Analysis
- max time kernel
148s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
27/10/2026, 05:03
General
- Target 2026-10-26_dcc280c26d3b59b7324be3e15edd1d52_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 361KB
- Sample261027-fp4ekaaw9v
- SHA256 b9e5f012a7d65af29d57d83d2f37de36dda9ee637aa409f0ff082a3365c1854c
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba
-
http://xytets.com:2345/t.asp?os=home
-
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-26_dcc280c26d3b59b7324be3e15edd1d52_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-26_dcc280c26d3b59b7324be3e15edd1d52_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\tqljdbvtnlgdywqo.exeC:\Temp\tqljdbvtnlgdywqo.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\tqlidbvqlg.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\tqlidbvqlg.exeC:\Temp\tqlidbvqlg.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_tqlidbvqlg.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_tqlidbvqlg.exeC:\Temp\i_tqlidbvqlg.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\tnlfcaysqk.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\tnlfcaysqk.exeC:\Temp\tnlfcaysqk.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_tnlfcaysqk.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_tnlfcaysqk.exeC:\Temp\i_tnlfcaysqk.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\kfcausnkfc.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\kfcausnkfc.exeC:\Temp\kfcausnkfc.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_kfcausnkfc.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_kfcausnkfc.exeC:\Temp\i_kfcausnkfc.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\khcaxrmkec.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\khcaxrmkec.exeC:\Temp\khcaxrmkec.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_khcaxrmkec.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_khcaxrmkec.exeC:\Temp\i_khcaxrmkec.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xrpjhczurp.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\xrpjhczurp.exeC:\Temp\xrpjhczurp.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xrpjhczurp.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_xrpjhczurp.exeC:\Temp\i_xrpjhczurp.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jhezwrpmhe.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\jhezwrpmhe.exeC:\Temp\jhezwrpmhe.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jhezwrpmhe.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_jhezwrpmhe.exeC:\Temp\i_jhezwrpmhe.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wuomgeywro.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\wuomgeywro.exeC:\Temp\wuomgeywro.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wuomgeywro.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_wuomgeywro.exeC:\Temp\i_wuomgeywro.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qoljdbywqo.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\qoljdbywqo.exeC:\Temp\qoljdbywqo.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qoljdbywqo.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_qoljdbywqo.exeC:\Temp\i_qoljdbywqo.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\dbytrljdbv.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\dbytrljdbv.exeC:\Temp\dbytrljdbv.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_dbytrljdbv.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_dbytrljdbv.exeC:\Temp\i_dbytrljdbv.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\avtnlidayv.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\avtnlidayv.exeC:\Temp\avtnlidayv.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_avtnlidayv.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_avtnlidayv.exeC:\Temp\i_avtnlidayv.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\sqkifdxvpk.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\sqkifdxvpk.exeC:\Temp\sqkifdxvpk.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_sqkifdxvpk.exe ups_ins3⤵
-
C:\Temp\i_sqkifdxvpk.exeC:\Temp\i_sqkifdxvpk.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fzxspkicsm.exe ups_run3⤵
-
C:\Temp\fzxspkicsm.exeC:\Temp\fzxspkicsm.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fzxspkicsm.exe ups_ins3⤵
-
C:\Temp\i_fzxspkicsm.exeC:\Temp\i_fzxspkicsm.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ecxupnkecx.exe ups_run3⤵
-
C:\Temp\ecxupnkecx.exeC:\Temp\ecxupnkecx.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ecxupnkecx.exe ups_ins3⤵
-
C:\Temp\i_ecxupnkecx.exeC:\Temp\i_ecxupnkecx.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zxrpjhbzur.exe ups_run3⤵
-
C:\Temp\zxrpjhbzur.exeC:\Temp\zxrpjhbzur.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zxrpjhbzur.exe ups_ins3⤵
-
C:\Temp\i_zxrpjhbzur.exeC:\Temp\i_zxrpjhbzur.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jhbzwrpjhb.exe ups_run3⤵
-
C:\Temp\jhbzwrpjhb.exeC:\Temp\jhbzwrpjhb.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jhbzwrpjhb.exe ups_ins3⤵
-
C:\Temp\i_jhbzwrpjhb.exeC:\Temp\i_jhbzwrpjhb.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\omgebzwroj.exe ups_run3⤵
-
