Analysis
- max time kernel
150s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
01/11/2026, 07:38
General
- Target 2026-11-01_f9a4e51fb58ee6e4d4be41db6849c5b3_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
- Size 381KB
- Sample261101-jggsdatvfs
- SHA256 f8c14b9d3f470ef5b2779efac47d854837754350b4b009771d103b8d1aa095c5
Score
10/10
Malware Config
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 43 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
- Suspicious use of AdjustPrivilegeToken 20 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-01_f9a4e51fb58ee6e4d4be41db6849c5b3_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-01_f9a4e51fb58ee6e4d4be41db6849c5b3_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\gaytqlidbvtnljda.exeC:\Temp\gaytqlidbvtnljda.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\lxvqnifavn.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\lxvqnifavn.exeC:\Temp\lxvqnifavn.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_lxvqnifavn.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_lxvqnifavn.exeC:\Temp\i_lxvqnifavn.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\aysnifdxvs.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\aysnifdxvs.exeC:\Temp\aysnifdxvs.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_aysnifdxvs.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_aysnifdxvs.exeC:\Temp\i_aysnifdxvs.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\dxvpnkfcax.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\dxvpnkfcax.exeC:\Temp\dxvpnkfcax.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_dxvpnkfcax.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_dxvpnkfcax.exeC:\Temp\i_dxvpnkfcax.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\cwuspkhfzx.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\cwuspkhfzx.exeC:\Temp\cwuspkhfzx.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_cwuspkhfzx.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_cwuspkhfzx.exeC:\Temp\i_cwuspkhfzx.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hezxrpjhez.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\hezxrpjhez.exeC:\Temp\hezxrpjhez.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hezxrpjhez.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_hezxrpjhez.exeC:\Temp\i_hezxrpjhez.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jhecwuomge.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\jhecwuomge.exeC:\Temp\jhecwuomge.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jhecwuomge.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_jhecwuomge.exeC:\Temp\i_jhecwuomge.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qomgeywroj.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\qomgeywroj.exeC:\Temp\qomgeywroj.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qomgeywroj.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_qomgeywroj.exeC:\Temp\i_qomgeywroj.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\roigdyvtoi.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\roigdyvtoi.exeC:\Temp\roigdyvtoi.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_roigdyvtoi.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_roigdyvtoi.exeC:\Temp\i_roigdyvtoi.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nlfayvqnlf.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\nlfayvqnlf.exeC:\Temp\nlfayvqnlf.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nlfayvqnlf.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_nlfayvqnlf.exeC:\Temp\i_nlfayvqnlf.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nifdxvtnlf.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\nifdxvtnlf.exeC:\Temp\nifdxvtnlf.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nifdxvtnlf.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_nifdxvtnlf.exeC:\Temp\i_nifdxvtnlf.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\snkfdxvpnh.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\snkfdxvpnh.exeC:\Temp\snkfdxvpnh.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_snkfdxvpnh.exe ups_ins3⤵
