Analysis
- max time kernel
149s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
20/10/2026, 07:45
General
- Target 2026-10-20_3c568df1a2f38ce5a5d0b39e5afffb6f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 376KB
- Sample261020-jlsqfaey5x
- SHA256 5566df40ede5c45bdcb9cb50df6552c356b0a824b37e16268b6f93e5041aa74d
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba
-
http://xytets.com:2345/t.asp?os=home
-
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-20_3c568df1a2f38ce5a5d0b39e5afffb6f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-20_3c568df1a2f38ce5a5d0b39e5afffb6f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\nhfzxspnkfcxvpnk.exeC:\Temp\nhfzxspnkfcxvpnk.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\usmcxuskhc.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\usmcxuskhc.exeC:\Temp\usmcxuskhc.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_usmcxuskhc.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_usmcxuskhc.exeC:\Temp\i_usmcxuskhc.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\upmhecaurm.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\upmhecaurm.exeC:\Temp\upmhecaurm.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_upmhecaurm.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_upmhecaurm.exeC:\Temp\i_upmhecaurm.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\cztrmkebwu.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\cztrmkebwu.exeC:\Temp\cztrmkebwu.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_cztrmkebwu.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_cztrmkebwu.exeC:\Temp\i_cztrmkebwu.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gbywuojgbz.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\gbywuojgbz.exeC:\Temp\gbywuojgbz.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gbywuojgbz.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_gbywuojgbz.exeC:\Temp\i_gbywuojgbz.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\yvtoljdbvt.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\yvtoljdbvt.exeC:\Temp\yvtoljdbvt.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_yvtoljdbvt.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_yvtoljdbvt.exeC:\Temp\i_yvtoljdbvt.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\tqljdyoiga.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\tqljdyoiga.exeC:\Temp\tqljdyoiga.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_tqljdyoiga.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_tqljdyoiga.exeC:\Temp\i_tqljdyoiga.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vtnlifaxvs.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\vtnlifaxvs.exeC:\Temp\vtnlifaxvs.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vtnlifaxvs.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_vtnlifaxvs.exeC:\Temp\i_vtnlifaxvs.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\axspnifaxs.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\axspnifaxs.exeC:\Temp\axspnifaxs.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_axspnifaxs.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_axspnifaxs.exeC:\Temp\i_axspnifaxs.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mkicaxspkf.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\mkicaxspkf.exeC:\Temp\mkicaxspkf.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mkicaxspkf.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_mkicaxspkf.exeC:\Temp\i_mkicaxspkf.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xupnhfzxsp.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\xupnhfzxsp.exeC:\Temp\xupnhfzxsp.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xupnhfzxsp.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_xupnhfzxsp.exeC:\Temp\i_xupnhfzxsp.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\uomhezwuom.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\uomhezwuom.exeC:\Temp\uomhezwuom.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_uomhezwuom.exe ups_ins3⤵
