Analysis
- max time kernel
149s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
24/10/2026, 07:45
General
- Target 2026-10-22_7a60d763c7114bd0c6cf389267e69795_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 376KB
- Sample261024-jlv6kas1cs
- SHA256 0cd4367d21eae674407c95f5993419347e07ab8ea7045aa66d2c3a5d37a4e362
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba
-
http://xytets.com:2345/t.asp?os=home
-
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-22_7a60d763c7114bd0c6cf389267e69795_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7a60d763c7114bd0c6cf389267e69795_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\qlidbvtnlfdyvqoi.exeC:\Temp\qlidbvtnlfdyvqoi.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nlgdbvtnld.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\nlgdbvtnld.exeC:\Temp\nlgdbvtnld.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nlgdbvtnld.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_nlgdbvtnld.exeC:\Temp\i_nlgdbvtnld.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nlfdavsnli.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\nlfdavsnli.exeC:\Temp\nlfdavsnli.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nlfdavsnli.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_nlfdavsnli.exeC:\Temp\i_nlfdavsnli.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vpnkicaxvp.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\vpnkicaxvp.exeC:\Temp\vpnkicaxvp.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vpnkicaxvp.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_vpnkicaxvp.exeC:\Temp\i_vpnkicaxvp.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hcausmkecx.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\hcausmkecx.exeC:\Temp\hcausmkecx.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hcausmkecx.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_hcausmkecx.exeC:\Temp\i_hcausmkecx.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rpjhczusmk.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\rpjhczusmk.exeC:\Temp\rpjhczusmk.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rpjhczusmk.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_rpjhczusmk.exeC:\Temp\i_rpjhczusmk.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ezwrpjhbzu.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ezwrpjhbzu.exeC:\Temp\ezwrpjhbzu.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ezwrpjhbzu.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ezwrpjhbzu.exeC:\Temp\i_ezwrpjhbzu.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jdbztrljeb.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\jdbztrljeb.exeC:\Temp\jdbztrljeb.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jdbztrljeb.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_jdbztrljeb.exeC:\Temp\i_jdbztrljeb.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rligebwtql.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\rligebwtql.exeC:\Temp\rligebwtql.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rligebwtql.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_rligebwtql.exeC:\Temp\i_rligebwtql.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ytrlidaytn.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ytrlidaytn.exeC:\Temp\ytrlidaytn.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ytrlidaytn.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ytrlidaytn.exeC:\Temp\i_ytrlidaytn.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\kigayvqnlf.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\kigayvqnlf.exeC:\Temp\kigayvqnlf.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_kigayvqnlf.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_kigayvqnlf.exeC:\Temp\i_kigayvqnlf.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\icausnkfca.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\icausnkfca.exeC:\Temp\icausnkfca.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_icausnkfca.exe ups_ins3⤵
-
C:\Temp\i_icausnkfca.exeC:\Temp\i_icausnkfca.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xvpnkfvpnh.exe ups_run3⤵
