Analysis
- max time kernel
149s - max time network
145s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
04/06/2026, 02:58
General
- Target 2026-06-04_8582a6b65cb6f1f7967aa5d5e726f1aa_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 376KB
- Sample260604-df5vxshs7x
- SHA256 c2fa495b6c17af97ae32173dd570e181bab2b63d7dcb78e79587f968e7ee5c00
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba
-
http://xytets.com:2345/t.asp?os=home
-
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 9 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 41 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 19 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 29 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 3 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-04_8582a6b65cb6f1f7967aa5d5e726f1aa_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-04_8582a6b65cb6f1f7967aa5d5e726f1aa_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\vtnlfdyvqoigaysq.exeC:\Temp\vtnlfdyvqoigaysq.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fdywqliayq.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\fdywqliayq.exeC:\Temp\fdywqliayq.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fdywqliayq.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_fdywqliayq.exeC:\Temp\i_fdywqliayq.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\icavsnlfdy.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\icavsnlfdy.exeC:\Temp\icavsnlfdy.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_icavsnlfdy.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_icavsnlfdy.exeC:\Temp\i_icavsnlfdy.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\dxvpnifays.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\dxvpnifays.exeC:\Temp\dxvpnifays.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_dxvpnifays.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_dxvpnifays.exeC:\Temp\i_dxvpnifays.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\khfzxspkfc.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\khfzxspkfc.exeC:\Temp\khfzxspkfc.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_khfzxspkfc.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_khfzxspkfc.exeC:\Temp\i_khfzxspkfc.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zxrpkhczus.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\zxrpkhczus.exeC:\Temp\zxrpkhczus.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zxrpkhczus.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_zxrpkhczus.exeC:\Temp\i_zxrpkhczus.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ecwrpjhbwu.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ecwrpjhbwu.exeC:\Temp\ecwrpjhbwu.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ecwrpjhbwu.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ecwrpjhbwu.exeC:\Temp\i_ecwrpjhbwu.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ywrojhtrlj.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ywrojhtrlj.exeC:\Temp\ywrojhtrlj.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ywrojhtrlj.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ywrojhtrlj.exeC:\Temp\i_ywrojhtrlj.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rljdbvtomg.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\rljdbvtomg.exeC:\Temp\rljdbvtomg.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rljdbvtomg.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_rljdbvtomg.exeC:\Temp\i_rljdbvtomg.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gbvtnlfdyv.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\gbvtnlfdyv.exeC:\Temp\gbvtnlfdyv.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gbvtnlfdyv.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_gbvtnlfdyv.exeC:\Temp\i_gbvtnlfdyv.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qlfdxvpnlf.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\qlfdxvpnlf.exeC:\Temp\qlfdxvpnlf.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qlfdxvpnlf.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_qlfdxvpnlf.exeC:\Temp\i_qlfdxvpnlf.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\kicankfdxv.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\kicankfdxv.exeC:\Temp\kicankfdxv.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_kicankfdxv.exe ups_ins3⤵
-
C:\Temp\i_kicankfdxv.exeC:\Temp\i_kicankfdxv.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\cxvpnhfzus.exe ups_run3⤵
-
C:\Temp\cxvpnhfzus.exeC:\Temp\cxvpnhfzus.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_cxvpnhfzus.exe ups_ins3⤵
-
C:\Temp\i_cxvpnhfzus.exeC:\Temp\i_cxvpnhfzus.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pmhfzxrpjh.exe ups_run3⤵
-
C:\Temp\pmhfzxrpjh.exeC:\Temp\pmhfzxrpjh.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pmhfzxrpjh.exe ups_ins3⤵
-
C:\Temp\i_pmhfzxrpjh.exeC:\Temp\i_pmhfzxrpjh.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ecwuomhezt.exe ups_run3⤵
-
C:\Temp\ecwuomhezt.exeC:\Temp\ecwuomhezt.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ecwuomhezt.exe ups_ins3⤵
-
C:\Temp\i_ecwuomhezt.exeC:\Temp\i_ecwuomhezt.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ebwugeywro.exe ups_run3⤵
-
C:\Temp\ebwugeywro.exeC:\Temp\ebwugeywro.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ebwugeywro.exe ups_ins3⤵
-
C:\Temp\i_ebwugeywro.exeC:\Temp\i_ebwugeywro.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\trojhbztrl.exe ups_run3⤵
-
