Analysis
- max time kernel
150s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
24/10/2026, 17:01
General
- Target 2026-10-22_349ec5fa0a374a833f9bbd72d34956d9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 361KB
- Sample261024-vjteqscy6m
- SHA256 014e606f4cc89571dcc8318706a2e7602f2070455e0ac180643f344953f515fc
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba
-
http://xytets.com:2345/t.asp?os=home
-
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-22_349ec5fa0a374a833f9bbd72d34956d9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_349ec5fa0a374a833f9bbd72d34956d9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\igaysqkidavtnlfd.exeC:\Temp\igaysqkidavtnlfd.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\kigayvpnki.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\kigayvpnki.exeC:\Temp\kigayvpnki.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_kigayvpnki.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_kigayvpnki.exeC:\Temp\i_kigayvpnki.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nkfcausnkf.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\nkfcausnkf.exeC:\Temp\nkfcausnkf.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nkfcausnkf.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_nkfcausnkf.exeC:\Temp\i_nkfcausnkf.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hczusmkecx.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\hczusmkecx.exeC:\Temp\hczusmkecx.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hczusmkecx.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_hczusmkecx.exeC:\Temp\i_hczusmkecx.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\heztrpjhbz.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\heztrpjhbz.exeC:\Temp\heztrpjhbz.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_heztrpjhbz.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_heztrpjhbz.exeC:\Temp\i_heztrpjhbz.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\omgecwurmj.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\omgecwurmj.exeC:\Temp\omgecwurmj.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_omgecwurmj.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_omgecwurmj.exeC:\Temp\i_omgecwurmj.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wtrljgbywt.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\wtrljgbywt.exeC:\Temp\wtrljgbywt.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wtrljgbywt.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_wtrljgbywt.exeC:\Temp\i_wtrljgbywt.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\trljdbvtol.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\trljdbvtol.exeC:\Temp\trljdbvtol.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_trljdbvtol.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_trljdbvtol.exeC:\Temp\i_trljdbvtol.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\yvqnlfdayv.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\yvqnlfdayv.exeC:\Temp\yvqnlfdayv.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_yvqnlfdayv.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_yvqnlfdayv.exeC:\Temp\i_yvqnlfdayv.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\igayvqnifa.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\igayvqnifa.exeC:\Temp\igayvqnifa.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_igayvqnifa.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_igayvqnifa.exeC:\Temp\i_igayvqnifa.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xusnhfdxvp.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\xusnhfdxvp.exeC:\Temp\xusnhfdxvp.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xusnhfdxvp.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_xusnhfdxvp.exeC:\Temp\i_xusnhfdxvp.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\spnhfzxusm.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\spnhfzxusm.exeC:\Temp\spnhfzxusm.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_spnhfzxusm.exe ups_ins3⤵
-
C:\Temp\i_spnhfzxusm.exeC:\Temp\i_spnhfzxusm.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zxupmhezxr.exe ups_run3⤵
