Analysis
- max time kernel
149s - max time network
144s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
23/05/2026, 01:49
General
- Target 2026-05-23_026f095b0a9833e9c2276493c8996e57_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 361KB
- Sample260523-b8yafacz21
- SHA256 faaa9304eea764700fdb2c3175602c54afad21a1cb098d50069f1f9ea3e1cb81
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba
-
http://xytets.com:2345/t.asp?os=home
-
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 9 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 41 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 19 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 29 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 3 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-23_026f095b0a9833e9c2276493c8996e57_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-23_026f095b0a9833e9c2276493c8996e57_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\gbytrljdbvtolgey.exeC:\Temp\gbytrljdbvtolgey.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qlgdqlibvi.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\qlgdqlibvi.exeC:\Temp\qlgdqlibvi.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qlgdqlibvi.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_qlgdqlibvi.exeC:\Temp\i_qlgdqlibvi.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nlfdyvqoig.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\nlfdyvqoig.exeC:\Temp\nlfdyvqoig.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nlfdyvqoig.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_nlfdyvqoig.exeC:\Temp\i_nlfdyvqoig.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\avsnkicavs.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\avsnkicavs.exeC:\Temp\avsnkicavs.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_avsnkicavs.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_avsnkicavs.exeC:\Temp\i_avsnkicavs.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pnhfcxvpnh.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\pnhfcxvpnh.exeC:\Temp\pnhfcxvpnh.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pnhfcxvpnh.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_pnhfcxvpnh.exeC:\Temp\i_pnhfcxvpnh.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hczusmkecx.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\hczusmkecx.exeC:\Temp\hczusmkecx.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hczusmkecx.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_hczusmkecx.exeC:\Temp\i_hczusmkecx.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ecwuomhezw.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ecwuomhezw.exeC:\Temp\ecwuomhezw.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ecwuomhezw.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ecwuomhezw.exeC:\Temp\i_ecwuomhezw.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wrpjhbztrl.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\wrpjhbztrl.exeC:\Temp\wrpjhbztrl.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wrpjhbztrl.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_wrpjhbztrl.exeC:\Temp\i_wrpjhbztrl.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\oigbytrljg.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\oigbytrljg.exeC:\Temp\oigbytrljg.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_oigbytrljg.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_oigbytrljg.exeC:\Temp\i_oigbytrljg.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ytqljdbvto.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ytqljdbvto.exeC:\Temp\ytqljdbvto.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ytqljdbvto.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ytqljdbvto.exeC:\Temp\i_ytqljdbvto.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vtnlgdyvqo.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\vtnlgdyvqo.exeC:\Temp\vtnlgdyvqo.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vtnlgdyvqo.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_vtnlgdyvqo.exeC:\Temp\i_vtnlgdyvqo.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nifaysqnic.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\nifaysqnic.exeC:\Temp\nifaysqnic.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nifaysqnic.exe ups_ins3⤵
-
C:\Temp\i_nifaysqnic.exeC:\Temp\i_nifaysqnic.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fdxvpnhfax.exe ups_run3⤵
-
C:\Temp\fdxvpnhfax.exeC:\Temp\fdxvpnhfax.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fdxvpnhfax.exe ups_ins3⤵
-
C:\Temp\i_fdxvpnhfax.exeC:\Temp\i_fdxvpnhfax.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zxrpkhcaxr.exe ups_run3⤵
-
C:\Temp\zxrpkhcaxr.exeC:\Temp\zxrpkhcaxr.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zxrpkhcaxr.exe ups_ins3⤵
-
C:\Temp\i_zxrpkhcaxr.exeC:\Temp\i_zxrpkhcaxr.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\cxupjhczxr.exe ups_run3⤵
-
C:\Temp\cxupjhczxr.exeC:\Temp\cxupjhczxr.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_cxupjhczxr.exe ups_ins3⤵
-
C:\Temp\i_cxupjhczxr.exeC:\Temp\i_cxupjhczxr.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zurmjecwuo.exe ups_run3⤵
-
C:\Temp\zurmjecwuo.exeC:\Temp\zurmjecwuo.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zurmjecwuo.exe ups_ins3⤵
-
C:\Temp\i_zurmjecwuo.exeC:\Temp\i_zurmjecwuo.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ljdbztomge.exe ups_run3⤵
