Analysis
- max time kernel
149s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
31/10/2026, 17:51
General
- Target 2026-10-30_eadae4d2c6eb2315f2eb18f5dd60d3f2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
- Size 381KB
- Sample261031-wfdesaywbx
- SHA256 94745d77dd5dfa4cba4fbda2b43d254dd6a526a11bb22491939bbe20ed8b8aff
Score
10/10
Malware Config
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 41 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 19 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-30_eadae4d2c6eb2315f2eb18f5dd60d3f2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-30_eadae4d2c6eb2315f2eb18f5dd60d3f2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\omgezwrpjhbztrmj.exeC:\Temp\omgezwrpjhbztrmj.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rpjhbztrpj.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\rpjhbztrpj.exeC:\Temp\rpjhbztrpj.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rpjhbztrpj.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_rpjhbztrpj.exeC:\Temp\i_rpjhbztrpj.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bwtrojgbzt.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\bwtrojgbzt.exeC:\Temp\bwtrojgbzt.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bwtrojgbzt.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_bwtrojgbzt.exeC:\Temp\i_bwtrojgbzt.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vtqljdbvtr.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\vtqljdbvtr.exeC:\Temp\vtqljdbvtr.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vtqljdbvtr.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_vtqljdbvtr.exeC:\Temp\i_vtqljdbvtr.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ysqlidaysq.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ysqlidaysq.exeC:\Temp\ysqlidaysq.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ysqlidaysq.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ysqlidaysq.exeC:\Temp\i_ysqlidaysq.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qnlgavsqki.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\qnlgavsqki.exeC:\Temp\qnlgavsqki.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qnlgavsqki.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_qnlgavsqki.exeC:\Temp\i_qnlgavsqki.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ifdxvsnkfc.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ifdxvsnkfc.exeC:\Temp\ifdxvsnkfc.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ifdxvsnkfc.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ifdxvsnkfc.exeC:\Temp\i_ifdxvsnkfc.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\kecwupmhfz.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\kecwupmhfz.exeC:\Temp\kecwupmhfz.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_kecwupmhfz.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_kecwupmhfz.exeC:\Temp\i_kecwupmhfz.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\smkecxupnh.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\smkecxupnh.exeC:\Temp\smkecxupnh.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_smkecxupnh.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_smkecxupnh.exeC:\Temp\i_smkecxupnh.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mjecwtrmje.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\mjecwtrmje.exeC:\Temp\mjecwtrmje.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mjecwtrmje.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_mjecwtrmje.exeC:\Temp\i_mjecwtrmje.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gebwtrljhb.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\gebwtrljhb.exeC:\Temp\gebwtrljhb.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gebwtrljhb.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_gebwtrljhb.exeC:\Temp\i_gebwtrljhb.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vtrljdbwto.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\vtrljdbwto.exeC:\Temp\vtrljdbwto.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vtrljdbwto.exe ups_ins3⤵
-
C:\Temp\i_vtrljdbwto.exeC:\Temp\i_vtrljdbwto.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\yvtnlgdywq.exe ups_run3⤵