-
C:\Temp\zxupmhezxr.exeC:\Temp\zxupmhezxr.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zxupmhezxr.exe ups_ins3⤵
-
C:\Temp\i_zxupmhezxr.exeC:\Temp\i_zxupmhezxr.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zxrpjhbzur.exe ups_run3⤵
-
C:\Temp\zxrpjhbzur.exeC:\Temp\zxrpjhbzur.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zxrpjhbzur.exe ups_ins3⤵
-
C:\Temp\i_zxrpjhbzur.exeC:\Temp\i_zxrpjhbzur.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\trljebwtrm.exe ups_run3⤵
-
C:\Temp\trljebwtrm.exeC:\Temp\trljebwtrm.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_trljebwtrm.exe ups_ins3⤵
-
C:\Temp\i_trljebwtrm.exeC:\Temp\i_trljebwtrm.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\omgebvtolg.exe ups_run3⤵
-
C:\Temp\omgebvtolg.exeC:\Temp\omgebvtolg.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_omgebvtolg.exe ups_ins3⤵
-
C:\Temp\i_omgebvtolg.exeC:\Temp\i_omgebvtolg.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vtndbvtnlg.exe ups_run3⤵
-
C:\Temp\vtndbvtnlg.exeC:\Temp\vtndbvtnlg.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vtndbvtnlg.exe ups_ins3⤵
-
C:\Temp\i_vtndbvtnlg.exeC:\Temp\i_vtndbvtnlg.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bvtnlfdxvs.exe ups_run3⤵
-
C:\Temp\bvtnlfdxvs.exeC:\Temp\bvtnlfdxvs.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bvtnlfdxvs.exe ups_ins3⤵
-
C:\Temp\i_bvtnlfdxvs.exeC:\Temp\i_bvtnlfdxvs.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\tnkicavsqn.exe ups_run3⤵
-
C:\Temp\tnkicavsqn.exeC:\Temp\tnkicavsqn.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_tnkicavsqn.exe ups_ins3⤵
-
C:\Temp\i_tnkicavsqn.exeC:\Temp\i_tnkicavsqn.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ausnkfdxvp.exe ups_run3⤵
-
C:\Temp\ausnkfdxvp.exeC:\Temp\ausnkfdxvp.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ausnkfdxvp.exe ups_ins3⤵
-
C:\Temp\i_ausnkfdxvp.exeC:\Temp\i_ausnkfdxvp.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hczxvsmkhf.exe ups_run3⤵
-
C:\Temp\hczxvsmkhf.exeC:\Temp\hczxvsmkhf.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hczxvsmkhf.exe ups_ins3⤵
-
C:\Temp\i_hczxvsmkhf.exeC:\Temp\i_hczxvsmkhf.exe ups_ins4⤵
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x368,0x7ffd9fc5c188,0x7ffd9fc5c194,0x7ffd9fc5c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1868,i,17758317710705977337,9619766647204515977,524288 --field-trial-handle=2732,i,13502620578939890684,10759483552920388404,262144 --variations-seed-version --mojo-platform-channel-handle=2804 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1600,i,10431160146779329343,2098458756845697925,262144 --field-trial-handle=2732,i,13502620578939890684,10759483552920388404,262144 --variations-seed-version --mojo-platform-channel-handle=2728 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2220,i,5390866403392951378,606955154487918897,524288 --field-trial-handle=2732,i,13502620578939890684,10759483552920388404,262144 --variations-seed-version --mojo-platform-channel-handle=3024 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3544,i,12569678218294008983,13812295247696284911,2097152 --field-trial-handle=2732,i,13502620578939890684,10759483552920388404,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3596,i,1508373348822401207,16485161716169992107,2097152 --field-trial-handle=2732,i,13502620578939890684,10759483552920388404,262144 --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4320,i,16342947269076955369,16630037591562720294,2097152 --field-trial-handle=2732,i,13502620578939890684,10759483552920388404,262144 --variations-seed-version --mojo-platform-channel-handle=4420 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4344,i,12152377656371244418,9194339242363527287,2097152 --field-trial-handle=2732,i,13502620578939890684,10759483552920388404,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3828,i,8536231668118423335,241744871050250881,524288 --field-trial-handle=2732,i,13502620578939890684,10759483552920388404,262144 --variations-seed-version --mojo-platform-channel-handle=3856 