Analysis
- max time kernel
149s - max time network
145s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
03/11/2026, 16:01
General
- Target 2026-11-02_0b59158acddcba8f3f2cc896acc77de0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
- Size 365KB
- Sample261103-tgh1jsxt2k
- SHA256 9232171621d0024dd250b4087c59c89d41576d7f6ba997364d3d4b870103a9da
Score
10/10
Malware Config
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-02_0b59158acddcba8f3f2cc896acc77de0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-02_0b59158acddcba8f3f2cc896acc77de0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\vpnhfzxspnhfcaus.exeC:\Temp\vpnhfzxspnhfcaus.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\causmkfcas.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\causmkfcas.exeC:\Temp\causmkfcas.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_causmkfcas.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_causmkfcas.exeC:\Temp\i_causmkfcas.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\usmkezxrpj.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\usmkezxrpj.exeC:\Temp\usmkezxrpj.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_usmkezxrpj.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_usmkezxrpj.exeC:\Temp\i_usmkezxrpj.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\uomhezxrpj.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\uomhezxrpj.exeC:\Temp\uomhezxrpj.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_uomhezxrpj.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_uomhezxrpj.exeC:\Temp\i_uomhezxrpj.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\omgebztroj.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\omgebztroj.exeC:\Temp\omgebztroj.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_omgebztroj.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_omgebztroj.exeC:\Temp\i_omgebztroj.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\tolgeywtom.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\tolgeywtom.exeC:\Temp\tolgeywtom.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_tolgeywtom.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_tolgeywtom.exeC:\Temp\i_tolgeywtom.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vtnlgdyvqo.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\vtnlgdyvqo.exeC:\Temp\vtnlgdyvqo.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vtnlgdyvqo.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_vtnlgdyvqo.exeC:\Temp\i_vtnlgdyvqo.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vtnlfdxvqn.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\vtnlfdxvqn.exeC:\Temp\vtnlfdxvqn.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vtnlfdxvqn.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_vtnlfdxvqn.exeC:\Temp\i_vtnlfdxvqn.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\usqkifaxvp.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\usqkifaxvp.exeC:\Temp\usqkifaxvp.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_usqkifaxvp.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_usqkifaxvp.exeC:\Temp\i_usqkifaxvp.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\usmkfcxvpn.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\usmkfcxvpn.exeC:\Temp\usmkfcxvpn.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_usmkfcxvpn.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_usmkfcxvpn.exeC:\Temp\i_usmkfcxvpn.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pnhfzxrpkh.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\pnhfzxrpkh.exeC:\Temp\pnhfzxrpkh.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pnhfzxrpkh.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_pnhfzxrpkh.exeC:\Temp\i_pnhfzxrpkh.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\usmkecwuom.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\usmkecwuom.exeC:\Temp\usmkecwuom.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_usmkecwuom.exe ups_ins3⤵
-