-
C:\Temp\xvpnkfvpnh.exeC:\Temp\xvpnkfvpnh.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xvpnkfvpnh.exe ups_ins3⤵
-
C:\Temp\i_xvpnkfvpnh.exeC:\Temp\i_xvpnkfvpnh.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xuspkhczxr.exe ups_run3⤵
-
C:\Temp\xuspkhczxr.exeC:\Temp\xuspkhczxr.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xuspkhczxr.exe ups_ins3⤵
-
C:\Temp\i_xuspkhczxr.exeC:\Temp\i_xuspkhczxr.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xrpjhezxrp.exe ups_run3⤵
-
C:\Temp\xrpjhezxrp.exeC:\Temp\xrpjhezxrp.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xrpjhezxrp.exe ups_ins3⤵
-
C:\Temp\i_xrpjhezxrp.exeC:\Temp\i_xrpjhezxrp.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ztromgbzwr.exe ups_run3⤵
-
C:\Temp\ztromgbzwr.exeC:\Temp\ztromgbzwr.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ztromgbzwr.exe ups_ins3⤵
-
C:\Temp\i_ztromgbzwr.exeC:\Temp\i_ztromgbzwr.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\omgbzwqomg.exe ups_run3⤵
-
C:\Temp\omgbzwqomg.exeC:\Temp\omgbzwqomg.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_omgbzwqomg.exe ups_ins3⤵
-
C:\Temp\i_omgbzwqomg.exeC:\Temp\i_omgbzwqomg.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\lgeywqoljg.exe ups_run3⤵
-
C:\Temp\lgeywqoljg.exeC:\Temp\lgeywqoljg.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_lgeywqoljg.exe ups_ins3⤵
-
C:\Temp\i_lgeywqoljg.exeC:\Temp\i_lgeywqoljg.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qlgayvqoig.exe ups_run3⤵
-
C:\Temp\qlgayvqoig.exeC:\Temp\qlgayvqoig.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qlgayvqoig.exe ups_ins3⤵
-
C:\Temp\i_qlgayvqoig.exeC:\Temp\i_qlgayvqoig.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ayvpnlfdav.exe ups_run3⤵
-
C:\Temp\ayvpnlfdav.exeC:\Temp\ayvpnlfdav.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ayvpnlfdav.exe ups_ins3⤵
-
C:\Temp\i_ayvpnlfdav.exeC:\Temp\i_ayvpnlfdav.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xvpnifdavs.exe ups_run3⤵
-
C:\Temp\xvpnifdavs.exeC:\Temp\xvpnifdavs.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffd7ca2c188,0x7ffd7ca2c194,0x7ffd7ca2c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2092,i,1753029540592517475,5473919136914423722,524288 --field-trial-handle=2608,i,15050098655836710519,12766631556378757620,262144 --variations-seed-version --mojo-platform-channel-handle=2652 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1864,i,719363141037264030,1924529160238547728,262144 --field-trial-handle=2608,i,15050098655836710519,12766631556378757620,262144 --variations-seed-version --mojo-platform-channel-handle=2604 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2452,i,16039016044293945041,18065366287170808881,524288 --field-trial-handle=2608,i,15050098655836710519,12766631556378757620,262144 --variations-seed-version --mojo-platform-channel-handle=2888 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3564,i,8093077959335066482,13753893312101202554,2097152 --field-trial-handle=2608,i,15050098655836710519,12766631556378757620,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3568,i,12322563500841350453,12693436767507938465,2097152 --field-trial-handle=2608,i,15050098655836710519,12766631556378757620,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4292,i,11285494428381353260,13753262378458423311,2097152 --field-trial-handle=2608,i,15050098655836710519,12766631556378757620,262144 --variations-seed-version --mojo-platform-channel-handle=4436 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4388,i,6530161774418084770,15187203762765733600,2097152 --field-trial-handle=2608,i,15050098655836710519,12766631556378757620,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3788,i,2050353589204242338,11754948943883594508,524288 --field-trial-handle=2608,i,15050098655836710519,12766631556378757620,262144 --variations-seed-version --mojo-platform-channel-handle=3760 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3764,i,7243205538978395392,10289572132493021082,2097152 --field-trial-handle=2608,i,15050098655836710519,12766631556378757620,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5484,i,6562489502932806840,217094962206093869,2097152 --field-trial-handle=2608,i,15050098655836710519,12766631556378757620,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5732,i,18149254516822156990,6200634366845820312,524288 --field-trial-handle=2608,i,15050098655836710519,12766631556378757620,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5732,i,18149254516822156990,6200634366845820312,524288 --field-trial-handle=2608,i,15050098655836710519,12766631556378757620,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5516,i,10634500927606222873,5302835561049488968,524288 --field-trial-handle=2608,i,15050098655836710519,12766631556378757620,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5524,i,9795043956016603282,14882419450548442000,524288 --field-trial-handle=2608,i,15050098655836710519,12766631556378757620,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,5876462611551712841,14759327575966840474,524288 --field-trial-handle=2608,i,15050098655836710519,12766631556378757620,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6116,i,7691399102923034353,2634033921431773339,524288 --field-trial-handle=2608,i,15050098655836710519,12766631556378757620,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6908,i,8447994498148824334,3206536165996524970,524288 --field-trial-handle=2608,i,15050098655836710519,12766631556378757620,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3720,i,14074612780585871314,2099393865635386645,524288 --field-trial-handle=2608,i,15050098655836710519,12766631556378757620,262144 --variations-seed-version --mojo-platform-channel-handle=6936 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=5256,i,8537934309820551578,3786395074732486037,2097152 --field-trial-handle=2608,i,15050098655836710519,12766631556378757620,262144 --variations-seed-version --mojo-platform-channel-handle=7072 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4484,i,3637678142623466981,4318546032911215602,524288 --field-trial-handle=2608,i,15050098655836710519,12766631556378757620,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4884,i,7805962872034950816,8147023081871755048,524288 --field-trial-handle=2608,i,15050098655836710519,12766631556378757620,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4384,i,13161858743218146211,1095898079737860171,524288 --field-trial-handle=2608,i,15050098655836710519,12766631556378757620,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1284,i,7965144153602591108,13380239130368019330,524288 --field-trial-handle=2608,i,15050098655836710519,12766631556378757620,262144 --variations-seed-version --mojo-platform-channel-handle=6576 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6308,i,10291717122473906864,14340337897859065362,524288 --field-trial-handle=2608,i,15050098655836710519,12766631556378757620,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4508,i,585303932717479573,122337330392273225,524288 --field-trial-handle=2608,i,15050098655836710519,12766631556378757620,262144 --variations-seed-version --mojo-platform-channel-handle=6748 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6724,i,3661196480017803444,10580527298020229458,524288 --field-trial-handle=2608,i,15050098655836710519,12766631556378757620,262144 --variations-seed-version --mojo-platform-channel-handle=912 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6688,i,10381117984161339963,6206300388271303707,262144 --field-trial-handle=2608,i,15050098655836710519,12766631556378757620,262144 --variations-seed-version --mojo-platform-channel-handle=6892 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1856,i,1284719252340294422,10305160354709161072,524288 --field-trial-handle=2608,i,15050098655836710519,12766631556378757620,262144 --variations-seed-version --mojo-platform-channel-handle=1504 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\qlidbvtnlfdyvqoi.sysC:\Temp\qlidbvtnlfdyvqoi.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Temp\xvqnigayvq.sysC:\Temp\xvqnigayvq.sys1⤵
