/2856-891-0x0000000000970000-0x0000000000A82000-memory.dmp
memory/2900-633-0x00000000009A0000-0x0000000000AB2000-memory.dmp
memory/2980-806-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3084-685-0x0000000000950000-0x0000000000A62000-memory.dmp
memory/3104-909-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3132-637-0x0000000000970000-0x0000000000A82000-memory.dmp
memory/3328-537-0x0000000000970000-0x0000000000A82000-memory.dmp
memory/3344-756-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3404-728-0x00000000009B0000-0x0000000000AC2000-memory.dmp
memory/3408-648-0x0000000000960000-0x0000000000A72000-memory.dmp
memory/3464-74-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3544-546-0x0000000000860000-0x0000000000972000-memory.dmp
memory/3764-689-0x0000000000970000-0x0000000000A82000-memory.dmp
memory/3896-674-0x0000000000AF0000-0x0000000000C02000-memory.dmp
memory/3952-758-0x0000000000AD0000-0x0000000000BE2000-memory.dmp
memory/4120-627-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4160-816-0x0000000000A20000-0x0000000000B32000-memory.dmp
memory/4172-940-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4200-817-0x0000000000970000-0x0000000000A82000-memory.dmp
memory/4252-802-0x0000000000A20000-0x0000000000B32000-memory.dmp
memory/4304-912-0x0000000000960000-0x0000000000A72000-memory.dmp
memory/4372-686-0x00000000009D0000-0x0000000000AE2000-memory.dmp
memory/4452-781-0x0000000000A90000-0x0000000000BA2000-memory.dmp
memory/4452-683-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4456-630-0x00000000009F0000-0x0000000000B02000-memory.dmp
memory/4472-760-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4472-726-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4600-879-0x0000000000A00000-0x0000000000B12000-memory.dmp
memory/4776-181-0x0000000000980000-0x0000000000A92000-memory.dmp
memory/4796-629-0x0000000000990000-0x0000000000AA2000-memory.dmp
memory/4804-778-0x0000000000B00000-0x0000000000C12000-memory.dmp
memory/4840-530-0x0000000000AC0000-0x0000000000BD2000-memory.dmp
memory/4856-805-0x00000000009F0000-0x0000000000B02000-memory.dmp
memory/5004-777-0x0000000000980000-0x0000000000A92000-memory.dmp
memory/5008-911-0x0000000000970000-0x0000000000A82000-memory.dmp
memory/5104-612-0x00000000009A0000-0x0000000000AB2000-memory.dmp
memory/5108-531-0x00000000009A0000-0x0000000000AB2000-memory.dmp