Analysis
- max time kernel
150s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
24/10/2026, 02:11
General
- Target 2026-10-22_a3725eaf3ad22c97a4dd6e5d2e9918d4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 361KB
- Sample261024-cmd54shs4m
- SHA256 7a09fb815b53d9721d9f375aae15012e1f22c6807e476fa1b2bb0bfe110edf99
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba
-
http://xytets.com:2345/t.asp?os=home
-
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 43 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
- Suspicious use of AdjustPrivilegeToken 20 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-22_a3725eaf3ad22c97a4dd6e5d2e9918d4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_a3725eaf3ad22c97a4dd6e5d2e9918d4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\jecwuomgezwugeyw.exeC:\Temp\jecwuomgezwugeyw.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jdbztojhwq.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\jdbztojhwq.exeC:\Temp\jdbztojhwq.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jdbztojhwq.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_jdbztojhwq.exeC:\Temp\i_jdbztojhwq.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wtomdbztro.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\wtomdbztro.exeC:\Temp\wtomdbztro.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wtomdbztro.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_wtomdbztro.exeC:\Temp\i_wtomdbztro.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\tolgeywqnl.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\tolgeywqnl.exeC:\Temp\tolgeywqnl.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_tolgeywqnl.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_tolgeywqnl.exeC:\Temp\i_tolgeywqnl.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qnlfdavtnl.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\qnlfdavtnl.exeC:\Temp\qnlfdavtnl.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qnlfdavtnl.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_qnlfdavtnl.exeC:\Temp\i_qnlfdavtnl.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pnifdxvpni.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\pnifdxvpni.exeC:\Temp\pnifdxvpni.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pnifdxvpni.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_pnifdxvpni.exeC:\Temp\i_pnifdxvpni.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\smkifaxvsn.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\smkifaxvsn.exeC:\Temp\smkifaxvsn.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_smkifaxvsn.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_smkifaxvsn.exeC:\Temp\i_smkifaxvsn.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\usmkhcaxsp.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\usmkhcaxsp.exeC:\Temp\usmkhcaxsp.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_usmkhcaxsp.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_usmkhcaxsp.exeC:\Temp\i_usmkhcaxsp.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\czurmkecwu.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\czurmkecwu.exeC:\Temp\czurmkecwu.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_czurmkecwu.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_czurmkecwu.exeC:\Temp\i_czurmkecwu.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jhbztrljeb.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\jhbztrljeb.exeC:\Temp\jhbztrljeb.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jhbztrljeb.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_jhbztrljeb.exeC:\Temp\i_jhbztrljeb.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\urljebwuom.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\urljebwuom.exeC:\Temp\urljebwuom.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_urljebwuom.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_urljebwuom.exeC:\Temp\i_urljebwuom.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\oljdbztrlj.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\oljdbztrlj.exeC:\Temp\oljdbztrlj.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_oljdbztrlj.exe ups_ins3⤵
-
