Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
11/05/2026, 00:42
General
- Target 2026-05-11_2bc365c29d5c7d8180bba14ba6a74ae1_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 361KB
- Sample260511-a2jm2ab15m
- SHA256 312fb5d9ac28ee61ab826ef3a3b30be78e303c712f231b03b1870b1c705d7d8e
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba
-
http://xytets.com:2345/t.asp?os=home
-
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 9 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 29 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 3 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-11_2bc365c29d5c7d8180bba14ba6a74ae1_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-11_2bc365c29d5c7d8180bba14ba6a74ae1_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\mjecwuomgezwrpjh.exeC:\Temp\mjecwuomgezwrpjh.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ztrmjecwpj.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\ztrmjecwpj.exeC:\Temp\ztrmjecwpj.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ztrmjecwpj.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ztrmjecwpj.exeC:\Temp\i_ztrmjecwpj.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rljebwuomg.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\rljebwuomg.exeC:\Temp\rljebwuomg.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rljebwuomg.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_rljebwuomg.exeC:\Temp\i_rljebwuomg.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gbytqljdbw.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\gbytqljdbw.exeC:\Temp\gbytqljdbw.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gbytqljdbw.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_gbytqljdbw.exeC:\Temp\i_gbytqljdbw.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\tqljdbvtnl.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\tqljdbvtnl.exeC:\Temp\tqljdbvtnl.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_tqljdbvtnl.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_tqljdbvtnl.exeC:\Temp\i_tqljdbvtnl.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qlidbvtnlf.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\qlidbvtnlf.exeC:\Temp\qlidbvtnlf.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qlidbvtnlf.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_qlidbvtnlf.exeC:\Temp\i_qlidbvtnlf.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fdavsnlfdx.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\fdavsnlfdx.exeC:\Temp\fdavsnlfdx.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fdavsnlfdx.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_fdavsnlfdx.exeC:\Temp\i_fdavsnlfdx.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\usnkfcxvpn.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\usnkfcxvpn.exeC:\Temp\usnkfcxvpn.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_usnkfcxvpn.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_usnkfcxvpn.exeC:\Temp\i_usnkfcxvpn.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jhczusmkec.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\jhczusmkec.exeC:\Temp\jhczusmkec.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jhczusmkec.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_jhczusmkec.exeC:\Temp\i_jhczusmkec.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\khczurmkec.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\khczurmkec.exeC:\Temp\khczurmkec.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_khczurmkec.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_khczurmkec.exeC:\Temp\i_khczurmkec.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\cwuomgezwr.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\cwuomgezwr.exeC:\Temp\cwuomgezwr.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_cwuomgezwr.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_cwuomgezwr.exeC:\Temp\i_cwuomgezwr.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\trljeywroj.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\trljeywroj.exeC:\Temp\trljeywroj.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_trljeywroj.exe ups_ins3⤵
-
C:\Temp\i_trljeywroj.exeC:\Temp\i_trljeywroj.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jdbvqnlgdy.exe ups_run3⤵
-
C:\Temp\jdbvqnlgdy.exeC:\Temp\jdbvqnlgdy.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jdbvqnlgdy.exe ups_ins3⤵
-
C:\Temp\i_jdbvqnlgdy.exeC:\Temp\i_jdbvqnlgdy.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fdyvqnigay.exe ups_run3⤵
-
C:\Temp\fdyvqnigay.exeC:\Temp\fdyvqnigay.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fdyvqnigay.exe ups_ins3⤵
-
C:\Temp\i_fdyvqnigay.exeC:\Temp\i_fdyvqnigay.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ysqkidavsn.exe ups_run3⤵
-
C:\Temp\ysqkidavsn.exeC:\Temp\ysqkidavsn.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ysqkidavsn.exe ups_ins3⤵
-
C:\Temp\i_ysqkidavsn.exeC:\Temp\i_ysqkidavsn.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nkfcxvpnhf.exe ups_run3⤵
-
C:\Temp\nkfcxvpnhf.exeC:\Temp\nkfcxvpnhf.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nkfcxvpnhf.exe ups_ins3⤵
-
C:\Temp\i_nkfcxvpnhf.exeC:\Temp\i_nkfcxvpnhf.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ausmkhcaup.exe ups_run3⤵
-
C:\Temp\ausmkhcaup.exeC:\Temp\ausmkhcaup.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ausmkhcaup.exe ups_ins3⤵
-
C:\Temp\i_ausmkhcaup.exeC:\Temp\i_ausmkhcaup.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xupmhfzxrp.exe ups_run3⤵
