Analysis
- max time kernel
149s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
30/10/2026, 17:02
General
- Target 2026-10-30_c8eacba6da60845855f51d5aec8b13ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
- Size 381KB
- Sample261030-vkblbadx2x
- SHA256 75863b9289636c4f2e22f204d135d6afc6d3c8f100383b8c74b179186339a636
Score
10/10
Malware Config
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-30_c8eacba6da60845855f51d5aec8b13ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-30_c8eacba6da60845855f51d5aec8b13ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\oigbytrljdbvtolg.exeC:\Temp\oigbytrljdbvtolg.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\oljdbvtgdb.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\oljdbvtgdb.exeC:\Temp\oljdbvtgdb.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_oljdbvtgdb.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_oljdbvtgdb.exeC:\Temp\i_oljdbvtgdb.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\lidbytqljd.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\lidbytqljd.exeC:\Temp\lidbytqljd.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_lidbytqljd.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_lidbytqljd.exeC:\Temp\i_lidbytqljd.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\spnifdxvqn.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\spnifdxvqn.exeC:\Temp\spnifdxvqn.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_spnifdxvqn.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_spnifdxvqn.exeC:\Temp\i_spnifdxvqn.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nkicausmkf.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\nkicausmkf.exeC:\Temp\nkicausmkf.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nkicausmkf.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_nkicausmkf.exeC:\Temp\i_nkicausmkf.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\czxusmkecz.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\czxusmkecz.exeC:\Temp\czxusmkecz.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_czxusmkecz.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_czxusmkecz.exeC:\Temp\i_czxusmkecz.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hecwupmhcz.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\hecwupmhcz.exeC:\Temp\hecwupmhcz.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hecwupmhcz.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_hecwupmhcz.exeC:\Temp\i_hecwupmhcz.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ebwurmkecw.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ebwurmkecw.exeC:\Temp\ebwurmkecw.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ebwurmkecw.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ebwurmkecw.exeC:\Temp\i_ebwurmkecw.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jhbywrojgb.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\jhbywrojgb.exeC:\Temp\jhbywrojgb.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jhbywrojgb.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_jhbywrojgb.exeC:\Temp\i_jhbywrojgb.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\igdywqolge.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\igdywqolge.exeC:\Temp\igdywqolge.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_igdywqolge.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_igdywqolge.exeC:\Temp\i_igdywqolge.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\tnlgdbvtnl.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\tnlgdbvtnl.exeC:\Temp\tnlgdbvtnl.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_tnlgdbvtnl.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_tnlgdbvtnl.exeC:\Temp\i_tnlgdbvtnl.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nlfdxvqnlf.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\nlfdxvqnlf.exeC:\Temp\nlfdxvqnlf.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nlfdxvqnlf.exe ups_ins3⤵
-
C:\Temp\i_nlfdxvqnlf.exeC:\Temp\i_nlfdxvqnlf.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\kfcavsnkfd.exe ups_run3⤵
-
C:\Temp\kfcavsnkfd.exeC:\Temp\kfcavsnkfd.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_kfcavsnkfd.exe ups_ins3⤵
-
C:\Temp\i_kfcavsnkfd.exeC:\Temp\i_kfcavsnkfd.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\cxupmkfcxu.exe ups_run3⤵
-
C:\Temp\cxupmkfcxu.exeC:\Temp\cxupmkfcxu.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_cxupmkfcxu.exe ups_ins3⤵
-
C:\Temp\i_cxupmkfcxu.exeC:\Temp\i_cxupmkfcxu.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\eczxrpnkec.exe ups_run3⤵
-
C:\Temp\eczxrpnkec.exeC:\Temp\eczxrpnkec.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_eczxrpnkec.exe ups_ins3⤵
-
C:\Temp\i_eczxrpnkec.exeC:\Temp\i_eczxrpnkec.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\khczxrpmhe.exe ups_run3⤵
-
C:\Temp\khczxrpmhe.exeC:\Temp\khczxrpmhe.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_khczxrpmhe.exe ups_ins3⤵
-
C:\Temp\i_khczxrpmhe.exeC:\Temp\i_khczxrpmhe.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\omgezwrpjh.exe ups_run3⤵
-
C:\Temp\omgezwrpjh.exeC:\Temp\omgezwrpjh.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_omgezwrpjh.exe ups_ins3⤵
-
