Analysis
- max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
30/10/2026, 14:16
General
- Target 2026-10-30_e4e17b6cc372b8e2741e1cca90ee0599_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 361KB
- Sample261030-rk413sd14m
- SHA256 200fa5f688a47140eb568569f05c53f396d053d43790351463c57bf960a82f8f
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba
-
http://xytets.com:2345/t.asp?os=home
-
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-30_e4e17b6cc372b8e2741e1cca90ee0599_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-30_e4e17b6cc372b8e2741e1cca90ee0599_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\vsnlfdxvpnifaysq.exeC:\Temp\vsnlfdxvpnifaysq.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\axvtnlfdxv.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\axvtnlfdxv.exeC:\Temp\axvtnlfdxv.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_axvtnlfdxv.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_axvtnlfdxv.exeC:\Temp\i_axvtnlfdxv.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\spkidxvpnh.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\spkidxvpnh.exeC:\Temp\spkidxvpnh.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_spkidxvpnh.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_spkidxvpnh.exeC:\Temp\i_spkidxvpnh.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\kfcxupnhfz.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\kfcxupnhfz.exeC:\Temp\kfcxupnhfz.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_kfcxupnhfz.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_kfcxupnhfz.exeC:\Temp\i_kfcxupnhfz.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jhfzusmkeu.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\jhfzusmkeu.exeC:\Temp\jhfzusmkeu.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jhfzusmkeu.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_jhfzusmkeu.exeC:\Temp\i_jhfzusmkeu.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ebwtrmjecw.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ebwtrmjecw.exeC:\Temp\ebwtrmjecw.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ebwtrmjecw.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ebwtrmjecw.exeC:\Temp\i_ebwtrmjecw.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wtoljhbwto.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\wtoljhbwto.exeC:\Temp\wtoljhbwto.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wtoljhbwto.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_wtoljhbwto.exeC:\Temp\i_wtoljhbwto.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bytqljdbvt.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\bytqljdbvt.exeC:\Temp\bytqljdbvt.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bytqljdbvt.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_bytqljdbvt.exeC:\Temp\i_bytqljdbvt.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\yvtnlgdyvq.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\yvtnlgdyvq.exeC:\Temp\yvtnlgdyvq.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_yvtnlgdyvq.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_yvtnlgdyvq.exeC:\Temp\i_yvtnlgdyvq.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vtnlfdyvqn.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\vtnlfdyvqn.exeC:\Temp\vtnlfdyvqn.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vtnlfdyvqn.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_vtnlfdyvqn.exeC:\Temp\i_vtnlfdyvqn.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pnlfdxvpnh.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\pnlfdxvpnh.exeC:\Temp\pnlfdxvpnh.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pnlfdxvpnh.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_pnlfdxvpnh.exeC:\Temp\i_pnlfdxvpnh.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pnhfzxspki.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\pnhfzxspki.exeC:\Temp\pnhfzxspki.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pnhfzxspki.exe ups_ins3⤵
