Analysis
- max time kernel
148s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
11/11/2026, 18:12
General
- Target 2026-11-10_d9d59c92a7070976ade1cadd7ab4b015_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 361KB
- Sample261111-wthawsxt9q
- SHA256 f134b0cb404543a156faa0d414749beb66604539723da7293be54381b3d1fc5f
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba
-
http://xytets.com:2345/t.asp?os=home
-
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-10_d9d59c92a7070976ade1cadd7ab4b015_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-10_d9d59c92a7070976ade1cadd7ab4b015_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\qnifdxvqnigaysqk.exeC:\Temp\qnifdxvqnigaysqk.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vtqkidysqi.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\vtqkidysqi.exeC:\Temp\vtqkidysqi.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vtqkidysqi.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_vtqkidysqi.exeC:\Temp\i_vtqkidysqi.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ayspnhfaxs.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ayspnhfaxs.exeC:\Temp\ayspnhfaxs.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ayspnhfaxs.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ayspnhfaxs.exeC:\Temp\i_ayspnhfaxs.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\cxvpnhfzxv.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\cxvpnhfzxv.exeC:\Temp\cxvpnhfzxv.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_cxvpnhfzxv.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_cxvpnhfzxv.exeC:\Temp\i_cxvpnhfzxv.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\urpkhfzusm.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\urpkhfzusm.exeC:\Temp\urpkhfzusm.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_urpkhfzusm.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_urpkhfzusm.exeC:\Temp\i_urpkhfzusm.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zxrpjhbztr.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\zxrpjhbztr.exeC:\Temp\zxrpjhbztr.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zxrpjhbztr.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_zxrpjhbztr.exeC:\Temp\i_zxrpjhbztr.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ecwujhbzwu.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ecwujhbzwu.exeC:\Temp\ecwujhbzwu.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ecwujhbzwu.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ecwujhbzwu.exeC:\Temp\i_ecwujhbzwu.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ywtrojgbyw.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ywtrojgbyw.exeC:\Temp\ywtrojgbyw.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ywtrojgbyw.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ywtrojgbyw.exeC:\Temp\i_ywtrojgbyw.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ligbytqoig.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ligbytqoig.exeC:\Temp\ligbytqoig.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ligbytqoig.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ligbytqoig.exeC:\Temp\i_ligbytqoig.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fdxvqnigdy.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\fdxvqnigdy.exeC:\Temp\fdxvqnigdy.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fdxvqnigdy.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_fdxvqnigdy.exeC:\Temp\i_fdxvqnigdy.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\idavtnlida.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\idavtnlida.exeC:\Temp\idavtnlida.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_idavtnlida.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_idavtnlida.exeC:\Temp\i_idavtnlida.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fcxvpnhfax.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\fcxvpnhfax.exeC:\Temp\fcxvpnhfax.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fcxvpnhfax.exe ups_ins3⤵
-
