Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
15/04/2026, 22:25
General
- Target 2026-04-15_931c498d4a7c8a3aca621998b9c0a1c3_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 376KB
- Sample260415-2cfzdsa18p
- SHA256 d0a3d6df8b77c769e089a336059786a8e17afa8acf54dbe016992f0f737ca1aa
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba
-
http://xytets.com:2345/t.asp?os=home
-
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 41 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 19 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 29 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 3 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_931c498d4a7c8a3aca621998b9c0a1c3_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-15_931c498d4a7c8a3aca621998b9c0a1c3_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\icausmkfcxvpnhfz.exeC:\Temp\icausmkfcxvpnhfz.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pnhfzusmkz.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\pnhfzusmkz.exeC:\Temp\pnhfzusmkz.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pnhfzusmkz.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_pnhfzusmkz.exeC:\Temp\i_pnhfzusmkz.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wrpjhbzurm.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\wrpjhbzurm.exeC:\Temp\wrpjhbzurm.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wrpjhbzurm.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_wrpjhbzurm.exeC:\Temp\i_wrpjhbzurm.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hbztrmjecw.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\hbztrmjecw.exeC:\Temp\hbztrmjecw.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hbztrmjecw.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_hbztrmjecw.exeC:\Temp\i_hbztrmjecw.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bwuomgeywr.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\bwuomgeywr.exeC:\Temp\bwuomgeywr.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bwuomgeywr.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_bwuomgeywr.exeC:\Temp\i_bwuomgeywr.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\idbvtnlgey.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\idbvtnlgey.exeC:\Temp\idbvtnlgey.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_idbvtnlgey.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_idbvtnlgey.exeC:\Temp\i_idbvtnlgey.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\dbvqnlfdyv.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\dbvqnlfdyv.exeC:\Temp\dbvqnlfdyv.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_dbvqnlfdyv.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_dbvqnlfdyv.exeC:\Temp\i_dbvqnlfdyv.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qnigaysqki.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\qnigaysqki.exeC:\Temp\qnigaysqki.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qnigaysqki.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_qnigaysqki.exeC:\Temp\i_qnigaysqki.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\kicaysqkau.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\kicaysqkau.exeC:\Temp\kicaysqkau.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_kicaysqkau.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_kicaysqkau.exeC:\Temp\i_kicaysqkau.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zxspkicaus.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\zxspkicaus.exeC:\Temp\zxspkicaus.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zxspkicaus.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_zxspkicaus.exeC:\Temp\i_zxspkicaus.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hbzxrmkecw.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\hbzxrmkecw.exeC:\Temp\hbzxrmkecw.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hbzxrmkecw.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_hbzxrmkecw.exeC:\Temp\i_hbzxrmkecw.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rmjecwuomg.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\rmjecwuomg.exeC:\Temp\rmjecwuomg.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rmjecwuomg.exe ups_ins3⤵
-
C:\Temp\i_rmjecwuomg.exeC:\Temp\i_rmjecwuomg.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mgerojgbzt.exe ups_run3⤵
-
C:\Temp\mgerojgbzt.exeC:\Temp\mgerojgbzt.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mgerojgbzt.exe ups_ins3⤵
-
C:\Temp\i_mgerojgbzt.exeC:\Temp\i_mgerojgbzt.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\trljdbvtrl.exe ups_run3⤵
-
C:\Temp\trljdbvtrl.exeC:\Temp\trljdbvtrl.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_trljdbvtrl.exe ups_ins3⤵
