Analysis
- max time kernel
150s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
06/10/2026, 23:15
General
- Target 2026-10-05_619694d971a5193406ca0bf9e765d32e_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 361KB
- Sample261006-28mf2sg17x
- SHA256 5ca23909d98aff3c124afd27d9b588a6cf53885adb300d7d0e5f4f42fb6a75cf
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba
-
http://xytets.com:2345/t.asp?os=home
-
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 9 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-05_619694d971a5193406ca0bf9e765d32e_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-05_619694d971a5193406ca0bf9e765d32e_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\qolgdywqoigaysql.exeC:\Temp\qolgdywqoigaysql.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vtnlgdyvql.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\vtnlgdyvql.exeC:\Temp\vtnlgdyvql.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vtnlgdyvql.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_vtnlgdyvql.exeC:\Temp\i_vtnlgdyvql.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xvsqkidavt.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\xvsqkidavt.exeC:\Temp\xvsqkidavt.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xvsqkidavt.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_xvsqkidavt.exeC:\Temp\i_xvsqkidavt.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xspkicausm.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\xspkicausm.exeC:\Temp\xspkicausm.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xspkicausm.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_xspkicausm.exeC:\Temp\i_xspkicausm.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\caxspkhcau.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\caxspkhcau.exeC:\Temp\caxspkhcau.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_caxspkhcau.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_caxspkhcau.exeC:\Temp\i_caxspkhcau.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xrpkhcausm.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\xrpkhcausm.exeC:\Temp\xrpkhcausm.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xrpkhcausm.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_xrpkhcausm.exeC:\Temp\i_xrpkhcausm.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rpmhebztro.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\rpmhebztro.exeC:\Temp\rpmhebztro.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rpmhebztro.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_rpmhebztro.exeC:\Temp\i_rpmhebztro.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wrojgbztrl.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\wrojgbztrl.exeC:\Temp\wrojgbztrl.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wrojgbztrl.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_wrojgbztrl.exeC:\Temp\i_wrojgbztrl.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bzwromgdyw.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\bzwromgdyw.exeC:\Temp\bzwromgdyw.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bzwromgdyw.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_bzwromgdyw.exeC:\Temp\i_bzwromgdyw.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qoigbytrlj.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\qoigbytrlj.exeC:\Temp\qoigbytrlj.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qoigbytrlj.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_qoigbytrlj.exeC:\Temp\i_qoigbytrlj.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fdbvtnlfdy.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\fdbvtnlfdy.exeC:\Temp\fdbvtnlfdy.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fdbvtnlfdy.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_fdbvtnlfdy.exeC:\Temp\i_fdbvtnlfdy.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\aysqkicavs.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\aysqkicavs.exeC:\Temp\aysqkicavs.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_aysqkicavs.exe ups_ins3⤵
-