-
C:\Temp\xupmhfzxrp.exeC:\Temp\xupmhfzxrp.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xupmhfzxrp.exe ups_ins3⤵
-
C:\Temp\i_xupmhfzxrp.exeC:\Temp\i_xupmhfzxrp.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jhbztrmjeb.exe ups_run3⤵
-
C:\Temp\jhbztrmjeb.exeC:\Temp\jhbztrmjeb.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jhbztrmjeb.exe ups_ins3⤵
-
C:\Temp\i_jhbztrmjeb.exeC:\Temp\i_jhbztrmjeb.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bztrljebwu.exe ups_run3⤵
-
C:\Temp\bztrljebwu.exeC:\Temp\bztrljebwu.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bztrljebwu.exe ups_ins3⤵
-
C:\Temp\i_bztrljebwu.exeC:\Temp\i_bztrljebwu.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\tolgeywqoi.exe ups_run3⤵
-
C:\Temp\tolgeywqoi.exeC:\Temp\tolgeywqoi.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x2f4,0x7ffc4906c188,0x7ffc4906c194,0x7ffc4906c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1832,i,15438251078655537118,14976895674739789511,524288 --field-trial-handle=2160,i,5944854574954845083,12998988489845477790,262144 --variations-seed-version --mojo-platform-channel-handle=2196 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1620,i,807476983400914219,12450069315680936449,262144 --field-trial-handle=2160,i,5944854574954845083,12998988489845477790,262144 --variations-seed-version --mojo-platform-channel-handle=2148 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2480,i,13188302261999463697,4600197946397644563,524288 --field-trial-handle=2160,i,5944854574954845083,12998988489845477790,262144 --variations-seed-version --mojo-platform-channel-handle=1952 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3536,i,2464315623690966429,11299122560066490919,2097152 --field-trial-handle=2160,i,5944854574954845083,12998988489845477790,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3556,i,11040068604172895210,14881494108621907968,2097152 --field-trial-handle=2160,i,5944854574954845083,12998988489845477790,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4180,i,10294353739949214530,13757961938931053776,2097152 --field-trial-handle=2160,i,5944854574954845083,12998988489845477790,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4260,i,1253641411770170419,17431599928608032688,2097152 --field-trial-handle=2160,i,5944854574954845083,12998988489845477790,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4368,i,18438806078801439338,9640501278282199180,2097152 --field-trial-handle=2160,i,5944854574954845083,12998988489845477790,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4452,i,980514533423440230,8653085402557068863,2097152 --field-trial-handle=2160,i,5944854574954845083,12998988489845477790,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5264,i,16264994202906071257,16069218162879285733,524288 --field-trial-handle=2160,i,5944854574954845083,12998988489845477790,262144 --variations-seed-version --mojo-platform-channel-handle=5016 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4356,i,7624182738868005316,9732297332201617341,524288 --field-trial-handle=2160,i,5944854574954845083,12998988489845477790,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5504,i,2138196031464863813,3750488024315518411,524288 --field-trial-handle=2160,i,5944854574954845083,12998988489845477790,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4352,i,6842841574037524150,10099056027231769127,524288 --field-trial-handle=2160,i,5944854574954845083,12998988489845477790,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,15029477038136486597,6776209075929159199,524288 --field-trial-handle=2160,i,5944854574954845083,12998988489845477790,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6152,i,10936523618103048524,12870640666657608816,524288 --field-trial-handle=2160,i,5944854574954845083,12998988489845477790,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:144⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.execookie_exporter.exe --cookie-json=11285⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,15029477038136486597,6776209075929159199,524288 --field-trial-handle=2160,i,5944854574954845083,12998988489845477790,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,7749559898672425331,1159773584457662339,524288 --field-trial-handle=2160,i,5944854574954845083,12998988489845477790,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6496,i,11793995894079366940,3506902761137283017,524288 --field-trial-handle=2160,i,5944854574954845083,12998988489845477790,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6152,i,10118281387107087325,10451462119638225502,524288 --field-trial-handle=2160,i,5944854574954845083,12998988489845477790,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6760,i,10147896226921745657,6561852410099753830,524288 --field-trial-handle=2160,i,5944854574954845083,12998988489845477790,262144 --variations-seed-version --mojo-platform-channel-handle=6764 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6460,i,13070170808927495191,16968040916270480665,524288 --field-trial-handle=2160,i,5944854574954845083,12998988489845477790,262144 --variations-seed-version --mojo-platform-channel-handle=6776 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4504,i,10584504615205790307,2972906749615966782,524288 --field-trial-handle=2160,i,5944854574954845083,12998988489845477790,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4408,i,15045239032104738144,7160738979362772189,524288 --field-trial-handle=2160,i,5944854574954845083,12998988489845477790,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4244,i,15315576195310442585,5051820365359318690,524288 --field-trial-handle=2160,i,5944854574954845083,12998988489845477790,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5460,i,4500846349400125215,4568657203835342295,524288 --field-trial-handle=2160,i,5944854574954845083,12998988489845477790,262144 --variations-seed-version --mojo-platform-channel-handle=2992 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4352,i,2859756766660832816,16887629390614386681,524288 --field-trial-handle=2160,i,5944854574954845083,12998988489845477790,262144 --variations-seed-version --mojo-platform-channel-handle=4728 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4540,i,6804351658007669564,12550410813790012672,524288 --field-trial-handle=2160,i,5944854574954845083,12998988489845477790,262144 --variations-seed-version --mojo-platform-channel-handle=4504 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=876,i,10774569831997112997,9614126502899328718,524288 --field-trial-handle=2160,i,5944854574954845083,12998988489845477790,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6292,i,3926335996441113492,1593757085838693041,262144 --field-trial-handle=2160,i,5944854574954845083,12998988489845477790,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5800,i,13342905907393243113,14800832433578184094,524288 --field-trial-handle=2160,i,5944854574954845083,12998988489845477790,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\mjecwuomgezwrpjh.sysC:\Temp\mjecwuomgezwrpjh.sys1⤵
- Executes dropped EXE
-
C:\Temp\bztomgebwu.sysC:\Temp\bztomgebwu.sys1⤵
- Executes dropped EXE
-
C:\Temp\qljdbwtolg.sysC:\Temp\qljdbwtolg.sys1⤵
- Executes dropped EXE
-
C:\Temp\igaytqljdb.sysC:\Temp\igaytqljdb.sys1⤵
- Executes dropped EXE
-
C:\Temp\bvtnlfdyvq.sysC:\Temp\bvtnlfdyvq.sys1⤵
- Executes dropped EXE
-
C:\Temp\pnifaysqki.sysC:\Temp\pnifaysqki.sys1⤵
- Executes dropped EXE
-
C:\Temp\fcxvpnhfax.sysC:\Temp\fcxvpnhfax.sys1⤵
- Executes dropped EXE
-
C:\Temp\cxupnhfzxs.sysC:\Temp\cxupnhfzxs.sys1⤵
- Executes dropped EXE
-
C:\Temp\usmkecwrpj.sysC:\Temp\usmkecwrpj.sys1⤵
- Executes dropped EXE
-
C:\Temp\mgezwrpjhb.sysC:\Temp\mgezwrpjhb.sys1⤵
- Executes dropped EXE
-
C:\Temp\ebwuomgeyw.sysC:\Temp\ebwuomgeyw.sys1⤵
- Executes dropped EXE
-
C:\Temp\bytrljdbvt.sysC:\Temp\bytrljdbvt.sys1⤵
-
C:\Temp\qlidbvtnlf.sysC:\Temp\qlidbvtnlf.sys1⤵
-
C:\Temp\fdxvpnifay.sysC:\Temp\fdxvpnifay.sys1⤵
-
C:\Temp\xvpnhfzxsp.sysC:\Temp\xvpnhfzxsp.sys1⤵
-
C:\Temp\smkfcxvpkh.sysC:\Temp\smkfcxvpkh.sys1⤵
-
C:\Temp\kecxupmhfz.sysC:\Temp\kecxupmhfz.sys1⤵
-
C:\Temp\urmkecwuom.sysC:\Temp\urmkecwuom.sys1⤵
-
C:\Temp\jgbztrljdb.sysC:\Temp\jgbztrljdb.sys1⤵
-
C:\Temp\jhbztrljeb.sysC:\Temp\jhbztrljeb.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CreateProcess.exe
bvtnlfdyvq.sys
bztomgebwu.sys
gbytqljdbw.exe
i_gbytqljdbw.exe
i_qlidbvtnlf.exe
i_rljebwuomg.exe
i_tqljdbvtnl.exe
i_ztrmjecwpj.exe
igaytqljdb.sys
mjecwuomgezwrpjh.exe
mjecwuomgezwrpjh.sys
qlidbvtnlf.exe
qljdbwtolg.sys
rljebwuomg.exe
tqljdbvtnl.exe
ztrmjecwpj.exe
blocklist
protocols.json
settings.dat
settings.dat
BookmarkMergedSurfaceOrdering
the-real-index
SiteList-Enterprise.json
Edge Profile.ico
HubApps
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
Preferences
Preferences
Secure Preferences
sync_diagnostic.log
CURRENT
MANIFEST-000001
OperationConfig
OperationConfig~RFe592447.TMP
office_endpoints_list.json
Local State
Local State
Local State
Local State
Local State
Local State
nav_config.json
metadata.json
metadata.json
metadata.json
metadata.json
577bde99-dd7e-4675-a78a-6980379fa3d3.tmp
67d84b6c-cfd7-418d-a908-223d68d9c4b9.tmp
c3918759-1689-402e-9456-2cedd383d851.tmp
content_new.js
fe18900f-c19c-434e-92c7-ca35c060eda6.tmp
manifest.json
manifest.json
manifest.json
manifest.json
memory/416-611-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/972-532-0x00000278BAE30000-0x00000278BAF4E000-memory.dmp
memory/1080-744-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1080-768-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1228-535-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1228-626-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1376-560-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1376-575-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1812-772-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1980-603-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2360-799-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3140-698-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3152-803-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3212-663-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3280-683-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3700-607-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4416-484-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4444-718-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4452-730-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4556-630-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4740-72-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4836-572-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5048-782-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5048-767-0x0000000000010000-0x00000000000AB000-memory.dmp