-
C:\Temp\i_trljdbvtrl.exeC:\Temp\i_trljdbvtrl.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gdywqoidbv.exe ups_run3⤵
-
C:\Temp\gdywqoidbv.exeC:\Temp\gdywqoidbv.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gdywqoidbv.exe ups_ins3⤵
-
C:\Temp\i_gdywqoidbv.exeC:\Temp\i_gdywqoidbv.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\snlfdxsqki.exe ups_run3⤵
-
C:\Temp\snlfdxsqki.exeC:\Temp\snlfdxsqki.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_snlfdxsqki.exe ups_ins3⤵
-
C:\Temp\i_snlfdxsqki.exeC:\Temp\i_snlfdxsqki.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\icausnkfdx.exe ups_run3⤵
-
C:\Temp\icausnkfdx.exeC:\Temp\icausnkfdx.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_icausnkfdx.exe ups_ins3⤵
-
C:\Temp\i_icausnkfdx.exeC:\Temp\i_icausnkfdx.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ausmkfcxvp.exe ups_run3⤵
-
C:\Temp\ausmkfcxvp.exeC:\Temp\ausmkfcxvp.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ausmkfcxvp.exe ups_ins3⤵
-
C:\Temp\i_ausmkfcxvp.exeC:\Temp\i_ausmkfcxvp.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pnhfzusmke.exe ups_run3⤵
-
C:\Temp\pnhfzusmke.exeC:\Temp\pnhfzusmke.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pnhfzusmke.exe ups_ins3⤵
-
C:\Temp\i_pnhfzusmke.exeC:\Temp\i_pnhfzusmke.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wrpjhbztrp.exe ups_run3⤵
-
C:\Temp\wrpjhbztrp.exeC:\Temp\wrpjhbztrp.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wrpjhbztrp.exe ups_ins3⤵
-
C:\Temp\i_wrpjhbztrp.exeC:\Temp\i_wrpjhbztrp.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x368,0x7ff9c42ec188,0x7ff9c42ec194,0x7ff9c42ec1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1716,i,15417638325047713731,16305364199493748305,524288 --field-trial-handle=2200,i,15772722387983668760,14330501720268911941,262144 --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1588,i,16095439698216746461,2745160378352466983,262144 --field-trial-handle=2200,i,15772722387983668760,14330501720268911941,262144 --variations-seed-version --mojo-platform-channel-handle=2196 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2492,i,14387967688116031807,7334230927334378473,524288 --field-trial-handle=2200,i,15772722387983668760,14330501720268911941,262144 --variations-seed-version --mojo-platform-channel-handle=2516 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3512,i,9158203259602618701,11269921551566704282,2097152 --field-trial-handle=2200,i,15772722387983668760,14330501720268911941,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3516,i,10890321758409636040,290831199457720418,2097152 --field-trial-handle=2200,i,15772722387983668760,14330501720268911941,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4828,i,9333295822209884867,13878493304114621540,524288 --field-trial-handle=2200,i,15772722387983668760,14330501720268911941,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4884,i,7130710123001278004,11013702278982296687,524288 --field-trial-handle=2200,i,15772722387983668760,14330501720268911941,262144 --variations-seed-version --mojo-platform-channel-handle=4964 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5716,i,9358456802794076171,13496057274000957488,524288 --field-trial-handle=2200,i,15772722387983668760,14330501720268911941,262144 --variations-seed-version --mojo-platform-channel-handle=5732 /prefetch:144⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.execookie_exporter.exe --cookie-json=11285⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5788,i,10641076082955284387,15755681891390434941,524288 --field-trial-handle=2200,i,15772722387983668760,14330501720268911941,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5788,i,10641076082955284387,15755681891390434941,524288 --field-trial-handle=2200,i,15772722387983668760,14330501720268911941,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,15954429777288743389,2513056246492366962,524288 --field-trial-handle=2200,i,15772722387983668760,14330501720268911941,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,14953176480629177723,8632144008047378512,524288 --field-trial-handle=2200,i,15772722387983668760,14330501720268911941,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,9068400371072180278,9486929140432021816,524288 --field-trial-handle=2200,i,15772722387983668760,14330501720268911941,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6264,i,8270038468372815336,868959578965578414,524288 --field-trial-handle=2200,i,15772722387983668760,14330501720268911941,262144 --variations-seed-version --mojo-platform-channel-handle=728 