C:\Temp\i_usmkecwuom.exeC:\Temp\i_usmkecwuom.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\uomgebwtrm.exe ups_run3⤵
-
C:\Temp\uomgebwtrm.exeC:\Temp\uomgebwtrm.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_uomgebwtrm.exe ups_ins3⤵
-
C:\Temp\i_uomgebwtrm.exeC:\Temp\i_uomgebwtrm.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ztrljdbztr.exe ups_run3⤵
-
C:\Temp\ztrljdbztr.exeC:\Temp\ztrljdbztr.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ztrljdbztr.exe ups_ins3⤵
-
C:\Temp\i_ztrljdbztr.exeC:\Temp\i_ztrljdbztr.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wtolgeywqo.exe ups_run3⤵
-
C:\Temp\wtolgeywqo.exeC:\Temp\wtolgeywqo.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wtolgeywqo.exe ups_ins3⤵
-
C:\Temp\i_wtolgeywqo.exeC:\Temp\i_wtolgeywqo.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qoigdavtnl.exe ups_run3⤵
-
C:\Temp\qoigdavtnl.exeC:\Temp\qoigdavtnl.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qoigdavtnl.exe ups_ins3⤵
-
C:\Temp\i_qoigdavtnl.exeC:\Temp\i_qoigdavtnl.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\tnlfdxvqni.exe ups_run3⤵
-
C:\Temp\tnlfdxvqni.exeC:\Temp\tnlfdxvqni.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_tnlfdxvqni.exe ups_ins3⤵
-
C:\Temp\i_tnlfdxvqni.exeC:\Temp\i_tnlfdxvqni.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xvpnifaxvs.exe ups_run3⤵
-
C:\Temp\xvpnifaxvs.exeC:\Temp\xvpnifaxvs.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xvpnifaxvs.exe ups_ins3⤵
-
C:\Temp\i_xvpnifaxvs.exeC:\Temp\i_xvpnifaxvs.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vpmkfcxvpn.exe ups_run3⤵
-
C:\Temp\vpmkfcxvpn.exeC:\Temp\vpmkfcxvpn.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vpmkfcxvpn.exe ups_ins3⤵
-
C:\Temp\i_vpmkfcxvpn.exeC:\Temp\i_vpmkfcxvpn.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\upmhfzxrpj.exe ups_run3⤵
-
C:\Temp\upmhfzxrpj.exeC:\Temp\upmhfzxrpj.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_upmhfzxrpj.exe ups_ins3⤵
-
C:\Temp\i_upmhfzxrpj.exeC:\Temp\i_upmhfzxrpj.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zpmgebztro.exe ups_run3⤵
-
C:\Temp\zpmgebztro.exeC:\Temp\zpmgebztro.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffc6201c188,0x7ffc6201c194,0x7ffc6201c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1720,i,1481340689874885748,16753469055118360977,262144 --field-trial-handle=2644,i,13044304092384948514,18076778726572126535,262144 --variations-seed-version --mojo-platform-channel-handle=2640 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1892,i,7800549015147865258,14049904772639641633,524288 --field-trial-handle=2644,i,13044304092384948514,18076778726572126535,262144 --variations-seed-version --mojo-platform-channel-handle=2680 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2296,i,2436634593111391574,4245440677565279889,524288 --field-trial-handle=2644,i,13044304092384948514,18076778726572126535,262144 --variations-seed-version --mojo-platform-channel-handle=3092 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3624,i,17530742428565929878,12358397789952297153,2097152 --field-trial-handle=2644,i,13044304092384948514,18076778726572126535,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3636,i,1903089540288607123,7880244031130301131,2097152 --field-trial-handle=2644,i,13044304092384948514,18076778726572126535,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4260,i,10648597100077474075,10573499740508077287,2097152 --field-trial-handle=2644,i,13044304092384948514,18076778726572126535,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4376,i,14277040185534779996,7835240682884968641,2097152 --field-trial-handle=2644,i,13044304092384948514,18076778726572126535,262144 --variations-seed-version --mojo-platform-channel-handle=4388 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5148,i,2374125129263617906,17671258319751764506,2097152 --field-trial-handle=2644,i,13044304092384948514,18076778726572126535,262144 --variations-seed-version --mojo-platform-channel-handle=3824 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3424,i,2455469017146862553,5377352331366733841,524288 --field-trial-handle=2644,i,13044304092384948514,18076778726572126535,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3912,i,5533478761204174354,8160239091352002162,2097152 --field-trial-handle=2644,i,13044304092384948514,18076778726572126535,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,14446973234273581302,9897538614655540907,524288 --field-trial-handle=2644,i,13044304092384948514,18076778726572126535,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,14446973234273581302,9897538614655540907,524288 --field-trial-handle=2644,i,13044304092384948514,18076778726572126535,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3820,i,10189068720287205861,17099661413416222137,524288 --field-trial-handle=2644,i,13044304092384948514,18076778726572126535,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5324,i,5537058620659868271,817379992247074244,524288 --field-trial-handle=2644,i,13044304092384948514,18076778726572126535,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6344,i,16739449316769828882,9792048650569949179,524288 --field-trial-handle=2644,i,13044304092384948514,18076778726572126535,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6512,i,8867163368044249619,17755130405378054304,524288 --field-trial-handle=2644,i,13044304092384948514,18076778726572126535,262144 --variations-seed-version --mojo-platform-channel-handle=6504 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6364,i,14193490816237832272,1873705978226038045,524288 --field-trial-handle=2644,i,13044304092384948514,18076778726572126535,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6604,i,547465814892014532,4359109204496691456,524288 --field-trial-handle=2644,i,13044304092384948514,18076778726572126535,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=5492,i,286344311858328409,16714812969046367202,2097152 --field-trial-handle=2644,i,13044304092384948514,18076778726572126535,262144 --variations-seed-version --mojo-platform-channel-handle=6852 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5008,i,2786752522597596046,12641978463625829066,524288 --field-trial-handle=2644,i,13044304092384948514,18076778726572126535,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5208,i,4977170788858611071,9442811158285345137,524288 --field-trial-handle=2644,i,13044304092384948514,18076778726572126535,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5212,i,9541159516134009367,10724641034582433431,524288 --field-trial-handle=2644,i,13044304092384948514,18076778726572126535,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6272,i,16211660938546040150,17996703067607538509,524288 --field-trial-handle=2644,i,13044304092384948514,18076778726572126535,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,16447339630749061150,9369640052397140964,524288 --field-trial-handle=2644,i,13044304092384948514,18076778726572126535,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3532,i,796834483815502088,2538211008482810049,524288 --field-trial-handle=2644,i,13044304092384948514,18076778726572126535,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4384,i,8375745771475549739,5955705423155211826,524288 --field-trial-handle=2644,i,13044304092384948514,18076778726572126535,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6496,i,9143449085540405116,7935988513049275875,262144 --field-trial-handle=2644,i,13044304092384948514,18076778726572126535,262144 --variations-seed-version --mojo-platform-channel-handle=3904 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3448,i,8681266817127627752,2275021296792614849,524288 --field-trial-handle=2644,i,13044304092384948514,18076778726572126535,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\vpnhfzxspnhfcaus.sysC:\Temp\vpnhfzxspnhfcaus.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Temp\zusmkecaur.sysC:\Temp\zusmkecaur.sys1⤵
