Analysis
- max time kernel
150s - max time network
145s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
21/10/2026, 03:59
General
- Target 2026-10-19_0df40d6d7600fdceb539b78af14159ae_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
- Size 365KB
- Sample261021-ej63tscw2r
- SHA256 3566831c7d286e6d250c12be8a474c72698bb2574106fa4d4d588a6c3a1310c0
Score
10/10
Malware Config
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 43 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_0df40d6d7600fdceb539b78af14159ae_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-19_0df40d6d7600fdceb539b78af14159ae_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\gaytqljdyvqoigay.exeC:\Temp\gaytqljdyvqoigay.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gayvtnlfdy.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\gayvtnlfdy.exeC:\Temp\gayvtnlfdy.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gayvtnlfdy.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_gayvtnlfdy.exeC:\Temp\i_gayvtnlfdy.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\sqkigaysqk.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\sqkigaysqk.exeC:\Temp\sqkigaysqk.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_sqkigaysqk.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_sqkigaysqk.exeC:\Temp\i_sqkigaysqk.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\icavsqkica.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\icavsqkica.exeC:\Temp\icavsqkica.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_icavsqkica.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_icavsqkica.exeC:\Temp\i_icavsqkica.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zxvsnhfaxs.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\zxvsnhfaxs.exeC:\Temp\zxvsnhfaxs.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zxvsnhfaxs.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_zxvsnhfaxs.exeC:\Temp\i_zxvsnhfaxs.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\spkhczusmk.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\spkhczusmk.exeC:\Temp\spkhczusmk.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_spkhczusmk.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_spkhczusmk.exeC:\Temp\i_spkhczusmk.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mjhczxrpjh.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\mjhczxrpjh.exeC:\Temp\mjhczxrpjh.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mjhczxrpjh.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_mjhczxrpjh.exeC:\Temp\i_mjhczxrpjh.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zurmjebwuo.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\zurmjebwuo.exeC:\Temp\zurmjebwuo.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zurmjebwuo.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_zurmjebwuo.exeC:\Temp\i_zurmjebwuo.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jhbztrljdb.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\jhbztrljdb.exeC:\Temp\jhbztrljdb.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jhbztrljdb.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_jhbztrljdb.exeC:\Temp\i_jhbztrljdb.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ytrljdbvto.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ytrljdbvto.exeC:\Temp\ytrljdbvto.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ytrljdbvto.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ytrljdbvto.exeC:\Temp\i_ytrljdbvto.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\yoigaysqli.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\yoigaysqli.exeC:\Temp\yoigaysqli.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_yoigaysqli.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_yoigaysqli.exeC:\Temp\i_yoigaysqli.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\sqlidaxvtn.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\sqlidaxvtn.exeC:\Temp\sqlidaxvtn.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_sqlidaxvtn.exe ups_ins3⤵
-