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6264,i,16016531639147908531,17008368630982792927,524288 --field-trial-handle=2200,i,15772722387983668760,14330501720268911941,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5092,i,13223600685355434217,1139585969948057623,524288 --field-trial-handle=2200,i,15772722387983668760,14330501720268911941,262144 --variations-seed-version --mojo-platform-channel-handle=6440 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5572,i,13762167774989030937,10090019413550294735,524288 --field-trial-handle=2200,i,15772722387983668760,14330501720268911941,262144 --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5056,i,6067580389168799226,13934189543117571005,524288 --field-trial-handle=2200,i,15772722387983668760,14330501720268911941,262144 --variations-seed-version --mojo-platform-channel-handle=6816 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5088,i,9481744013627770319,7617898694002855542,524288 --field-trial-handle=2200,i,15772722387983668760,14330501720268911941,262144 --variations-seed-version --mojo-platform-channel-handle=6936 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6780,i,5100299341019527396,16063477720900375752,262144 --field-trial-handle=2200,i,15772722387983668760,14330501720268911941,262144 --variations-seed-version --mojo-platform-channel-handle=6756 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6172,i,7128392607042969750,3013040576663688951,524288 --field-trial-handle=2200,i,15772722387983668760,14330501720268911941,262144 --variations-seed-version --mojo-platform-channel-handle=3384 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\icausmkfcxvpnhfz.sysC:\Temp\icausmkfcxvpnhfz.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Temp\urmkecwuom.sysC:\Temp\urmkecwuom.sys1⤵
- Executes dropped EXE
-
C:\Temp\zurmkecwuo.sysC:\Temp\zurmkecwuo.sys1⤵
- Executes dropped EXE
-
C:\Temp\jhbztrljdb.sysC:\Temp\jhbztrljdb.sys1⤵
- Executes dropped EXE
-
C:\Temp\ytqljdbvto.sysC:\Temp\ytqljdbvto.sys1⤵
- Executes dropped EXE
-
C:\Temp\qoigaytqlf.sysC:\Temp\qoigaytqlf.sys1⤵
- Executes dropped EXE
-
C:\Temp\lfdxvqniga.sysC:\Temp\lfdxvqniga.sys1⤵
- Executes dropped EXE
-
C:\Temp\vsqkicavsn.sysC:\Temp\vsqkicavsn.sys1⤵
- Executes dropped EXE
-
C:\Temp\kicausmkfc.sysC:\Temp\kicausmkfc.sys1⤵
- Executes dropped EXE
-
C:\Temp\rpjhczurmk.sysC:\Temp\rpjhczurmk.sys1⤵
- Executes dropped EXE
-
C:\Temp\jhczusecwu.sysC:\Temp\jhczusecwu.sys1⤵
- Executes dropped EXE
-
C:\Temp\wrljebwuom.sysC:\Temp\wrljebwuom.sys1⤵
-
C:\Temp\geywqojdbw.sysC:\Temp\geywqojdbw.sys1⤵
-
C:\Temp\tolgdywqoi.sysC:\Temp\tolgdywqoi.sys1⤵
-
C:\Temp\nlysqkidav.sysC:\Temp\nlysqkidav.sys1⤵
-
C:\Temp\dxvqnigays.sysC:\Temp\dxvqnigays.sys1⤵
-
C:\Temp\kicausnkfd.sysC:\Temp\kicausnkfd.sys1⤵
-
C:\Temp\cwupmhfzxr.sysC:\Temp\cwupmhfzxr.sys1⤵
-
C:\Temp\jhbzuomhbz.sysC:\Temp\jhbzuomhbz.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CreateProcess.exe
bwuomgeywr.exe
dbvqnlfdyv.exe
hbztrmjecw.exe
i_bwuomgeywr.exe
i_dbvqnlfdyv.exe
i_hbztrmjecw.exe
i_idbvtnlgey.exe
i_pnhfzusmkz.exe
i_wrpjhbzurm.exe
icausmkfcxvpnhfz.exe
icausmkfcxvpnhfz.sys
idbvtnlgey.exe
jhbztrljdb.sys
pnhfzusmkz.exe
qoigaytqlf.sys
urmkecwuom.sys
wrpjhbzurm.exe
ytqljdbvto.sys
zurmkecwuo.sys
autofill_bypass_cache_forms.json
edge_autofill_global_block_list.json
v1FieldTypes.json
settings.dat
settings.dat
4363d2a4-b5e8-4d62-89f6-78f57490061d.tmp
BookmarkMergedSurfaceOrdering
BrowsingTopicsState
SiteList-Enterprise.json
HubApps
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Preferences
Preferences
sync_diagnostic.log
CURRENT
MANIFEST-000001
data.txt
Local State
Local State
Local State
Local State
Local State
metadata.json
metadata.json
metadata.json
metadata.json
3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
metadata.json
fd2aa73a-4002-4e94-a655-b0ce6bc5788b.tmp
manifest.json
manifest.json
keys.json
manifest.json
manifest.json
memory/324-575-0x00000000009A0000-0x0000000000A7F000-memory.dmp
memory/432-854-0x0000000000890000-0x000000000096F000-memory.dmp
memory/552-592-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/572-66-0x0000000000830000-0x000000000090F000-memory.dmp
memory/608-704-0x0000000000960000-0x0000000000A3F000-memory.dmp
memory/740-591-0x0000000000990000-0x0000000000A6F000-memory.dmp
memory/932-631-0x0000000000980000-0x0000000000A5F000-memory.dmp
memory/936-587-0x0000000000970000-0x0000000000A4F000-memory.dmp
memory/1032-839-0x0000000000960000-0x0000000000A3F000-memory.dmp
memory/1056-623-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1056-672-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1060-760-0x0000000000AE0000-0x0000000000BBF000-memory.dmp
