Analysis
- max time kernel
150s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
28/10/2026, 16:21
General
- Target 2026-10-27_efb268d4ae29d076ef612ce4c00d72ff_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 361KB
- Sample261028-tt5p3set6r
- SHA256 0dc6492e682778874fcc6d1b0295f303afc4c3856efe12ab8604f0504de26d4b
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba
-
http://xytets.com:2345/t.asp?os=home
-
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-27_efb268d4ae29d076ef612ce4c00d72ff_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-27_efb268d4ae29d076ef612ce4c00d72ff_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\idavtnlfdxvsqkid.exeC:\Temp\idavtnlfdxvsqkid.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nlfdxvqnia.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\nlfdxvqnia.exeC:\Temp\nlfdxvqnia.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nlfdxvqnia.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_nlfdxvqnia.exeC:\Temp\i_nlfdxvqnia.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\snkfcxupnk.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\snkfcxupnk.exeC:\Temp\snkfcxupnk.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_snkfcxupnk.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_snkfcxupnk.exeC:\Temp\i_snkfcxupnk.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\cxupmhfzxs.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\cxupmhfzxs.exeC:\Temp\cxupmhfzxs.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_cxupmhfzxs.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_cxupmhfzxs.exeC:\Temp\i_cxupmhfzxs.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hfcxupmhez.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\hfcxupmhez.exeC:\Temp\hfcxupmhez.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hfcxupmhez.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_hfcxupmhez.exeC:\Temp\i_hfcxupmhez.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bzwrpjhbzu.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\bzwrpjhbzu.exeC:\Temp\bzwrpjhbzu.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bzwrpjhbzu.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_bzwrpjhbzu.exeC:\Temp\i_bzwrpjhbzu.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wuomgeywqo.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\wuomgeywqo.exeC:\Temp\wuomgeywqo.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wuomgeywqo.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_wuomgeywqo.exeC:\Temp\i_wuomgeywqo.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ywqoigbytr.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ywqoigbytr.exeC:\Temp\ywqoigbytr.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ywqoigbytr.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ywqoigbytr.exeC:\Temp\i_ywqoigbytr.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qljdbwtoig.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\qljdbwtoig.exeC:\Temp\qljdbwtoig.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qljdbwtoig.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_qljdbwtoig.exeC:\Temp\i_qljdbwtoig.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bvsnkidayv.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\bvsnkidayv.exeC:\Temp\bvsnkidayv.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bvsnkidayv.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_bvsnkidayv.exeC:\Temp\i_bvsnkidayv.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qnlfdxvpnh.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\qnlfdxvpnh.exeC:\Temp\qnlfdxvpnh.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qnlfdxvpnh.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_qnlfdxvpnh.exeC:\Temp\i_qnlfdxvpnh.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pmhfzxspki.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\pmhfzxspki.exeC:\Temp\pmhfzxspki.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pmhfzxspki.exe ups_ins3⤵
-
C:\Temp\i_pmhfzxspki.exeC:\Temp\i_pmhfzxspki.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mkhfzxupmk.exe ups_run3⤵
-
C:\Temp\mkhfzxupmk.exeC:\Temp\mkhfzxupmk.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mkhfzxupmk.exe ups_ins3⤵
-
C:\Temp\i_mkhfzxupmk.exeC:\Temp\i_mkhfzxupmk.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rmjecwupmh.exe ups_run3⤵
-
C:\Temp\rmjecwupmh.exeC:\Temp\rmjecwupmh.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rmjecwupmh.exe ups_ins3⤵
-
C:\Temp\i_rmjecwupmh.exeC:\Temp\i_rmjecwupmh.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jgecwurojg.exe ups_run3⤵
-
C:\Temp\jgecwurojg.exeC:\Temp\jgecwurojg.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jgecwurojg.exe ups_ins3⤵
-
C:\Temp\i_jgecwurojg.exeC:\Temp\i_jgecwurojg.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rljgbytrlj.exe ups_run3⤵
-
C:\Temp\rljgbytrlj.exeC:\Temp\rljgbytrlj.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rljgbytrlj.exe ups_ins3⤵
-
C:\Temp\i_rljgbytrlj.exeC:\Temp\i_rljgbytrlj.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\trljdbwqol.exe ups_run3⤵
-
C:\Temp\trljdbwqol.exeC:\Temp\trljdbwqol.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_trljdbwqol.exe ups_ins3⤵
-