- Executes dropped EXE
-
C:\Temp\rmkebzurmk.sysC:\Temp\rmkebzurmk.sys1⤵
- Executes dropped EXE
-
C:\Temp\wuomhezwuo.sysC:\Temp\wuomhezwuo.sys1⤵
- Executes dropped EXE
-
C:\Temp\zwromgeywq.sysC:\Temp\zwromgeywq.sys1⤵
- Executes dropped EXE
-
C:\Temp\dbvtolgeyw.sysC:\Temp\dbvtolgeyw.sys1⤵
- Executes dropped EXE
-
C:\Temp\yvtnlfdxvt.sysC:\Temp\yvtnlfdxvt.sys1⤵
- Executes dropped EXE
-
C:\Temp\davtnlfdav.sysC:\Temp\davtnlfdav.sys1⤵
- Executes dropped EXE
-
C:\Temp\faxsqkifax.sysC:\Temp\faxsqkifax.sys1⤵
- Executes dropped EXE
-
C:\Temp\upmkecxusm.sysC:\Temp\upmkecxusm.sys1⤵
- Executes dropped EXE
-
C:\Temp\usmjhfzxrp.sysC:\Temp\usmjhfzxrp.sys1⤵
- Executes dropped EXE
-
C:\Temp\zwrpjhbzur.sysC:\Temp\zwrpjhbzur.sys1⤵
-
C:\Temp\bywurmjebw.sysC:\Temp\bywurmjebw.sys1⤵
-
C:\Temp\ytrolgeywq.sysC:\Temp\ytrolgeywq.sys1⤵
-
C:\Temp\qljdbvsqol.sysC:\Temp\qljdbvsqol.sys1⤵
-
C:\Temp\ayvqnigays.sysC:\Temp\ayvqnigays.sys1⤵
-
C:\Temp\avsnlfdxvp.sysC:\Temp\avsnlfdxvp.sys1⤵
-
C:\Temp\usqkhfzxus.sysC:\Temp\usqkhfzxus.sys1⤵
-
C:\Temp\xrpjhczusm.sysC:\Temp\xrpjhczusm.sys1⤵
-
C:\Temp\zurpjhczur.sysC:\Temp\zurpjhczur.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
causmkfcas.exe
dbvtolgeyw.sys
i_causmkfcas.exe
i_omgebztroj.exe
i_tolgeywtom.exe
i_uomhezxrpj.exe
i_usmkezxrpj.exe
omgebztroj.exe
rmkebzurmk.sys
tolgeywtom.exe
uomhezxrpj.exe
usmkezxrpj.exe
vpnhfzxspnhfcaus.exe
vpnhfzxspnhfcaus.sys
wuomhezwuo.sys
zusmkecaur.sys
zwromgeywq.sys
25adb1bf-2eb1-4fb0-a7ef-37605e3b0f5b.tmp
67d9ce02-180c-4301-837e-cb5f95ea49a0.tmp
95055e1c-00a8-4413-b272-e46bb2a37d34.tmp
9f1ce931-2731-46d0-9392-96488015020b.tmp
settings.dat
settings.dat
2635f762-cd13-4895-add7-c57ccd8be269.tmp
539de170-1c8d-4b22-8d76-4438f79b71e7.tmp
82d094cc-426b-4959-95aa-3ea2cb2a70a7.tmp
9147f148-c99f-4a7c-bde4-3b0f6f7d2011.tmp
95eb101c-3ca4-4312-9407-cdcaa5712900.tmp
temp-index
the-real-index
14820549-58b7-4196-a7c1-4ea3d5eae1ac.tmp
dasherSettingSchema.json
05fa108c-9a16-4e86-863b-4f1b94993f97.tmp
47e59ff7-8adc-408b-8fa6-5b7687c20ec3.tmp
d46ee9f7-ee23-4ec4-a613-2b430f6aab97.tmp
sync_diagnostic.log
b2902adf-5663-404a-8e9c-94320ce16b4a.tmp
8ede0fe2-abeb-43b1-8f66-dc32d7308f73.tmp
ac782e42-477f-4e4d-80d0-ae933881a000.tmp
c59eed53-cd7c-42a2-b936-37da08ce8b6a.tmp
6a675b89-0905-467b-bf1e-c118502be2f3.tmp
d76e4d23-a463-443b-989b-d4ab5079822b.tmp
f0f1ad24-cc14-46c0-ae0c-8f6fb12b7078.tmp
3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
67e53943-08ba-4732-b323-3f53ef05511c.tmp
c3beddc3-0506-4bc1-bd7f-bd44659f9957.tmp
533bf7b2-6d48-4cf0-90d6-59f1a68ad7cd.tmp
fbc05575-27cd-4b66-8e56-e874836464cf.tmp
content.js
messages.json
manifest.json
manifest.json
manifest.json
manifest.json
CreateProcess.exe
memory/252-511-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/624-66-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1236-559-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2004-677-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2384-657-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2532-689-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2536-715-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2672-611-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2732-631-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2756-581-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3328-653-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3828-434-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4068-483-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4364-737-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4396-535-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4684-719-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4820-575-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5368-555-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5816-694-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/6080-523-0x0000000000010000-0x00000000000AB000-memory.dmp