-
C:\Temp\i_pnhfzxspki.exeC:\Temp\i_pnhfzxspki.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jhfzxuomjh.exe ups_run3⤵
-
C:\Temp\jhfzxuomjh.exeC:\Temp\jhfzxuomjh.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jhfzxuomjh.exe ups_ins3⤵
-
C:\Temp\i_jhfzxuomjh.exeC:\Temp\i_jhfzxuomjh.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rmkecwupmh.exe ups_run3⤵
-
C:\Temp\rmkecwupmh.exeC:\Temp\rmkecwupmh.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rmkecwupmh.exe ups_ins3⤵
-
C:\Temp\i_rmkecwupmh.exeC:\Temp\i_rmkecwupmh.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jhbztrljeb.exe ups_run3⤵
-
C:\Temp\jhbztrljeb.exeC:\Temp\jhbztrljeb.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jhbztrljeb.exe ups_ins3⤵
-
C:\Temp\i_jhbztrljeb.exeC:\Temp\i_jhbztrljeb.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jdbvtoljdb.exe ups_run3⤵
-
C:\Temp\jdbvtoljdb.exeC:\Temp\jdbvtoljdb.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jdbvtoljdb.exe ups_ins3⤵
-
C:\Temp\i_jdbvtoljdb.exeC:\Temp\i_jdbvtoljdb.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jdbvtndyvq.exe ups_run3⤵
-
C:\Temp\jdbvtndyvq.exeC:\Temp\jdbvtndyvq.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jdbvtndyvq.exe ups_ins3⤵
-
C:\Temp\i_jdbvtndyvq.exeC:\Temp\i_jdbvtndyvq.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\dyvqolfdxv.exe ups_run3⤵
-
C:\Temp\dyvqolfdxv.exeC:\Temp\dyvqolfdxv.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_dyvqolfdxv.exe ups_ins3⤵
-
C:\Temp\i_dyvqolfdxv.exeC:\Temp\i_dyvqolfdxv.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\sqkicavsnl.exe ups_run3⤵
-
C:\Temp\sqkicavsnl.exeC:\Temp\sqkicavsnl.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_sqkicavsnl.exe ups_ins3⤵
-
C:\Temp\i_sqkicavsnl.exeC:\Temp\i_sqkicavsnl.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\smkfcxvpnh.exe ups_run3⤵
-
C:\Temp\smkfcxvpnh.exeC:\Temp\smkfcxvpnh.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_smkfcxvpnh.exe ups_ins3⤵
-
C:\Temp\i_smkfcxvpnh.exeC:\Temp\i_smkfcxvpnh.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xusmkfcxvp.exe ups_run3⤵
-
C:\Temp\xusmkfcxvp.exeC:\Temp\xusmkfcxvp.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffed435c188,0x7ffed435c194,0x7ffed435c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,15520050260248387581,1564559702345352428,262144 --field-trial-handle=2344,i,4187633329467520932,15149627756813290564,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1880,i,17686820237528268986,18160560970150672125,524288 --field-trial-handle=2344,i,4187633329467520932,15149627756813290564,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2400,i,18136323895341949097,5244539943123904051,524288 --field-trial-handle=2344,i,4187633329467520932,15149627756813290564,262144 --variations-seed-version --mojo-platform-channel-handle=3060 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3500,i,12912126016972547880,6159827615402361532,2097152 --field-trial-handle=2344,i,4187633329467520932,15149627756813290564,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3504,i,12105284393220496538,8087206707005789434,2097152 --field-trial-handle=2344,i,4187633329467520932,15149627756813290564,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4268,i,4133709130436850747,8643519655561872880,2097152 --field-trial-handle=2344,i,4187633329467520932,15149627756813290564,262144 --variations-seed-version --mojo-platform-channel-handle=4784 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4292,i,16076001554800526639,6361089701401490200,2097152 --field-trial-handle=2344,i,4187633329467520932,15149627756813290564,262144 --variations-seed-version --mojo-platform-channel-handle=4788 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5332,i,6201005366832121426,1344538547851246819,524288 --field-trial-handle=2344,i,4187633329467520932,15149627756813290564,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3748,i,8133691949574634478,103131460278211736,524288 --field-trial-handle=2344,i,4187633329467520932,15149627756813290564,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5428,i,8815916835271493165,11052381834393101818,524288 --field-trial-handle=2344,i,4187633329467520932,15149627756813290564,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5960,i,16963187556339158726,14571985090568892801,524288 --field-trial-handle=2344,i,4187633329467520932,15149627756813290564,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5960,i,16963187556339158726,14571985090568892801,524288 --field-trial-handle=2344,i,4187633329467520932,15149627756813290564,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6296,i,5935359126762264666,17919594003216250341,524288 --field-trial-handle=2344,i,4187633329467520932,15149627756813290564,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6444,i,10744413547471289727,10166422014945253623,524288 --field-trial-handle=2344,i,4187633329467520932,15149627756813290564,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6500,i,2470081035289495532,15467177281528352434,524288 --field-trial-handle=2344,i,4187633329467520932,15149627756813290564,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6468,i,4734040252686364258,545844168498860389,524288 --field-trial-handle=2344,i,4187633329467520932,15149627756813290564,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4772,i,14669675179904361700,9399366311375307490,524288 --field-trial-handle=2344,i,4187633329467520932,15149627756813290564,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4788,i,15491955445707715962,18101706141087408531,524288 --field-trial-handle=2344,i,4187633329467520932,15149627756813290564,262144 --variations-seed-version --mojo-platform-channel-handle=6696 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4832,i,631213096476810840,13400247913679371892,524288 --field-trial-handle=2344,i,4187633329467520932,15149627756813290564,262144 --variations-seed-version --mojo-platform-channel-handle=6772 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5668,i,10586080657594039656,3383202627097714862,524288 --field-trial-handle=2344,i,4187633329467520932,15149627756813290564,262144 --variations-seed-version --mojo-platform-channel-handle=6868 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6888,i,5649843263673510690,8104816068104333864,524288 --field-trial-handle=2344,i,4187633329467520932,15149627756813290564,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6892,i,6712088903139255585,10572277013175754626,524288 --field-trial-handle=2344,i,4187633329467520932,15149627756813290564,262144 --variations-seed-version --mojo-platform-channel-handle=6968 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2796,i,3774864174959875415,1932195234325869179,524288 --field-trial-handle=2344,i,4187633329467520932,15149627756813290564,262144 --variations-seed-version --mojo-platform-channel-handle=6968 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6968,i,9162254240095032660,3202140325006006915,262144 --field-trial-handle=2344,i,4187633329467520932,15149627756813290564,262144 --variations-seed-version --mojo-platform-channel-handle=6932 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6924,i,1025934835814894247,9499968327255013889,524288 --field-trial-handle=2344,i,4187633329467520932,15149627756813290564,262144 --variations-seed-version --mojo-platform-channel-handle=6684 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6460,i,5326645924651893412,16239869353650509431,524288 --field-trial-handle=2344,i,4187633329467520932,15149627756813290564,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\vsnlfdxvpnifaysq.sysC:\Temp\vsnlfdxvpnifaysq.sys1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Temp\spnhfaxvpn.sysC:\Temp\spnhfaxvpn.sys1⤵
- Executes dropped EXE
-
C:\Temp\snkfcxupfz.sysC:\Temp\snkfcxupfz.sys1⤵
- Executes dropped EXE
-