C:\Temp\i_fcxvpnhfax.exeC:\Temp\i_fcxvpnhfax.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hfcxupmkec.exe ups_run3⤵
-
C:\Temp\hfcxupmkec.exeC:\Temp\hfcxupmkec.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hfcxupmkec.exe ups_ins3⤵
-
C:\Temp\i_hfcxupmkec.exeC:\Temp\i_hfcxupmkec.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rmkecwuomh.exe ups_run3⤵
-
C:\Temp\rmkecwuomh.exeC:\Temp\rmkecwuomh.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rmkecwuomh.exe ups_ins3⤵
-
C:\Temp\i_rmkecwuomh.exeC:\Temp\i_rmkecwuomh.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wurmkezxrp.exe ups_run3⤵
-
C:\Temp\wurmkezxrp.exeC:\Temp\wurmkezxrp.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wurmkezxrp.exe ups_ins3⤵
-
C:\Temp\i_wurmkezxrp.exeC:\Temp\i_wurmkezxrp.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rljhbztrlj.exe ups_run3⤵
-
C:\Temp\rljhbztrlj.exeC:\Temp\rljhbztrlj.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rljhbztrlj.exe ups_ins3⤵
-
C:\Temp\i_rljhbztrlj.exeC:\Temp\i_rljhbztrlj.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jdbwtomgey.exe ups_run3⤵
-
C:\Temp\jdbwtomgey.exeC:\Temp\jdbwtomgey.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jdbwtomgey.exe ups_ins3⤵
-
C:\Temp\i_jdbwtomgey.exeC:\Temp\i_jdbwtomgey.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bvtnlfdyvq.exe ups_run3⤵
-
C:\Temp\bvtnlfdyvq.exeC:\Temp\bvtnlfdyvq.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bvtnlfdyvq.exe ups_ins3⤵
-
C:\Temp\i_bvtnlfdyvq.exeC:\Temp\i_bvtnlfdyvq.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\igayvqoiga.exe ups_run3⤵
-
C:\Temp\igayvqoiga.exeC:\Temp\igayvqoiga.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_igayvqoiga.exe ups_ins3⤵
-
C:\Temp\i_igayvqoiga.exeC:\Temp\i_igayvqoiga.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ysqkicavsn.exe ups_run3⤵
-
C:\Temp\ysqkicavsn.exeC:\Temp\ysqkicavsn.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ysqkicavsn.exe ups_ins3⤵
-
C:\Temp\i_ysqkicavsn.exeC:\Temp\i_ysqkicavsn.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vpnhfaxvpn.exe ups_run3⤵
-
C:\Temp\vpnhfaxvpn.exeC:\Temp\vpnhfaxvpn.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2c8,0x304,0x7ffa50f8c188,0x7ffa50f8c194,0x7ffa50f8c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,4022738251751185846,16475955181922592404,262144 --field-trial-handle=2268,i,4725794112519696546,3811680299823533420,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1920,i,18050945176884751254,3441438717701561911,524288 --field-trial-handle=2268,i,4725794112519696546,3811680299823533420,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2524,i,8289625048485739801,1650382456537931127,524288 --field-trial-handle=2268,i,4725794112519696546,3811680299823533420,262144 --variations-seed-version --mojo-platform-channel-handle=3192 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3572,i,13977705321098997231,16270945656841306580,2097152 --field-trial-handle=2268,i,4725794112519696546,3811680299823533420,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3604,i,6298156710573313324,12598212854908796764,2097152 --field-trial-handle=2268,i,4725794112519696546,3811680299823533420,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4312,i,7273151898485706245,448703606628714249,2097152 --field-trial-handle=2268,i,4725794112519696546,3811680299823533420,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4248,i,15341754791121270532,12655067812609552001,2097152 --field-trial-handle=2268,i,4725794112519696546,3811680299823533420,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3752,i,13379138317118213374,12315864004326991203,524288 --field-trial-handle=2268,i,4725794112519696546,3811680299823533420,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3720,i,18185362311259217355,2353976208523209780,524288 --field-trial-handle=2268,i,4725794112519696546,3811680299823533420,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3740,i,9905203085065959665,7629058168423030693,524288 --field-trial-handle=2268,i,4725794112519696546,3811680299823533420,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5968,i,11988032675872597181,14598838961511153895,524288 --field-trial-handle=2268,i,4725794112519696546,3811680299823533420,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5968,i,11988032675872597181,14598838961511153895,524288 --field-trial-handle=2268,i,4725794112519696546,3811680299823533420,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6292,i,4644583604113962128,9654403858198121231,524288 --field-trial-handle=2268,i,4725794112519696546,3811680299823533420,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6472,i,438853140428214214,768637740569944389,524288 --field-trial-handle=2268,i,4725794112519696546,3811680299823533420,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6824,i,12368485789583599266,11610774806471404686,524288 --field-trial-handle=2268,i,4725794112519696546,3811680299823533420,262144 --variations-seed-version --mojo-platform-channel-handle=6828 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6972,i,10405770984877744620,4900278405788707873,524288 --field-trial-handle=2268,i,4725794112519696546,3811680299823533420,262144 --variations-seed-version --mojo-platform-channel-handle=6968 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4456,i,8342128696568840098,12346990311834879100,524288 --field-trial-handle=2268,i,4725794112519696546,3811680299823533420,262144 --variations-seed-version --mojo-platform-channel-handle=4888 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4940,i,1159585817398856353,12473124624332297334,524288 --field-trial-handle=2268,i,4725794112519696546,3811680299823533420,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4944,i,1716752824897578058,5131916498064147689,524288 --field-trial-handle=2268,i,4725794112519696546,3811680299823533420,262144 --variations-seed-version --mojo-platform-channel-handle=7052 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4972,i,12457595084000789224,11352334544109711453,524288 --field-trial-handle=2268,i,4725794112519696546,3811680299823533420,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,12759372296745461251,15196517211633052009,524288 --field-trial-handle=2268,i,4725794112519696546,3811680299823533420,262144 --variations-seed-version --mojo-platform-channel-handle=7024 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6976,i,6168295946559355552,14267112579257895777,524288 --field-trial-handle=2268,i,4725794112519696546,3811680299823533420,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7080,i,11723643915297034127,11734843896668846227,524288 --field-trial-handle=2268,i,4725794112519696546,3811680299823533420,262144 --variations-seed-version --mojo-platform-channel-handle=4924 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6888,i,16725852188612786756,16183348738354477978,262144 --field-trial-handle=2268,i,4725794112519696546,3811680299823533420,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6808,i,7171707469714198984,14867326614387019289,524288 --field-trial-handle=2268,i,4725794112519696546,3811680299823533420,262144 --variations-seed-version --mojo-platform-channel-handle=6788 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\qnifdxvqnigaysqk.sysC:\Temp\qnifdxvqnigaysqk.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Temp\qkigaysqki.sysC:\Temp\qkigaysqki.sys1⤵
- Executes dropped EXE
-
C:\Temp\fcausnkfdx.sysC:\Temp\fcausnkfdx.sys1⤵
- Executes dropped EXE
-
C:\Temp\usmkecxusm.sysC:\Temp\usmkecxusm.sys1⤵
- Executes dropped EXE
-
C:\Temp\keurpjhczu.sysC:\Temp\keurpjhczu.sys1⤵
- Executes dropped EXE
-
C:\Temp\hbzurmgecw.sysC:\Temp\hbzurmgecw.sys1⤵
- Executes dropped EXE
-
C:\Temp\ywtomjebzt.sysC:\Temp\ywtomjebzt.sys1⤵
- Executes dropped EXE
-
C:\Temp\olgeywqoig.sysC:\Temp\olgeywqoig.sys1⤵
- Executes dropped EXE
-
C:\Temp\tqljdbvtnl.sysC:\Temp\tqljdbvtnl.sys1⤵
- Executes dropped EXE
-
C:\Temp\lfdavtnlfd.sysC:\Temp\lfdavtnlfd.sys1⤵
- Executes dropped EXE
-
C:\Temp\ifaxsqkica.sysC:\Temp\ifaxsqkica.sys1⤵
