Analysis
- max time kernel
149s - max time network
157s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
06/10/2026, 12:33
General
- Target 2026-10-06_6e924f5ee431cd0b5341d9e27e7a93bd_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 456KB
- Sample261006-pradyay1et
- SHA256 ba45d38ea0afed991b3ab843dbea8af935c9b185617423a402a1665b0d43d392
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba
-
http://xytets.com:2345/t.asp?os=home
-
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 9 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 41 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 19 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 19 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-06_6e924f5ee431cd0b5341d9e27e7a93bd_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-06_6e924f5ee431cd0b5341d9e27e7a93bd_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\urmjezwurmjhezwu.exeC:\Temp\urmjezwurmjhezwu.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bzxrpjhezw.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\bzxrpjhezw.exeC:\Temp\bzxrpjhezw.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bzxrpjhezw.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_bzxrpjhezw.exeC:\Temp\i_bzxrpjhezw.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\oljdbwtojd.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\oljdbwtojd.exeC:\Temp\oljdbwtojd.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_oljdbwtojd.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_oljdbwtojd.exeC:\Temp\i_oljdbwtojd.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\lgdbwtrigy.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\lgdbwtrigy.exeC:\Temp\lgdbwtrigy.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_lgdbwtrigy.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_lgdbwtrigy.exeC:\Temp\i_lgdbwtrigy.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\yvqolgdyvq.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\yvqolgdyvq.exeC:\Temp\yvqolgdyvq.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_yvqolgdyvq.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_yvqolgdyvq.exeC:\Temp\i_yvqolgdyvq.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pnifaysqki.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\pnifaysqki.exeC:\Temp\pnifaysqki.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pnifaysqki.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_pnifaysqki.exeC:\Temp\i_pnifaysqki.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nkicavsnkf.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\nkicavsnkf.exeC:\Temp\nkicavsnkf.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nkicavsnkf.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_nkicavsnkf.exeC:\Temp\i_nkicavsnkf.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\khcaupmhfz.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\khcaupmhfz.exeC:\Temp\khcaupmhfz.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_khcaupmhfz.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_khcaupmhfz.exeC:\Temp\i_khcaupmhfz.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pnhfzusmke.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\pnhfzusmke.exeC:\Temp\pnhfzusmke.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pnhfzusmke.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_pnhfzusmke.exeC:\Temp\i_pnhfzusmke.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ezwrpjhbzt.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ezwrpjhbzt.exeC:\Temp\ezwrpjhbzt.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ezwrpjhbzt.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ezwrpjhbzt.exeC:\Temp\i_ezwrpjhbzt.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ztrljdbztr.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ztrljdbztr.exeC:\Temp\ztrljdbztr.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ztrljdbztr.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ztrljdbztr.exeC:\Temp\i_ztrljdbztr.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\dbvtrljdbv.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\dbvtrljdbv.exeC:\Temp\dbvtrljdbv.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_dbvtrljdbv.exe ups_ins3⤵