C:\Temp\i_aysqkicavs.exeC:\Temp\i_aysqkicavs.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nkfdxvsnkf.exe ups_run3⤵
-
C:\Temp\nkfdxvsnkf.exeC:\Temp\nkfdxvsnkf.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nkfdxvsnkf.exe ups_ins3⤵
-
C:\Temp\i_nkfdxvsnkf.exeC:\Temp\i_nkfdxvsnkf.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pmkecaxspk.exe ups_run3⤵
-
C:\Temp\pmkecaxspk.exeC:\Temp\pmkecaxspk.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pmkecaxspk.exe ups_ins3⤵
-
C:\Temp\i_pmkecaxspk.exeC:\Temp\i_pmkecaxspk.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pjhczxrpjh.exe ups_run3⤵
-
C:\Temp\pjhczxrpjh.exeC:\Temp\pjhczxrpjh.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pjhczxrpjh.exe ups_ins3⤵
-
C:\Temp\i_pjhczxrpjh.exeC:\Temp\i_pjhczxrpjh.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\romgezwrpj.exe ups_run3⤵
-
C:\Temp\romgezwrpj.exeC:\Temp\romgezwrpj.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_romgezwrpj.exe ups_ins3⤵
-
C:\Temp\i_romgezwrpj.exeC:\Temp\i_romgezwrpj.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bwtromgebz.exe ups_run3⤵
-
C:\Temp\bwtromgebz.exeC:\Temp\bwtromgebz.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bwtromgebz.exe ups_ins3⤵
-
C:\Temp\i_bwtromgebz.exeC:\Temp\i_bwtromgebz.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wtolgdywqo.exe ups_run3⤵
-
C:\Temp\wtolgdywqo.exeC:\Temp\wtolgdywqo.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wtolgdywqo.exe ups_ins3⤵
-
C:\Temp\i_wtolgdywqo.exeC:\Temp\i_wtolgdywqo.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\igaywqnlig.exe ups_run3⤵
-
C:\Temp\igaywqnlig.exeC:\Temp\igaywqnlig.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_igaywqnlig.exe ups_ins3⤵
-
C:\Temp\i_igaywqnlig.exeC:\Temp\i_igaywqnlig.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\yvqoigsqki.exe ups_run3⤵
-
C:\Temp\yvqoigsqki.exeC:\Temp\yvqoigsqki.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_yvqoigsqki.exe ups_ins3⤵
-
C:\Temp\i_yvqoigsqki.exeC:\Temp\i_yvqoigsqki.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\snkfdxvpnh.exe ups_run3⤵
-
C:\Temp\snkfdxvpnh.exeC:\Temp\snkfdxvpnh.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7fff6a32c188,0x7fff6a32c194,0x7fff6a32c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1692,i,9340974596560355796,16969726378055316241,262144 --field-trial-handle=2272,i,11505597354162730128,13041929302998781923,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1920,i,3303244823249289957,3474425223966276340,524288 --field-trial-handle=2272,i,11505597354162730128,13041929302998781923,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1428,i,8948296345234477750,2913593435460429110,524288 --field-trial-handle=2272,i,11505597354162730128,13041929302998781923,262144 --variations-seed-version --mojo-platform-channel-handle=3264 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3516,i,15831421358617947789,1811475714273569210,2097152 --field-trial-handle=2272,i,11505597354162730128,13041929302998781923,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3528,i,3674370466925843427,4786615721615879586,2097152 --field-trial-handle=2272,i,11505597354162730128,13041929302998781923,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4240,i,11148671233539542206,16624274819446528223,2097152 --field-trial-handle=2272,i,11505597354162730128,13041929302998781923,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4276,i,12429143642136188309,15737518790703423229,2097152 --field-trial-handle=2272,i,11505597354162730128,13041929302998781923,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5268,i,12310012688861541977,10511426008843920619,524288 --field-trial-handle=2272,i,11505597354162730128,13041929302998781923,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5380,i,11312101876829108605,2082220297273436255,2097152 --field-trial-handle=2272,i,11505597354162730128,13041929302998781923,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5032,i,11152588925116009041,6366196180406560970,2097152 --field-trial-handle=2272,i,11505597354162730128,13041929302998781923,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5232,i,5845028840130357351,9081323866922103205,524288 --field-trial-handle=2272,i,11505597354162730128,13041929302998781923,262144 --variations-seed-version --mojo-platform-channel-handle=3836 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5240,i,15661281799414927829,9334282112975797885,524288 --field-trial-handle=2272,i,11505597354162730128,13041929302998781923,262144 --variations-seed-version --mojo-platform-channel-handle=3776 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6088,i,8939524319704065597,2620699608144457407,524288 --field-trial-handle=2272,i,11505597354162730128,13041929302998781923,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6088,i,8939524319704065597,2620699608144457407,524288 --field-trial-handle=2272,i,11505597354162730128,13041929302998781923,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6416,i,11491388481647008803,2512073260311949266,524288 --field-trial-handle=2272,i,11505597354162730128,13041929302998781923,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6712,i,7723018069673749644,8125472227798006898,524288 --field-trial-handle=2272,i,11505597354162730128,13041929302998781923,262144 --variations-seed-version --mojo-platform-channel-handle=6536 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6536,i,11151130027800533995,11680139100327895841,2097152 --field-trial-handle=2272,i,11505597354162730128,13041929302998781923,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3544,i,11675364589835014650,6899231183699665415,524288 --field-trial-handle=2272,i,11505597354162730128,13041929302998781923,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3708,i,5572360773945079392,16867256242076048391,524288 --field-trial-handle=2272,i,11505597354162730128,13041929302998781923,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4276,i,3810684014329901779,10685675806623077963,524288 --field-trial-handle=2272,i,11505597354162730128,13041929302998781923,262144 --variations-seed-version --mojo-platform-channel-handle=3252 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=2520,i,2139114809794290617,6852878142637290284,2097152 --field-trial-handle=2272,i,11505597354162730128,13041929302998781923,262144 --variations-seed-version --mojo-platform-channel-handle=2836 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5472,i,7250140920286358426,10366070539583636514,524288 --field-trial-handle=2272,i,11505597354162730128,13041929302998781923,262144 --variations-seed-version --mojo-platform-channel-handle=6788 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5376,i,3661479102144990467,9785870402734203430,524288 --field-trial-handle=2272,i,11505597354162730128,13041929302998781923,262144 --variations-seed-version --mojo-platform-channel-handle=6828 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6884,i,4807044319629967393,6763929980366836431,524288 --field-trial-handle=2272,i,11505597354162730128,13041929302998781923,262144 --variations-seed-version --mojo-platform-channel-handle=944 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=6968,i,18337687989658861659,16961927274142041132,2097152 --field-trial-handle=2272,i,11505597354162730128,13041929302998781923,262144 --variations-seed-version --mojo-platform-channel-handle=6956 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6564,i,1025842151392213390,5078489716970222550,524288 --field-trial-handle=2272,i,11505597354162730128,13041929302998781923,262144 --variations-seed-version --mojo-platform-channel-handle=1892 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6736,i,3536964970563999495,3258443257984172007,262144 --field-trial-handle=2272,i,11505597354162730128,13041929302998781923,262144 --variations-seed-version --mojo-platform-channel-handle=3216 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5720,i,14345842628414388576,5496278340636967220,524288 --field-trial-handle=2272,i,11505597354162730128,13041929302998781923,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Temp\qolgdywqoigaysql.sysC:\Temp\qolgdywqoigaysql.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Temp\fdavtnlfda.sysC:\Temp\fdavtnlfda.sys1⤵