- Executes dropped EXE
-
C:\Temp\xvsnkicaus.sysC:\Temp\xvsnkicaus.sys1⤵
- Executes dropped EXE
-
C:\Temp\mkfcaxspki.sysC:\Temp\mkfcaxspki.sys1⤵
- Executes dropped EXE
-
C:\Temp\pjhczuspkh.sysC:\Temp\pjhczuspkh.sys1⤵
- Executes dropped EXE
-
C:\Temp\ecwuomjhbz.sysC:\Temp\ecwuomjhbz.sys1⤵
- Executes dropped EXE
-
C:\Temp\jgeywrojhb.sysC:\Temp\jgeywrojhb.sys1⤵
- Executes dropped EXE
-
C:\Temp\toljdbzwuo.sysC:\Temp\toljdbzwuo.sys1⤵
- Executes dropped EXE
-
C:\Temp\bytqolgdyw.sysC:\Temp\bytqolgdyw.sys1⤵
- Executes dropped EXE
-
C:\Temp\tnlidbvtnl.sysC:\Temp\tnlidbvtnl.sys1⤵
- Executes dropped EXE
-
C:\Temp\sqcaxspnlf.sysC:\Temp\sqcaxspnlf.sys1⤵
- Executes dropped EXE
-
C:\Temp\xvsnkfdxvp.sysC:\Temp\xvsnkfdxvp.sys1⤵
-
C:\Temp\xupnkfcaus.sysC:\Temp\xupnkfcaus.sys1⤵
-
C:\Temp\cwupmhezxr.sysC:\Temp\cwupmhezxr.sys1⤵
-
C:\Temp\zwromheczt.sysC:\Temp\zwromheczt.sys1⤵
-
C:\Temp\jhezwrojgb.sysC:\Temp\jhezwrojgb.sys1⤵
-
C:\Temp\ojgeywqojg.sysC:\Temp\ojgeywqojg.sys1⤵
-
C:\Temp\qligaytqlj.sysC:\Temp\qligaytqlj.sys1⤵
-
C:\Temp\qlidbvtnlf.sysC:\Temp\qlidbvtnlf.sys1⤵
-
C:\Temp\ifaysqkida.sysC:\Temp\ifaysqkida.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
hcausmkecx.exe
i_hcausmkecx.exe
i_nlfdavsnli.exe
i_nlgdbvtnld.exe
i_rpjhczusmk.exe
i_vpnkicaxvp.exe
mkfcaxspki.sys
nlfdavsnli.exe
nlgdbvtnld.exe
pjhczuspkh.sys
qlidbvtnlfdyvqoi.exe
qlidbvtnlfdyvqoi.sys
rpjhczusmk.exe
vpnkicaxvp.exe
xvqnigayvq.sys
xvsnkicaus.sys
0aed6b46-9466-4cf8-a081-d1835b16a86c.tmp
2fdbc55e-46cd-45e5-bbf6-9f92f8506e00.tmp
6013239d-924d-42cb-8e87-07bec5805972.tmp
68f4abe5-7281-4c4f-aa3f-18f161f1c481.tmp
89741fb5-88ac-4c0a-8770-d0fa3e9f917d.tmp
12ae4386-8c38-4cbb-a655-3172f376e8ff.tmp
settings.dat
settings.dat
07802a16-e4b5-4830-b4c7-2019eac16b02.tmp
1b3bd238-1e12-491c-918a-3eeee86464a9.tmp
59ac1172-135b-4777-89d5-e828e2802361.tmp
temp-index
the-real-index
a001f1ff-d750-4f74-b4b8-753bd3d013ce.tmp
18c41a5d-d25e-43be-abab-573c7194e16e.tmp
9797dac0-49fc-42a3-8982-311422c1e53e.tmp
b87f8a0e-9886-46d3-a8b3-662b3f0c3d92.tmp
sync_diagnostic.log
da7fc164-ad65-4216-8a40-b2dba5bbfb40.tmp
db826d24-7140-42d1-bb0d-922e044666bd.tmp
e09d64d0-9d73-4795-8c8d-bc9408cb972c.tmp
799a6d2c-749c-4173-9ff1-4304fcf65c02.tmp
OperationConfig
c84e4298-8fed-4dd1-9efa-9d2cd495a908.tmp
022a8599-5be7-44a7-9469-46a1e876d7e3.tmp
0bfac44b-a50b-4946-8c39-4aac35e1a1a4.tmp
43eb4344-753d-414a-93a5-a3d0fd663f3c.tmp
8ca67c9c-0a87-4969-8bbc-10159dab1493.tmp
3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
d690c110-8d00-49dd-969e-b9c40e2a8a4c.tmp
metadata.json
61528781-16f8-406e-b609-ebbd35a2bead.tmp
ec959559-1fa6-42cf-a2b5-cdc88c6de3f5.tmp
messages.json
messages.json
dasherSettingSchema.json
service_worker_bin_prod.js
content.js
manifest.json
manifest.json
manifest.json
manifest.json
CreateProcess.exe
memory/1404-908-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1876-868-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2328-888-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2536-805-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2540-722-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2704-651-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2756-819-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2756-841-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2816-747-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2900-831-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3092-777-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3148-844-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3444-691-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3540-912-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4020-702-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4444-742-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4612-59-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4720-726-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4956-679-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5052-864-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5548-602-0x0000000000010000-0x00000000000AB000-memory.dmp