C:\Temp\i_omgezwrpjh.exeC:\Temp\i_omgezwrpjh.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ljgbywqoig.exe ups_run3⤵
-
C:\Temp\ljgbywqoig.exeC:\Temp\ljgbywqoig.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ljgbywqoig.exe ups_ins3⤵
-
C:\Temp\i_ljgbywqoig.exeC:\Temp\i_ljgbywqoig.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nlgdbvtrlj.exe ups_run3⤵
-
C:\Temp\nlgdbvtrlj.exeC:\Temp\nlgdbvtrlj.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nlgdbvtrlj.exe ups_ins3⤵
-
C:\Temp\i_nlgdbvtrlj.exeC:\Temp\i_nlgdbvtrlj.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vtnlfdyvqn.exe ups_run3⤵
-
C:\Temp\vtnlfdyvqn.exeC:\Temp\vtnlfdyvqn.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vtnlfdyvqn.exe ups_ins3⤵
-
C:\Temp\i_vtnlfdyvqn.exeC:\Temp\i_vtnlfdyvqn.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vsnkifdxvp.exe ups_run3⤵
-
C:\Temp\vsnkifdxvp.exeC:\Temp\vsnkifdxvp.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffed949c188,0x7ffed949c194,0x7ffed949c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1684,i,16250794942404223889,11051150612459357006,262144 --field-trial-handle=2344,i,2116122699500989832,7279999927143314052,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1856,i,12669800116765198918,13704238621789047769,524288 --field-trial-handle=2344,i,2116122699500989832,7279999927143314052,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2468,i,8339926642839193866,6583022848595764244,524288 --field-trial-handle=2344,i,2116122699500989832,7279999927143314052,262144 --variations-seed-version --mojo-platform-channel-handle=2996 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3564,i,9536504558777303673,11284986410474984787,2097152 --field-trial-handle=2344,i,2116122699500989832,7279999927143314052,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3568,i,12523053595999516492,7731968902051062157,2097152 --field-trial-handle=2344,i,2116122699500989832,7279999927143314052,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4296,i,3432138086552018937,3948159740670271077,2097152 --field-trial-handle=2344,i,2116122699500989832,7279999927143314052,262144 --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4284,i,13599082162864868901,3973893394375187088,2097152 --field-trial-handle=2344,i,2116122699500989832,7279999927143314052,262144 --variations-seed-version --mojo-platform-channel-handle=4892 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3748,i,17196993711307326974,4370258144368310385,524288 --field-trial-handle=2344,i,2116122699500989832,7279999927143314052,262144 --variations-seed-version --mojo-platform-channel-handle=3768 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5368,i,7528637288919472862,14526085862801021069,2097152 --field-trial-handle=2344,i,2116122699500989832,7279999927143314052,262144 --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5508,i,8834425844327493815,11240418198688688021,524288 --field-trial-handle=2344,i,2116122699500989832,7279999927143314052,262144 --variations-seed-version --mojo-platform-channel-handle=3836 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3692,i,14524483061239319345,9219121130529021301,524288 --field-trial-handle=2344,i,2116122699500989832,7279999927143314052,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5952,i,2154401576026806626,10906216339662704832,2097152 --field-trial-handle=2344,i,2116122699500989832,7279999927143314052,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6184,i,14589078840764418593,246468126623348941,524288 --field-trial-handle=2344,i,2116122699500989832,7279999927143314052,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6184,i,14589078840764418593,246468126623348941,524288 --field-trial-handle=2344,i,2116122699500989832,7279999927143314052,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6388,i,9746955742109972269,12396737756156758835,524288 --field-trial-handle=2344,i,2116122699500989832,7279999927143314052,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6536,i,10032779341550843115,15578987766177002034,524288 --field-trial-handle=2344,i,2116122699500989832,7279999927143314052,262144 --variations-seed-version --mojo-platform-channel-handle=6552 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6580,i,5853654861694358574,849621884504708723,524288 --field-trial-handle=2344,i,2116122699500989832,7279999927143314052,262144 --variations-seed-version --mojo-platform-channel-handle=6536 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6584,i,8152465859895956315,13533274017142958178,524288 --field-trial-handle=2344,i,2116122699500989832,7279999927143314052,262144 --variations-seed-version --mojo-platform-channel-handle=6568 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,8881037908616974165,13615490299272346764,524288 --field-trial-handle=2344,i,2116122699500989832,7279999927143314052,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5328,i,15363823062588872181,14701651829070242808,524288 --field-trial-handle=2344,i,2116122699500989832,7279999927143314052,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4296,i,12205496271525884417,2797425452888374431,524288 --field-trial-handle=2344,i,2116122699500989832,7279999927143314052,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5152,i,12534896700653981102,9934437840491559594,524288 --field-trial-handle=2344,i,2116122699500989832,7279999927143314052,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5824,i,6786690061150247848,4663925793680855618,524288 --field-trial-handle=2344,i,2116122699500989832,7279999927143314052,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5544,i,15001343719338836492,3580694478041886903,524288 --field-trial-handle=2344,i,2116122699500989832,7279999927143314052,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4884,i,13279986579225232531,4073604379043672919,524288 --field-trial-handle=2344,i,2116122699500989832,7279999927143314052,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6132,i,16144111656293219156,12660170768123234450,262144 --field-trial-handle=2344,i,2116122699500989832,7279999927143314052,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2632,i,12519466789711408784,11029265701162464427,524288 --field-trial-handle=2344,i,2116122699500989832,7279999927143314052,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\oigbytrljdbvtolg.sysC:\Temp\oigbytrljdbvtolg.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Temp\vqnlfdyvqo.sysC:\Temp\vqnlfdyvqo.sys1⤵
- Executes dropped EXE
-
C:\Temp\avtnlfdxvq.sysC:\Temp\avtnlfdxvq.sys1⤵
- Executes dropped EXE
-
C:\Temp\snkfdxvpnh.sysC:\Temp\snkfdxvpnh.sys1⤵
- Executes dropped EXE
-
C:\Temp\pnhfzxvsnk.sysC:\Temp\pnhfzxvsnk.sys1⤵
- Executes dropped EXE
-
C:\Temp\pjhczusmke.sysC:\Temp\pjhczusmke.sys1⤵
- Executes dropped EXE
-
C:\Temp\jhbzurmkec.sysC:\Temp\jhbzurmkec.sys1⤵
- Executes dropped EXE
-
C:\Temp\bztromjebw.sysC:\Temp\bztromjebw.sys1⤵
- Executes dropped EXE
-
C:\Temp\qojgbywqoj.sysC:\Temp\qojgbywqoj.sys1⤵
- Executes dropped EXE
-
C:\Temp\qoigdbvtol.sysC:\Temp\qoigdbvtol.sys1⤵
- Executes dropped EXE
-
C:\Temp\tnlfdxvqni.sysC:\Temp\tnlfdxvqni.sys1⤵
- Executes dropped EXE
-
C:\Temp\kicaysqkif.sysC:\Temp\kicaysqkif.sys1⤵
-
C:\Temp\nkfdxvpnhf.sysC:\Temp\nkfdxvpnhf.sys1⤵
-
C:\Temp\hcausmkfca.sysC:\Temp\hcausmkfca.sys1⤵
-
C:\Temp\hczxrpmkec.sysC:\Temp\hczxrpmkec.sys1⤵
-
C:\Temp\rpmgezwrpj.sysC:\Temp\rpmgezwrpj.sys1⤵
-
C:\Temp\wtrljebzwr.sysC:\Temp\wtrljebzwr.sys1⤵
-
C:\Temp\qomgeywqoj.sysC:\Temp\qomgeywqoj.sys1⤵
-
C:\Temp\yvtnlgdywq.sysC:\Temp\yvtnlgdywq.sys1⤵
-
C:\Temp\ayvtnlfdsq.sysC:\Temp\ayvtnlfdsq.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
avtnlfdxvq.sys
czxusmkecz.exe
i_czxusmkecz.exe
i_lidbytqljd.exe
i_nkicausmkf.exe
i_oljdbvtgdb.exe
i_spnifdxvqn.exe
lidbytqljd.exe
nkicausmkf.exe
oigbytrljdbvtolg.exe
oigbytrljdbvtolg.sys
oljdbvtgdb.exe
pjhczusmke.sys
pnhfzxvsnk.sys
snkfdxvpnh.sys
spnifdxvqn.exe
vqnlfdyvqo.sys
0ecf612f-961f-4e32-a357-1318353c485f.tmp
1c12e505-e7a6-4409-881f-847457d495ab.tmp
1d288a22-e779-4efe-86b9-953dae6e11a0.tmp
6c7ba5dc-8ac9-423e-994c-757addef7184.tmp
settings.dat
settings.dat
72cf69ff-010f-4545-94db-b5269e80f5c1.tmp
75a440fb-d9c5-4fef-884d-a3b7f798ea00.tmp
the-real-index
the-real-index
db37b20e-9e01-42a7-84de-c1b8f9fe41d3.tmp
dasherSettingSchema.json
10a431cb-ee4b-453f-bf15-1489c3a86d9b.tmp
544dfcf5-3215-4f00-9de2-b2fb97267f33.tmp
f693c3d3-0f5f-4695-9e83-45e42fdb7205.tmp
ce633dc9-d080-4653-a551-0b56eb6a148c.tmp
e92f00a5-a396-4072-bcbc-5a57a94fc9fe.tmp
ff255d69-76cd-47f7-872a-dacdfd932915.tmp
2bbe2fd5-23d3-488a-ba97-de47cccffff1.tmp
OperationConfig
a2ebab3d-d7f1-4912-8091-b7947529356a.tmp
3062daed-3ccb-4103-8b06-b792ce26c33f.tmp
949b946f-8368-405e-904f-11189303365c.tmp
metadata.json
d71f8ddf-86f4-4698-9ca0-c3643d8a69f3.tmp
1cb56621-acc5-4393-9a96-42136b833b03.tmp
3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
metadata.json
7b464e6f-26f6-4bfb-a6c4-a01d8f252fd3.tmp
f0cf3a3d-2679-4488-964b-16adc047a85e.tmp
content.js
messages.json
manifest.json
manifest.json
manifest.json
manifest.json
CreateProcess.exe
memory/592-518-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2212-649-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2212-626-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2460-715-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2924-429-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3232-555-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3232-572-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3352-478-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3724-690-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3916-63-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3992-686-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4024-571-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4240-734-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4332-551-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4396-684-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5404-653-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5428-648-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5564-531-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5836-606-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5928-711-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5928-731-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5984-576-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/6040-506-0x0000000000010000-0x00000000000AB000-memory.dmp