C:\Temp\i_oljdbztrlj.exeC:\Temp\i_oljdbztrlj.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ligayvtnlg.exe ups_run3⤵
-
C:\Temp\ligayvtnlg.exeC:\Temp\ligayvtnlg.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ligayvtnlg.exe ups_ins3⤵
-
C:\Temp\i_ligayvtnlg.exeC:\Temp\i_ligayvtnlg.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nkidavtnlf.exe ups_run3⤵
-
C:\Temp\nkidavtnlf.exeC:\Temp\nkidavtnlf.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nkidavtnlf.exe ups_ins3⤵
-
C:\Temp\i_nkidavtnlf.exeC:\Temp\i_nkidavtnlf.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qnifaxsqki.exe ups_run3⤵
-
C:\Temp\qnifaxsqki.exeC:\Temp\qnifaxsqki.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qnifaxsqki.exe ups_ins3⤵
-
C:\Temp\i_qnifaxsqki.exeC:\Temp\i_qnifaxsqki.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\spkicaxspk.exe ups_run3⤵
-
C:\Temp\spkicaxspk.exeC:\Temp\spkicaxspk.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_spkicaxspk.exe ups_ins3⤵
-
C:\Temp\i_spkicaxspk.exeC:\Temp\i_spkicaxspk.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\usmkhfzxup.exe ups_run3⤵
-
C:\Temp\usmkhfzxup.exeC:\Temp\usmkhfzxup.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_usmkhfzxup.exe ups_ins3⤵
-
C:\Temp\i_usmkhfzxup.exeC:\Temp\i_usmkhfzxup.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\cwurpjhczp.exe ups_run3⤵
-
C:\Temp\cwurpjhczp.exeC:\Temp\cwurpjhczp.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_cwurpjhczp.exe ups_ins3⤵
-
C:\Temp\i_cwurpjhczp.exeC:\Temp\i_cwurpjhczp.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wurmjhbztr.exe ups_run3⤵
-
C:\Temp\wurmjhbztr.exeC:\Temp\wurmjhbztr.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wurmjhbztr.exe ups_ins3⤵
-
C:\Temp\i_wurmjhbztr.exeC:\Temp\i_wurmjhbztr.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zwtolgdbyw.exe ups_run3⤵
-
C:\Temp\zwtolgdbyw.exeC:\Temp\zwtolgdbyw.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zwtolgdbyw.exe ups_ins3⤵
-
C:\Temp\i_zwtolgdbyw.exeC:\Temp\i_zwtolgdbyw.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\dbvtolgeyt.exe ups_run3⤵
-
C:\Temp\dbvtolgeyt.exeC:\Temp\dbvtolgeyt.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_dbvtolgeyt.exe ups_ins3⤵
-
C:\Temp\i_dbvtolgeyt.exeC:\Temp\i_dbvtolgeyt.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffb08a0c188,0x7ffb08a0c194,0x7ffb08a0c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1952,i,4013358334055870396,17434054401722731071,262144 --field-trial-handle=2528,i,17187787008880048075,7205041407687572604,262144 --variations-seed-version --mojo-platform-channel-handle=2524 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2056,i,10202020377700686754,16398641284826351310,524288 --field-trial-handle=2528,i,17187787008880048075,7205041407687572604,262144 --variations-seed-version --mojo-platform-channel-handle=2604 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2532,i,15898173658481678382,1369115285362452789,524288 --field-trial-handle=2528,i,17187787008880048075,7205041407687572604,262144 --variations-seed-version --mojo-platform-channel-handle=3200 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3576,i,3494634282742455480,8506664169827602258,2097152 --field-trial-handle=2528,i,17187787008880048075,7205041407687572604,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3580,i,9638980681671875260,2089551628118093588,2097152 --field-trial-handle=2528,i,17187787008880048075,7205041407687572604,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4260,i,969147958934729548,2200956944678631189,2097152 --field-trial-handle=2528,i,17187787008880048075,7205041407687572604,262144 --variations-seed-version --mojo-platform-channel-handle=4832 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4280,i,3740681336763781272,11059509523684664543,2097152 --field-trial-handle=2528,i,17187787008880048075,7205041407687572604,262144 --variations-seed-version --mojo-platform-channel-handle=4892 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5276,i,7781164904208357559,17689297675998199815,524288 --field-trial-handle=2528,i,17187787008880048075,7205041407687572604,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5340,i,13334646615623199350,4809150914946546824,2097152 --field-trial-handle=2528,i,17187787008880048075,7205041407687572604,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5192,i,10005747932747977427,4666202067968221018,524288 --field-trial-handle=2528,i,17187787008880048075,7205041407687572604,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5164,i,8542601187360636380,1255070220179977928,524288 --field-trial-handle=2528,i,17187787008880048075,7205041407687572604,262144 --variations-seed-version --mojo-platform-channel-handle=3864 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5808,i,11377554908904373322,2497554246192247582,2097152 --field-trial-handle=2528,i,17187787008880048075,7205041407687572604,262144 --variations-seed-version --mojo-platform-channel-handle=3832 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6272,i,8852827328653789584,2582019975539297627,524288 --field-trial-handle=2528,i,17187787008880048075,7205041407687572604,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6272,i,8852827328653789584,2582019975539297627,524288 --field-trial-handle=2528,i,17187787008880048075,7205041407687572604,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6448,i,6764291908641254503,11540204974418092114,524288 --field-trial-handle=2528,i,17187787008880048075,7205041407687572604,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6576,i,14751926802135937276,1358612823280945837,524288 --field-trial-handle=2528,i,17187787008880048075,7205041407687572604,262144 --variations-seed-version --mojo-platform-channel-handle=6584 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5004,i,15270731986004202,5409387377905630207,524288 --field-trial-handle=2528,i,17187787008880048075,7205041407687572604,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6536,i,17416102209593705562,4794398823250420965,524288 --field-trial-handle=2528,i,17187787008880048075,7205041407687572604,262144 --variations-seed-version --mojo-platform-channel-handle=4832 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1412,i,6126530168884200129,1215336545458864430,524288 --field-trial-handle=2528,i,17187787008880048075,7205041407687572604,262144 --variations-seed-version --mojo-platform-channel-handle=1268 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1424,i,12328763324267425891,9731463715146618964,524288 --field-trial-handle=2528,i,17187787008880048075,7205041407687572604,262144 --variations-seed-version --mojo-platform-channel-handle=1272 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1432,i,15944486402966689721,7246147181925601990,524288 --field-trial-handle=2528,i,17187787008880048075,7205041407687572604,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,12392024532826226137,9727399885362709659,524288 --field-trial-handle=2528,i,17187787008880048075,7205041407687572604,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1456,i,18046190854518775409,13080610369655828411,524288 --field-trial-handle=2528,i,17187787008880048075,7205041407687572604,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5612,i,8496008580125246279,14240989546317167230,524288 --field-trial-handle=2528,i,17187787008880048075,7205041407687572604,262144 --variations-seed-version --mojo-platform-channel-handle=3396 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1456,i,14126935470647972358,17627420883156984945,524288 --field-trial-handle=2528,i,17187787008880048075,7205041407687572604,262144 --variations-seed-version --mojo-platform-channel-handle=6504 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6264,i,16730951712545993869,2344880734065568568,262144 --field-trial-handle=2528,i,17187787008880048075,7205041407687572604,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3544,i,10468384152273187733,4427724509164546819,524288 --field-trial-handle=2528,i,17187787008880048075,7205041407687572604,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\jecwuomgezwugeyw.sysC:\Temp\jecwuomgezwugeyw.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Temp\bztrljdbwt.sysC:\Temp\bztrljdbwt.sys1⤵
- Executes dropped EXE
-
C:\Temp\vtnlgdywqo.sysC:\Temp\vtnlgdywqo.sys1⤵