C:\Temp\hfzxupmkhc.sysC:\Temp\hfzxupmkhc.sys1⤵
- Executes dropped EXE
-
C:\Temp\kecwuomhez.sysC:\Temp\kecwuomhez.sys1⤵
- Executes dropped EXE
-
C:\Temp\bwtomjebzw.sysC:\Temp\bwtomjebzw.sys1⤵
- Executes dropped EXE
-
C:\Temp\zwqojgbztr.sysC:\Temp\zwqojgbztr.sys1⤵
- Executes dropped EXE
-
C:\Temp\gdbvtqliga.sysC:\Temp\gdbvtqliga.sys1⤵
- Executes dropped EXE
-
C:\Temp\davtnlfdxv.sysC:\Temp\davtnlfdxv.sys1⤵
- Executes dropped EXE
-
C:\Temp\snkicayspn.sysC:\Temp\snkicayspn.sys1⤵
- Executes dropped EXE
-
C:\Temp\spkhcauspk.sysC:\Temp\spkhcauspk.sys1⤵
- Executes dropped EXE
-
C:\Temp\uspkhfcxup.sysC:\Temp\uspkhfcxup.sys1⤵
-
C:\Temp\urmjhbzxrp.sysC:\Temp\urmjhbzxrp.sys1⤵
-
C:\Temp\mgezwrojhe.sysC:\Temp\mgezwrojhe.sys1⤵
-
C:\Temp\omjebzljgb.sysC:\Temp\omjebzljgb.sys1⤵
-
C:\Temp\igeywqoigb.sysC:\Temp\igeywqoigb.sys1⤵
-
C:\Temp\gayvtnliga.sysC:\Temp\gayvtnliga.sys1⤵
-
C:\Temp\yvtnlfdxvq.sysC:\Temp\yvtnlfdxvq.sys1⤵
-
C:\Temp\ausqkifdxv.sysC:\Temp\ausqkifdxv.sys1⤵
-
C:\Temp\xusmkecxup.sysC:\Temp\xusmkecxup.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
axvtnlfdxv.exe
bwtomjebzw.sys
ebwtrmjecw.exe
hfzxupmkhc.sys
i_axvtnlfdxv.exe
i_ebwtrmjecw.exe
i_jhfzusmkeu.exe
i_kfcxupnhfz.exe
i_spkidxvpnh.exe
jhfzusmkeu.exe
kecwuomhez.sys
kfcxupnhfz.exe
snkfcxupfz.sys
spkidxvpnh.exe
spnhfaxvpn.sys
vsnlfdxvpnifaysq.exe
vsnlfdxvpnifaysq.sys
wtoljhbwto.exe
206359f8-a4bd-4231-89cf-abeb4e30edff.tmp
31b99090-1b28-45b4-b787-50969a396e39.tmp
34e88f17-285b-4e1a-ac8d-038330fbf8ba.tmp
5dc4208b-bace-4f27-a56e-b4f4c8a5635e.tmp
7e01b49b-f03a-4be0-a9e9-3bbfb8d66c99.tmp
settings.dat
settings.dat
43ce3195-69cb-4f84-91d2-db37cd9d16f9.tmp
55dda91d-0415-4691-af54-4b71a730534f.tmp
72a8f548-528a-43ce-a8e4-d878ee55fa4a.tmp
93a9fb7d-d388-4be9-aafa-45f84c694a3a.tmp
temp-index
6f1c76d4-b79d-47d0-9b37-d6336d124be3.tmp
dasherSettingSchema.json
1b22c76c-9444-4d80-9253-61e28fd12cea.tmp
77707d70-b3ef-4b75-85ec-fd75cc5a442e.tmp
95991170-c978-4965-800d-6ed64e520b33.tmp
sync_diagnostic.log
ae14e217-db44-4c36-9b6e-85575a6aace9.tmp
fb9a5308-634b-456d-8d08-e60e82991497.tmp
OperationConfig
bdaac255-beda-4257-a31a-102cfbbd367b.tmp
b776dcce-33ae-4df5-a56c-dc7cfac483a8.tmp
d017d11d-fead-4222-b91b-8c200ed63315.tmp
d83fa209-4b03-4ade-806e-3e34fdbc7899.tmp
f340d1e2-3804-4874-b75b-5b5ab4dafabc.tmp
3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
ca47d30e-689c-481b-9a98-670da99018bf.tmp
f8a9f79c-a1c0-4e9c-ad06-a5ca0b8071af.tmp
30826071-89de-4dc5-b014-28774ec3d68f.tmp
69bb814a-5948-47e1-a1a4-795e761abc72.tmp
messages.json
content.js
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
CreateProcess.exe
memory/2056-553-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2128-664-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2320-517-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2376-720-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2608-574-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2764-479-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2976-554-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2976-530-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3084-740-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3400-715-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3648-585-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3704-62-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4076-744-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4728-676-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4824-430-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4824-505-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4824-481-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4832-638-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5408-558-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5424-696-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5600-652-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/6028-610-0x0000000000010000-0x00000000000AB000-memory.dmp