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5416,i,18338230089897059556,9907498629617491652,524288 --field-trial-handle=2732,i,13502620578939890684,10759483552920388404,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5404,i,3260480650518819482,2163036486932653819,524288 --field-trial-handle=2732,i,13502620578939890684,10759483552920388404,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6124,i,15399803666680953779,5261576148788067713,524288 --field-trial-handle=2732,i,13502620578939890684,10759483552920388404,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6124,i,15399803666680953779,5261576148788067713,524288 --field-trial-handle=2732,i,13502620578939890684,10759483552920388404,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6316,i,12909645217908041740,2457633534595357986,524288 --field-trial-handle=2732,i,13502620578939890684,10759483552920388404,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6468,i,15701087935230480416,9179116639386344723,524288 --field-trial-handle=2732,i,13502620578939890684,10759483552920388404,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6624,i,1231861386550553473,18368963340352497512,2097152 --field-trial-handle=2732,i,13502620578939890684,10759483552920388404,262144 --variations-seed-version --mojo-platform-channel-handle=6620 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5252,i,15989796322011771601,1092515773444113962,524288 --field-trial-handle=2732,i,13502620578939890684,10759483552920388404,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6300,i,16081607214969181420,3439610862814969926,524288 --field-trial-handle=2732,i,13502620578939890684,10759483552920388404,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6556,i,912828766950448527,11535205631476661073,2097152 --field-trial-handle=2732,i,13502620578939890684,10759483552920388404,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6772,i,2682847027054319744,5146533992545142768,2097152 --field-trial-handle=2732,i,13502620578939890684,10759483552920388404,262144 --variations-seed-version --mojo-platform-channel-handle=6756 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4704,i,2780317545737926302,7584305723505752666,524288 --field-trial-handle=2732,i,13502620578939890684,10759483552920388404,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6124,i,7584536796173612414,13884115923049789229,524288 --field-trial-handle=2732,i,13502620578939890684,10759483552920388404,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6200,i,2699998336977880336,10740627600976453470,524288 --field-trial-handle=2732,i,13502620578939890684,10759483552920388404,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5684,i,14381156293906936855,12999166475127152310,524288 --field-trial-handle=2732,i,13502620578939890684,10759483552920388404,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6068,i,3588559675525179301,17029569828853499641,524288 --field-trial-handle=2732,i,13502620578939890684,10759483552920388404,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6688,i,8980237008903523358,16799803592173130616,524288 --field-trial-handle=2732,i,13502620578939890684,10759483552920388404,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6944,i,8245656603668585302,16600173784075180809,524288 --field-trial-handle=2732,i,13502620578939890684,10759483552920388404,262144 --variations-seed-version --mojo-platform-channel-handle=7032 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6044,i,12023874491688546443,12013258389996740419,262144 --field-trial-handle=2732,i,13502620578939890684,10759483552920388404,262144 --variations-seed-version --mojo-platform-channel-handle=6852 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3488,i,14400973351199621968,9540614677735470763,524288 --field-trial-handle=2732,i,13502620578939890684,10759483552920388404,262144 --variations-seed-version --mojo-platform-channel-handle=2620 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\igaysqkidavtnlfd.sysC:\Temp\igaysqkidavtnlfd.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Temp\sqkicxusmk.sysC:\Temp\sqkicxusmk.sys1⤵
- Executes dropped EXE
-
