Analysis
- max time kernel
150s - max time network
145s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
09/08/2026, 14:55
General
- Target 2026-08-09_0ebb57fc9c57eaba357b05d315043478_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 361KB
- Sample260809-sartfagq2s
- SHA256 42e8720210804f40dcae6920212f9a98e41da2d4cdb1f6978c6778921d6f476e
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba
-
http://xytets.com:2345/t.asp?os=home
-
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_0ebb57fc9c57eaba357b05d315043478_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_0ebb57fc9c57eaba357b05d315043478_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\olgeywqojgbytrlj.exeC:\Temp\olgeywqojgbytrlj.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\tolgeywroj.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\tolgeywroj.exeC:\Temp\tolgeywroj.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_tolgeywroj.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_tolgeywroj.exeC:\Temp\i_tolgeywroj.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gaywqnlgdy.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\gaywqnlgdy.exeC:\Temp\gaywqnlgdy.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gaywqnlgdy.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_gaywqnlgdy.exeC:\Temp\i_gaywqnlgdy.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qljdavtnlx.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\qljdavtnlx.exeC:\Temp\qljdavtnlx.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qljdavtnlx.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_qljdavtnlx.exeC:\Temp\i_qljdavtnlx.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qkicavsnlf.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\qkicavsnlf.exeC:\Temp\qkicavsnlf.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qkicavsnlf.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_qkicavsnlf.exeC:\Temp\i_qkicavsnlf.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\upkicausnk.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\upkicausnk.exeC:\Temp\upkicausnk.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_upkicausnk.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_upkicausnk.exeC:\Temp\i_upkicausnk.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pnhfzxrpkh.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\pnhfzxrpkh.exeC:\Temp\pnhfzxrpkh.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pnhfzxrpkh.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_pnhfzxrpkh.exeC:\Temp\i_pnhfzxrpkh.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\kecwupmher.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\kecwupmher.exeC:\Temp\kecwupmher.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_kecwupmher.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_kecwupmher.exeC:\Temp\i_kecwupmher.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\omhecwuomh.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\omhecwuomh.exeC:\Temp\omhecwuomh.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_omhecwuomh.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_omhecwuomh.exeC:\Temp\i_omhecwuomh.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mgebwuomge.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\mgebwuomge.exeC:\Temp\mgebwuomge.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mgebwuomge.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_mgebwuomge.exeC:\Temp\i_mgebwuomge.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\dbwtolgeyw.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\dbwtolgeyw.exeC:\Temp\dbwtolgeyw.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_dbwtolgeyw.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_dbwtolgeyw.exeC:\Temp\i_dbwtolgeyw.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nlgdyvtolg.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\nlgdyvtolg.exeC:\Temp\nlgdyvtolg.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nlgdyvtolg.exe ups_ins3⤵
-
C:\Temp\i_nlgdyvtolg.exeC:\Temp\i_nlgdyvtolg.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\avsqkidavs.exe ups_run3⤵
-
C:\Temp\avsqkidavs.exeC:\Temp\avsqkidavs.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_avsqkidavs.exe ups_ins3⤵
-
C:\Temp\i_avsqkidavs.exeC:\Temp\i_avsqkidavs.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vsnlfdxusn.exe ups_run3⤵
-
C:\Temp\vsnlfdxusn.exeC:\Temp\vsnlfdxusn.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vsnlfdxusn.exe ups_ins3⤵
-
C:\Temp\i_vsnlfdxusn.exeC:\Temp\i_vsnlfdxusn.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\spmkeczxvp.exe ups_run3⤵
-
C:\Temp\spmkeczxvp.exeC:\Temp\spmkeczxvp.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_spmkeczxvp.exe ups_ins3⤵
-
C:\Temp\i_spmkeczxvp.exeC:\Temp\i_spmkeczxvp.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pnkfcxupnh.exe ups_run3⤵
-
C:\Temp\pnkfcxupnh.exeC:\Temp\pnkfcxupnh.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pnkfcxupnh.exe ups_ins3⤵
-
C:\Temp\i_pnkfcxupnh.exeC:\Temp\i_pnkfcxupnh.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mhecwurpmh.exe ups_run3⤵
-
C:\Temp\mhecwurpmh.exeC:\Temp\mhecwurpmh.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mhecwurpmh.exe ups_ins3⤵
-
C:\Temp\i_mhecwurpmh.exeC:\Temp\i_mhecwurpmh.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ztrljebzwr.exe ups_run3⤵