- Executes dropped EXE
-
C:\Temp\ligayvtnli.sysC:\Temp\ligayvtnli.sys1⤵
- Executes dropped EXE
-
C:\Temp\davsnlfdxv.sysC:\Temp\davsnlfdxv.sys1⤵
- Executes dropped EXE
-
C:\Temp\sqkicaxspn.sysC:\Temp\sqkicaxspn.sys1⤵
- Executes dropped EXE
-
C:\Temp\usmkecausp.sysC:\Temp\usmkecausp.sys1⤵
- Executes dropped EXE
-
C:\Temp\bzurmkecwu.sysC:\Temp\bzurmkecwu.sys1⤵
- Executes dropped EXE
-
C:\Temp\omkhcztrom.sysC:\Temp\omkhcztrom.sys1⤵
- Executes dropped EXE
-
C:\Temp\trpjhbztrm.sysC:\Temp\trpjhbztrm.sys1⤵
- Executes dropped EXE
-
C:\Temp\qoigbytrlj.sysC:\Temp\qoigbytrlj.sys1⤵
- Executes dropped EXE
-
C:\Temp\ljdaysqolg.sysC:\Temp\ljdaysqolg.sys1⤵
-
C:\Temp\ysqlidbvtq.sysC:\Temp\ysqlidbvtq.sys1⤵
-
C:\Temp\sqnifaxsqk.sysC:\Temp\sqnifaxsqk.sys1⤵
-
C:\Temp\xspnhfzxsp.sysC:\Temp\xspnhfzxsp.sys1⤵
-
C:\Temp\cxvpnhxrpm.sysC:\Temp\cxvpnhxrpm.sys1⤵
-
C:\Temp\cwuomkeczu.sysC:\Temp\cwuomkeczu.sys1⤵
-
C:\Temp\ezwrpjhbzt.sysC:\Temp\ezwrpjhbzt.sys1⤵
-
C:\Temp\eywrojgbyw.sysC:\Temp\eywrojgbyw.sys1⤵
-
C:\Temp\jgebwtolge.sysC:\Temp\jgebwtolge.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
bztrljdbwt.sys
davsnlfdxv.sys
i_jdbztojhwq.exe
i_pnifdxvpni.exe
i_qnlfdavtnl.exe
i_tolgeywqnl.exe
i_wtomdbztro.exe
jdbztojhwq.exe
jecwuomgezwugeyw.exe
jecwuomgezwugeyw.sys
ligayvtnli.sys
pnifdxvpni.exe
qnlfdavtnl.exe
sqkicaxspn.sys
tolgeywqnl.exe
vtnlgdywqo.sys
wtomdbztro.exe
3a4bc3bd-fc9c-4380-b723-53fc7520697f.tmp
770f221c-78c1-486a-99bb-b46f842bd42b.tmp
968cea56-c6a4-44d8-8bc1-d6ea329d49cd.tmp
settings.dat
settings.dat
00c0a007-ae93-47ee-beb2-cac8d05bb5c6.tmp
539afd8d-005b-4e0f-abab-659063ad8dea.tmp
5b9ffe02-ea94-4617-8dd0-d6d0f88057f7.tmp
temp-index
the-real-index
f9067eae-5117-4da3-b2c9-9f4569523240.tmp
dasherSettingSchema.json
9f1f2d34-65f8-4f8b-b8c5-2e92af967f5d.tmp
e5ebf1fb-5982-457e-958f-c439139f59c1.tmp
e80dc751-7a21-4cd4-96a7-bb8a700a3256.tmp
cf77015d-753e-4c85-b5e5-0225e95067b5.tmp
e2465f57-f3ed-4ef3-b8bf-f2b8e5a52dc5.tmp
OperationConfig
bd6cbf46-b1ad-447f-a644-360a49be9bc4.tmp
a9acbdbe-591d-433e-83de-8e68d9e69268.tmp
b0353626-61ba-4f8a-bc4c-7275fd31a81a.tmp
3e7ee7d5-0b32-4023-9039-a18f2d02cdd2.tmp
8c228ae3-1c68-4822-92a7-7d266ebc68c1.tmp
b4574589-2aaf-41f0-a4f4-dc28ad66b948.tmp
db7fa093-c32e-4151-a4d4-36804fc290e1.tmp
298e9c26-2159-4480-9d4c-682370e69f1a.tmp
3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
metadata.json
3f83a3a4-eb3e-4939-82fc-5f762d5f6029.tmp
de5982b4-cebe-4f9c-a6d3-6759fce970af.tmp
messages.json
content.js
manifest.json
manifest.json
manifest.json
manifest.json
CreateProcess.exe
memory/612-577-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/612-560-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1360-718-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1528-534-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1692-740-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1708-576-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2336-480-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2528-680-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2528-658-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2836-486-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2836-431-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3212-509-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3368-66-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4120-692-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4280-581-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4280-613-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4632-696-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4644-679-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5000-611-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5272-556-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5628-521-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5628-553-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5732-676-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5732-654-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5764-632-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5824-722-0x0000000000010000-0x00000000000AB000-memory.dmp