C:\Temp\hfcxupmkfc.sysC:\Temp\hfcxupmkfc.sys1⤵
- Executes dropped EXE
-
C:\Temp\khczwupmke.sysC:\Temp\khczwupmke.sys1⤵
- Executes dropped EXE
-
C:\Temp\pjhbztrpjh.sysC:\Temp\pjhbztrpjh.sys1⤵
- Executes dropped EXE
-
C:\Temp\trojgebwro.sysC:\Temp\trojgebwro.sys1⤵
- Executes dropped EXE
-
C:\Temp\ywqoigaytq.sysC:\Temp\ywqoigaytq.sys1⤵
- Executes dropped EXE
-
C:\Temp\gdbvtnlgdy.sysC:\Temp\gdbvtnlgdy.sys1⤵
- Executes dropped EXE
-
C:\Temp\daysqoifax.sysC:\Temp\daysqoifax.sys1⤵
- Executes dropped EXE
-
C:\Temp\dxvpnhfaxv.sysC:\Temp\dxvpnhfaxv.sys1⤵
- Executes dropped EXE
-
C:\Temp\spkicaxrpn.sysC:\Temp\spkicaxrpn.sys1⤵
- Executes dropped EXE
-
C:\Temp\hczxrpnhfz.sysC:\Temp\hczxrpnhfz.sys1⤵
-
C:\Temp\bzxupmhezw.sysC:\Temp\bzxupmhezw.sys1⤵
-
C:\Temp\wuomjebwuo.sysC:\Temp\wuomjebwuo.sys1⤵
-
C:\Temp\zojgeywqoj.sysC:\Temp\zojgeywqoj.sys1⤵
-
C:\Temp\trligdywqo.sysC:\Temp\trligdywqo.sys1⤵
-
C:\Temp\vtqlidbvtq.sysC:\Temp\vtqlidbvtq.sys1⤵
-
C:\Temp\sqnifdxsqk.sysC:\Temp\sqnifdxsqk.sys1⤵
-
C:\Temp\icaxsqkica.sysC:\Temp\icaxsqkica.sys1⤵
-
C:\Temp\nkfcxvpnhf.sysC:\Temp\nkfcxvpnhf.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
hczusmkecx.exe
heztrpjhbz.exe
hfcxupmkfc.sys
i_hczusmkecx.exe
i_heztrpjhbz.exe
i_kigayvpnki.exe
i_nkfcausnkf.exe
i_omgecwurmj.exe
igaysqkidavtnlfd.exe
igaysqkidavtnlfd.sys
khczwupmke.sys
kigayvpnki.exe
nkfcausnkf.exe
omgecwurmj.exe
pjhbztrpjh.sys
sqkicxusmk.sys
trojgebwro.sys
053e1bed-b9c5-4c71-8faf-53e362340d44.tmp
0681999a-2a94-40d7-920a-ab7981b84018.tmp
0f6a3c61-8e2f-4927-8364-bd18ee7552cf.tmp
33e8a803-db95-4175-b786-a178a62a5582.tmp
settings.dat
settings.dat
14aab380-3953-4c6e-825a-f036125d151c.tmp
4214f519-5c7e-490d-bd4e-213b1eda1271.tmp
temp-index
the-real-index
e59cc652-1b22-4521-86b0-369e1c8beeb5.tmp
dasherSettingSchema.json
08b2be19-12d2-46a3-a304-f016997c2aeb.tmp
7c04f142-f307-43c4-94cc-ad48cab02870.tmp
8665a8a9-0973-4f0d-86fb-2dbec6355adf.tmp
b38adf42-e8fd-4254-9cd3-2f4a271aaa0a.tmp
c5706cc9-8d94-4296-a539-7ff4cd9dd4f8.tmp
c9607d72-2b2e-4165-8dc6-de68fef01aa4.tmp
6e1be9ac-22cc-415a-8c5a-ff3397e80cbe.tmp
OperationConfig
5bcba906-b3e2-4b46-bafd-923737361af6.tmp
ece84981-d742-4b8c-8d8f-9e74177b9823.tmp
fd1656be-5b28-4501-aa12-183f97f9874c.tmp
2b701d48-e40e-422c-ad30-3fe350462419.tmp
3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
b7401335-a6a6-499b-9f4f-edaab1652e0b.tmp
f0be9c41-2470-4ffd-90a9-3a0f38acae9a.tmp
f79e2f93-e370-4441-9c1d-aab246b40df4.tmp
172d3dd3-6537-4eab-a891-d378dac4c018.tmp
ebd28278-cda0-46ff-83c2-cba4d75d4ed0.tmp
messages.json
content.js
manifest.json
manifest.json
manifest.json
manifest.json
CreateProcess.exe
memory/472-687-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/776-559-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/796-582-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/796-613-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/892-637-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1848-432-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2492-555-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2492-561-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3012-709-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3220-731-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4196-659-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4488-534-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4568-510-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4704-683-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4704-713-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4704-733-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4764-467-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4764-66-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4980-625-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5392-522-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5444-612-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5740-482-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/6092-671-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/6092-576-0x0000000000010000-0x00000000000AB000-memory.dmp