Analysis
- max time kernel
149s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
02/08/2026, 21:33
General
- Target 2026-08-02_8a68eeb609bb37d3fe05a43134943c08_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 376KB
- Sample260802-1ee97sscmd
- SHA256 9c52283ee8c28324bab34c163267b76dc9ab730b0c7fa0ff37e0ee4f2e4b91aa
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba
-
http://xytets.com:2345/t.asp?os=home
-
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_8a68eeb609bb37d3fe05a43134943c08_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_8a68eeb609bb37d3fe05a43134943c08_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\zxrpjhczurmkecwu.exeC:\Temp\zxrpjhczurmkecwu.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fzxrpjhczx.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\fzxrpjhczx.exeC:\Temp\fzxrpjhczx.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fzxrpjhczx.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_fzxrpjhczx.exeC:\Temp\i_fzxrpjhczx.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rmjebztrpj.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\rmjebztrpj.exeC:\Temp\rmjebztrpj.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rmjebztrpj.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_rmjebztrpj.exeC:\Temp\i_rmjebztrpj.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\urljeuojgb.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\urljeuojgb.exeC:\Temp\urljeuojgb.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_urljeuojgb.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_urljeuojgb.exeC:\Temp\i_urljeuojgb.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jdbywqojgb.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\jdbywqojgb.exeC:\Temp\jdbywqojgb.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jdbywqojgb.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_jdbywqojgb.exeC:\Temp\i_jdbywqojgb.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ligaytqljd.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ligaytqljd.exeC:\Temp\ligaytqljd.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ligaytqljd.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ligaytqljd.exeC:\Temp\i_ligaytqljd.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\yvqnifaxvq.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\yvqnifaxvq.exeC:\Temp\yvqnifaxvq.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_yvqnifaxvq.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_yvqnifaxvq.exeC:\Temp\i_yvqnifaxvq.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xnhfaxspki.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\xnhfaxspki.exeC:\Temp\xnhfaxspki.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xnhfaxspki.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_xnhfaxspki.exeC:\Temp\i_xnhfaxspki.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fdxvsnkfcx.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\fdxvsnkfcx.exeC:\Temp\fdxvsnkfcx.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fdxvsnkfcx.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_fdxvsnkfcx.exeC:\Temp\i_fdxvsnkfcx.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ecwupmhecz.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ecwupmhecz.exeC:\Temp\ecwupmhecz.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ecwupmhecz.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ecwupmhecz.exeC:\Temp\i_ecwupmhecz.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pmgezwrpmh.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\pmgezwrpmh.exeC:\Temp\pmgezwrpmh.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pmgezwrpmh.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_pmgezwrpmh.exeC:\Temp\i_pmgezwrpmh.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mhezwjgebw.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\mhezwjgebw.exeC:\Temp\mhezwjgebw.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mhezwjgebw.exe ups_ins3⤵
-
C:\Temp\i_mhezwjgebw.exeC:\Temp\i_mhezwjgebw.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ojgbztrljh.exe ups_run3⤵
-
C:\Temp\ojgbztrljh.exeC:\Temp\ojgbztrljh.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ojgbztrljh.exe ups_ins3⤵
-
C:\Temp\i_ojgbztrljh.exeC:\Temp\i_ojgbztrljh.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ljdbvtnljd.exe ups_run3⤵
-
C:\Temp\ljdbvtnljd.exeC:\Temp\ljdbvtnljd.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ljdbvtnljd.exe ups_ins3⤵
-
C:\Temp\i_ljdbvtnljd.exeC:\Temp\i_ljdbvtnljd.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\avtnlidyvq.exe ups_run3⤵
-
C:\Temp\avtnlidyvq.exeC:\Temp\avtnlidyvq.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_avtnlidyvq.exe ups_ins3⤵
-
C:\Temp\i_avtnlidyvq.exeC:\Temp\i_avtnlidyvq.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\yvqnigaysq.exe ups_run3⤵
-
C:\Temp\yvqnigaysq.exeC:\Temp\yvqnigaysq.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_yvqnigaysq.exe ups_ins3⤵
-
C:\Temp\i_yvqnigaysq.exeC:\Temp\i_yvqnigaysq.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\sqnifaxusq.exe ups_run3⤵
-
C:\Temp\sqnifaxusq.exeC:\Temp\sqnifaxusq.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_sqnifaxusq.exe ups_ins3⤵
-
C:\Temp\i_sqnifaxusq.exeC:\Temp\i_sqnifaxusq.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pnkhcausmk.exe ups_run3⤵
-
