Analysis
- max time kernel
150s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
31/10/2026, 23:09
General
- Target 2026-10-30_8c89e2f8a7b422bb8d5868e3d02a5a28_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
- Size 365KB
- Sample261031-25el2aaf69
- SHA256 1a55ebc804a95aa46ff5633c0ed783c3bc27cd04e6158aa0c49a29f489f3fcb2
Score
10/10
Malware Config
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
- Suspicious use of AdjustPrivilegeToken 18 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-30_8c89e2f8a7b422bb8d5868e3d02a5a28_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-30_8c89e2f8a7b422bb8d5868e3d02a5a28_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\vsqlidavtnlfdyvq.exeC:\Temp\vsqlidavtnlfdyvq.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\avsqkidavs.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\avsqkidavs.exeC:\Temp\avsqkidavs.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_avsqkidavs.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_avsqkidavs.exeC:\Temp\i_avsqkidavs.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\usmkfcxvpn.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\usmkfcxvpn.exeC:\Temp\usmkfcxvpn.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_usmkfcxvpn.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_usmkfcxvpn.exeC:\Temp\i_usmkfcxvpn.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zxusmkhfzx.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\zxusmkhfzx.exeC:\Temp\zxusmkhfzx.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zxusmkhfzx.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_zxusmkhfzx.exeC:\Temp\i_zxusmkhfzx.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jhfzxrpkhc.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\jhfzxrpkhc.exeC:\Temp\jhfzxrpkhc.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jhfzxrpkhc.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_jhfzxrpkhc.exeC:\Temp\i_jhfzxrpkhc.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bztrpjebzu.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\bztrpjebzu.exeC:\Temp\bztrpjebzu.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bztrpjebzu.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_bztrpjebzu.exeC:\Temp\i_bztrpjebzu.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\eywtoljgey.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\eywtoljgey.exeC:\Temp\eywtoljgey.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_eywtoljgey.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_eywtoljgey.exeC:\Temp\i_eywtoljgey.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ywqoigbytr.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ywqoigbytr.exeC:\Temp\ywqoigbytr.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ywqoigbytr.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ywqoigbytr.exeC:\Temp\i_ywqoigbytr.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\tolgeywqoi.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\tolgeywqoi.exeC:\Temp\tolgeywqoi.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_tolgeywqoi.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_tolgeywqoi.exeC:\Temp\i_tolgeywqoi.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\igaysnlida.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\igaysnlida.exeC:\Temp\igaysnlida.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_igaysnlida.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_igaysnlida.exeC:\Temp\i_igaysnlida.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\dxvsqnifax.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\dxvsqnifax.exeC:\Temp\dxvsqnifax.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_dxvsqnifax.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_dxvsqnifax.exeC:\Temp\i_dxvsqnifax.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\cxusmkfcxu.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\cxusmkfcxu.exeC:\Temp\cxusmkfcxu.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_cxusmkfcxu.exe ups_ins3⤵
-
C:\Temp\i_cxusmkfcxu.exeC:\Temp\i_cxusmkfcxu.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hfzxrpkhca.exe ups_run3⤵
-
C:\Temp\hfzxrpkhca.exeC:\Temp\hfzxrpkhca.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hfzxrpkhca.exe ups_ins3⤵
-
C:\Temp\i_hfzxrpkhca.exeC:\Temp\i_hfzxrpkhca.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mkecwupmhf.exe ups_run3⤵
-
C:\Temp\mkecwupmhf.exeC:\Temp\mkecwupmhf.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mkecwupmhf.exe ups_ins3⤵
-
C:\Temp\i_mkecwupmhf.exeC:\Temp\i_mkecwupmhf.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\uomgezwroj.exe ups_run3⤵
-
C:\Temp\uomgezwroj.exeC:\Temp\uomgezwroj.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_uomgezwroj.exe ups_ins3⤵
-
C:\Temp\i_uomgezwroj.exeC:\Temp\i_uomgezwroj.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\uomgebomge.exe ups_run3⤵
-
C:\Temp\uomgebomge.exeC:\Temp\uomgebomge.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_uomgebomge.exe ups_ins3⤵
-
C:\Temp\i_uomgebomge.exeC:\Temp\i_uomgebomge.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ljdbwtolge.exe ups_run3⤵
-
C:\Temp\ljdbwtolge.exeC:\Temp\ljdbwtolge.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ljdbwtolge.exe ups_ins3⤵
-