C:\Temp\omgebzwroj.exeC:\Temp\omgebzwroj.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_omgebzwroj.exe ups_ins3⤵
-
C:\Temp\i_omgebzwroj.exeC:\Temp\i_omgebzwroj.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\olgdywqoig.exe ups_run3⤵
-
C:\Temp\olgdywqoig.exeC:\Temp\olgdywqoig.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_olgdywqoig.exe ups_ins3⤵
-
C:\Temp\i_olgdywqoig.exeC:\Temp\i_olgdywqoig.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\daytqlidbv.exe ups_run3⤵
-
C:\Temp\daytqlidbv.exeC:\Temp\daytqlidbv.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_daytqlidbv.exe ups_ins3⤵
-
C:\Temp\i_daytqlidbv.exeC:\Temp\i_daytqlidbv.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gaysqkidav.exe ups_run3⤵
-
C:\Temp\gaysqkidav.exeC:\Temp\gaysqkidav.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gaysqkidav.exe ups_ins3⤵
-
C:\Temp\i_gaysqkidav.exeC:\Temp\i_gaysqkidav.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fdxvsnkica.exe ups_run3⤵
-
C:\Temp\fdxvsnkica.exeC:\Temp\fdxvsnkica.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x33c,0x7ffd7ca2c188,0x7ffd7ca2c194,0x7ffd7ca2c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1716,i,6720142324765487876,1457315629507324697,262144 --field-trial-handle=2316,i,10711476098295755659,11558582859154567774,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1888,i,13174288973704653394,1593823099087802978,524288 --field-trial-handle=2316,i,10711476098295755659,11558582859154567774,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2588,i,14456193400419728206,1802973297660270196,524288 --field-trial-handle=2316,i,10711476098295755659,11558582859154567774,262144 --variations-seed-version --mojo-platform-channel-handle=2944 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3604,i,13849156097365369852,13523568072828842413,2097152 --field-trial-handle=2316,i,10711476098295755659,11558582859154567774,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3608,i,9438847795229832706,12938424517526794418,2097152 --field-trial-handle=2316,i,10711476098295755659,11558582859154567774,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4392,i,10933934777794323917,7670181839994441682,2097152 --field-trial-handle=2316,i,10711476098295755659,11558582859154567774,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4404,i,11533163570148172632,9355544119195594728,2097152 --field-trial-handle=2316,i,10711476098295755659,11558582859154567774,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3680,i,14370187208416427200,4990909290052611132,524288 --field-trial-handle=2316,i,10711476098295755659,11558582859154567774,262144 --variations-seed-version --mojo-platform-channel-handle=3708 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3664,i,5760499939421698484,6337538703639145809,2097152 --field-trial-handle=2316,i,10711476098295755659,11558582859154567774,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5540,i,14608646770001218859,1875813550749895798,2097152 --field-trial-handle=2316,i,10711476098295755659,11558582859154567774,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3608,i,1341312652530754006,14881930987041703568,524288 --field-trial-handle=2316,i,10711476098295755659,11558582859154567774,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3840,i,13422677755409156618,2329988295574034692,524288 --field-trial-handle=2316,i,10711476098295755659,11558582859154567774,262144 --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5848,i,6943590289491803520,10176011653757156565,524288 --field-trial-handle=2316,i,10711476098295755659,11558582859154567774,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5848,i,6943590289491803520,10176011653757156565,524288 --field-trial-handle=2316,i,10711476098295755659,11558582859154567774,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6260,i,7992135561405642664,16067418729481203863,524288 --field-trial-handle=2316,i,10711476098295755659,11558582859154567774,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6424,i,4318619732009927909,2256803377882020562,524288 --field-trial-handle=2316,i,10711476098295755659,11558582859154567774,262144 --variations-seed-version --mojo-platform-channel-handle=6436 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6272,i,9787907018711630199,13804534975266895664,524288 --field-trial-handle=2316,i,10711476098295755659,11558582859154567774,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6340,i,17724262347405350411,1624230492492535304,524288 --field-trial-handle=2316,i,10711476098295755659,11558582859154567774,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5164,i,3065839988909598070,3519795400945079508,524288 --field-trial-handle=2316,i,10711476098295755659,11558582859154567774,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5188,i,1344743627219371783,5339418524834030497,524288 --field-trial-handle=2316,i,10711476098295755659,11558582859154567774,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4540,i,5116393205507573152,15306350458504476424,524288 --field-trial-handle=2316,i,10711476098295755659,11558582859154567774,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5060,i,12030482481739107394,2441567125862142698,524288 --field-trial-handle=2316,i,10711476098295755659,11558582859154567774,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6228,i,5363730281746437796,5569279173836706195,524288 --field-trial-handle=2316,i,10711476098295755659,11558582859154567774,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=932,i,7546187730826774337,74766619664726969,524288 --field-trial-handle=2316,i,10711476098295755659,11558582859154567774,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5324,i,2772005114762152281,7611970139450565280,524288 --field-trial-handle=2316,i,10711476098295755659,11558582859154567774,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=932,i,15245468143656692236,10151809286773124203,262144 --field-trial-handle=2316,i,10711476098295755659,11558582859154567774,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5800,i,2665176275298194768,910591186395467367,524288 --field-trial-handle=2316,i,10711476098295755659,11558582859154567774,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\tqljdbvtnlgdywqo.sysC:\Temp\tqljdbvtnlgdywqo.sys1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Temp\davtnlfdyv.sysC:\Temp\davtnlfdyv.sys1⤵
- Executes dropped EXE
-
C:\Temp\nkfcxvsnki.sysC:\Temp\nkfcxvsnki.sys1⤵
- Executes dropped EXE
-
C:\Temp\pnkfcxupnk.sysC:\Temp\pnkfcxupnk.sys1⤵
- Executes dropped EXE
-
C:\Temp\spjeczusmk.sysC:\Temp\spjeczusmk.sys1⤵
- Executes dropped EXE
-
C:\Temp\pjhezxromh.sysC:\Temp\pjhezxromh.sys1⤵
- Executes dropped EXE
-
C:\Temp\trljdbwtom.sysC:\Temp\trljdbwtom.sys1⤵
- Executes dropped EXE
-
C:\Temp\wtrljgbywu.sysC:\Temp\wtrljgbywu.sys1⤵
- Executes dropped EXE
-
C:\Temp\gaywtoljdb.sysC:\Temp\gaywtoljdb.sys1⤵
- Executes dropped EXE
-
C:\Temp\dyvtnlidbv.sysC:\Temp\dyvtnlidbv.sys1⤵
- Executes dropped EXE
-
C:\Temp\idaysqcaxs.sysC:\Temp\idaysqcaxs.sys1⤵
- Executes dropped EXE
-
C:\Temp\fcausnkfdx.sysC:\Temp\fcausnkfdx.sys1⤵
-
C:\Temp\fzxupmkicz.sysC:\Temp\fzxupmkicz.sys1⤵
-
C:\Temp\ezwupmkecw.sysC:\Temp\ezwupmkecw.sys1⤵
-
C:\Temp\pmgezwrpjh.sysC:\Temp\pmgezwrpjh.sys1⤵
-
C:\Temp\rljhbzwroj.sysC:\Temp\rljhbzwroj.sys1⤵
-
C:\Temp\rojgbywqoj.sysC:\Temp\rojgbywqoj.sys1⤵
-
C:\Temp\gdywqolfdy.sysC:\Temp\gdywqolfdy.sys1⤵
-
C:\Temp\nlfdxvqnlf.sysC:\Temp\nlfdxvqnlf.sys1⤵
-
C:\Temp\ifdxvpnkic.sysC:\Temp\ifdxvpnkic.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
davtnlfdyv.sys
i_kfcausnkfc.exe
i_khcaxrmkec.exe
i_tnlfcaysqk.exe
i_tqlidbvqlg.exe
i_xrpjhczurp.exe
jhezwrpmhe.exe
kfcausnkfc.exe
khcaxrmkec.exe
nkfcxvsnki.sys
pjhezxromh.sys
pnkfcxupnk.sys
spjeczusmk.sys
tnlfcaysqk.exe
tqlidbvqlg.exe
tqljdbvtnlgdywqo.exe
tqljdbvtnlgdywqo.sys
xrpjhczurp.exe
01fd0c64-696b-421a-b5f5-b104fbc50964.tmp
59cd2185-a964-4881-aa3a-8a96f7625c41.tmp
cdc43e49-c56c-4fd2-9411-42f37f1dc36a.tmp
settings.dat
settings.dat
2c67e67a-81ca-4f79-8ba1-b61a068c9345.tmp
731066b0-d483-4661-9964-96bd5e32a8bc.tmp
99b86c99-640f-4547-8157-61c64aed9f52.tmp
temp-index
the-real-index
93328f30-99e2-447e-97b7-23828dc4c854.tmp
dasherSettingSchema.json
7d036076-04c0-4bc4-a7a4-0a956043d8d2.tmp
8f467b85-b562-49be-8a7a-4f1d3aa8d034.tmp
a59c332b-996e-42ee-b26c-21535656ed63.tmp
sync_diagnostic.log
a905a65b-5df2-4f0b-a93b-892bdbec1960.tmp
a930f573-bf6e-41f2-92fd-397f4261247a.tmp
c31e62cd-40da-455c-82d0-c566b4a9e206.tmp
OperationConfig
bec8bfa0-5d70-49d7-b7f8-7b5540fe0d17.tmp
b0b78746-8fc1-4cc6-9d8c-7ac7e2cd7f44.tmp
35311ca0-8170-41bb-a318-ddf582513a92.tmp
5468b4dd-0262-4e14-8989-284a163e34d3.tmp
dd7e0e51-1941-491c-8385-ebd5e39ae362.tmp
ec304b72-47cd-47fb-8718-4b4b374f0c60.tmp
3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
cb92148e-57cc-4db0-abb8-e40dc28ac0cf.tmp
metadata.json
f46631a0-76e2-4119-9439-372919d1fa35.tmp
91b856cd-86c2-4f46-8358-7fda679e927c.tmp
ce39d701-e211-4676-a291-ad6dd75457fa.tmp
content.js
messages.json
manifest.json
manifest.json
manifest.json
manifest.json
CreateProcess.exe
memory/2064-661-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2680-744-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2756-563-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3036-571-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3068-66-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3092-619-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3640-516-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3640-487-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4184-541-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4308-722-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4460-701-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4712-685-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4740-726-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4932-515-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5008-567-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5140-697-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5328-589-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5552-631-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5824-438-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5852-665-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5904-528-0x0000000000010000-0x00000000000AB000-memory.dmp