Analysis
- max time kernel
149s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
23/10/2026, 10:56
General
- Target 2026-10-23_720a78b9cf378973dbb5ae9dde593350_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 361KB
- Sample261023-m1tstsbs2s
- SHA256 63afcb758bec7bc67a7b0cbaa7faf663fbfa4ed339a13ec1d6ff99eae39e6424
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba
-
http://xytets.com:2345/t.asp?os=home
-
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 43 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
- Suspicious use of AdjustPrivilegeToken 20 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-23_720a78b9cf378973dbb5ae9dde593350_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-23_720a78b9cf378973dbb5ae9dde593350_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\pjecwupmhezxrpjh.exeC:\Temp\pjecwupmhezxrpjh.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mkecwusmhz.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\mkecwusmhz.exeC:\Temp\mkecwusmhz.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mkecwusmhz.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_mkecwusmhz.exeC:\Temp\i_mkecwusmhz.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\kezwuomhez.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\kezwuomhez.exeC:\Temp\kezwuomhez.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_kezwuomhez.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_kezwuomhez.exeC:\Temp\i_kezwuomhez.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bztrljhbyw.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\bztrljhbyw.exeC:\Temp\bztrljhbyw.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bztrljhbyw.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_bztrljhbyw.exeC:\Temp\i_bztrljhbyw.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ebwtqoigby.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ebwtqoigby.exeC:\Temp\ebwtqoigby.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ebwtqoigby.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ebwtqoigby.exeC:\Temp\i_ebwtqoigby.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\dbvtolgdyw.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\dbvtolgdyw.exeC:\Temp\dbvtolgdyw.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_dbvtolgdyw.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_dbvtolgdyw.exeC:\Temp\i_dbvtolgdyw.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\yvqnlfdysq.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\yvqnlfdysq.exeC:\Temp\yvqnlfdysq.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_yvqnlfdysq.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_yvqnlfdysq.exeC:\Temp\i_yvqnlfdysq.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\axspnifaxs.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\axspnifaxs.exeC:\Temp\axspnifaxs.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_axspnifaxs.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_axspnifaxs.exeC:\Temp\i_axspnifaxs.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xspnhfcxus.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\xspnhfcxus.exeC:\Temp\xspnhfcxus.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xspnhfcxus.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_xspnhfcxus.exeC:\Temp\i_xspnhfcxus.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ecxusmkecw.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ecxusmkecw.exeC:\Temp\ecxusmkecw.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ecxusmkecw.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ecxusmkecw.exeC:\Temp\i_ecxusmkecw.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bzxrmjecwu.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\bzxrmjecwu.exeC:\Temp\bzxrmjecwu.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bzxrmjecwu.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_bzxrmjecwu.exeC:\Temp\i_bzxrmjecwu.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bwtrljhezw.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\bwtrljhezw.exeC:\Temp\bwtrljhezw.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bwtrljhezw.exe ups_ins3⤵
-
C:\Temp\i_bwtrljhezw.exeC:\Temp\i_bwtrljhezw.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ojgeywqojg.exe ups_run3⤵
-
C:\Temp\ojgeywqojg.exeC:\Temp\ojgeywqojg.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ojgeywqojg.exe ups_ins3⤵
-
C:\Temp\i_ojgeywqojg.exeC:\Temp\i_ojgeywqojg.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\tqojgbytrl.exe ups_run3⤵
-
C:\Temp\tqojgbytrl.exeC:\Temp\tqojgbytrl.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_tqojgbytrl.exe ups_ins3⤵
-
C:\Temp\i_tqojgbytrl.exeC:\Temp\i_tqojgbytrl.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qligayvtnl.exe ups_run3⤵
-
C:\Temp\qligayvtnl.exeC:\Temp\qligayvtnl.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qligayvtnl.exe ups_ins3⤵
-
C:\Temp\i_qligayvtnl.exeC:\Temp\i_qligayvtnl.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\dxvpnifaxs.exe ups_run3⤵
-
C:\Temp\dxvpnifaxs.exeC:\Temp\dxvpnifaxs.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_dxvpnifaxs.exe ups_ins3⤵
-
C:\Temp\i_dxvpnifaxs.exeC:\Temp\i_dxvpnifaxs.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fdxvhfcxsp.exe ups_run3⤵
-