-
C:\Temp\i_uomhezwuom.exeC:\Temp\i_uomhezwuom.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ojhbztrpjh.exe ups_run3⤵
-
C:\Temp\ojhbztrpjh.exeC:\Temp\ojhbztrpjh.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ojhbztrpjh.exe ups_ins3⤵
-
C:\Temp\i_ojhbztrpjh.exeC:\Temp\i_ojhbztrpjh.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\olgeywtolg.exe ups_run3⤵
-
C:\Temp\olgeywtolg.exeC:\Temp\olgeywtolg.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_olgeywtolg.exe ups_ins3⤵
-
C:\Temp\i_olgeywtolg.exeC:\Temp\i_olgeywtolg.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ywtoljgeyw.exe ups_run3⤵
-
C:\Temp\ywtoljgeyw.exeC:\Temp\ywtoljgeyw.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ywtoljgeyw.exe ups_ins3⤵
-
C:\Temp\i_ywtoljgeyw.exeC:\Temp\i_ywtoljgeyw.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\yvtnlgdyvq.exe ups_run3⤵
-
C:\Temp\yvtnlgdyvq.exeC:\Temp\yvtnlgdyvq.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_yvtnlgdyvq.exe ups_ins3⤵
-
C:\Temp\i_yvtnlgdyvq.exeC:\Temp\i_yvtnlgdyvq.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\davsqnlfda.exe ups_run3⤵
-
C:\Temp\davsqnlfda.exeC:\Temp\davsqnlfda.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_davsqnlfda.exe ups_ins3⤵
-
C:\Temp\i_davsqnlfda.exeC:\Temp\i_davsqnlfda.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\auspnhfdxs.exe ups_run3⤵
-
C:\Temp\auspnhfdxs.exeC:\Temp\auspnhfdxs.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_auspnhfdxs.exe ups_ins3⤵
-
C:\Temp\i_auspnhfdxs.exeC:\Temp\i_auspnhfdxs.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pkicausmkf.exe ups_run3⤵
-
C:\Temp\pkicausmkf.exeC:\Temp\pkicausmkf.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pkicausmkf.exe ups_ins3⤵
-
C:\Temp\i_pkicausmkf.exeC:\Temp\i_pkicausmkf.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\kecwurmjhf.exe ups_run3⤵
-
C:\Temp\kecwurmjhf.exeC:\Temp\kecwurmjhf.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_kecwurmjhf.exe ups_ins3⤵
-
C:\Temp\i_kecwurmjhf.exeC:\Temp\i_kecwurmjhf.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\omgezwrpjh.exe ups_run3⤵
-
C:\Temp\omgezwrpjh.exeC:\Temp\omgezwrpjh.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ff84a9dc188,0x7ff84a9dc194,0x7ff84a9dc1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1948,i,10437173409694110763,16901118979839271687,262144 --field-trial-handle=2552,i,17114576411027006897,6673455641536905781,262144 --variations-seed-version --mojo-platform-channel-handle=2548 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1984,i,18125426921280316952,6339210264962541288,524288 --field-trial-handle=2552,i,17114576411027006897,6673455641536905781,262144 --variations-seed-version --mojo-platform-channel-handle=2580 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2676,i,5129602577005340145,6419447108697263152,524288 --field-trial-handle=2552,i,17114576411027006897,6673455641536905781,262144 --variations-seed-version --mojo-platform-channel-handle=3236 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3572,i,277563807695982673,17120654208468480596,2097152 --field-trial-handle=2552,i,17114576411027006897,6673455641536905781,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3588,i,626390229789690277,3056238716201092330,2097152 --field-trial-handle=2552,i,17114576411027006897,6673455641536905781,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4284,i,17988062583461998144,12272940464046462909,2097152 --field-trial-handle=2552,i,17114576411027006897,6673455641536905781,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4260,i,16043889225881865155,8615621386181555743,2097152 --field-trial-handle=2552,i,17114576411027006897,6673455641536905781,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5452,i,6641785233504488537,1991281248291599400,524288 --field-trial-handle=2552,i,17114576411027006897,6673455641536905781,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5552,i,9713201850677553961,5535971393665645143,2097152 --field-trial-handle=2552,i,17114576411027006897,6673455641536905781,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3860,i,4556022710931765381,10496608343638632194,2097152 --field-trial-handle=2552,i,17114576411027006897,6673455641536905781,262144 --variations-seed-version --mojo-platform-channel-handle=3780 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4348,i,10971371669545964489,8004769254040932902,524288 --field-trial-handle=2552,i,17114576411027006897,6673455641536905781,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4400,i,3680052594465977806,8697962526855227824,524288 --field-trial-handle=2552,i,17114576411027006897,6673455641536905781,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,12497775620374051753,16483260142672660461,524288 --field-trial-handle=2552,i,17114576411027006897,6673455641536905781,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,12497775620374051753,16483260142672660461,524288 --field-trial-handle=2552,i,17114576411027006897,6673455641536905781,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6308,i,232418470159346750,11185396680265052498,524288 --field-trial-handle=2552,i,17114576411027006897,6673455641536905781,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6304,i,14001476531129592486,17022959067393543869,524288 --field-trial-handle=2552,i,17114576411027006897,6673455641536905781,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6328,i,3355041885534242022,7449145753018048155,524288 --field-trial-handle=2552,i,17114576411027006897,6673455641536905781,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6560,i,16880031460707542808,10476017219080966617,524288 --field-trial-handle=2552,i,17114576411027006897,6673455641536905781,262144 --variations-seed-version --mojo-platform-channel-handle=6556 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1412,i,6570691161222061817,7032871731833144777,524288 --field-trial-handle=2552,i,17114576411027006897,6673455641536905781,262144 --variations-seed-version --mojo-platform-channel-handle=1420 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1272,i,9388410078434151315,10399807419579210087,524288 --field-trial-handle=2552,i,17114576411027006897,6673455641536905781,262144 --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1276,i,12056656928652779463,1876104984437099034,524288 --field-trial-handle=2552,i,17114576411027006897,6673455641536905781,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4968,i,11653704687341611688,15430471971408426809,524288 --field-trial-handle=2552,i,17114576411027006897,6673455641536905781,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6444,i,13692621303790073121,9468587297272577567,524288 --field-trial-handle=2552,i,17114576411027006897,6673455641536905781,262144 --variations-seed-version --mojo-platform-channel-handle=5636 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6232,i,14809582561603844253,2590656851686620905,524288 --field-trial-handle=2552,i,17114576411027006897,6673455641536905781,262144 --variations-seed-version --mojo-platform-channel-handle=4972 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,9247608897367541106,11895059547531175481,524288 --field-trial-handle=2552,i,17114576411027006897,6673455641536905781,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6428,i,9609167897518017911,11063721131619667902,524288 --field-trial-handle=2552,i,17114576411027006897,6673455641536905781,262144 --variations-seed-version --mojo-platform-channel-handle=6572 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4368,i,4094426018948929476,8258786129529510202,262144 --field-trial-handle=2552,i,17114576411027006897,6673455641536905781,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5812,i,6037438919371103583,1416473629078729903,524288 --field-trial-handle=2552,i,17114576411027006897,6673455641536905781,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\nhfzxspnkfcxvpnk.sysC:\Temp\nhfzxspnkfcxvpnk.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Temp\xrpjhecaus.sysC:\Temp\xrpjhecaus.sys1⤵