C:\Temp\i_ljdbwtolge.exeC:\Temp\i_ljdbwtolge.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nlgaysqlid.exe ups_run3⤵
-
C:\Temp\nlgaysqlid.exeC:\Temp\nlgaysqlid.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nlgaysqlid.exe ups_ins3⤵
-
C:\Temp\i_nlgaysqlid.exeC:\Temp\i_nlgaysqlid.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\idavsnlfdx.exe ups_run3⤵
-
C:\Temp\idavsnlfdx.exeC:\Temp\idavsnlfdx.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_idavsnlfdx.exe ups_ins3⤵
-
C:\Temp\i_idavsnlfdx.exeC:\Temp\i_idavsnlfdx.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\kicavsnkfd.exe ups_run3⤵
-
C:\Temp\kicavsnkfd.exeC:\Temp\kicavsnkfd.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_kicavsnkfd.exe ups_ins3⤵
-
C:\Temp\i_kicavsnkfd.exeC:\Temp\i_kicavsnkfd.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\icausmkhfz.exe ups_run3⤵
-
C:\Temp\icausmkhfz.exeC:\Temp\icausmkhfz.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffb04d5c188,0x7ffb04d5c194,0x7ffb04d5c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,919892545019651254,14954322057369423813,262144 --field-trial-handle=2288,i,2088779764453184965,13536179278618534047,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1844,i,300118077661984747,614383065262225573,524288 --field-trial-handle=2288,i,2088779764453184965,13536179278618534047,262144 --variations-seed-version --mojo-platform-channel-handle=3064 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2412,i,2943376273475417009,7888244900507442225,524288 --field-trial-handle=2288,i,2088779764453184965,13536179278618534047,262144 --variations-seed-version --mojo-platform-channel-handle=3084 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3564,i,8153689296229562102,706820012590110044,2097152 --field-trial-handle=2288,i,2088779764453184965,13536179278618534047,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3568,i,16008075259268314121,17935086606245666325,2097152 --field-trial-handle=2288,i,2088779764453184965,13536179278618534047,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4300,i,474954129002320489,6875664109543572271,2097152 --field-trial-handle=2288,i,2088779764453184965,13536179278618534047,262144 --variations-seed-version --mojo-platform-channel-handle=4592 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4232,i,4582877775562176338,9907481920319705502,2097152 --field-trial-handle=2288,i,2088779764453184965,13536179278618534047,262144 --variations-seed-version --mojo-platform-channel-handle=4572 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5332,i,7411449609934326068,6627085816471603338,524288 --field-trial-handle=2288,i,2088779764453184965,13536179278618534047,262144 --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5404,i,11506071741515948389,18349943011115536480,524288 --field-trial-handle=2288,i,2088779764453184965,13536179278618534047,262144 --variations-seed-version --mojo-platform-channel-handle=3780 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5392,i,10205469465606860363,3944305879874612822,524288 --field-trial-handle=2288,i,2088779764453184965,13536179278618534047,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,8685873140442529153,14174076563440519454,524288 --field-trial-handle=2288,i,2088779764453184965,13536179278618534047,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,8685873140442529153,14174076563440519454,524288 --field-trial-handle=2288,i,2088779764453184965,13536179278618534047,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6292,i,3853971016436354959,1359570529377055341,524288 --field-trial-handle=2288,i,2088779764453184965,13536179278618534047,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6472,i,15571594177592125453,14648081503911683727,524288 --field-trial-handle=2288,i,2088779764453184965,13536179278618534047,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6376,i,140554158553161385,2252768150110746025,524288 --field-trial-handle=2288,i,2088779764453184965,13536179278618534047,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3576,i,2033369976921719738,5728566053174463228,524288 --field-trial-handle=2288,i,2088779764453184965,13536179278618534047,262144 --variations-seed-version --mojo-platform-channel-handle=6520 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5080,i,17335661681480731891,4052172569523137350,524288 --field-trial-handle=2288,i,2088779764453184965,13536179278618534047,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5064,i,2247363135240355346,13824966358943161996,524288 --field-trial-handle=2288,i,2088779764453184965,13536179278618534047,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5068,i,6821145157980709117,9409544590819785622,524288 --field-trial-handle=2288,i,2088779764453184965,13536179278618534047,262144 --variations-seed-version --mojo-platform-channel-handle=4584 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2456,i,14468405383700842193,17546377744850964102,524288 --field-trial-handle=2288,i,2088779764453184965,13536179278618534047,262144 --variations-seed-version --mojo-platform-channel-handle=5620 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,9717310461695947643,2461754222066949497,524288 --field-trial-handle=2288,i,2088779764453184965,13536179278618534047,262144 --variations-seed-version --mojo-platform-channel-handle=6764 