- Executes dropped EXE
-
C:\Temp\hfcxupnkfc.sysC:\Temp\hfcxupnkfc.sys1⤵
-
C:\Temp\uspkhczusm.sysC:\Temp\uspkhczusm.sys1⤵
-
C:\Temp\zxrpjhbzxr.sysC:\Temp\zxrpjhbzxr.sys1⤵
-
C:\Temp\omjebztroj.sysC:\Temp\omjebztroj.sys1⤵
-
C:\Temp\jgbytrljdb.sysC:\Temp\jgbytrljdb.sys1⤵
-
C:\Temp\jdbytqlige.sysC:\Temp\jdbytqlige.sys1⤵
-
C:\Temp\igaysqlidb.sysC:\Temp\igaysqlidb.sys1⤵
-
C:\Temp\fdxvqnifay.sysC:\Temp\fdxvqnifay.sys1⤵
-
C:\Temp\spkifaxspk.sysC:\Temp\spkifaxspk.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
ayspnhfaxs.exe
cxvpnhfzxv.exe
ecwujhbzwu.exe
fcausnkfdx.sys
hbzurmgecw.sys
i_ayspnhfaxs.exe
i_cxvpnhfzxv.exe
i_urpkhfzusm.exe
i_vtqkidysqi.exe
i_zxrpjhbztr.exe
keurpjhczu.sys
qkigaysqki.sys
qnifdxvqnigaysqk.exe
qnifdxvqnigaysqk.sys
urpkhfzusm.exe
usmkecxusm.sys
vtqkidysqi.exe
zxrpjhbztr.exe
0ab3f17c-1ed0-4db0-b489-7bca743a8572.tmp
1213d58e-a555-49cd-9805-375236bd9ebb.tmp
19952bfd-679e-409f-aef9-d92be4dbdabb.tmp
3e3facda-0e5d-49c7-8699-b6df4d39bf59.tmp
9d3d1279-17d3-40d3-9347-ada2b7412145.tmp
manifest.json
settings.dat
settings.dat
13ce9a9f-7751-41ed-a5bf-968b75c4e58d.tmp
1cf2830f-9b3e-4a37-b9fc-f4e2c85117d0.tmp
2cad096b-96bc-4fb4-9de2-fc5c50c5118e.tmp
9139390b-f230-485d-b47f-5a636bd31ab2.tmp
temp-index
b1fc6a43-30c1-41ee-81d5-ff80be17398c.tmp
128.png
messages.json
dasherSettingSchema.json
service_worker_bin_prod.js
066725ad-116f-4589-9ce7-024d1b4020b6.tmp
9c223732-d2be-40df-905d-5560683ff69d.tmp
e4059f37-7895-4230-8d48-cfe87cd15b07.tmp
sync_diagnostic.log
bc79b5ed-3206-4a41-8ef8-190305fca813.tmp
e237d345-3c88-4b62-9059-1b82bbc123f3.tmp
fee51ab3-d065-4485-8e46-bdcd2a2d84ad.tmp
manifest.json
smart_switch_list.json
manifest.json
manifest.json
nav_config.json
36807b5c-5230-4f0a-a719-97b54cfeca83.tmp
44bb3112-6e56-4c8e-b188-3ae6c8db1abc.tmp
90ae6509-e310-44d4-96a9-44f82a588bf5.tmp
3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
d6a134c0-afcf-494f-b098-82db36e80de9.tmp
metadata.json
ffc455d7-d655-490d-b79e-3ddc21cc626d.tmp
3f6f6f35-70ea-485c-ac64-665c9b157f3f.tmp
6d8c4461-076f-4ebe-8cd1-a9b6246a68f0.tmp
content.js
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
verified_contents.json
manifest.json
offscreendocument.html
offscreendocument_main.js
page_embed_script.js
llm_user_input_extractor_config.json
office_endpoints_list.json
protocols.json
CreateProcess.exe
memory/1244-62-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1244-737-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1912-954-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1912-897-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1912-777-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1912-971-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2488-876-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2488-847-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2532-995-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2548-752-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2900-702-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3004-802-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3004-828-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3196-996-0x0000000000CB0000-0x0000000000D0F000-memory.dmp
memory/3576-885-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3788-831-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3820-1001-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4160-920-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4572-975-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4572-998-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4584-826-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4876-823-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4876-789-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4880-1024-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4980-853-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5032-934-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5928-969-0x0000000000010000-0x00000000000AB000-memory.dmp