-
C:\Temp\i_dbvtrljdbv.exeC:\Temp\i_dbvtrljdbv.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qlgdyoifdy.exe ups_run3⤵
-
C:\Temp\qlgdyoifdy.exeC:\Temp\qlgdyoifdy.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qlgdyoifdy.exe ups_ins3⤵
-
C:\Temp\i_qlgdyoifdy.exeC:\Temp\i_qlgdyoifdy.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\lidbvtnlfd.exe ups_run3⤵
-
C:\Temp\lidbvtnlfd.exeC:\Temp\lidbvtnlfd.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_lidbvtnlfd.exe ups_ins3⤵
-
C:\Temp\i_lidbvtnlfd.exeC:\Temp\i_lidbvtnlfd.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ifaxvpnifa.exe ups_run3⤵
-
C:\Temp\ifaxvpnifa.exeC:\Temp\ifaxvpnifa.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ifaxvpnifa.exe ups_ins3⤵
-
C:\Temp\i_ifaxvpnifa.exeC:\Temp\i_ifaxvpnifa.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xuspnhfzxs.exe ups_run3⤵
-
C:\Temp\xuspnhfzxs.exeC:\Temp\xuspnhfzxs.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xuspnhfzxs.exe ups_ins3⤵
-
C:\Temp\i_xuspnhfzxs.exeC:\Temp\i_xuspnhfzxs.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wupmhfzxrp.exe ups_run3⤵
-
C:\Temp\wupmhfzxrp.exeC:\Temp\wupmhfzxrp.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wupmhfzxrp.exe ups_ins3⤵
-
C:\Temp\i_wupmhfzxrp.exeC:\Temp\i_wupmhfzxrp.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\uomkhezwur.exe ups_run3⤵
-
C:\Temp\uomkhezwur.exeC:\Temp\uomkhezwur.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_uomkhezwur.exe ups_ins3⤵
-
C:\Temp\i_uomkhezwur.exeC:\Temp\i_uomkhezwur.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\omgezwrojg.exe ups_run3⤵
-
C:\Temp\omgezwrojg.exeC:\Temp\omgezwrojg.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_omgezwrojg.exe ups_ins3⤵
-
C:\Temp\i_omgezwrojg.exeC:\Temp\i_omgezwrojg.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\lgdbywqolj.exe ups_run3⤵
-
C:\Temp\lgdbywqolj.exeC:\Temp\lgdbywqolj.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_lgdbywqolj.exe ups_ins3⤵
-
C:\Temp\i_lgdbywqolj.exeC:\Temp\i_lgdbywqolj.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f4,0x2f8,0x2fc,0x2f0,0x2cc,0x7ffd35f3c188,0x7ffd35f3c194,0x7ffd35f3c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1940,i,12263792845312126102,5709015970596765418,262144 --field-trial-handle=2476,i,7698367676172688810,9718146446875161360,262144 --variations-seed-version --mojo-platform-channel-handle=2472 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2092,i,612861591302842506,7706606202186668253,524288 --field-trial-handle=2476,i,7698367676172688810,9718146446875161360,262144 --variations-seed-version --mojo-platform-channel-handle=2508 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2676,i,11174796620523158780,14433827097499456798,524288 --field-trial-handle=2476,i,7698367676172688810,9718146446875161360,262144 --variations-seed-version --mojo-platform-channel-handle=3280 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3580,i,4769472649087210249,15808100190855583385,2097152 --field-trial-handle=2476,i,7698367676172688810,9718146446875161360,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3584,i,9003709897351813237,1569288292511588802,2097152 --field-trial-handle=2476,i,7698367676172688810,9718146446875161360,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,2144728642416731882,8135598207106108890,2097152 --field-trial-handle=2476,i,7698367676172688810,9718146446875161360,262144 --variations-seed-version --mojo-platform-channel-handle=4828 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4224,i,14545998386831731171,105663963001694723,2097152 --field-trial-handle=2476,i,7698367676172688810,9718146446875161360,262144 --variations-seed-version --mojo-platform-channel-handle=4832 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5252,i,13923518893689965573,6189227912395907192,524288 --field-trial-handle=2476,i,7698367676172688810,9718146446875161360,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5468,i,13170075307684794774,13446535231416400912,524288 --field-trial-handle=2476,i,7698367676172688810,9718146446875161360,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5472,i,14520111139675266081,1574743710894616202,524288 --field-trial-handle=2476,i,7698367676172688810,9718146446875161360,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,2992552598085168348,14673339021524158133,524288 --field-trial-handle=2476,i,7698367676172688810,9718146446875161360,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,2992552598085168348,14673339021524158133,524288 --field-trial-handle=2476,i,7698367676172688810,9718146446875161360,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,16845399422715682087,7753932602316361205,524288 --field-trial-handle=2476,i,7698367676172688810,9718146446875161360,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6520,i,9862933305284203002,10258209779667424400,524288 --field-trial-handle=2476,i,7698367676172688810,9718146446875161360,262144 --variations-seed-version --mojo-platform-channel-handle=6524 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5244,i,10101837204151083642,7857942794391347792,2097152 --field-trial-handle=2476,i,7698367676172688810,9718146446875161360,262144 --variations-seed-version --mojo-platform-channel-handle=6608 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=3840,i,3101501875581051246,16154821796292139423,2097152 --field-trial-handle=2476,i,7698367676172688810,9718146446875161360,262144 --variations-seed-version --mojo-platform-channel-handle=3848 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1304,i,4358675415190930820,3253392600867087756,524288 --field-trial-handle=2476,i,7698367676172688810,9718146446875161360,262144 --variations-seed-version --mojo-platform-channel-handle=1300 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6564,i,3588059664254145466,7437911665043233345,524288 --field-trial-handle=2476,i,7698367676172688810,9718146446875161360,262144 --variations-seed-version --mojo-platform-channel-handle=1412 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1308,i,4490785755257209893,10721676314725936069,524288 --field-trial-handle=2476,i,7698367676172688810,9718146446875161360,262144 --variations-seed-version --mojo-platform-channel-handle=4876 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=4832,i,2090648616605431065,12425049649553080021,2097152 --field-trial-handle=2476,i,7698367676172688810,9718146446875161360,262144 --variations-seed-version --mojo-platform-channel-handle=3804 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6576,i,9504247337265869580,698755450234353506,2097152 --field-trial-handle=2476,i,7698367676172688810,9718146446875161360,262144 --variations-seed-version --mojo-platform-channel-handle=1500 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5164,i,10939217251984054169,3811107307604397641,524288 --field-trial-handle=2476,i,7698367676172688810,9718146446875161360,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6448,i,7729137124713367591,6716397447747713935,524288 --field-trial-handle=2476,i,7698367676172688810,9718146446875161360,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6696,i,7449907790334922738,9809842537273588204,524288 --field-trial-handle=2476,i,7698367676172688810,9718146446875161360,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5088,i,983774857962353862,7983074417930268804,524288 --field-trial-handle=2476,i,7698367676172688810,9718146446875161360,262144 --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4840,i,10631008046893139349,8320983324392019089,262144 --field-trial-handle=2476,i,7698367676172688810,9718146446875161360,262144 --variations-seed-version --mojo-platform-channel-handle=4824 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4824,i,7329270196386427007,6496943620494309660,524288 --field-trial-handle=2476,i,7698367676172688810,9718146446875161360,262144 --variations-seed-version --mojo-platform-channel-handle=4808 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\urmjezwurmjhezwu.sysC:\Temp\urmjezwurmjhezwu.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Temp\gbztrljebw.sysC:\Temp\gbztrljebw.sys1⤵
