Analysis
- max time kernel
148s - max time network
151s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
23/04/2026, 19:08
General
- Target 2026-04-23_e8316b4c0286983b83c0a5ddf6efeb0b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 722KB
- Sample260423-xtcwvaez3r
- SHA256 589e55b76c51a707a33cbf6241f9472e3934bdb37a0a4534e98ba176c892ffa0
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 9 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 41 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 19 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 29 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 3 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 19 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-23_e8316b4c0286983b83c0a5ddf6efeb0b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-23_e8316b4c0286983b83c0a5ddf6efeb0b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\wtomgeywrojgbztr.exeC:\Temp\wtomgeywrojgbztr.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hbztrljebw.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\hbztrljebw.exeC:\Temp\hbztrljebw.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hbztrljebw.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_hbztrljebw.exeC:\Temp\i_hbztrljebw.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qoigaytrlj.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\qoigaytrlj.exeC:\Temp\qoigaytrlj.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qoigaytrlj.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_qoigaytrlj.exeC:\Temp\i_qoigaytrlj.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\sqkidavtnl.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\sqkidavtnl.exeC:\Temp\sqkidavtnl.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_sqkidavtnl.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_sqkidavtnl.exeC:\Temp\i_sqkidavtnl.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\kfdxvpnifa.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\kfdxvpnifa.exeC:\Temp\kfdxvpnifa.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_kfdxvpnifa.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_kfdxvpnifa.exeC:\Temp\i_kfdxvpnifa.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\kfzxspkhca.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\kfzxspkhca.exeC:\Temp\kfzxspkhca.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_kfzxspkhca.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_kfzxspkhca.exeC:\Temp\i_kfzxspkhca.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pkicaupnhf.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\pkicaupnhf.exeC:\Temp\pkicaupnhf.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pkicaupnhf.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_pkicaupnhf.exeC:\Temp\i_pkicaupnhf.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\czusmkecwu.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\czusmkecwu.exeC:\Temp\czusmkecwu.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_czusmkecwu.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_czusmkecwu.exeC:\Temp\i_czusmkecwu.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pjhbztrmje.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\pjhbztrmje.exeC:\Temp\pjhbztrmje.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pjhbztrmje.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_pjhbztrmje.exeC:\Temp\i_pjhbztrmje.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wtolgeztrl.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\wtolgeztrl.exeC:\Temp\wtolgeztrl.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wtolgeztrl.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_wtolgeztrl.exeC:\Temp\i_wtolgeztrl.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ljdbvtolge.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ljdbvtolge.exeC:\Temp\ljdbvtolge.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ljdbvtolge.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ljdbvtolge.exeC:\Temp\i_ljdbvtolge.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qoigaysqoi.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\qoigaysqoi.exeC:\Temp\qoigaysqoi.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qoigaysqoi.exe ups_ins3⤵
-
C:\Temp\i_qoigaysqoi.exeC:\Temp\i_qoigaysqoi.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\aysqkidavt.exe ups_run3⤵
-
C:\Temp\aysqkidavt.exeC:\Temp\aysqkidavt.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_aysqkidavt.exe ups_ins3⤵
-
C:\Temp\i_aysqkidavt.exeC:\Temp\i_aysqkidavt.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fcavsmkica.exe ups_run3⤵
-
C:\Temp\fcavsmkica.exeC:\Temp\fcavsmkica.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fcavsmkica.exe ups_ins3⤵
-
C:\Temp\i_fcavsmkica.exeC:\Temp\i_fcavsmkica.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ausnkfdxvp.exe ups_run3⤵
-
C:\Temp\ausnkfdxvp.exeC:\Temp\ausnkfdxvp.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ausnkfdxvp.exe ups_ins3⤵
-
C:\Temp\i_ausnkfdxvp.exeC:\Temp\i_ausnkfdxvp.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mkecxupnhc.exe ups_run3⤵
-
C:\Temp\mkecxupnhc.exeC:\Temp\mkecxupnhc.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mkecxupnhc.exe ups_ins3⤵
-
C:\Temp\i_mkecxupnhc.exeC:\Temp\i_mkecxupnhc.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\cwupjhbzur.exe ups_run3⤵
-
C:\Temp\cwupjhbzur.exeC:\Temp\cwupjhbzur.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_cwupjhbzur.exe ups_ins3⤵
-