-
C:\Temp\yvtnlgdywq.exeC:\Temp\yvtnlgdywq.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_yvtnlgdywq.exe ups_ins3⤵
-
C:\Temp\i_yvtnlgdywq.exeC:\Temp\i_yvtnlgdywq.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\lidbvsqkif.exe ups_run3⤵
-
C:\Temp\lidbvsqkif.exeC:\Temp\lidbvsqkif.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_lidbvsqkif.exe ups_ins3⤵
-
C:\Temp\i_lidbvsqkif.exeC:\Temp\i_lidbvsqkif.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vsnkidausn.exe ups_run3⤵
-
C:\Temp\vsnkidausn.exeC:\Temp\vsnkidausn.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vsnkidausn.exe ups_ins3⤵
-
C:\Temp\i_vsnkidausn.exeC:\Temp\i_vsnkidausn.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xspkicausm.exe ups_run3⤵
-
C:\Temp\xspkicausm.exeC:\Temp\xspkicausm.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xspkicausm.exe ups_ins3⤵
-
C:\Temp\i_xspkicausm.exeC:\Temp\i_xspkicausm.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\cxupmkecxu.exe ups_run3⤵
-
C:\Temp\cxupmkecxu.exeC:\Temp\cxupmkecxu.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_cxupmkecxu.exe ups_ins3⤵
-
C:\Temp\i_cxupmkecxu.exeC:\Temp\i_cxupmkecxu.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ecwurmkecw.exe ups_run3⤵
-
C:\Temp\ecwurmkecw.exeC:\Temp\ecwurmkecw.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ecwurmkecw.exe ups_ins3⤵
-
C:\Temp\i_ecwurmkecw.exeC:\Temp\i_ecwurmkecw.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\trpjheywro.exe ups_run3⤵
-
C:\Temp\trpjheywro.exeC:\Temp\trpjheywro.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_trpjheywro.exe ups_ins3⤵
-
C:\Temp\i_trpjheywro.exeC:\Temp\i_trpjheywro.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bwtolgeywq.exe ups_run3⤵
-
C:\Temp\bwtolgeywq.exeC:\Temp\bwtolgeywq.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bwtolgeywq.exe ups_ins3⤵
-
C:\Temp\i_bwtolgeywq.exeC:\Temp\i_bwtolgeywq.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x16c,0x2f4,0x2f8,0x168,0x304,0x7ffb2e00c188,0x7ffb2e00c194,0x7ffb2e00c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1948,i,11647333846577271734,4554399827702578044,262144 --field-trial-handle=2600,i,6627969648907800217,2389018169010182297,262144 --variations-seed-version --mojo-platform-channel-handle=2596 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2168,i,2654679289189334941,11174500534038049684,524288 --field-trial-handle=2600,i,6627969648907800217,2389018169010182297,262144 --variations-seed-version --mojo-platform-channel-handle=2628 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2660,i,11382318447135229076,15063530114153464975,524288 --field-trial-handle=2600,i,6627969648907800217,2389018169010182297,262144 --variations-seed-version --mojo-platform-channel-handle=3252 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3588,i,342662533918316658,15526533879404151533,2097152 --field-trial-handle=2600,i,6627969648907800217,2389018169010182297,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3600,i,15810180919871273049,6997360282671516200,2097152 --field-trial-handle=2600,i,6627969648907800217,2389018169010182297,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4208,i,141425215386619292,14880803988057711432,2097152 --field-trial-handle=2600,i,6627969648907800217,2389018169010182297,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4244,i,6317648418695594774,12629886841604568238,2097152 --field-trial-handle=2600,i,6627969648907800217,2389018169010182297,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5320,i,3632278222997835327,1651458103078055443,524288 --field-trial-handle=2600,i,6627969648907800217,2389018169010182297,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3796,i,15670812030836026930,16703005120171174664,2097152 --field-trial-handle=2600,i,6627969648907800217,2389018169010182297,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3656,i,6965310797911565792,11859238385914550699,524288 --field-trial-handle=2600,i,6627969648907800217,2389018169010182297,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3720,i,17244162874051694927,16359866041175949701,524288 --field-trial-handle=2600,i,6627969648907800217,2389018169010182297,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6012,i,4544962420709586307,6030298717405669252,524288 --field-trial-handle=2600,i,6627969648907800217,2389018169010182297,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6068,i,6611947730965584328,3321583282480963857,2097152 --field-trial-handle=2600,i,6627969648907800217,2389018169010182297,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6012,i,4544962420709586307,6030298717405669252,524288 --field-trial-handle=2600,i,6627969648907800217,2389018169010182297,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6444,i,12403292753330724308,7094371093205986645,524288 --field-trial-handle=2600,i,6627969648907800217,2389018169010182297,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6400,i,17372185781266822157,15200045783276993543,524288 --field-trial-handle=2600,i,6627969648907800217,2389018169010182297,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6948,i,6132685477176149488,6887171120149699428,524288 --field-trial-handle=2600,i,6627969648907800217,2389018169010182297,262144 --variations-seed-version --mojo-platform-channel-handle=6924 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7104,i,6537402189711084767,13103783409116423821,524288 --field-trial-handle=2600,i,6627969648907800217,2389018169010182297,262144 --variations-seed-version --mojo-platform-channel-handle=7100 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=5272,i,10684728848509768861,17241542364822794744,2097152 --field-trial-handle=2600,i,6627969648907800217,2389018169010182297,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6084,i,8835656618452993344,5656317097142582510,2097152 --field-trial-handle=2600,i,6627969648907800217,2389018169010182297,262144 --variations-seed-version --mojo-platform-channel-handle=7280 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7348,i,13128905674467756222,13016195414431319619,524288 --field-trial-handle=2600,i,6627969648907800217,2389018169010182297,262144 --variations-seed-version --mojo-platform-channel-handle=7352 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1316,i,18317836020537467438,14793817719346651153,524288 --field-trial-handle=2600,i,6627969648907800217,2389018169010182297,262144 --variations-seed-version --mojo-platform-channel-handle=1432 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1320,i,15377536926216270010,215491659326648584,524288 --field-trial-handle=2600,i,6627969648907800217,2389018169010182297,262144 --variations-seed-version --mojo-platform-channel-handle=7312 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5036,i,8415849423577922317,10902116905987607901,524288 --field-trial-handle=2600,i,6627969648907800217,2389018169010182297,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5648,i,11953173402831327899,7073597919123030889,524288 --field-trial-handle=2600,i,6627969648907800217,2389018169010182297,262144 --variations-seed-version --mojo-platform-channel-handle=5708 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5744,i,16204543044136919799,13784022284491428798,524288 --field-trial-handle=2600,i,6627969648907800217,2389018169010182297,262144 --variations-seed-version --mojo-platform-channel-handle=7304 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1316,i,12873329634734245931,10032521016228302221,524288 --field-trial-handle=2600,i,6627969648907800217,2389018169010182297,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6356,i,127164935824002570,2335571070189206820,262144 --field-trial-handle=2600,i,6627969648907800217,2389018169010182297,262144 --variations-seed-version --mojo-platform-channel-handle=6916 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5544,i,14809859098773694100,2731643480151768995,524288 --field-trial-handle=2600,i,6627969648907800217,2389018169010182297,262144 --variations-seed-version --mojo-platform-channel-handle=1428 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\omgezwrpjhbztrmj.sysC:\Temp\omgezwrpjhbztrmj.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Temp\mjeuomgeyw.sysC:\Temp\mjeuomgeyw.sys1⤵