-
C:\Temp\i_snkfdxvpnh.exeC:\Temp\i_snkfdxvpnh.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\causmkecxu.exe ups_run3⤵
-
C:\Temp\causmkecxu.exeC:\Temp\causmkecxu.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_causmkecxu.exe ups_ins3⤵
-
C:\Temp\i_causmkecxu.exeC:\Temp\i_causmkecxu.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zurmkeczus.exe ups_run3⤵
-
C:\Temp\zurmkeczus.exeC:\Temp\zurmkeczus.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zurmkeczus.exe ups_ins3⤵
-
C:\Temp\i_zurmkeczus.exeC:\Temp\i_zurmkeczus.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mhezxupmhe.exe ups_run3⤵
-
C:\Temp\mhezxupmhe.exeC:\Temp\mhezxupmhe.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mhezxupmhe.exe ups_ins3⤵
-
C:\Temp\i_mhezxupmhe.exeC:\Temp\i_mhezxupmhe.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ljhbzwromg.exe ups_run3⤵
-
C:\Temp\ljhbzwromg.exeC:\Temp\ljhbzwromg.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ljhbzwromg.exe ups_ins3⤵
-
C:\Temp\i_ljhbzwromg.exeC:\Temp\i_ljhbzwromg.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\tqoigbywrl.exe ups_run3⤵
-
C:\Temp\tqoigbywrl.exeC:\Temp\tqoigbywrl.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_tqoigbywrl.exe ups_ins3⤵
-
C:\Temp\i_tqoigbywrl.exeC:\Temp\i_tqoigbywrl.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gdywqoigby.exe ups_run3⤵
-
C:\Temp\gdywqoigby.exeC:\Temp\gdywqoigby.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gdywqoigby.exe ups_ins3⤵
-
C:\Temp\i_gdywqoigby.exeC:\Temp\i_gdywqoigby.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\lfdbvtqoif.exe ups_run3⤵
-
C:\Temp\lfdbvtqoif.exeC:\Temp\lfdbvtqoif.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_lfdbvtqoif.exe ups_ins3⤵
-
C:\Temp\i_lfdbvtqoif.exeC:\Temp\i_lfdbvtqoif.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\davsqkicav.exe ups_run3⤵
-
C:\Temp\davsqkicav.exeC:\Temp\davsqkicav.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_davsqkicav.exe ups_ins3⤵
-
C:\Temp\i_davsqkicav.exeC:\Temp\i_davsqkicav.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hfaxsqkica.exe ups_run3⤵
-
C:\Temp\hfaxsqkica.exeC:\Temp\hfaxsqkica.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hfaxsqkica.exe ups_ins3⤵
-
C:\Temp\i_hfaxsqkica.exeC:\Temp\i_hfaxsqkica.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7fff22ccc188,0x7fff22ccc194,0x7fff22ccc1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2108,i,12000455255516403085,11475084635194024827,524288 --field-trial-handle=2460,i,13290806617669407441,2717466301390889603,262144 --variations-seed-version --mojo-platform-channel-handle=3084 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1876,i,18006363696385608162,1441283062841654100,262144 --field-trial-handle=2460,i,13290806617669407441,2717466301390889603,262144 --variations-seed-version --mojo-platform-channel-handle=2456 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2576,i,2242273593597171488,16942003485779191361,524288 --field-trial-handle=2460,i,13290806617669407441,2717466301390889603,262144 --variations-seed-version --mojo-platform-channel-handle=3292 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3472,i,14585597192099933838,13986704044923452989,2097152 --field-trial-handle=2460,i,13290806617669407441,2717466301390889603,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3492,i,8074904648977205798,15267042985282680994,2097152 --field-trial-handle=2460,i,13290806617669407441,2717466301390889603,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4268,i,17822864864790207145,18132451450511555496,2097152 --field-trial-handle=2460,i,13290806617669407441,2717466301390889603,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4248,i,10159973251076874333,11769536721966458978,2097152 --field-trial-handle=2460,i,13290806617669407441,2717466301390889603,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3772,i,14204930484512980343,14962715279519797315,524288 --field-trial-handle=2460,i,13290806617669407441,2717466301390889603,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3736,i,13643147257551529571,9710688896226757144,2097152 --field-trial-handle=2460,i,13290806617669407441,2717466301390889603,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3836,i,13023189097489668476,17410850033912839522,2097152 --field-trial-handle=2460,i,13290806617669407441,2717466301390889603,262144 --variations-seed-version --mojo-platform-channel-handle=3840 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4528,i,7860505857763745556,9464180795924832651,524288 --field-trial-handle=2460,i,13290806617669407441,2717466301390889603,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4540,i,12700419189486535055,14394961918493182234,524288 --field-trial-handle=2460,i,13290806617669407441,2717466301390889603,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5992,i,15353976646080579704,13917412127930737599,524288 --field-trial-handle=2460,i,13290806617669407441,2717466301390889603,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5992,i,15353976646080579704,13917412127930737599,524288 --field-trial-handle=2460,i,13290806617669407441,2717466301390889603,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6184,i,7517123762687650334,14554292401151599663,524288 --field-trial-handle=2460,i,13290806617669407441,2717466301390889603,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6208,i,3274226881456045166,17280333361854265064,524288 --field-trial-handle=2460,i,13290806617669407441,2717466301390889603,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6472,i,18218344937924761532,16196672261061854402,524288 --field-trial-handle=2460,i,13290806617669407441,2717466301390889603,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5764,i,16299023098187709242,14765809069177200648,524288 --field-trial-handle=2460,i,13290806617669407441,2717466301390889603,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1300,i,1867287962706168627,14571496257873915088,524288 --field-trial-handle=2460,i,13290806617669407441,2717466301390889603,262144 --variations-seed-version --mojo-platform-channel-handle=4580 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1424,i,11056484730644792861,9612101999583227889,524288 --field-trial-handle=2460,i,13290806617669407441,2717466301390889603,262144 --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1432,i,11033951830051396895,4260549943318443550,524288 --field-trial-handle=2460,i,13290806617669407441,2717466301390889603,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1792,i,7730576111130884805,6582442722980775332,524288 --field-trial-handle=2460,i,13290806617669407441,2717466301390889603,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6200,i,14921551813680201180,2564455596043686448,524288 --field-trial-handle=2460,i,13290806617669407441,2717466301390889603,262144 --variations-seed-version --mojo-platform-channel-handle=4900 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5340,i,9069027895074334313,10642663948273680938,524288 --field-trial-handle=2460,i,13290806617669407441,2717466301390889603,262144 --variations-seed-version --mojo-platform-channel-handle=6628 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6744,i,14700333066878762627,9739679680145896679,524288 --field-trial-handle=2460,i,13290806617669407441,2717466301390889603,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6124,i,17774840696792559402,1831099249555543549,262144 --field-trial-handle=2460,i,13290806617669407441,2717466301390889603,262144 --variations-seed-version --mojo-platform-channel-handle=6792 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2864,i,9784840996685999507,12372874477439839873,524288 --field-trial-handle=2460,i,13290806617669407441,2717466301390889603,262144 --variations-seed-version --mojo-platform-channel-handle=2972 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\gaytqlidbvtnljda.sysC:\Temp\gaytqlidbvtnljda.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Temp\aysqnidays.sysC:\Temp\aysqnidays.sys1⤵