C:\Temp\i_trljdbwqol.exeC:\Temp\i_trljdbwqol.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\lifdyvtqli.exe ups_run3⤵
-
C:\Temp\lifdyvtqli.exeC:\Temp\lifdyvtqli.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_lifdyvtqli.exe ups_ins3⤵
-
C:\Temp\i_lifdyvtqli.exeC:\Temp\i_lifdyvtqli.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nifaysqkic.exe ups_run3⤵
-
C:\Temp\nifaysqkic.exeC:\Temp\nifaysqkic.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nifaysqkic.exe ups_ins3⤵
-
C:\Temp\i_nifaysqkic.exeC:\Temp\i_nifaysqkic.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\causnkfcxv.exe ups_run3⤵
-
C:\Temp\causnkfcxv.exeC:\Temp\causnkfcxv.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_causnkfcxv.exe ups_ins3⤵
-
C:\Temp\i_causnkfcxv.exeC:\Temp\i_causnkfcxv.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\khcausmkec.exe ups_run3⤵
-
C:\Temp\khcausmkec.exeC:\Temp\khcausmkec.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x220,0x224,0x2f8,0x128,0x300,0x7ffb15eec188,0x7ffb15eec194,0x7ffb15eec1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,366348651105139257,8085010968700704622,262144 --field-trial-handle=2328,i,6711754445859699847,12134421792581527070,262144 --variations-seed-version --mojo-platform-channel-handle=1944 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1900,i,164832734056135921,7303091347077375196,524288 --field-trial-handle=2328,i,6711754445859699847,12134421792581527070,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2476,i,13931840531715525272,6249031654574811381,524288 --field-trial-handle=2328,i,6711754445859699847,12134421792581527070,262144 --variations-seed-version --mojo-platform-channel-handle=3128 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3596,i,8059187759382107005,10723094556291725730,2097152 --field-trial-handle=2328,i,6711754445859699847,12134421792581527070,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3612,i,1019444053074490582,16348047760441802850,2097152 --field-trial-handle=2328,i,6711754445859699847,12134421792581527070,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4260,i,7349525916318256462,15494446664128577586,2097152 --field-trial-handle=2328,i,6711754445859699847,12134421792581527070,262144 --variations-seed-version --mojo-platform-channel-handle=4912 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4276,i,18334642247447489711,14704140210654702387,2097152 --field-trial-handle=2328,i,6711754445859699847,12134421792581527070,262144 --variations-seed-version --mojo-platform-channel-handle=4916 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3592,i,9174353401355806004,11984934832129806958,524288 --field-trial-handle=2328,i,6711754445859699847,12134421792581527070,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5416,i,14782744920979295095,93890323508049675,524288 --field-trial-handle=2328,i,6711754445859699847,12134421792581527070,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5404,i,7354003539136216252,11610739273099286623,524288 --field-trial-handle=2328,i,6711754445859699847,12134421792581527070,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,2632588063822692192,15591849038974497331,524288 --field-trial-handle=2328,i,6711754445859699847,12134421792581527070,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,2632588063822692192,15591849038974497331,524288 --field-trial-handle=2328,i,6711754445859699847,12134421792581527070,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6228,i,3062701342691661326,2537257735179480630,524288 --field-trial-handle=2328,i,6711754445859699847,12134421792581527070,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6312,i,17631095214071933785,13983575018683586288,524288 --field-trial-handle=2328,i,6711754445859699847,12134421792581527070,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6352,i,11154125767980586726,6305543647826118960,524288 --field-trial-handle=2328,i,6711754445859699847,12134421792581527070,262144 --variations-seed-version --mojo-platform-channel-handle=6568 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6316,i,3713112799097957802,12504998650570999101,524288 --field-trial-handle=2328,i,6711754445859699847,12134421792581527070,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,8888991373873067267,7693214374466437857,524288 --field-trial-handle=2328,i,6711754445859699847,12134421792581527070,262144 --variations-seed-version --mojo-platform-channel-handle=4976 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4264,i,11242279317033265516,15882464072979347478,524288 --field-trial-handle=2328,i,6711754445859699847,12134421792581527070,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4800,i,15912309671113601359,4691286652990004316,524288 --field-trial-handle=2328,i,6711754445859699847,12134421792581527070,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6820,i,16184485781485979234,12405932126678138713,524288 --field-trial-handle=2328,i,6711754445859699847,12134421792581527070,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6460,i,11403520018901753218,4893230755537915575,524288 --field-trial-handle=2328,i,6711754445859699847,12134421792581527070,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6344,i,245687512679749443,17092220689669963837,524288 --field-trial-handle=2328,i,6711754445859699847,12134421792581527070,262144 --variations-seed-version --mojo-platform-channel-handle=2760 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6344,i,316972145549502636,4581775708721381020,524288 --field-trial-handle=2328,i,6711754445859699847,12134421792581527070,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5728,i,17761864631812086324,9634920495552547114,524288 --field-trial-handle=2328,i,6711754445859699847,12134421792581527070,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5440,i,16864482878271439252,12110995790587697240,262144 --field-trial-handle=2328,i,6711754445859699847,12134421792581527070,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5488,i,15381880627642707641,17291995476588812607,524288 --field-trial-handle=2328,i,6711754445859699847,12134421792581527070,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6152,i,12231272725612787131,1302977893775273327,524288 --field-trial-handle=2328,i,6711754445859699847,12134421792581527070,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\idavtnlfdxvsqkid.sysC:\Temp\idavtnlfdxvsqkid.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Temp\usqkifaxsp.sysC:\Temp\usqkifaxsp.sys1⤵
- Executes dropped EXE
-
C:\Temp\kicausmkic.sysC:\Temp\kicausmkic.sys1⤵
- Executes dropped EXE
-
C:\Temp\ecwuspnhfz.sysC:\Temp\ecwuspnhfz.sys1⤵
- Executes dropped EXE
-
C:\Temp\hecwuomhez.sysC:\Temp\hecwuomhez.sys1⤵
- Executes dropped EXE
-
C:\Temp\wuomjhezwr.sysC:\Temp\wuomjhezwr.sys1⤵
- Executes dropped EXE
-
C:\Temp\dbywqojgbz.sysC:\Temp\dbywqojgbz.sys1⤵
- Executes dropped EXE
-
C:\Temp\rligaywtnl.sysC:\Temp\rligaywtnl.sys1⤵
- Executes dropped EXE
-
C:\Temp\lidbvtnlfd.sysC:\Temp\lidbvtnlfd.sys1⤵
- Executes dropped EXE
-
C:\Temp\snkfcayspn.sysC:\Temp\snkfcayspn.sys1⤵
- Executes dropped EXE
-
C:\Temp\ausmkfdxvp.sysC:\Temp\ausmkfdxvp.sys1⤵
- Executes dropped EXE
-
C:\Temp\spnhfcxusm.sysC:\Temp\spnhfcxusm.sys1⤵
-
C:\Temp\urmkecwuom.sysC:\Temp\urmkecwuom.sys1⤵
-
C:\Temp\ljhbztrpjh.sysC:\Temp\ljhbztrpjh.sys1⤵
-
C:\Temp\wurmjdbztr.sysC:\Temp\wurmjdbztr.sys1⤵
-
C:\Temp\vtrljeywto.sysC:\Temp\vtrljeywto.sys1⤵
-
C:\Temp\qligayvqnl.sysC:\Temp\qligayvqnl.sys1⤵
-
C:\Temp\qkicavsnlf.sysC:\Temp\qkicavsnlf.sys1⤵
-
C:\Temp\pnifaxsqni.sysC:\Temp\pnifaxsqni.sys1⤵
-
C:\Temp\hfcausmkic.sysC:\Temp\hfcausmkic.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
bzwrpjhbzu.exe
cxupmhfzxs.exe
ecwuspnhfz.sys
hecwuomhez.sys
hfcxupmhez.exe
i_bzwrpjhbzu.exe
i_cxupmhfzxs.exe
i_hfcxupmhez.exe
i_nlfdxvqnia.exe
i_snkfcxupnk.exe
idavtnlfdxvsqkid.exe
idavtnlfdxvsqkid.sys
kicausmkic.sys
nlfdxvqnia.exe
snkfcxupnk.exe
usqkifaxsp.sys
wuomgeywqo.exe
wuomjhezwr.sys
140c0d05-ff2c-4d07-bb71-0a581f700682.tmp
461a39d3-f4ab-40d8-8cda-8445f6814127.tmp
88bc5a4c-cb53-45c3-8e9d-380c8937275d.tmp
settings.dat
settings.dat
03fd691c-e374-4cef-8b3c-73d0585fe7c9.tmp
0fc2a793-53e1-462d-a98d-a8837e83f955.tmp
354c6245-f598-4226-a9a7-f244fdbc6745.tmp
64d2e54a-ce71-44d9-bf5a-6a83db65ddad.tmp
LOG.old
temp-index
the-real-index
b0677dfe-6d93-4ba5-b6d0-895effa708ce.tmp
dasherSettingSchema.json
89e4873f-4421-468e-8c17-080db0355223.tmp
9567fca1-8e31-462e-82fb-7cc07ca327f3.tmp
b4daf713-9248-4939-b9ae-68a65564ea70.tmp
sync_diagnostic.log
ba02c136-c297-4d0d-b2b3-ca57ab103cab.tmp
6dcb2ed3-18d5-4071-b66a-88ff82627978.tmp
ab370d00-3043-485b-8e51-a85581616e1e.tmp
ae681f9a-b602-4afd-b5df-805ef305d095.tmp
b1d13029-0769-4723-ab09-f02d0d1e9970.tmp
5773df8a-9907-44b7-8f3d-0a59d8a147ce.tmp
c551d1eb-dfcb-4416-b877-742b24a7dce1.tmp
d5c6dc67-806d-48ea-a56e-42da35f04fed.tmp
metadata.json
01b67add-f0d9-4855-b8dc-5546ad9b95c8.tmp
3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
d9ee4415-d94c-4fad-a48e-d82e76f9649a.tmp
2c330620-8f39-4246-8854-690a74f8ff56.tmp
30b0a739-d8f3-4bb3-8d23-6c780ef768ce.tmp
messages.json
content.js
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
CreateProcess.exe
memory/252-746-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1416-640-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1452-721-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1596-612-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1800-559-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2124-479-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2508-576-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2620-66-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2680-519-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2804-532-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3588-430-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4116-682-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4264-702-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4668-726-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4976-587-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5060-507-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5092-555-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5092-560-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5288-750-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5892-678-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/6072-654-0x0000000000010000-0x00000000000AB000-memory.dmp