- Executes dropped EXE
-
C:\Temp\lfdxvpnica.sysC:\Temp\lfdxvpnica.sys1⤵
- Executes dropped EXE
-
C:\Temp\axspnkicau.sysC:\Temp\axspnkicau.sys1⤵
- Executes dropped EXE
-
C:\Temp\ecxusmkecx.sysC:\Temp\ecxusmkecx.sys1⤵
- Executes dropped EXE
-
C:\Temp\mkhczwromk.sysC:\Temp\mkhczwromk.sys1⤵
- Executes dropped EXE
-
C:\Temp\ecztrmjecw.sysC:\Temp\ecztrmjecw.sys1⤵
- Executes dropped EXE
-
C:\Temp\bztrljhbzt.sysC:\Temp\bztrljhbzt.sys1⤵
- Executes dropped EXE
-
C:\Temp\yvtolgdywq.sysC:\Temp\yvtolgdywq.sys1⤵
- Executes dropped EXE
-
C:\Temp\lidbvtnlfd.sysC:\Temp\lidbvtnlfd.sys1⤵
- Executes dropped EXE
-
C:\Temp\kidavsqkic.sysC:\Temp\kidavsqkic.sys1⤵
- Executes dropped EXE
-
C:\Temp\nkicavsnki.sysC:\Temp\nkicavsnki.sys1⤵
-
C:\Temp\pnhfcaxspn.sysC:\Temp\pnhfcaxspn.sys1⤵
-
C:\Temp\mkhczxrpjh.sysC:\Temp\mkhczxrpjh.sys1⤵
-
C:\Temp\ecwurmkecw.sysC:\Temp\ecwurmkecw.sys1⤵
-
C:\Temp\zwrojgeywt.sysC:\Temp\zwrojgeywt.sys1⤵
-
C:\Temp\bvtolgeywq.sysC:\Temp\bvtolgeywq.sys1⤵
-
C:\Temp\vtndyvqoig.sysC:\Temp\vtndyvqoig.sys1⤵
-
C:\Temp\vtqlidavtq.sysC:\Temp\vtqlidavtq.sys1⤵
-
C:\Temp\pnlfdxvqni.sysC:\Temp\pnlfdxvqni.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
axspnkicau.sys
caxspkhcau.exe
ecxusmkecx.sys
fdavtnlfda.sys
i_caxspkhcau.exe
i_vtnlgdyvql.exe
i_xrpkhcausm.exe
i_xspkicausm.exe
i_xvsqkidavt.exe
lfdxvpnica.sys
mkhczwromk.sys
qolgdywqoigaysql.exe
qolgdywqoigaysql.sys
rpmhebztro.exe
vtnlgdyvql.exe
xrpkhcausm.exe
xspkicausm.exe
xvsqkidavt.exe
43ef7644-875f-4878-93ff-5d07cf452978.tmp
69d5372a-f4db-424e-85ae-9f961b369cc0.tmp
86a0993e-0dcc-4543-832d-9d4b1a8e7bc9.tmp
36009433-9daa-4a12-8fa5-513ac4b6dee5.tmp
settings.dat
settings.dat
32dc898d-2bd5-4f16-a467-6dc1554f87e0.tmp
3d081a7d-fa39-4089-9f5b-e8cdcddf3aaf.tmp
4ecb1b48-ee2d-4753-95bd-88564a83521f.tmp
988ada98-945a-40f0-8345-606c41bfedb9.tmp
temp-index
the-real-index
a9dfa8ca-948c-414f-bf45-3d24c3b1bb4d.tmp
02444d44-904b-4a39-9229-c9909d031e25.tmp
3cd1ec82-7e24-4ab3-a216-3655c7f5b8ec.tmp
cdefecc2-237c-4e30-b1aa-942e74d51bc4.tmp
sync_diagnostic.log
c132874d-04f7-4b01-8c98-60a4c394bfb2.tmp
e75dc1e5-9122-4740-afd6-d894a216d1a8.tmp
644ac478-c945-456f-ba1f-dd236a890ed5.tmp
25501298-53ec-4f82-99ec-530d4662510f.tmp
26e24d4a-682b-4f60-a4e8-fa7d2f2de189.tmp
43a3a02b-7c80-45ab-b3d1-abd2835a6e8c.tmp
c9a0658e-53b5-4731-bdc1-da05a5f6afe1.tmp
d3c45a50-6caf-4005-aa1a-ada04aa46fcc.tmp
0b1ce068-f83b-4866-8dc3-81bc44eb2930.tmp
0274f976-8244-4cb4-8d10-e755c39bb50f.tmp
7fecb028-b438-4f55-a218-ce865e944caa.tmp
content.js
manifest.json
manifest.json
manifest.json
manifest.json
CreateProcess.exe
memory/124-383-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/256-510-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1076-292-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1180-349-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1256-332-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1256-326-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1540-462-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2084-290-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2392-467-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2520-353-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2700-488-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2808-427-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2808-403-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2952-240-0x000002908A340000-0x000002908A6FB000-memory.dmp
memory/2952-235-0x000002908A340000-0x000002908A6FB000-memory.dmp
memory/2968-251-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3004-425-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3380-430-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4384-492-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4460-200-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4852-330-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5196-66-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5844-304-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5988-450-0x0000000000010000-0x00000000000AB000-memory.dmp