C:\Temp\i_sqlidaxvtn.exeC:\Temp\i_sqlidaxvtn.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vsqkicavsn.exe ups_run3⤵
-
C:\Temp\vsqkicavsn.exeC:\Temp\vsqkicavsn.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vsqkicavsn.exe ups_ins3⤵
-
C:\Temp\i_vsqkicavsn.exeC:\Temp\i_vsqkicavsn.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rpkhcausmk.exe ups_run3⤵
-
C:\Temp\rpkhcausmk.exeC:\Temp\rpkhcausmk.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rpkhcausmk.exe ups_ins3⤵
-
C:\Temp\i_rpkhcausmk.exeC:\Temp\i_rpkhcausmk.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zxuspjhfca.exe ups_run3⤵
-
C:\Temp\zxuspjhfca.exeC:\Temp\zxuspjhfca.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zxuspjhfca.exe ups_ins3⤵
-
C:\Temp\i_zxuspjhfca.exeC:\Temp\i_zxuspjhfca.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ezwrpjhbzx.exe ups_run3⤵
-
C:\Temp\ezwrpjhbzx.exeC:\Temp\ezwrpjhbzx.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ezwrpjhbzx.exe ups_ins3⤵
-
C:\Temp\i_ezwrpjhbzx.exeC:\Temp\i_ezwrpjhbzx.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wuomgebztr.exe ups_run3⤵
-
C:\Temp\wuomgebztr.exeC:\Temp\wuomgebztr.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wuomgebztr.exe ups_ins3⤵
-
C:\Temp\i_wuomgebztr.exeC:\Temp\i_wuomgebztr.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bvtrljdbwt.exe ups_run3⤵
-
C:\Temp\bvtrljdbwt.exeC:\Temp\bvtrljdbwt.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bvtrljdbwt.exe ups_ins3⤵
-
C:\Temp\i_bvtrljdbwt.exeC:\Temp\i_bvtrljdbwt.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jdbvtolgdy.exe ups_run3⤵
-
C:\Temp\jdbvtolgdy.exeC:\Temp\jdbvtolgdy.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jdbvtolgdy.exe ups_ins3⤵
-
C:\Temp\i_jdbvtolgdy.exeC:\Temp\i_jdbvtolgdy.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gaysqlidbv.exe ups_run3⤵
-
C:\Temp\gaysqlidbv.exeC:\Temp\gaysqlidbv.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gaysqlidbv.exe ups_ins3⤵
-
C:\Temp\i_gaysqlidbv.exeC:\Temp\i_gaysqlidbv.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\lfdxvqniga.exe ups_run3⤵
-
C:\Temp\lfdxvqniga.exeC:\Temp\lfdxvqniga.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_lfdxvqniga.exe ups_ins3⤵
-
C:\Temp\i_lfdxvqniga.exeC:\Temp\i_lfdxvqniga.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x33c,0x7ff8622bc188,0x7ff8622bc194,0x7ff8622bc1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1664,i,1183561080635619916,10491675552486464221,262144 --field-trial-handle=2436,i,2896179435562263485,9729093426054317137,262144 --variations-seed-version --mojo-platform-channel-handle=2440 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=1896,i,62104157790827818,2534939507669393941,524288 --field-trial-handle=2436,i,2896179435562263485,9729093426054317137,262144 --variations-seed-version --mojo-platform-channel-handle=2476 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=2268,i,3890497708383725606,12577156457150775414,524288 --field-trial-handle=2436,i,2896179435562263485,9729093426054317137,262144 --variations-seed-version --mojo-platform-channel-handle=2968 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3616,i,2685158718899668796,7743038701633945227,2097152 --field-trial-handle=2436,i,2896179435562263485,9729093426054317137,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3612,i,4501439575206929066,15653858847828406703,2097152 --field-trial-handle=2436,i,2896179435562263485,9729093426054317137,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4272,i,11103192875409685278,4477053830932753440,2097152 --field-trial-handle=2436,i,2896179435562263485,9729093426054317137,262144 --variations-seed-version --mojo-platform-channel-handle=4744 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4284,i,16738639426036932140,15616211959384558982,2097152 --field-trial-handle=2436,i,2896179435562263485,9729093426054317137,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=3684,i,16842566996999315220,1442331279460223103,524288 --field-trial-handle=2436,i,2896179435562263485,9729093426054317137,262144 --variations-seed-version --mojo-platform-channel-handle=3844 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5512,i,17559528130617386944,17705742669440788850,524288 --field-trial-handle=2436,i,2896179435562263485,9729093426054317137,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5388,i,9572223439297291455,8927383909827818355,524288 --field-trial-handle=2436,i,2896179435562263485,9729093426054317137,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5992,i,6702346282781094717,3322075244159064782,524288 --field-trial-handle=2436,i,2896179435562263485,9729093426054317137,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5992,i,6702346282781094717,3322075244159064782,524288 --field-trial-handle=2436,i,2896179435562263485,9729093426054317137,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6292,i,14824293954801163641,3199481628595166391,524288 --field-trial-handle=2436,i,2896179435562263485,9729093426054317137,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6316,i,6712155002857665928,17212675952957826794,524288 --field-trial-handle=2436,i,2896179435562263485,9729093426054317137,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6292,i,8636066476071953130,2681705179934054898,524288 --field-trial-handle=2436,i,2896179435562263485,9729093426054317137,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6696,i,15154894537240205871,10102196472095187698,524288 --field-trial-handle=2436,i,2896179435562263485,9729093426054317137,262144 --variations-seed-version --mojo-platform-channel-handle=6504 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=4980,i,8296433708552046130,10236999013258381474,524288 --field-trial-handle=2436,i,2896179435562263485,9729093426054317137,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=4268,i,11127278799214833388,6924700118511928793,524288 --field-trial-handle=2436,i,2896179435562263485,9729093426054317137,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=4936,i,7917341718981980053,5541844858056789598,524288 --field-trial-handle=2436,i,2896179435562263485,9729093426054317137,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5376,i,7277227561055784131,15393536758638722254,524288 --field-trial-handle=2436,i,2896179435562263485,9729093426054317137,262144 --variations-seed-version --mojo-platform-channel-handle=5708 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6312,i,17722217044026298785,9453967412981216205,524288 --field-trial-handle=2436,i,2896179435562263485,9729093426054317137,262144 --variations-seed-version --mojo-platform-channel-handle=6704 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5720,i,13668989242846453677,7842005012426285919,524288 --field-trial-handle=2436,i,2896179435562263485,9729093426054317137,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6500,i,6149294833255027571,17555910349023133608,524288 --field-trial-handle=2436,i,2896179435562263485,9729093426054317137,262144 --variations-seed-version --mojo-platform-channel-handle=5780 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --subproc-heap-profiling --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6500,i,11432557737589735568,3399364739467350134,262144 --field-trial-handle=2436,i,2896179435562263485,9729093426054317137,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=3124,i,13866192283663465068,17822650995614466008,524288 --field-trial-handle=2436,i,2896179435562263485,9729093426054317137,262144 --variations-seed-version --mojo-platform-channel-handle=3116 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\gaytqljdyvqoigay.sysC:\Temp\gaytqljdyvqoigay.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Temp\idbvtnljdb.sysC:\Temp\idbvtnljdb.sys1⤵
- Executes dropped EXE
-
C:\Temp\qkifaxvqni.sysC:\Temp\qkifaxvqni.sys1⤵
- Executes dropped EXE
-
C:\Temp\cavsmkfcxv.sysC:\Temp\cavsmkfcxv.sys1⤵
- Executes dropped EXE
-
C:\Temp\causmkfcxu.sysC:\Temp\causmkfcxu.sys1⤵
- Executes dropped EXE
-
C:\Temp\upmhfzxupm.sysC:\Temp\upmhfzxupm.sys1⤵
- Executes dropped EXE
-