-
C:\Temp\ztrljebzwr.exeC:\Temp\ztrljebzwr.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ztrljebzwr.exe ups_ins3⤵
-
C:\Temp\i_ztrljebzwr.exeC:\Temp\i_ztrljebzwr.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ywqomgeyvt.exe ups_run3⤵
-
C:\Temp\ywqomgeyvt.exeC:\Temp\ywqomgeyvt.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ywqomgeyvt.exe ups_ins3⤵
-
C:\Temp\i_ywqomgeyvt.exeC:\Temp\i_ywqomgeyvt.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ljdbvtqoig.exe ups_run3⤵
-
C:\Temp\ljdbvtqoig.exeC:\Temp\ljdbvtqoig.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ljdbvtqoig.exe ups_ins3⤵
-
C:\Temp\i_ljdbvtqoig.exeC:\Temp\i_ljdbvtqoig.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\lidbvtnlfd.exe ups_run3⤵
-
C:\Temp\lidbvtnlfd.exeC:\Temp\lidbvtnlfd.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ff83d36c188,0x7ff83d36c194,0x7ff83d36c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1988,i,5424442124651740220,12811116802513310005,262144 --field-trial-handle=2524,i,676343859195453862,6423227787966108451,262144 --variations-seed-version --mojo-platform-channel-handle=2520 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2164,i,14261880221843054867,8477604669187908805,524288 --field-trial-handle=2524,i,676343859195453862,6423227787966108451,262144 --variations-seed-version --mojo-platform-channel-handle=2548 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2592,i,14364200005975242392,4139354531855786639,524288 --field-trial-handle=2524,i,676343859195453862,6423227787966108451,262144 --variations-seed-version --mojo-platform-channel-handle=3224 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3572,i,1552272790208398233,337380703507467107,2097152 --field-trial-handle=2524,i,676343859195453862,6423227787966108451,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3596,i,3347412686900965081,6244084772971898505,2097152 --field-trial-handle=2524,i,676343859195453862,6423227787966108451,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4224,i,7786928288925116133,18043282518782917423,2097152 --field-trial-handle=2524,i,676343859195453862,6423227787966108451,262144 --variations-seed-version --mojo-platform-channel-handle=4748 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4236,i,6232977439362269298,11001280001715502245,2097152 --field-trial-handle=2524,i,676343859195453862,6423227787966108451,262144 --variations-seed-version --mojo-platform-channel-handle=4752 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3800,i,3135583984655476927,15789284169307486206,2097152 --field-trial-handle=2524,i,676343859195453862,6423227787966108451,262144 --variations-seed-version --mojo-platform-channel-handle=3848 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5156,i,11005504490603581925,2711018880806371553,524288 --field-trial-handle=2524,i,676343859195453862,6423227787966108451,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5508,i,5885621617998291093,2744317112825760576,2097152 --field-trial-handle=2524,i,676343859195453862,6423227787966108451,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,795085880736463961,18398422383966150192,524288 --field-trial-handle=2524,i,676343859195453862,6423227787966108451,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,795085880736463961,18398422383966150192,524288 --field-trial-handle=2524,i,676343859195453862,6423227787966108451,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5424,i,14509172794951279053,2036472674079150367,524288 --field-trial-handle=2524,i,676343859195453862,6423227787966108451,262144 --variations-seed-version --mojo-platform-channel-handle=3848 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5316,i,190866008777794444,14243236428009712884,524288 --field-trial-handle=2524,i,676343859195453862,6423227787966108451,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6428,i,11886761687797228571,13471211721462988500,524288 --field-trial-handle=2524,i,676343859195453862,6423227787966108451,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6528,i,4621738405271691568,12727230506823307726,524288 --field-trial-handle=2524,i,676343859195453862,6423227787966108451,262144 --variations-seed-version --mojo-platform-channel-handle=6532 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6524,i,5512970909179104841,12704029938633620181,2097152 --field-trial-handle=2524,i,676343859195453862,6423227787966108451,262144 --variations-seed-version --mojo-platform-channel-handle=6632 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5036,i,14900885162225793286,15072895841441171407,524288 --field-trial-handle=2524,i,676343859195453862,6423227787966108451,262144 --variations-seed-version --mojo-platform-channel-handle=4752 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5944,i,1392472052587163676,8985229862373435629,524288 --field-trial-handle=2524,i,676343859195453862,6423227787966108451,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1432,i,10602878983082015878,13497383710903056155,524288 --field-trial-handle=2524,i,676343859195453862,6423227787966108451,262144 --variations-seed-version --mojo-platform-channel-handle=1308 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1444,i,16140624965462368185,3163284176932910274,524288 --field-trial-handle=2524,i,676343859195453862,6423227787966108451,262144 --variations-seed-version --mojo-platform-channel-handle=3796 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1452,i,6883567449365735724,17599265132830276404,524288 --field-trial-handle=2524,i,676343859195453862,6423227787966108451,262144 --variations-seed-version --mojo-platform-channel-handle=4852 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,7749261099906560492,12910198241224215488,524288 --field-trial-handle=2524,i,676343859195453862,6423227787966108451,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6832,i,3026277734702930135,133719633862288250,524288 --field-trial-handle=2524,i,676343859195453862,6423227787966108451,262144 --variations-seed-version --mojo-platform-channel-handle=6836 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6852,i,6067493533337315830,9919818011711230632,524288 --field-trial-handle=2524,i,676343859195453862,6423227787966108451,262144 --variations-seed-version --mojo-platform-channel-handle=920 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6620,i,7924246556714969448,11974663221867223768,524288 --field-trial-handle=2524,i,676343859195453862,6423227787966108451,262144 --variations-seed-version --mojo-platform-channel-handle=6844 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6236,i,15617484533711563719,16234219509986832502,262144 --field-trial-handle=2524,i,676343859195453862,6423227787966108451,262144 --variations-seed-version --mojo-platform-channel-handle=6800 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5308,i,9308116811907771522,2270706498694000745,524288 --field-trial-handle=2524,i,676343859195453862,6423227787966108451,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\olgeywqojgbytrlj.sysC:\Temp\olgeywqojgbytrlj.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Temp\wqolgdbwtr.sysC:\Temp\wqolgdbwtr.sys1⤵
- Executes dropped EXE
-
C:\Temp\ytqljdbvtq.sysC:\Temp\ytqljdbvtq.sys1⤵
- Executes dropped EXE
-
C:\Temp\nifdavtnli.sysC:\Temp\nifdavtnli.sys1⤵
- Executes dropped EXE
-
C:\Temp\usmkfcaxsp.sysC:\Temp\usmkfcaxsp.sys1⤵
- Executes dropped EXE
-
C:\Temp\xvpnhfzxsp.sysC:\Temp\xvpnhfzxsp.sys1⤵
- Executes dropped EXE
-
C:\Temp\kecwurpkhf.sysC:\Temp\kecwurpkhf.sys1⤵
- Executes dropped EXE
-
C:\Temp\rmjeczxrpm.sysC:\Temp\rmjeczxrpm.sys1⤵
- Executes dropped EXE
-
C:\Temp\ojgbzwrljh.sysC:\Temp\ojgbzwrljh.sys1⤵
- Executes dropped EXE
-
C:\Temp\mgebwtrljg.sysC:\Temp\mgebwtrljg.sys1⤵
- Executes dropped EXE
-
C:\Temp\qolgdywqoi.sysC:\Temp\qolgdywqoi.sys1⤵
- Executes dropped EXE
-
C:\Temp\gayvqnifdy.sysC:\Temp\gayvqnifdy.sys1⤵
-
C:\Temp\avsnkfdxvs.sysC:\Temp\avsnkfdxvs.sys1⤵
-
C:\Temp\usqkhfcxus.sysC:\Temp\usqkhfcxus.sys1⤵
-
C:\Temp\smkecaurpk.sysC:\Temp\smkecaurpk.sys1⤵
-
C:\Temp\mkecwurpmh.sysC:\Temp\mkecwurpmh.sys1⤵
-
C:\Temp\gezwuomgey.sysC:\Temp\gezwuomgey.sys1⤵
-
C:\Temp\geywuomgey.sysC:\Temp\geywuomgey.sys1⤵
-
C:\Temp\igeywtrlig.sysC:\Temp\igeywtrlig.sys1⤵
-
C:\Temp\igdyvqnlfd.sysC:\Temp\igdyvqnlfd.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
gaywqnlgdy.exe
i_gaywqnlgdy.exe
i_qkicavsnlf.exe
i_qljdavtnlx.exe
i_tolgeywroj.exe
i_upkicausnk.exe
nifdavtnli.sys
olgeywqojgbytrlj.exe
olgeywqojgbytrlj.sys
qkicavsnlf.exe
qljdavtnlx.exe
tolgeywroj.exe
upkicausnk.exe
usmkfcaxsp.sys
wqolgdbwtr.sys
xvpnhfzxsp.sys
ytqljdbvtq.sys
settings.dat
settings.dat
the-real-index
the-real-index~RFe59ae47.TMP
SiteList-Enterprise.json
Edge Profile.ico
751d1763-cf1f-4758-8406-afb72dab58f3.tmp
Network Persistent State
SCT Auditing Pending Reports
Preferences
Preferences
Preferences
Secure Preferences
6db89354-5259-45d7-9851-a1e4e23c6b9a.tmp
Local State
Local State
Local State
Local State
Local State
metadata.json
metadata.json
metadata.json
299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
a5de39d9-e44f-453a-a920-75fd70f3ed56.tmp
metadata.json
f7001182-b6cc-4917-aadb-b9a296b890ea.tmp
content_new.js
CreateProcess.exe
memory/408-737-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/604-719-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1272-233-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1708-185-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2004-694-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2008-64-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2924-511-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3300-613-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3620-633-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3620-655-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4560-583-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4584-556-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4672-606-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4672-579-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4748-560-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4768-689-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5124-658-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5376-363-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5848-564-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5880-653-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5928-678-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/6000-715-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/6000-734-0x0000000000010000-0x00000000000AB000-memory.dmp