C:\Temp\fdxvhfcxsp.exeC:\Temp\fdxvhfcxsp.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fdxvhfcxsp.exe ups_ins3⤵
-
C:\Temp\i_fdxvhfcxsp.exeC:\Temp\i_fdxvhfcxsp.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xuspnhfaxs.exe ups_run3⤵
-
C:\Temp\xuspnhfaxs.exeC:\Temp\xuspnhfaxs.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xuspnhfaxs.exe ups_ins3⤵
-
C:\Temp\i_xuspnhfaxs.exeC:\Temp\i_xuspnhfaxs.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\usmkecwusp.exe ups_run3⤵
-
C:\Temp\usmkecwusp.exeC:\Temp\usmkecwusp.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_usmkecwusp.exe ups_ins3⤵
-
C:\Temp\i_usmkecwusp.exeC:\Temp\i_usmkecwusp.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wromgecwuo.exe ups_run3⤵
-
C:\Temp\wromgecwuo.exeC:\Temp\wromgecwuo.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wromgecwuo.exe ups_ins3⤵
-
C:\Temp\i_wromgecwuo.exeC:\Temp\i_wromgecwuo.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ecwuomgezw.exe ups_run3⤵
-
C:\Temp\ecwuomgezw.exeC:\Temp\ecwuomgezw.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ecwuomgezw.exe ups_ins3⤵
-
C:\Temp\i_ecwuomgezw.exeC:\Temp\i_ecwuomgezw.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ffbc023c188,0x7ffbc023c194,0x7ffbc023c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1576,i,2147743523424589434,6325408933712568219,262144 --field-trial-handle=2300,i,1189746684002779416,1003194750371228678,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1884,i,5533674461987666992,8669744364309656981,524288 --field-trial-handle=2300,i,1189746684002779416,1003194750371228678,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2272,i,437001273329409126,10731354584866986148,524288 --field-trial-handle=2300,i,1189746684002779416,1003194750371228678,262144 --variations-seed-version --mojo-platform-channel-handle=3016 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3592,i,2466578704663667273,10775734245629638482,2097152 --field-trial-handle=2300,i,1189746684002779416,1003194750371228678,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3600,i,17699976685682204025,4698341810320180125,2097152 --field-trial-handle=2300,i,1189746684002779416,1003194750371228678,262144 --variations-seed-version --mojo-platform-channel-handle=3732 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4308,i,2372343784606548791,15652040453965947926,2097152 --field-trial-handle=2300,i,1189746684002779416,1003194750371228678,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4328,i,4590634185096221359,2434107752855707416,2097152 --field-trial-handle=2300,i,1189746684002779416,1003194750371228678,262144 --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3668,i,6481682329548645665,11765640723492881602,524288 --field-trial-handle=2300,i,1189746684002779416,1003194750371228678,262144 --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5376,i,4903408141243950968,918835817090824052,524288 --field-trial-handle=2300,i,1189746684002779416,1003194750371228678,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5364,i,1566394325887998619,623045867517169479,524288 --field-trial-handle=2300,i,1189746684002779416,1003194750371228678,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,922821877876153239,464355389490416527,524288 --field-trial-handle=2300,i,1189746684002779416,1003194750371228678,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,922821877876153239,464355389490416527,524288 --field-trial-handle=2300,i,1189746684002779416,1003194750371228678,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6256,i,16090859808430564163,2890686483910463958,524288 --field-trial-handle=2300,i,1189746684002779416,1003194750371228678,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6268,i,17550995965283094016,3357629552867791122,524288 --field-trial-handle=2300,i,1189746684002779416,1003194750371228678,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6564,i,16244693210243725173,2439988318012856272,524288 --field-trial-handle=2300,i,1189746684002779416,1003194750371228678,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6640,i,9133622137811726453,6646566298382105942,524288 --field-trial-handle=2300,i,1189746684002779416,1003194750371228678,262144 --variations-seed-version --mojo-platform-channel-handle=6556 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5192,i,1252546267976398592,15152554694567430541,524288 --field-trial-handle=2300,i,1189746684002779416,1003194750371228678,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5196,i,13337247101131176871,2620492747880648046,524288 --field-trial-handle=2300,i,1189746684002779416,1003194750371228678,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5180,i,4958681623193396776,5740973470016417284,524288 --field-trial-handle=2300,i,1189746684002779416,1003194750371228678,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2920,i,9860911120214988258,6331360720288220005,524288 --field-trial-handle=2300,i,1189746684002779416,1003194750371228678,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6000,i,18412898397895296228,13616324605226800605,524288 --field-trial-handle=2300,i,1189746684002779416,1003194750371228678,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5668,i,1297094360847157114,3005914360946268161,524288 --field-trial-handle=2300,i,1189746684002779416,1003194750371228678,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5480,i,16448094606072707800,1428521524408287853,524288 --field-trial-handle=2300,i,1189746684002779416,1003194750371228678,262144 --variations-seed-version --mojo-platform-channel-handle=932 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5540,i,90102050964935415,2418292491182527655,524288 --field-trial-handle=2300,i,1189746684002779416,1003194750371228678,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6444,i,14362913929081454081,13099674032514991594,524288 --field-trial-handle=2300,i,1189746684002779416,1003194750371228678,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6712,i,4922294972653441433,1812024197776243726,262144 --field-trial-handle=2300,i,1189746684002779416,1003194750371228678,262144 --variations-seed-version --mojo-platform-channel-handle=6772 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2816,i,8082085291080142227,9894647687306052201,524288 --field-trial-handle=2300,i,1189746684002779416,1003194750371228678,262144 --variations-seed-version --mojo-platform-channel-handle=2812 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\pjecwupmhezxrpjh.sysC:\Temp\pjecwupmhezxrpjh.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Temp\rmkecwuomh.sysC:\Temp\rmkecwuomh.sys1⤵
- Executes dropped EXE
-
C:\Temp\gebwuomgez.sysC:\Temp\gebwuomgez.sys1⤵
- Executes dropped EXE
-
C:\Temp\jdbwtrljge.sysC:\Temp\jdbwtrljge.sys1⤵
- Executes dropped EXE
-
C:\Temp\lidbvtnlgd.sysC:\Temp\lidbvtnlgd.sys1⤵
- Executes dropped EXE
-
C:\Temp\yvqnifdxvt.sysC:\Temp\yvqnifdxvt.sys1⤵
- Executes dropped EXE
-
C:\Temp\dxvsnkifay.sysC:\Temp\dxvsnkifay.sys1⤵
- Executes dropped EXE
-
C:\Temp\kicausmkic.sysC:\Temp\kicausmkic.sys1⤵
- Executes dropped EXE
-
C:\Temp\iczxupnkfc.sysC:\Temp\iczxupnkfc.sys1⤵
- Executes dropped EXE
-
C:\Temp\khczusmkec.sysC:\Temp\khczusmkec.sys1⤵
- Executes dropped EXE
-
C:\Temp\bztrljhbzw.sysC:\Temp\bztrljhbzw.sys1⤵
- Executes dropped EXE
-
C:\Temp\qomjhbzwuo.sysC:\Temp\qomjhbzwuo.sys1⤵
-
C:\Temp\ywqojgbzto.sysC:\Temp\ywqojgbzto.sys1⤵
-
C:\Temp\nligayvqnl.sysC:\Temp\nligayvqnl.sys1⤵
-
C:\Temp\fvpnkidays.sysC:\Temp\fvpnkidays.sys1⤵
-
C:\Temp\ifdysqnifa.sysC:\Temp\ifdysqnifa.sys1⤵
-
C:\Temp\axspnhfcxu.sysC:\Temp\axspnhfcxu.sys1⤵
-
C:\Temp\xupnhfzxrp.sysC:\Temp\xupnhfzxrp.sys1⤵
-
C:\Temp\cwuomjhfzo.sysC:\Temp\cwuomjhfzo.sys1⤵
-
C:\Temp\gecwuomgey.sysC:\Temp\gecwuomgey.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
bztrljhbyw.exe
dbvtolgdyw.exe
ebwtqoigby.exe
gebwuomgez.sys
i_bztrljhbyw.exe
i_dbvtolgdyw.exe
i_ebwtqoigby.exe
i_kezwuomhez.exe
i_mkecwusmhz.exe
jdbwtrljge.sys
kezwuomhez.exe
lidbvtnlgd.sys
mkecwusmhz.exe
pjecwupmhezxrpjh.exe
pjecwupmhezxrpjh.sys
rmkecwuomh.sys
yvqnifdxvt.sys
yvqnlfdysq.exe
0e2c3167-d51b-4316-8c70-d50d6d6ef51e.tmp
7782e81e-cda2-4f51-b983-6b1b5e3b2028.tmp
8bafe054-991f-453f-be2e-1a6c62475c0e.tmp
97669e45-1ec5-46b5-b15b-d72e0fbb188d.tmp
settings.dat
settings.dat
70f057ef-4274-425e-8742-92fc6940519a.tmp
806789da-e6d7-41f3-9f2a-577a3015f50c.tmp
8db0defa-64ab-4796-b1de-ca9a29c0ae30.tmp
987db658-f3b2-45a8-ac92-e3eb3cfe20d5.tmp
LOG.old
LOG.old
temp-index
the-real-index
9685e79f-4424-40b6-b234-b25fcc58ccbb.tmp
dasherSettingSchema.json
1a61e8d2-542c-43a0-b89d-ed7a993289c6.tmp
8c61d945-f9d5-46f5-9038-90588d21aec6.tmp
fc9574cb-7f5d-4073-98bf-827a2708e6f0.tmp
fe6753fa-7908-4c7e-bf3f-4977f3e69792.tmp
b8175c90-4fa0-4726-98b5-46590fabf6d0.tmp
07418fcf-a0a4-46db-aa2e-bd70a8ae8722.tmp
41ccc9e8-d420-4414-b92c-005eb2ad511d.tmp
8dccd8f4-6e55-4e78-8506-a688ca6746f4.tmp
d1e80e84-bfcd-4241-8ee4-a492705b58ca.tmp
e1bf8205-b165-4beb-ad8b-8a0e9d94bace.tmp
3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
fefaa951-af8c-4b64-87db-317c53365fba.tmp
metadata.json
2da95147-de1b-44e4-b585-a3309d415ad6.tmp
f06153c8-a9c7-4fd2-aadf-5d36b2427987.tmp
content.js
messages.json
manifest.json
manifest.json
manifest.json
manifest.json
CreateProcess.exe
memory/356-433-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/688-703-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/688-709-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1236-730-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1328-708-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2364-630-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2420-66-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3140-534-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3140-559-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3256-644-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3400-734-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3556-522-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3816-588-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3948-510-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4152-618-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5016-482-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5152-578-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5440-671-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5860-691-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5868-752-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5944-557-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/6044-562-0x0000000000010000-0x00000000000AB000-memory.dmp