- Executes dropped EXE
-
C:\Temp\jgbvtoljdb.sysC:\Temp\jgbvtoljdb.sys1⤵
- Executes dropped EXE
-
C:\Temp\gdbvtnlgdy.sysC:\Temp\gdbvtnlgdy.sys1⤵
- Executes dropped EXE
-
C:\Temp\avsnlidxvq.sysC:\Temp\avsnlidxvq.sys1⤵
- Executes dropped EXE
-
C:\Temp\fcxvpnkifa.sysC:\Temp\fcxvpnkifa.sys1⤵
- Executes dropped EXE
-
C:\Temp\snkfaxspnh.sysC:\Temp\snkfaxspnh.sys1⤵
- Executes dropped EXE
-
C:\Temp\mkeczxrpnh.sysC:\Temp\mkeczxrpnh.sys1⤵
- Executes dropped EXE
-
C:\Temp\romkecwurp.sysC:\Temp\romkecwurp.sys1⤵
- Executes dropped EXE
-
C:\Temp\hbywuomgey.sysC:\Temp\hbywuomgey.sys1⤵
- Executes dropped EXE
-
C:\Temp\trljdbwtol.sysC:\Temp\trljdbwtol.sys1⤵
- Executes dropped EXE
-
C:\Temp\bytrlidayt.sysC:\Temp\bytrlidayt.sys1⤵
-
C:\Temp\qkigayvtnl.sysC:\Temp\qkigayvtnl.sys1⤵
-
C:\Temp\sqkicausnk.sysC:\Temp\sqkicausnk.sys1⤵
-
C:\Temp\axvpnkfdau.sysC:\Temp\axvpnkfdau.sys1⤵
-
C:\Temp\zxrpnkiczu.sysC:\Temp\zxrpnkiczu.sys1⤵
-
C:\Temp\fzxrpjhbzx.sysC:\Temp\fzxrpjhbzx.sys1⤵
-
C:\Temp\wrpjhbzwro.sysC:\Temp\wrpjhbzwro.sys1⤵
-
C:\Temp\jebwuomgey.sysC:\Temp\jebwuomgey.sys1⤵
-
C:\Temp\jgbywqojgb.sysC:\Temp\jgbywqojgb.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
avsnlidxvq.sys
bwtrojgbzt.exe
gdbvtnlgdy.sys
i_bwtrojgbzt.exe
i_qnlgavsqki.exe
i_rpjhbztrpj.exe
i_vtqljdbvtr.exe
i_ysqlidaysq.exe
jgbvtoljdb.sys
mjeuomgeyw.sys
omgezwrpjhbztrmj.exe
omgezwrpjhbztrmj.sys
qnlgavsqki.exe
rpjhbztrpj.exe
vtqljdbvtr.exe
ysqlidaysq.exe
72634ed1-727d-45a7-beae-8fff8298fe8c.tmp
812690b9-f398-4398-85c3-b42f3edbc086.tmp
97348c67-c3fe-4d47-bd01-e912a31b9c6f.tmp
b070a35c-59a5-408a-ae94-92ac6a5b71be.tmp
settings.dat
settings.dat
07af7821-2204-45d8-abc8-97b2e5ba5750.tmp
3eabb8a0-37a5-4d1f-a85f-5b6fea15cc90.tmp
6d6ce018-1fdd-4952-9c65-b4748e600c40.tmp
846ec7d4-7e77-4498-a4bc-9f5e0692d355.tmp
temp-index
5ed2f9c8-fd4d-4fbb-9006-833586c52b39.tmp
dasherSettingSchema.json
025617ca-9453-4bed-933c-560de9811abf.tmp
2310df66-3253-4663-aec1-de3ce2397597.tmp
2cf3371c-1075-4e71-9e1e-d702e40a544d.tmp
sync_diagnostic.log
a73564d1-d454-478e-ad62-afb9b8a2ce52.tmp
d5e2b87a-c6d1-4f59-a81f-8252e52e578b.tmp
883a6980-05d4-4e2f-b6ca-626907a8c715.tmp
a94e692d-7bb1-40e2-b971-e47107ff0030.tmp
124558b6-ad46-4076-8df0-97997283d778.tmp
1ceb087a-73b2-4ff6-a341-84870e1582ed.tmp
3dd50b96-bdd5-4ac9-9d9e-d4c8ade3282b.tmp
53e05672-2f94-4ce6-8f97-48a0cbc3b790.tmp
d07e8171-8489-42b4-a101-775b683c3d10.tmp
dc4b5c28-2112-4893-860b-ebd0f4fcd654.tmp
3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
726224d7-bee6-4caf-8b00-8efc4d3f8f21.tmp
773ca56e-1088-4405-9b44-2dcab77fc830.tmp
30736f30-fa50-4133-ac8f-2b9b7a053b93.tmp
a754238c-21ec-4a7b-8598-7f7012ddb62b.tmp
content.js
messages.json
manifest.json
manifest.json
manifest.json
manifest.json
CreateProcess.exe
memory/248-569-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/800-737-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/944-549-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1044-545-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1268-713-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1348-518-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1428-432-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1828-62-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1960-665-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2368-506-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2564-733-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3036-669-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3204-578-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3280-689-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4092-708-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4148-653-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4212-553-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4900-603-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5968-631-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/6020-481-0x0000000000010000-0x00000000000AB000-memory.dmp