C:\Temp\i_cwupjhbzur.exeC:\Temp\i_cwupjhbzur.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ojhbztrlje.exe ups_run3⤵
-
C:\Temp\ojhbztrlje.exeC:\Temp\ojhbztrlje.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ojhbztrlje.exe ups_ins3⤵
-
C:\Temp\i_ojhbztrlje.exeC:\Temp\i_ojhbztrlje.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mgeywtomyw.exe ups_run3⤵
-
C:\Temp\mgeywtomyw.exeC:\Temp\mgeywtomyw.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mgeywtomyw.exe ups_ins3⤵
-
C:\Temp\i_mgeywtomyw.exeC:\Temp\i_mgeywtomyw.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\dbvtnljdbv.exe ups_run3⤵
-
C:\Temp\dbvtnljdbv.exeC:\Temp\dbvtnljdbv.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_dbvtnljdbv.exe ups_ins3⤵
-
C:\Temp\i_dbvtnljdbv.exeC:\Temp\i_dbvtnljdbv.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x340,0x7ff86c55c188,0x7ff86c55c194,0x7ff86c55c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1804,i,94091767573265947,10209952058567587998,524288 --field-trial-handle=2192,i,9005616584092130140,4631543721431374115,262144 --variations-seed-version --mojo-platform-channel-handle=2224 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,3555807319868236648,9760614938198994842,262144 --field-trial-handle=2192,i,9005616584092130140,4631543721431374115,262144 --variations-seed-version --mojo-platform-channel-handle=2188 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2420,i,4427641522864126484,2060395015102033654,524288 --field-trial-handle=2192,i,9005616584092130140,4631543721431374115,262144 --variations-seed-version --mojo-platform-channel-handle=3028 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3488,i,3667311106052364193,7342712436523586655,2097152 --field-trial-handle=2192,i,9005616584092130140,4631543721431374115,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3492,i,7009477251467440905,10711483570155604749,2097152 --field-trial-handle=2192,i,9005616584092130140,4631543721431374115,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=1692,i,2785091566348798891,16425492123738137580,2097152 --field-trial-handle=2192,i,9005616584092130140,4631543721431374115,262144 --variations-seed-version --mojo-platform-channel-handle=4152 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4100,i,3033803355840725057,17352227279724076616,2097152 --field-trial-handle=2192,i,9005616584092130140,4631543721431374115,262144 --variations-seed-version --mojo-platform-channel-handle=4156 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4124,i,5937186929661206803,3797629580598493944,2097152 --field-trial-handle=2192,i,9005616584092130140,4631543721431374115,262144 --variations-seed-version --mojo-platform-channel-handle=4180 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4232,i,14338379776468914452,6781913573623597808,2097152 --field-trial-handle=2192,i,9005616584092130140,4631543721431374115,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5392,i,17304839111003999789,14227451370172552655,524288 --field-trial-handle=2192,i,9005616584092130140,4631543721431374115,262144 --variations-seed-version --mojo-platform-channel-handle=4568 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4520,i,14709480972491710547,15725250672257703624,524288 --field-trial-handle=2192,i,9005616584092130140,4631543721431374115,262144 --variations-seed-version --mojo-platform-channel-handle=4116 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4588,i,15317843925729715654,5875512011182839563,524288 --field-trial-handle=2192,i,9005616584092130140,4631543721431374115,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3840,i,5646281895778258989,12991391083359175921,524288 --field-trial-handle=2192,i,9005616584092130140,4631543721431374115,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,8959272266166878653,11694285304900566865,524288 --field-trial-handle=2192,i,9005616584092130140,4631543721431374115,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6124,i,9297324932782122241,1699202098701423542,524288 --field-trial-handle=2192,i,9005616584092130140,4631543721431374115,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:144⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.execookie_exporter.exe --cookie-json=11365⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,8959272266166878653,11694285304900566865,524288 --field-trial-handle=2192,i,9005616584092130140,4631543721431374115,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6344,i,2869133875265313993,2669617394775815846,524288 --field-trial-handle=2192,i,9005616584092130140,4631543721431374115,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6388,i,15998915275602496302,3111689924450748292,524288 --field-trial-handle=2192,i,9005616584092130140,4631543721431374115,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6752,i,14409637025158945131,5265402897685341258,524288 --field-trial-handle=2192,i,9005616584092130140,4631543721431374115,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6780,i,14544776584694939977,1693756923314351665,524288 --field-trial-handle=2192,i,9005616584092130140,4631543721431374115,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6812,i,4174124517345841061,6081392589655667682,524288 --field-trial-handle=2192,i,9005616584092130140,4631543721431374115,262144 --variations-seed-version --mojo-platform-channel-handle=6756 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4176,i,6174365666976764855,18116124163810358478,524288 --field-trial-handle=2192,i,9005616584092130140,4631543721431374115,262144 --variations-seed-version --mojo-platform-channel-handle=4836 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4252,i,10689482622754241587,7400743131199982647,524288 --field-trial-handle=2192,i,9005616584092130140,4631543721431374115,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4212,i,11967320000967884167,2001807557589232204,524288 --field-trial-handle=2192,i,9005616584092130140,4631543721431374115,262144 --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5556,i,16560996122481634896,13317598860487145448,524288 --field-trial-handle=2192,i,9005616584092130140,4631543721431374115,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5592,i,18038362453421944815,6728955784302043138,524288 --field-trial-handle=2192,i,9005616584092130140,4631543721431374115,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4636,i,16422412878830848853,8811313818878372427,524288 --field-trial-handle=2192,i,9005616584092130140,4631543721431374115,262144 --variations-seed-version --mojo-platform-channel-handle=4632 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4832,i,11161098612829004781,12801419451813925082,524288 --field-trial-handle=2192,i,9005616584092130140,4631543721431374115,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5456,i,11317723549803281165,11156567744415377627,262144 --field-trial-handle=2192,i,9005616584092130140,4631543721431374115,262144 --variations-seed-version --mojo-platform-channel-handle=4836 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5788,i,9646205799595527366,13359863794080823757,524288 --field-trial-handle=2192,i,9005616584092130140,4631543721431374115,262144 --variations-seed-version --mojo-platform-channel-handle=3116 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\wtomgeywrojgbztr.sysC:\Temp\wtomgeywrojgbztr.sys1⤵
- Executes dropped EXE
-
C:\Temp\dywqoigayt.sysC:\Temp\dywqoigayt.sys1⤵
- Executes dropped EXE
-
C:\Temp\daytqljdbv.sysC:\Temp\daytqljdbv.sys1⤵
- Executes dropped EXE
-
C:\Temp\faysnlfdxv.sysC:\Temp\faysnlfdxv.sys1⤵
- Executes dropped EXE
-
C:\Temp\ayvpkicavs.sysC:\Temp\ayvpkicavs.sys1⤵
- Executes dropped EXE
-
C:\Temp\zxspkicaus.sysC:\Temp\zxspkicaus.sys1⤵
- Executes dropped EXE
-
C:\Temp\jhbzurmkhc.sysC:\Temp\jhbzurmkhc.sys1⤵
- Executes dropped EXE
-
C:\Temp\zurmkecwuo.sysC:\Temp\zurmkecwuo.sys1⤵
- Executes dropped EXE
-
C:\Temp\rojhbztrmg.sysC:\Temp\rojhbztrmg.sys1⤵
- Executes dropped EXE
-
C:\Temp\tomgeywqoj.sysC:\Temp\tomgeywqoj.sys1⤵
- Executes dropped EXE
-
C:\Temp\dywqoidbvt.sysC:\Temp\dywqoidbvt.sys1⤵
- Executes dropped EXE
-
C:\Temp\ifdxvqniga.sysC:\Temp\ifdxvqniga.sys1⤵
-
C:\Temp\xvpnifaysq.sysC:\Temp\xvpnifaysq.sys1⤵
-
C:\Temp\icausmkfcx.sysC:\Temp\icausmkfcx.sys1⤵
-
C:\Temp\aupnhfzxrp.sysC:\Temp\aupnhfzxrp.sys1⤵
-
C:\Temp\jecwurmjec.sysC:\Temp\jecwurmjec.sys1⤵
-
C:\Temp\ecwuomhezw.sysC:\Temp\ecwuomhezw.sys1⤵
-
C:\Temp\tolgeywqoj.sysC:\Temp\tolgeywqoj.sys1⤵
-
C:\Temp\ljdbvtolge.sysC:\Temp\ljdbvtolge.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CreateProcess.exe
ayvpkicavs.sys
daytqljdbv.sys
dywqoigayt.sys
faysnlfdxv.sys
hbztrljebw.exe
i_hbztrljebw.exe
i_kfdxvpnifa.exe
i_kfzxspkhca.exe
i_qoigaytrlj.exe
i_sqkidavtnl.exe
kfdxvpnifa.exe
kfzxspkhca.exe
qoigaytrlj.exe
sqkidavtnl.exe
wtomgeywrojgbztr.exe
wtomgeywrojgbztr.sys
zxspkicaus.sys
9455553a-48de-4fe5-b830-17ea803bba2f.tmp
protocols.json
settings.dat
BookmarkMergedSurfaceOrdering
the-real-index
SiteList-Enterprise.json
Edge Profile.ico
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
Preferences
Preferences
Secure Preferences
sync_diagnostic.log
OperationConfig
OperationConfig~RFe594e26.TMP
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
nav_config.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
cabfa4a5-f595-4a8a-bf9b-8069a6b93657.tmp
da290eca-b0c3-492f-a577-035a4be491b7.tmp
content_new.js
2db7c1b2-f05b-4523-890d-6260922e0f26.tmp
manifest.json
manifest.json
manifest.json
memory/540-784-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1004-718-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1496-763-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1976-701-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2292-491-0x00000217441B0000-0x000002174420D000-memory.dmp
memory/2612-649-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2724-573-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2724-542-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2960-556-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3128-63-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3564-612-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3704-748-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3872-577-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4004-767-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4276-72-0x0000022541510000-0x000002254156D000-memory.dmp
memory/4428-702-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4428-678-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4592-544-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4592-527-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4740-494-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4740-531-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4892-444-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4924-581-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4932-624-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4932-650-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5108-714-0x0000000000010000-0x00000000000AB000-memory.dmp