C:\Temp\trojhbztrl.exeC:\Temp\trojhbztrl.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_trojhbztrl.exe ups_ins3⤵
-
C:\Temp\i_trojhbztrl.exeC:\Temp\i_trojhbztrl.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\igbytrljdb.exe ups_run3⤵
-
C:\Temp\igbytrljdb.exeC:\Temp\igbytrljdb.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_igbytrljdb.exe ups_ins3⤵
-
C:\Temp\i_igbytrljdb.exeC:\Temp\i_igbytrljdb.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\aysqlidyvq.exe ups_run3⤵
-
C:\Temp\aysqlidyvq.exeC:\Temp\aysqlidyvq.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_aysqlidyvq.exe ups_ins3⤵
-
C:\Temp\i_aysqlidyvq.exeC:\Temp\i_aysqlidyvq.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vqfausnkfd.exe ups_run3⤵
-
C:\Temp\vqfausnkfd.exeC:\Temp\vqfausnkfd.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vqfausnkfd.exe ups_ins3⤵
-
C:\Temp\i_vqfausnkfd.exeC:\Temp\i_vqfausnkfd.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2e0,0x368,0x7ffbe635c188,0x7ffbe635c194,0x7ffbe635c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1820,i,14261599750993670993,16268239828327421654,524288 --field-trial-handle=2176,i,3704687334496434036,7233275583792142997,262144 --variations-seed-version --mojo-platform-channel-handle=2212 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,4344747613209597502,12804685413832285071,262144 --field-trial-handle=2176,i,3704687334496434036,7233275583792142997,262144 --variations-seed-version --mojo-platform-channel-handle=2172 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2532,i,7998531155152568058,9097475385484531948,524288 --field-trial-handle=2176,i,3704687334496434036,7233275583792142997,262144 --variations-seed-version --mojo-platform-channel-handle=2716 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3472,i,3129332335624963002,16248534414450541675,2097152 --field-trial-handle=2176,i,3704687334496434036,7233275583792142997,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3476,i,17387288018433108921,14346723449528060411,2097152 --field-trial-handle=2176,i,3704687334496434036,7233275583792142997,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4180,i,17553978665079059818,13017891429644189375,2097152 --field-trial-handle=2176,i,3704687334496434036,7233275583792142997,262144 --variations-seed-version --mojo-platform-channel-handle=4192 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4200,i,3824269204474138400,14882161404182070027,2097152 --field-trial-handle=2176,i,3704687334496434036,7233275583792142997,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4292,i,10713696526311985226,7665795174518899520,2097152 --field-trial-handle=2176,i,3704687334496434036,7233275583792142997,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4296,i,554997168416901078,248551931119693797,2097152 --field-trial-handle=2176,i,3704687334496434036,7233275583792142997,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3960,i,18338968040275613879,9259044304765608682,524288 --field-trial-handle=2176,i,3704687334496434036,7233275583792142997,262144 --variations-seed-version --mojo-platform-channel-handle=3984 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3980,i,14622513114512065176,6269215587756308913,524288 --field-trial-handle=2176,i,3704687334496434036,7233275583792142997,262144 --variations-seed-version --mojo-platform-channel-handle=3940 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4192,i,13652809825143635545,11614004602016830659,524288 --field-trial-handle=2176,i,3704687334496434036,7233275583792142997,262144 --variations-seed-version --mojo-platform-channel-handle=3940 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3960,i,16232459184445210367,16185201094730266863,524288 --field-trial-handle=2176,i,3704687334496434036,7233275583792142997,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6116,i,16108182020105690488,9196531959911497746,524288 --field-trial-handle=2176,i,3704687334496434036,7233275583792142997,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6116,i,16108182020105690488,9196531959911497746,524288 --field-trial-handle=2176,i,3704687334496434036,7233275583792142997,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6256,i,11636438852554835134,8236599189195751111,524288 --field-trial-handle=2176,i,3704687334496434036,7233275583792142997,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:144⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.execookie_exporter.exe --cookie-json=11405⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6404,i,2592796413327411762,503357147350132818,524288 --field-trial-handle=2176,i,3704687334496434036,7233275583792142997,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6432,i,14420809178339982164,10232038297774228355,524288 --field-trial-handle=2176,i,3704687334496434036,7233275583792142997,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6264,i,4504121965076209589,17186822476732668574,524288 --field-trial-handle=2176,i,3704687334496434036,7233275583792142997,262144 --variations-seed-version --mojo-platform-channel-handle=6692 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6412,i,17039853241112922737,7395564922684416337,524288 --field-trial-handle=2176,i,3704687334496434036,7233275583792142997,262144 --variations-seed-version --mojo-platform-channel-handle=6700 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6492,i,17846429892876247155,5246122929246899976,524288 --field-trial-handle=2176,i,3704687334496434036,7233275583792142997,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4376,i,1417725636814167786,11336954587030639411,524288 --field-trial-handle=2176,i,3704687334496434036,7233275583792142997,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4392,i,1760732657305457157,6473724953325909487,524288 --field-trial-handle=2176,i,3704687334496434036,7233275583792142997,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4388,i,10582062567522059767,14005073146417454758,524288 --field-trial-handle=2176,i,3704687334496434036,7233275583792142997,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4584,i,9020906580978397857,9933070162848360756,524288 --field-trial-handle=2176,i,3704687334496434036,7233275583792142997,262144 --variations-seed-version --mojo-platform-channel-handle=3904 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4648,i,7578548886188472617,10701435632991774979,524288 --field-trial-handle=2176,i,3704687334496434036,7233275583792142997,262144 --variations-seed-version --mojo-platform-channel-handle=6824 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=868,i,6079214037104909986,12700918217086979554,524288 --field-trial-handle=2176,i,3704687334496434036,7233275583792142997,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=864,i,15692947203136267135,1810371922865801467,524288 --field-trial-handle=2176,i,3704687334496434036,7233275583792142997,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6368,i,15233611852704806849,17574852366647491351,262144 --field-trial-handle=2176,i,3704687334496434036,7233275583792142997,262144 --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,17501699340279899065,16625331680264075449,524288 --field-trial-handle=2176,i,3704687334496434036,7233275583792142997,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\vtnlfdyvqoigaysq.sysC:\Temp\vtnlfdyvqoigaysq.sys1⤵
- Executes dropped EXE
-
C:\Temp\avtnlfdxvq.sysC:\Temp\avtnlfdxvq.sys1⤵
- Executes dropped EXE
-
C:\Temp\nlfdxvpnic.sysC:\Temp\nlfdxvpnic.sys1⤵
- Executes dropped EXE
-
C:\Temp\uspkicausm.sysC:\Temp\uspkicausm.sys1⤵
- Executes dropped EXE
-
C:\Temp\kezxrpjhcz.sysC:\Temp\kezxrpjhcz.sys1⤵
- Executes dropped EXE
-
C:\Temp\xrpjhbzurm.sysC:\Temp\xrpjhbzurm.sys1⤵
- Executes dropped EXE
-
C:\Temp\mgeywrojhb.sysC:\Temp\mgeywrojhb.sys1⤵
- Executes dropped EXE
-
C:\Temp\ytrljdbvto.sysC:\Temp\ytrljdbvto.sys1⤵
- Executes dropped EXE
-
C:\Temp\nlgdbvtolg.sysC:\Temp\nlgdbvtolg.sys1⤵
- Executes dropped EXE
-
C:\Temp\gdyvqoiysq.sysC:\Temp\gdyvqoiysq.sys1⤵
- Executes dropped EXE
-
C:\Temp\vtnifaysqk.sysC:\Temp\vtnifaysqk.sys1⤵
- Executes dropped EXE
-
C:\Temp\kicausnkfc.sysC:\Temp\kicausnkfc.sys1⤵
-
C:\Temp\cwupmhfzxr.sysC:\Temp\cwupmhfzxr.sys1⤵
-
C:\Temp\xupmherpjh.sysC:\Temp\xupmherpjh.sys1⤵
-
C:\Temp\omhezxrpjh.sysC:\Temp\omhezxrpjh.sys1⤵
-
C:\Temp\eywqojgbzt.sysC:\Temp\eywqojgbzt.sys1⤵
-
C:\Temp\qoigaytqlj.sysC:\Temp\qoigaytqlj.sys1⤵
-
C:\Temp\tqljdbnlfd.sysC:\Temp\tqljdbnlfd.sys1⤵
-
C:\Temp\dxvqnigays.sysC:\Temp\dxvqnigays.sys1⤵
-
C:\Temp\snkfdxsqki.sysC:\Temp\snkfdxsqki.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
avtnlfdxvq.sys
dxvpnifays.exe
fdywqliayq.exe
i_dxvpnifays.exe
i_fdywqliayq.exe
i_icavsnlfdy.exe
i_khfzxspkfc.exe
i_zxrpkhczus.exe
icavsnlfdy.exe
kezxrpjhcz.sys
khfzxspkfc.exe
nlfdxvpnic.sys
uspkicausm.sys
vtnlfdyvqoigaysq.exe
vtnlfdyvqoigaysq.sys
xrpjhbzurm.sys
zxrpkhczus.exe
blocklist
protocols.json
settings.dat
settings.dat
BookmarkMergedSurfaceOrdering
the-real-index
SiteList-Enterprise.json
Edge Profile.ico
HubApps
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
Preferences
Preferences
Secure Preferences
sync_diagnostic.log
OperationConfig
OperationConfig~RFe598ce4.TMP
office_endpoints_list.json
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
nav_config.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
309f73a4-a40d-4064-9ed9-a8af7b08d98c.tmp
761b9d72-b013-4d2a-9810-a90a50ea0692.tmp
content_new.js
27afb1af-edc9-40e6-9502-2a698ab93bc2.tmp
manifest.json
manifest.json
manifest.json
manifest.json
CreateProcess.exe
memory/576-747-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/676-657-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/772-713-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1584-620-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1704-725-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1800-585-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1808-572-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1892-790-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1892-702-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1892-677-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2320-573-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2320-542-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2520-820-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3544-778-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3644-505-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3696-530-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3724-71-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3856-816-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3972-692-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4040-456-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4840-589-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4876-640-0x0000000000010000-0x00000000000AB000-memory.dmp