- Executes dropped EXE
-
C:\Temp\rljgbztrlj.sysC:\Temp\rljgbztrlj.sys1⤵
- Executes dropped EXE
-
C:\Temp\gdyvtnlgdy.sysC:\Temp\gdyvtnlgdy.sys1⤵
- Executes dropped EXE
-
C:\Temp\aysnlfdxvt.sysC:\Temp\aysnlfdxvt.sys1⤵
- Executes dropped EXE
-
C:\Temp\xvpnhfaxsq.sysC:\Temp\xvpnhfaxsq.sys1⤵
- Executes dropped EXE
-
C:\Temp\zxvsnkfdxv.sysC:\Temp\zxvsnkfdxv.sys1⤵
- Executes dropped EXE
-
C:\Temp\xupnhfzxrp.sysC:\Temp\xupnhfzxrp.sys1⤵
- Executes dropped EXE
-
C:\Temp\mkecwurmke.sysC:\Temp\mkecwurmke.sys1⤵
- Executes dropped EXE
-
C:\Temp\jebwtomgeb.sysC:\Temp\jebwtomgeb.sys1⤵
- Executes dropped EXE
-
C:\Temp\trljdbwtrl.sysC:\Temp\trljdbwtrl.sys1⤵
- Executes dropped EXE
-
C:\Temp\vtqljdbvto.sysC:\Temp\vtqljdbvto.sys1⤵
-
C:\Temp\tnlfdyvqni.sysC:\Temp\tnlfdyvqni.sys1⤵
-
C:\Temp\kfdxusqkic.sysC:\Temp\kfdxusqkic.sys1⤵
-
C:\Temp\xupnkicaxr.sysC:\Temp\xupnkicaxr.sys1⤵
-
C:\Temp\fzxupmhfzx.sysC:\Temp\fzxupmhfzx.sys1⤵
-
C:\Temp\rpjhfzxrpm.sysC:\Temp\rpjhfzxrpm.sys1⤵
-
C:\Temp\ojhbzwrpje.sysC:\Temp\ojhbzwrpje.sys1⤵
-
C:\Temp\ljdbwtqojg.sysC:\Temp\ljdbwtqojg.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
aysnlfdxvt.sys
bzxrpjhezw.exe
gbztrljebw.sys
gdyvtnlgdy.sys
i_bzxrpjhezw.exe
i_lgdbwtrigy.exe
i_oljdbwtojd.exe
i_pnifaysqki.exe
i_yvqolgdyvq.exe
lgdbwtrigy.exe
nkicavsnkf.exe
oljdbwtojd.exe
pnifaysqki.exe
rljgbztrlj.sys
urmjezwurmjhezwu.exe
urmjezwurmjhezwu.sys
xvpnhfaxsq.sys
yvqolgdyvq.exe
423715a1-e067-46ca-a85b-e65486bcdb17.tmp
45bfd7bf-25a9-4904-bd78-bcc33e99494e.tmp
47e3c525-2bc5-44eb-8a4a-d45facf9c241.tmp
9f565a33-1c5e-45e0-a6e8-82c4edb13d78.tmp
settings.dat
settings.dat
2dbce657-8276-4efe-a313-813d0b730353.tmp
3d5585d7-5680-4665-80db-00a5edf122ca.tmp
4ab2bcbf-b86a-47af-883e-28b513e61c89.tmp
temp-index
the-real-index
d89fd2af-9ffa-4e74-94fe-c4fa9c486237.tmp
0484dd86-8fba-44be-9ae1-b5c9c5c18135.tmp
180275f7-9906-4e65-84d9-e391a54f70a0.tmp
a4106f3e-9bb2-4fa4-9135-6263989b7fc4.tmp
sync_diagnostic.log
af2f09bf-890e-422c-a874-bde78420ff59.tmp
d66699a3-50fb-43e8-9561-7d900f4ea743.tmp
e44e053f-3226-4c2f-80e5-8f5abc85cb78.tmp
6d258982-5604-4ca5-817f-754e75578c2e.tmp
OperationConfig
a50de8e8-f42c-40d1-835a-c99f06b1a6aa.tmp
ced3c04e-154f-41be-a76c-dd9f661005f8.tmp
68670f02-2c04-4afd-922a-831811741fdf.tmp
a16d0cd3-096f-4c01-8da5-ee3974c55086.tmp
ab271d6d-fe65-4ce1-865c-ba032823209d.tmp
ee066482-02d9-4ffb-91a3-a1f4cf199cc5.tmp
489a16cd-b097-4416-85ba-239da6bf2498.tmp
441aaff7-1ed7-4c12-99ec-0fcd52a68271.tmp
a79fadf1-1cd9-400c-b837-2938a81508c4.tmp
content.js
manifest.json
manifest.json
manifest.json
manifest.json
CreateProcess.exe
memory/476-237-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/892-424-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1128-340-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1340-489-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1692-370-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1956-509-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2752-464-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2752-471-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2880-265-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3716-314-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4076-339-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4164-188-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4348-513-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4416-423-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4772-320-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4824-436-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4972-468-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5528-66-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5712-382-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/6104-285-0x0000000000010000-0x00000000000AB000-memory.dmp