memory/1120-588-0x0000000000A10000-0x0000000000AEF000-memory.dmp
memory/1140-687-0x0000000000860000-0x000000000093F000-memory.dmp
memory/1264-225-0x0000000000970000-0x0000000000A4F000-memory.dmp
memory/1412-262-0x00000000009F0000-0x0000000000ACF000-memory.dmp
memory/1528-630-0x0000000000A10000-0x0000000000AEF000-memory.dmp
memory/1592-852-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1620-815-0x00000000009B0000-0x0000000000A8F000-memory.dmp
memory/1788-239-0x0000000000A40000-0x0000000000B1F000-memory.dmp
memory/1808-539-0x0000000000A40000-0x0000000000B1F000-memory.dmp
memory/1836-804-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2016-803-0x0000000000960000-0x0000000000A3F000-memory.dmp
memory/2088-726-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2196-568-0x0000000000820000-0x00000000008FF000-memory.dmp
memory/2260-840-0x0000000000A60000-0x0000000000B3F000-memory.dmp
memory/2292-65-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2364-851-0x0000000000980000-0x0000000000A5F000-memory.dmp
memory/2380-607-0x0000000000A90000-0x0000000000B6F000-memory.dmp
memory/2416-270-0x0000000000830000-0x000000000090F000-memory.dmp
memory/2432-759-0x0000000000A60000-0x0000000000B3F000-memory.dmp
memory/2512-619-0x00000000009E0000-0x0000000000ABF000-memory.dmp
memory/2628-640-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2628-608-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2640-766-0x00000000009C0000-0x0000000000A9F000-memory.dmp
memory/2760-725-0x0000000000970000-0x0000000000A4F000-memory.dmp
memory/2776-749-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2776-800-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2812-675-0x0000000000A50000-0x0000000000B2F000-memory.dmp
memory/3076-828-0x0000000000930000-0x0000000000A0F000-memory.dmp
memory/3112-814-0x0000000000880000-0x000000000095F000-memory.dmp
memory/3272-381-0x00000000009C0000-0x0000000000A9F000-memory.dmp
memory/3316-748-0x00000000009F0000-0x0000000000ACF000-memory.dmp
memory/3372-869-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3448-829-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3588-595-0x00000000009E0000-0x0000000000ABF000-memory.dmp
memory/3592-203-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3640-271-0x0000000000970000-0x0000000000A4F000-memory.dmp
memory/3672-728-0x0000000000970000-0x0000000000A4F000-memory.dmp
memory/3704-767-0x0000000000970000-0x0000000000A4F000-memory.dmp
memory/3788-670-0x0000000000870000-0x000000000094F000-memory.dmp
memory/3792-569-0x0000000000AE0000-0x0000000000BBF000-memory.dmp
memory/3896-729-0x00000000008C0000-0x000000000099F000-memory.dmp
memory/3916-855-0x0000000000970000-0x0000000000A4F000-memory.dmp
memory/4240-618-0x0000000000A50000-0x0000000000B2F000-memory.dmp
memory/4312-67-0x0000000000970000-0x0000000000A4F000-memory.dmp
memory/4352-264-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4444-532-0x0000000000A10000-0x0000000000AEF000-memory.dmp
memory/4460-514-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4472-683-0x0000000000990000-0x0000000000A6F000-memory.dmp
memory/4476-247-0x0000000000870000-0x000000000094F000-memory.dmp
memory/4608-248-0x0000000000A20000-0x0000000000AFF000-memory.dmp
memory/4672-674-0x0000000000980000-0x0000000000A5F000-memory.dmp
memory/4680-671-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4680-685-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4764-241-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4804-541-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4804-577-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4816-764-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4884-224-0x00000000009D0000-0x0000000000AAF000-memory.dmp
memory/4888-899-0x0000000000980000-0x0000000000A5F000-memory.dmp
memory/4964-868-0x00000000009B0000-0x0000000000A8F000-memory.dmp
memory/5012-684-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5216-622-0x00000000009D0000-0x0000000000AAF000-memory.dmp
memory/5584-533-0x0000000000970000-0x0000000000A4F000-memory.dmp
memory/5660-763-0x00000000009A0000-0x0000000000A7F000-memory.dmp
memory/5708-887-0x0000000000830000-0x000000000090F000-memory.dmp
memory/5728-888-0x0000000000980000-0x0000000000A5F000-memory.dmp
memory/5808-604-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5808-576-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5836-816-0x0000000000200000-0x000000000025F000-memory.dmp
memory/5884-594-0x0000000000990000-0x0000000000A6F000-memory.dmp
memory/6052-201-0x0000000000A10000-0x0000000000AEF000-memory.dmp