-
C:\Temp\ljdbztomge.exeC:\Temp\ljdbztomge.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ljdbztomge.exe ups_ins3⤵
-
C:\Temp\i_ljdbztomge.exeC:\Temp\i_ljdbztomge.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vtqojdbvto.exe ups_run3⤵
-
C:\Temp\vtqojdbvto.exeC:\Temp\vtqojdbvto.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vtqojdbvto.exe ups_ins3⤵
-
C:\Temp\i_vtqojdbvto.exeC:\Temp\i_vtqojdbvto.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ywqoigaytn.exe ups_run3⤵
-
C:\Temp\ywqoigaytn.exeC:\Temp\ywqoigaytn.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ywqoigaytn.exe ups_ins3⤵
-
C:\Temp\i_ywqoigaytn.exeC:\Temp\i_ywqoigaytn.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\yvqnigaysq.exe ups_run3⤵
-
C:\Temp\yvqnigaysq.exeC:\Temp\yvqnigaysq.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_yvqnigaysq.exe ups_ins3⤵
-
C:\Temp\i_yvqnigaysq.exeC:\Temp\i_yvqnigaysq.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x368,0x7fff1a3bc188,0x7fff1a3bc194,0x7fff1a3bc1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1728,i,5879247333559767802,15474724992517262725,524288 --field-trial-handle=2188,i,3858826567221242239,5126029739843718052,262144 --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1612,i,18225516107455324935,12469328797291217257,262144 --field-trial-handle=2188,i,3858826567221242239,5126029739843718052,262144 --variations-seed-version --mojo-platform-channel-handle=2184 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2484,i,8896488401443552346,8189793514185984555,524288 --field-trial-handle=2188,i,3858826567221242239,5126029739843718052,262144 --variations-seed-version --mojo-platform-channel-handle=2524 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3484,i,3388817372407612971,14109328813442512537,2097152 --field-trial-handle=2188,i,3858826567221242239,5126029739843718052,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3500,i,9612821339503382653,15182796680304514108,2097152 --field-trial-handle=2188,i,3858826567221242239,5126029739843718052,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4208,i,1918714059337055094,10813904923018400058,2097152 --field-trial-handle=2188,i,3858826567221242239,5126029739843718052,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4248,i,3748249256741203595,13833453123107914285,2097152 --field-trial-handle=2188,i,3858826567221242239,5126029739843718052,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4316,i,11796918738579633646,7609384885782694641,2097152 --field-trial-handle=2188,i,3858826567221242239,5126029739843718052,262144 --variations-seed-version --mojo-platform-channel-handle=4416 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4428,i,3132147971846702764,14252113318133724427,2097152 --field-trial-handle=2188,i,3858826567221242239,5126029739843718052,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5384,i,17911247644824237431,166460204721434191,524288 --field-trial-handle=2188,i,3858826567221242239,5126029739843718052,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5388,i,9933714750624971187,17099985636768567019,524288 --field-trial-handle=2188,i,3858826567221242239,5126029739843718052,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5500,i,7138047059912332396,12657471520170080946,524288 --field-trial-handle=2188,i,3858826567221242239,5126029739843718052,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5488,i,6990255715327310097,14752593525793649545,524288 --field-trial-handle=2188,i,3858826567221242239,5126029739843718052,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6172,i,9767994521997116111,10500403868025799791,524288 --field-trial-handle=2188,i,3858826567221242239,5126029739843718052,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:144⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.execookie_exporter.exe --cookie-json=11285⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6264,i,6417764193083413767,9473903370557139875,524288 --field-trial-handle=2188,i,3858826567221242239,5126029739843718052,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6264,i,6417764193083413767,9473903370557139875,524288 --field-trial-handle=2188,i,3858826567221242239,5126029739843718052,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6408,i,2607988949521733963,13962564695423694847,524288 --field-trial-handle=2188,i,3858826567221242239,5126029739843718052,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6540,i,755309032218682983,16272076266555822611,524288 --field-trial-handle=2188,i,3858826567221242239,5126029739843718052,262144 --variations-seed-version --mojo-platform-channel-handle=6548 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6820,i,12619295305900064158,10932346475140076379,524288 --field-trial-handle=2188,i,3858826567221242239,5126029739843718052,262144 --variations-seed-version --mojo-platform-channel-handle=6520 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6172,i,8424620456584647927,4006643730279287714,524288 --field-trial-handle=2188,i,3858826567221242239,5126029739843718052,262144 --variations-seed-version --mojo-platform-channel-handle=6468 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6844,i,1945512296150111406,6509972108419594952,524288 --field-trial-handle=2188,i,3858826567221242239,5126029739843718052,262144 --variations-seed-version --mojo-platform-channel-handle=6848 