- Executes dropped EXE
-
C:\Temp\xusnkfcxvp.sysC:\Temp\xusnkfcxvp.sys1⤵
- Executes dropped EXE
-
C:\Temp\cwurpnhfzx.sysC:\Temp\cwurpnhfzx.sys1⤵
- Executes dropped EXE
-
C:\Temp\pmhfzxrpkh.sysC:\Temp\pmhfzxrpkh.sys1⤵
- Executes dropped EXE
-
C:\Temp\jhezwuomge.sysC:\Temp\jhezwuomge.sys1⤵
- Executes dropped EXE
-
C:\Temp\ojgebwtomg.sysC:\Temp\ojgebwtomg.sys1⤵
- Executes dropped EXE
-
C:\Temp\qoigaytqol.sysC:\Temp\qoigaytqol.sys1⤵
- Executes dropped EXE
-
C:\Temp\ywqoigaytq.sysC:\Temp\ywqoigaytq.sys1⤵
- Executes dropped EXE
-
C:\Temp\qnifaxvtnl.sysC:\Temp\qnifaxvtnl.sys1⤵
- Executes dropped EXE
-
C:\Temp\sqkicavsnk.sysC:\Temp\sqkicavsnk.sys1⤵
- Executes dropped EXE
-
C:\Temp\cxupnhfcxu.sysC:\Temp\cxupnhfcxu.sys1⤵
-
C:\Temp\hfzxrpnhfc.sysC:\Temp\hfzxrpnhfc.sys1⤵
-
C:\Temp\pmhezxrpmh.sysC:\Temp\pmhezxrpmh.sys1⤵
-
C:\Temp\omgezwrojh.sysC:\Temp\omgezwrojh.sys1⤵
-
C:\Temp\bztrojgebo.sysC:\Temp\bztrojgebo.sys1⤵
-
C:\Temp\jgbytrljdb.sysC:\Temp\jgbytrljdb.sys1⤵
-
C:\Temp\igayvqoigd.sysC:\Temp\igayvqoigd.sys1⤵
-
C:\Temp\fdxvsnifdx.sysC:\Temp\fdxvsnifdx.sys1⤵
-
C:\Temp\vpnhfaxsqk.sysC:\Temp\vpnhfaxsqk.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
aysnifdxvs.exe
aysqnidays.sys
cwurpnhfzx.sys
cwuspkhfzx.exe
dxvpnkfcax.exe
gaytqlidbvtnljda.exe
gaytqlidbvtnljda.sys
hezxrpjhez.exe
i_aysnifdxvs.exe
i_cwuspkhfzx.exe
i_dxvpnkfcax.exe
i_hezxrpjhez.exe
i_lxvqnifavn.exe
jhezwuomge.sys
lxvqnifavn.exe
pmhfzxrpkh.sys
xusnkfcxvp.sys
18c5253d-3720-410a-9e57-10c9f310c94f.tmp
29376ccf-c2dc-4d88-afed-a057964254cb.tmp
41911eec-0265-47be-bd94-9aa01db6ff4e.tmp
993c62a5-3bbc-40f9-8160-9d7437726234.tmp
settings.dat
settings.dat
2bc0603e-cd49-4162-878c-fa6657081bc5.tmp
366dde8c-9b84-4846-a057-0041b116098a.tmp
93b39641-c9c5-4d14-8634-6d4a7b39b8e0.tmp
the-real-index
the-real-index
7da04762-c9ad-481d-8dab-9d0ca87324ad.tmp
dasherSettingSchema.json
07c86963-bcc7-4dce-8afa-f57e248eb00e.tmp
1984b47e-12dc-455d-8fb1-4a76bee2bd1c.tmp
d0559e64-08f9-420a-b951-5a32433aab2b.tmp
sync_diagnostic.log
cc28b248-12d0-48b0-818c-2d3badfb35ca.tmp
d9592cdd-0421-4863-bb29-1bfd00af48a4.tmp
f4e9c2ec-63e8-49d6-8cfc-92aba64420d9.tmp
OperationConfig
f8f35a2c-5f63-4a0d-a32f-79959dcfb184.tmp
ad54a3c1-0302-4433-9273-3f24f730ed05.tmp
30ac9ec3-3dbf-402d-9421-35d71f66506a.tmp
866300b6-f539-4836-a7df-9842021f8a4c.tmp
8862edd0-9131-4851-b2f4-6cc0449c8f6f.tmp
e5193598-bbb1-4c32-bb40-f93a8d1c2045.tmp
0239312f-eb63-49e3-b21a-270b5dcc9e03.tmp
3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
metadata.json~RFe59c903.TMP
93325e5d-7757-42d1-a31a-d004769e5e20.tmp
fe73f783-3eb7-4f53-991c-eeea27ba2a6d.tmp
messages.json
content.js
manifest.json
manifest.json
manifest.json
manifest.json
CreateProcess.exe
memory/1200-713-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1216-580-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1236-717-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1484-480-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1484-514-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2868-735-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3140-66-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3356-622-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3448-508-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3564-432-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3840-688-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4272-656-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4532-575-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4588-652-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4600-692-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4820-610-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4836-555-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4984-534-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5352-676-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5884-521-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/6060-574-0x0000000000010000-0x00000000000AB000-memory.dmp