C:\Temp\wromkeczwr.sysC:\Temp\wromkeczwr.sys1⤵
- Executes dropped EXE
-
C:\Temp\jgbztrljdb.sysC:\Temp\jgbztrljdb.sys1⤵
- Executes dropped EXE
-
C:\Temp\lbvtoljdbw.sysC:\Temp\lbvtoljdbw.sys1⤵
- Executes dropped EXE
-
C:\Temp\bvtolgdywq.sysC:\Temp\bvtolgdywq.sys1⤵
- Executes dropped EXE
-
C:\Temp\avtqlfdbvt.sysC:\Temp\avtqlfdbvt.sys1⤵
- Executes dropped EXE
-
C:\Temp\xvpnlicaxv.sysC:\Temp\xvpnlicaxv.sys1⤵
-
C:\Temp\faxsqkiusn.sysC:\Temp\faxsqkiusn.sys1⤵
-
C:\Temp\cxuspkhczu.sysC:\Temp\cxuspkhczu.sys1⤵
-
C:\Temp\mhczurmkec.sysC:\Temp\mhczurmkec.sys1⤵
-
C:\Temp\hbztrmjecw.sysC:\Temp\hbztrmjecw.sys1⤵
-
C:\Temp\gezwtoljgb.sysC:\Temp\gezwtoljgb.sys1⤵
-
C:\Temp\jdbytrljgb.sysC:\Temp\jdbytrljgb.sys1⤵
-
C:\Temp\igdyvqniga.sysC:\Temp\igdyvqniga.sys1⤵
-
C:\Temp\ligaysqkid.sysC:\Temp\ligaysqkid.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
causmkfcxu.sys
cavsmkfcxv.sys
gaytqljdyvqoigay.exe
gaytqljdyvqoigay.sys
gayvtnlfdy.exe
i_gayvtnlfdy.exe
i_icavsqkica.exe
i_spkhczusmk.exe
i_sqkigaysqk.exe
i_zxvsnhfaxs.exe
icavsqkica.exe
idbvtnljdb.sys
mjhczxrpjh.exe
qkifaxvqni.sys
spkhczusmk.exe
sqkigaysqk.exe
upmhfzxupm.sys
zxvsnhfaxs.exe
29408b66-f4ad-493d-8c47-65309a25fd56.tmp
6ee3ab70-0fab-441e-8ca5-ea78021cc5c0.tmp
settings.dat
settings.dat
4b1a6cf5-e5e3-4278-b3c6-2930d343d11e.tmp
97c4549c-a08c-4e0d-aac1-f1ca895271d5.tmp
9e7ebc44-a1e4-43e9-93a8-89fadadef38a.tmp
temp-index
the-real-index
aef230dd-4866-469a-be10-ecc3df2a416f.tmp
dasherSettingSchema.json
7237e987-0f1a-4e88-8ccd-bab9605ec1e9.tmp
85ec624c-2bbb-43fe-b5db-45d7d5f2b9cb.tmp
9070931b-d57b-4ba1-8fb2-0fc86856c20f.tmp
sync_diagnostic.log
d4d84401-a0ee-4add-8e90-815b4a7940ac.tmp
e16de304-22ff-4aa4-a746-4de10a29c15d.tmp
f5bf0ac8-9791-4366-a9a4-0f3e2771db39.tmp
e2ae4466-5ba3-4f6c-8f3d-f755ea9cd865.tmp
a63550c7-dc1f-412f-890b-4c45cb24c0b3.tmp
b978717b-a7c8-424f-aef6-83baafcdfa27.tmp
37f356a9-036c-49e3-ba52-8c2cfd43fc96.tmp
68e21b58-4123-4022-8e68-32198df16112.tmp
ba6efe1f-f9b7-41b0-9c74-5b19350e8e51.tmp
d17cb36b-db1b-45e0-9b63-d26c5ada12e3.tmp
e45f074d-9ebb-47f8-98f9-fd14fee5f641.tmp
3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
e3ee0461-ce81-47e5-9e88-fa82a3a0cecf.tmp
metadata.json
12912e2d-4854-4e33-b13a-8d373ba0a9ec.tmp
9c557f22-53c0-4d08-aef6-08c7988043ae.tmp
content.js
messages.json
manifest.json
manifest.json
manifest.json
manifest.json
CreateProcess.exe
memory/368-524-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1240-661-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1376-581-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2460-615-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2468-487-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2468-432-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2608-711-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2812-627-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3280-585-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3444-734-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3460-686-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3912-674-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4236-482-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4236-517-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4720-560-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4772-663-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4772-641-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4860-511-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4860-525-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4912-716-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5008-467-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5008-64-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5688-690-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5688-713-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5816-562-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5816-538-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/6020-565-0x0000000000010000-0x00000000000AB000-memory.dmp