C:\Temp\pnkhcausmk.exeC:\Temp\pnkhcausmk.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pnkhcausmk.exe ups_ins3⤵
-
C:\Temp\i_pnkhcausmk.exeC:\Temp\i_pnkhcausmk.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mhezxuspjh.exe ups_run3⤵
-
C:\Temp\mhezxuspjh.exeC:\Temp\mhezxuspjh.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mhezxuspjh.exe ups_ins3⤵
-
C:\Temp\i_mhezxuspjh.exeC:\Temp\i_mhezxuspjh.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\uomjhezwuo.exe ups_run3⤵
-
C:\Temp\uomjhezwuo.exeC:\Temp\uomjhezwuo.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_uomjhezwuo.exe ups_ins3⤵
-
C:\Temp\i_uomjhezwuo.exeC:\Temp\i_uomjhezwuo.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bwtomgeywr.exe ups_run3⤵
-
C:\Temp\bwtomgeywr.exeC:\Temp\bwtomgeywr.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2c8,0x318,0x7ffe17afc188,0x7ffe17afc194,0x7ffe17afc1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1968,i,616949880535118562,13452843298340589204,524288 --field-trial-handle=2636,i,17133344690490892010,14262203855683550019,262144 --variations-seed-version --mojo-platform-channel-handle=2668 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1800,i,2255389861244885085,2122920560432827978,262144 --field-trial-handle=2636,i,17133344690490892010,14262203855683550019,262144 --variations-seed-version --mojo-platform-channel-handle=2632 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2368,i,6741773077570638378,13140328463012748629,524288 --field-trial-handle=2636,i,17133344690490892010,14262203855683550019,262144 --variations-seed-version --mojo-platform-channel-handle=2792 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3572,i,7012580248004717613,10989107924155554716,2097152 --field-trial-handle=2636,i,17133344690490892010,14262203855683550019,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3576,i,2324703747118858320,3639923774480298702,2097152 --field-trial-handle=2636,i,17133344690490892010,14262203855683550019,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4316,i,1518864958144488710,9608391489727815298,2097152 --field-trial-handle=2636,i,17133344690490892010,14262203855683550019,262144 --variations-seed-version --mojo-platform-channel-handle=4852 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4328,i,17522073834177041523,7315816982839446261,2097152 --field-trial-handle=2636,i,17133344690490892010,14262203855683550019,262144 --variations-seed-version --mojo-platform-channel-handle=4948 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5300,i,11687359583801122744,4759923492170888651,2097152 --field-trial-handle=2636,i,17133344690490892010,14262203855683550019,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5488,i,13783565222481075685,17016102597097712405,524288 --field-trial-handle=2636,i,17133344690490892010,14262203855683550019,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3832,i,15096832538746161527,16541539279330442263,2097152 --field-trial-handle=2636,i,17133344690490892010,14262203855683550019,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5940,i,4644870548405188773,10447278832769416679,524288 --field-trial-handle=2636,i,17133344690490892010,14262203855683550019,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5940,i,4644870548405188773,10447278832769416679,524288 --field-trial-handle=2636,i,17133344690490892010,14262203855683550019,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5476,i,14191484218712496436,13666172399355172497,524288 --field-trial-handle=2636,i,17133344690490892010,14262203855683550019,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5472,i,6379834014397874454,7600112403297717066,524288 --field-trial-handle=2636,i,17133344690490892010,14262203855683550019,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6232,i,13204079968031921634,629735040535983405,524288 --field-trial-handle=2636,i,17133344690490892010,14262203855683550019,262144 --variations-seed-version --mojo-platform-channel-handle=3828 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6460,i,3273556763613717272,674426074739931033,524288 --field-trial-handle=2636,i,17133344690490892010,14262203855683550019,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3828,i,5450774698907098659,15707183233213954365,524288 --field-trial-handle=2636,i,17133344690490892010,14262203855683550019,262144 --variations-seed-version --mojo-platform-channel-handle=6548 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6816,i,10350656694981438125,16255846588900412753,524288 --field-trial-handle=2636,i,17133344690490892010,14262203855683550019,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6896,i,8355002947031755337,15525331739165875298,2097152 --field-trial-handle=2636,i,17133344690490892010,14262203855683550019,262144 --variations-seed-version --mojo-platform-channel-handle=6564 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4948,i,1601321979010515569,1143698245299214586,524288 --field-trial-handle=2636,i,17133344690490892010,14262203855683550019,262144 --variations-seed-version --mojo-platform-channel-handle=4916 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5224,i,10925727590488799396,665716702919723019,524288 --field-trial-handle=2636,i,17133344690490892010,14262203855683550019,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4312,i,3171425906742085248,4033439027710702117,524288 --field-trial-handle=2636,i,17133344690490892010,14262203855683550019,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=5584,i,1470484387727823732,7509306896072191043,2097152 --field-trial-handle=2636,i,17133344690490892010,14262203855683550019,262144 --variations-seed-version --mojo-platform-channel-handle=3144 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6168,i,1046579653979066911,114588323007074654,524288 --field-trial-handle=2636,i,17133344690490892010,14262203855683550019,262144 --variations-seed-version --mojo-platform-channel-handle=6832 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5844,i,10199537200794002756,3096737917379691959,524288 --field-trial-handle=2636,i,17133344690490892010,14262203855683550019,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6464,i,11687201007105007591,5246063792799178488,524288 --field-trial-handle=2636,i,17133344690490892010,14262203855683550019,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=3688,i,3747846613100530143,10690957774905751213,2097152 --field-trial-handle=2636,i,17133344690490892010,14262203855683550019,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6800,i,1424739385606285426,4716415384554490234,524288 --field-trial-handle=2636,i,17133344690490892010,14262203855683550019,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5848,i,6283300447314093037,5221269285454589475,262144 --field-trial-handle=2636,i,17133344690490892010,14262203855683550019,262144 --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5792,i,14673846095929464521,12513837156001710102,524288 --field-trial-handle=2636,i,17133344690490892010,14262203855683550019,262144 --variations-seed-version --mojo-platform-channel-handle=6748 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\zxrpjhczurmkecwu.sysC:\Temp\zxrpjhczurmkecwu.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\Temp\zwupecwuom.sysC:\Temp\zwupecwuom.sys1⤵
- Executes dropped EXE
-
C:\Temp\rljhbzwuom.sysC:\Temp\rljhbzwuom.sys1⤵
- Executes dropped EXE
-
C:\Temp\jgeywqojgb.sysC:\Temp\jgeywqojgb.sys1⤵
- Executes dropped EXE
-
C:\Temp\nljdaywqol.sysC:\Temp\nljdaywqol.sys1⤵
- Executes dropped EXE
-
C:\Temp\iyvqnifday.sysC:\Temp\iyvqnifday.sys1⤵
- Executes dropped EXE
-
C:\Temp\vsqnifdxvs.sysC:\Temp\vsqnifdxvs.sys1⤵
- Executes dropped EXE
-
C:\Temp\cxusnkicau.sysC:\Temp\cxusnkicau.sys1⤵
- Executes dropped EXE
-
C:\Temp\kfcwupmhfz.sysC:\Temp\kfcwupmhfz.sys1⤵
- Executes dropped EXE
-
C:\Temp\czusmherpm.sysC:\Temp\czusmherpm.sys1⤵
- Executes dropped EXE
-
C:\Temp\omjecwromg.sysC:\Temp\omjecwromg.sys1⤵
- Executes dropped EXE
-
C:\Temp\omgeywtrlj.sysC:\Temp\omgeywtrlj.sys1⤵
-
C:\Temp\qoigbytrli.sysC:\Temp\qoigbytrli.sys1⤵
-
C:\Temp\qoigaytqlj.sysC:\Temp\qoigaytqlj.sys1⤵
-
C:\Temp\fdxvqnifay.sysC:\Temp\fdxvqnifay.sys1⤵
-
C:\Temp\usnkfcaysq.sysC:\Temp\usnkfcaysq.sys1⤵
-
C:\Temp\upmkifzxup.sysC:\Temp\upmkifzxup.sys1⤵
-
C:\Temp\zusmkecxup.sysC:\Temp\zusmkecxup.sys1⤵
-
C:\Temp\urpjhezwuo.sysC:\Temp\urpjhezwuo.sys1⤵
-
C:\Temp\cwuomgeywr.sysC:\Temp\cwuomgeywr.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
fzxrpjhczx.exe
i_fzxrpjhczx.exe
i_jdbywqojgb.exe
i_ligaytqljd.exe
i_rmjebztrpj.exe
i_urljeuojgb.exe
jdbywqojgb.exe
jgeywqojgb.sys
ligaytqljd.exe
nljdaywqol.sys
rljhbzwuom.sys
rmjebztrpj.exe
urljeuojgb.exe
zwupecwuom.sys
zxrpjhczurmkecwu.exe
zxrpjhczurmkecwu.sys
settings.dat
settings.dat
the-real-index
the-real-index~RFe5961fc.TMP
SiteList-Enterprise.json
Edge Profile.ico
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Preferences
Preferences
Preferences
Secure Preferences
Local State
Local State
Local State
Local State
Local State
metadata.json
metadata.json
metadata.json
299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
93b938dd-debc-4d14-8e47-c35190e1e178.tmp
metadata.json
c9866b0c-09ac-4612-be12-ea1cb041cd33.tmp
content_new.js
CreateProcess.exe
memory/1288-551-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1444-604-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1444-468-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1980-421-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2052-520-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2624-668-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2768-555-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3328-673-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3532-624-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3640-514-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3640-496-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3732-541-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4272-545-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4300-698-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4300-716-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4536-693-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4900-584-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5236-64-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5856-628-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5856-658-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5876-537-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5876-508-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5956-648-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/6032-715-0x0000000000010000-0x00000000000AB000-memory.dmp