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5264,i,6958609498214921188,7760175975777725375,524288 --field-trial-handle=2188,i,3858826567221242239,5126029739843718052,262144 --variations-seed-version --mojo-platform-channel-handle=4572 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4584,i,74512403566882038,16158698158398125195,524288 --field-trial-handle=2188,i,3858826567221242239,5126029739843718052,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4588,i,16607529636651675799,12727333170229147756,524288 --field-trial-handle=2188,i,3858826567221242239,5126029739843718052,262144 --variations-seed-version --mojo-platform-channel-handle=4776 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4492,i,7679875026265212066,12124555939188848648,524288 --field-trial-handle=2188,i,3858826567221242239,5126029739843718052,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5544,i,161603673246553812,16904238950817305779,524288 --field-trial-handle=2188,i,3858826567221242239,5126029739843718052,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5852,i,11298265764971036486,17296314241977003008,524288 --field-trial-handle=2188,i,3858826567221242239,5126029739843718052,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5528,i,16406354412471291596,16880221790699734773,524288 --field-trial-handle=2188,i,3858826567221242239,5126029739843718052,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5256,i,8593652401142326274,6195305581786014290,262144 --field-trial-handle=2188,i,3858826567221242239,5126029739843718052,262144 --variations-seed-version --mojo-platform-channel-handle=2960 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5976,i,11160813620898386034,3305632574039694562,524288 --field-trial-handle=2188,i,3858826567221242239,5126029739843718052,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\gbytrljdbvtolgey.sysC:\Temp\gbytrljdbvtolgey.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Temp\bvtoigdyvq.sysC:\Temp\bvtoigdyvq.sys1⤵
- Executes dropped EXE
-
C:\Temp\kicavsnlfd.sysC:\Temp\kicavsnlfd.sys1⤵
- Executes dropped EXE
-
C:\Temp\axspkfcxup.sysC:\Temp\axspkfcxup.sys1⤵
- Executes dropped EXE
-
C:\Temp\ausmkecxup.sysC:\Temp\ausmkecxup.sys1⤵
- Executes dropped EXE
-
C:\Temp\omhezxrpjh.sysC:\Temp\omhezxrpjh.sys1⤵
- Executes dropped EXE
-
C:\Temp\ecwtomjecw.sysC:\Temp\ecwtomjecw.sys1⤵
- Executes dropped EXE
-
C:\Temp\wtomgeywqo.sysC:\Temp\wtomgeywqo.sys1⤵
- Executes dropped EXE
-
C:\Temp\wqljdbwtoi.sysC:\Temp\wqljdbwtoi.sys1⤵
- Executes dropped EXE
-
C:\Temp\gaytqljdbv.sysC:\Temp\gaytqljdbv.sys1⤵
- Executes dropped EXE
-
C:\Temp\ytnlfdxvqn.sysC:\Temp\ytnlfdxvqn.sys1⤵
- Executes dropped EXE
-
C:\Temp\pnicaxsnkf.sysC:\Temp\pnicaxsnkf.sys1⤵
-
C:\Temp\snkfcxvpnh.sysC:\Temp\snkfcxvpnh.sys1⤵
-
C:\Temp\jhcausmkec.sysC:\Temp\jhcausmkec.sys1⤵
-
C:\Temp\heztrmjecw.sysC:\Temp\heztrmjecw.sys1⤵
-
C:\Temp\ztrmjebwuo.sysC:\Temp\ztrmjebwuo.sys1⤵
-
C:\Temp\qojgewtolg.sysC:\Temp\qojgewtolg.sys1⤵
-
C:\Temp\jdbvtnlgdy.sysC:\Temp\jdbvtnlgdy.sys1⤵
-
C:\Temp\vtnlfdysql.sysC:\Temp\vtnlfdysql.sys1⤵
-
C:\Temp\xvpnifaxsq.sysC:\Temp\xvpnifaxsq.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CreateProcess.exe
ausmkecxup.sys
avsnkicavs.exe
axspkfcxup.sys
bvtoigdyvq.sys
gbytrljdbvtolgey.exe
gbytrljdbvtolgey.sys
hczusmkecx.exe
i_avsnkicavs.exe
i_hczusmkecx.exe
i_nlfdyvqoig.exe
i_pnhfcxvpnh.exe
i_qlgdqlibvi.exe
kicavsnlfd.sys
nlfdyvqoig.exe
pnhfcxvpnh.exe
qlgdqlibvi.exe
blocklist
protocols.json
settings.dat
settings.dat
7c1ae32f-5a66-49bd-94ad-ef3a109ede32.tmp
BookmarkMergedSurfaceOrdering
temp-index
the-real-index~RFe58dde8.TMP
SiteList-Enterprise.json
Edge Profile.ico
HubApps
Network Persistent State
Network Persistent State
eea29bbb-6b4b-48f6-93fd-4ed6f0d4d89d.tmp
Preferences
Secure Preferences
sync_diagnostic.log
f1225d3f-3011-4c47-bbf1-48c6512d3df5.tmp
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
nav_config.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
205ad96a-b382-401a-9e8d-f4fea05f655e.tmp
8494066d-632a-47c9-9bd9-461570302793.tmp
content_new.js
18c48a38-e301-40e0-b56b-afbaab7313b0.tmp
manifest.json
manifest.json
manifest.json
memory/644-832-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1564-602-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1992-637-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2116-706-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2292-625-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2432-557-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2464-76-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2556-460-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2872-692-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2872-662-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3060-775-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3252-768-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3448-812-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3472-509-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3884-803-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3912-738-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4160-578-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4556-537-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4744-690-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4796-590-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4840-726-0x0000000000010000-0x00000000000AB000-memory.dmp