- Executes dropped EXE
-
C:\Temp\ebzurmjecz.sysC:\Temp\ebzurmjecz.sys1⤵
- Executes dropped EXE
-
C:\Temp\ywromgebwu.sysC:\Temp\ywromgebwu.sys1⤵
- Executes dropped EXE
-
C:\Temp\gbytqomgey.sysC:\Temp\gbytqomgey.sys1⤵
- Executes dropped EXE
-
C:\Temp\ywqoigbytr.sysC:\Temp\ywqoigbytr.sys1⤵
- Executes dropped EXE
-
C:\Temp\qoifdaysqn.sysC:\Temp\qoifdaysqn.sys1⤵
- Executes dropped EXE
-
C:\Temp\xvpnhfaxsq.sysC:\Temp\xvpnhfaxsq.sys1⤵
- Executes dropped EXE
-
C:\Temp\fcxvpnhfcx.sysC:\Temp\fcxvpnhfcx.sys1⤵
- Executes dropped EXE
-
C:\Temp\urpnhfcxup.sysC:\Temp\urpnhfcxup.sys1⤵
- Executes dropped EXE
-
C:\Temp\urmkeczurp.sysC:\Temp\urmkeczurp.sys1⤵
- Executes dropped EXE
-
C:\Temp\pmgebztrpj.sysC:\Temp\pmgebztrpj.sys1⤵
-
C:\Temp\ebwuomgezw.sysC:\Temp\ebwuomgezw.sys1⤵
-
C:\Temp\wtolgdbywq.sysC:\Temp\wtolgdbywq.sys1⤵
-
C:\Temp\avtnlfdyvq.sysC:\Temp\avtnlfdyvq.sys1⤵
-
C:\Temp\avsqkicavs.sysC:\Temp\avsqkicavs.sys1⤵
-
C:\Temp\nifdxvsqkf.sysC:\Temp\nifdxvsqkf.sys1⤵
-
C:\Temp\mkicausnkf.sysC:\Temp\mkicausnkf.sys1⤵
-
C:\Temp\jhfzxupmhe.sysC:\Temp\jhfzxupmhe.sys1⤵
-
C:\Temp\pjgezwuomk.sysC:\Temp\pjgezwuomk.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
cztrmkebwu.exe
ebzurmjecz.sys
gbytqomgey.sys
gbywuojgbz.exe
i_cztrmkebwu.exe
i_gbywuojgbz.exe
i_upmhecaurm.exe
i_usmcxuskhc.exe
i_yvtoljdbvt.exe
nhfzxspnkfcxvpnk.exe
nhfzxspnkfcxvpnk.sys
upmhecaurm.exe
usmcxuskhc.exe
xrpjhecaus.sys
yvtoljdbvt.exe
ywqoigbytr.sys
ywromgebwu.sys
2b58efe0-efe0-4289-b9ef-691e06e4b5d4.tmp
5ad11f0f-3c1f-4a34-9685-52a649261510.tmp
67a5fc14-7430-4542-be22-983000959757.tmp
6f9b1852-6f7d-485d-a78f-c77e34a60cb8.tmp
settings.dat
settings.dat
4c005285-1de8-406a-9175-f65c3f1c86a7.tmp
53c337f3-8d13-44c0-992e-0e9b47a06c44.tmp
760d0cc6-0579-436c-a967-49b2430e5c6b.tmp
9ff9160e-1c31-4331-9f37-0c2c6684e29d.tmp
LOG
the-real-index
the-real-index
1e0f5669-5def-4046-81bd-d72f953c0216.tmp
dasherSettingSchema.json
522bf97d-68cc-4c94-9447-ac3ab9243f0f.tmp
Network Persistent State
bc53c584-29fa-4158-b64f-b3d4cfebe4fc.tmp
sync_diagnostic.log
ae59dcb7-63a7-42f3-bd89-e7a35c30024f.tmp
c445ebb3-99d1-42b9-a5a7-b3f8118f70d8.tmp
6f9cc41a-5de6-4455-8ee3-6d1248fd5c67.tmp
OperationConfig
a9377a97-8d3a-49c0-8d58-15063a46b7eb.tmp
4f56b88c-8da6-4805-980b-81f3692aea94.tmp
63929de4-1391-4f7b-8d59-e1877c582a54.tmp
7b20d9b7-881b-4f81-96f5-b846907b0416.tmp
163b9a9e-4cfb-408c-95ab-497b8c465d89.tmp
3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
metadata.json
bf7a6853-2509-41ed-95f4-64baf94ad3bd.tmp
ffb663fe-a6c7-4e60-8d0f-fc4e4acb21d1.tmp
messages.json
content.js
manifest.json
manifest.json
manifest.json
manifest.json
CreateProcess.exe
memory/8-684-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1852-745-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1880-484-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1936-722-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3180-638-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3496-567-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3872-726-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4152-435-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4176-618-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4228-512-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4292-563-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4568-588-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4768-542-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4860-717-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5056-721-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5056-741-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5320-583-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5340-524-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5976-660-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5984-66-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/6088-664-0x0000000000010000-0x00000000000AB000-memory.dmp