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5560,i,1549039284444305377,15708778343093024372,524288 --field-trial-handle=2288,i,2088779764453184965,13536179278618534047,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5624,i,10694666842772919562,8681420983238335850,524288 --field-trial-handle=2288,i,2088779764453184965,13536179278618534047,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6488,i,14282836935547374229,6230631400263345347,524288 --field-trial-handle=2288,i,2088779764453184965,13536179278618534047,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5468,i,9976420829013033529,16058196713237087,262144 --field-trial-handle=2288,i,2088779764453184965,13536179278618534047,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6476,i,17697209643165817445,11855850869674208113,524288 --field-trial-handle=2288,i,2088779764453184965,13536179278618534047,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6036,i,3270214675657551044,16610215853829086993,524288 --field-trial-handle=2288,i,2088779764453184965,13536179278618534047,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\vsqlidavtnlfdyvq.sysC:\Temp\vsqlidavtnlfdyvq.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Temp\hfaxvpnhca.sysC:\Temp\hfaxvpnhca.sys1⤵
- Executes dropped EXE
-
C:\Temp\nkfdxvpkif.sysC:\Temp\nkfdxvpkif.sys1⤵
- Executes dropped EXE
-
C:\Temp\keczxupmkh.sysC:\Temp\keczxupmkh.sys1⤵
- Executes dropped EXE
-
C:\Temp\kecwuomhez.sysC:\Temp\kecwuomhez.sys1⤵
- Executes dropped EXE
-
C:\Temp\eywuomgezw.sysC:\Temp\eywuomgezw.sys1⤵
- Executes dropped EXE
-
C:\Temp\ljgeytqljd.sysC:\Temp\ljgeytqljd.sys1⤵
- Executes dropped EXE
-
C:\Temp\dbvtnlgdyw.sysC:\Temp\dbvtnlgdyw.sys1⤵
- Executes dropped EXE
-
C:\Temp\nlidavtqlf.sysC:\Temp\nlidavtqlf.sys1⤵
- Executes dropped EXE
-
C:\Temp\snkfcausqk.sysC:\Temp\snkfcausqk.sys1⤵
- Executes dropped EXE
-
C:\Temp\khcausmkec.sysC:\Temp\khcausmkec.sys1⤵
-
C:\Temp\mkecwurpjh.sysC:\Temp\mkecwurpjh.sys1⤵
-
C:\Temp\zwrpmzwrpj.sysC:\Temp\zwrpmzwrpj.sys1⤵
-
C:\Temp\ztrojhbywr.sysC:\Temp\ztrojhbywr.sys1⤵
-
C:\Temp\ljdbywtomg.sysC:\Temp\ljdbywtomg.sys1⤵
-
C:\Temp\nlgdbvtnlg.sysC:\Temp\nlgdbvtnlg.sys1⤵
-
C:\Temp\qlidavsqol.sysC:\Temp\qlidavsqol.sys1⤵
-
C:\Temp\nlfdavsnlf.sysC:\Temp\nlfdavsnlf.sys1⤵
-
C:\Temp\khcausmkfc.sysC:\Temp\khcausmkfc.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
avsqkidavs.exe
bztrpjebzu.exe
eywtoljgey.exe
eywuomgezw.sys
hfaxvpnhca.sys
i_avsqkidavs.exe
i_bztrpjebzu.exe
i_jhfzxrpkhc.exe
i_usmkfcxvpn.exe
i_zxusmkhfzx.exe
jhfzxrpkhc.exe
kecwuomhez.sys
keczxupmkh.sys
nkfdxvpkif.sys
usmkfcxvpn.exe
vsqlidavtnlfdyvq.exe
vsqlidavtnlfdyvq.sys
zxusmkhfzx.exe
26816c4d-0102-422f-8be4-5175bc933107.tmp
472d99bd-e2f2-476a-a819-d3a8761c4603.tmp
4837f236-ef8f-4917-85ad-61bcdf3a1afd.tmp
57d965e8-527a-43b2-aeca-6b82f73362e6.tmp
settings.dat
settings.dat
39cef506-06e6-4c3c-84f2-76e30b51bf77.tmp
7b615f4a-f3a0-48a3-a7e7-1ac28ca5f226.tmp
8a2f707b-3525-40f5-9d30-0e49a3cf0e6b.tmp
92548423-46f5-483e-90cb-8a1a2480f6dc.tmp
LOG.old
the-real-index
the-real-index
d00679ca-6706-4523-90b5-c370aafac7ff.tmp
dasherSettingSchema.json
451c3560-940d-4098-85d9-a01e53bce1dc.tmp
98cad1b2-e306-48bd-8222-bb2d1b66f632.tmp
Sdch Dictionaries
e8069ca2-493a-41ba-8c89-83ed7423e3c1.tmp
4135555d-9fbe-4576-9f4a-3d109db202d3.tmp
b284e380-2acc-4dad-8f78-6a6c82cc74ec.tmp
cbe4cc3f-3327-46fb-8c82-ebaeea0d67d6.tmp
08499451-a411-44ed-ab36-bb95a641e4eb.tmp
46533cbd-1662-4559-b7aa-430dcd519f2c.tmp
6a57d8c0-d057-4253-916c-0cffb56fed6a.tmp
a7d8aa23-52fa-484a-adda-6ba25aae571d.tmp
3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
9e68427b-535a-4cdd-9522-f8c203722e95.tmp
f006cf50-cfe3-4d0e-92ec-eac36076e717.tmp
1b80d88c-4e5f-4352-8c63-375c99b1d709.tmp
6be6bdda-ed0d-4eb9-8579-32a1862de511.tmp
messages.json
content_new.js
manifest.json
manifest.json
manifest.json
manifest.json
CreateProcess.exe
memory/432-704-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/628-561-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1196-618-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1672-484-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1672-518-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2296-512-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2520-747-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3528-434-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3880-660-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4296-581-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4428-582-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4428-565-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4784-684-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5144-538-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5176-672-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5324-723-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5528-525-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5892-752-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5924-66-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5924-469-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5972-727-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5972-748-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/6088-646-0x0000000000010000-0x00000000000AB000-memory.dmp