Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
05/05/2026, 01:05
General
- Target 2026-05-05_1e2c2cc064ba7e4a43d3fa4df9628349_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
- Size 389KB
- Sample260505-bfwadaav2q
- SHA256 fe48e500b8bd7f8598ea2e9faf13a99dac50539f29e7c5f1e854bac3691f9507
Score
10/10
Malware Config
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 9 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 29 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 3 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-05_1e2c2cc064ba7e4a43d3fa4df9628349_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-05_1e2c2cc064ba7e4a43d3fa4df9628349_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\geywqobytrljdbvt.exeC:\Temp\geywqobytrljdbvt.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\lgeywoigyt.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\lgeywoigyt.exeC:\Temp\lgeywoigyt.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_lgeywoigyt.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_lgeywoigyt.exeC:\Temp\i_lgeywoigyt.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\tnlgdywqoi.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\tnlgdywqoi.exeC:\Temp\tnlgdywqoi.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_tnlgdywqoi.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_tnlgdywqoi.exeC:\Temp\i_tnlgdywqoi.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fdxvqnigay.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\fdxvqnigay.exeC:\Temp\fdxvqnigay.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fdxvqnigay.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_fdxvqnigay.exeC:\Temp\i_fdxvqnigay.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vqnifaysqk.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\vqnifaysqk.exeC:\Temp\vqnifaysqk.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vqnifaysqk.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_vqnifaysqk.exeC:\Temp\i_vqnifaysqk.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\kicausmhfz.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\kicausmhfz.exeC:\Temp\kicausmhfz.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_kicausmhfz.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_kicausmhfz.exeC:\Temp\i_kicausmhfz.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fzxrpkhcam.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\fzxrpkhcam.exeC:\Temp\fzxrpkhcam.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fzxrpkhcam.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_fzxrpkhcam.exeC:\Temp\i_fzxrpkhcam.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\cwupmhezxr.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\cwupmhezxr.exeC:\Temp\cwupmhezxr.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_cwupmhezxr.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_cwupmhezxr.exeC:\Temp\i_cwupmhezxr.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\uomgezwroj.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\uomgezwroj.exeC:\Temp\uomgezwroj.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_uomgezwroj.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_uomgezwroj.exeC:\Temp\i_uomgezwroj.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jeywqojgbz.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\jeywqojgbz.exeC:\Temp\jeywqojgbz.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jeywqojgbz.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_jeywqojgbz.exeC:\Temp\i_jeywqojgbz.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ljdbwtolge.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ljdbwtolge.exeC:\Temp\ljdbwtolge.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ljdbwtolge.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ljdbwtolge.exeC:\Temp\i_ljdbwtolge.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fdbvqoigdy.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\fdbvqoigdy.exeC:\Temp\fdbvqoigdy.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fdbvqoigdy.exe ups_ins3⤵
-
C:\Temp\i_fdbvqoigdy.exeC:\Temp\i_fdbvqoigdy.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\davtnlfdxv.exe ups_run3⤵
-
C:\Temp\davtnlfdxv.exeC:\Temp\davtnlfdxv.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_davtnlfdxv.exe ups_ins3⤵
-
C:\Temp\i_davtnlfdxv.exeC:\Temp\i_davtnlfdxv.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fdxvpnhfdx.exe ups_run3⤵
-
C:\Temp\fdxvpnhfdx.exeC:\Temp\fdxvpnhfdx.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fdxvpnhfdx.exe ups_ins3⤵
-
C:\Temp\i_fdxvpnhfdx.exeC:\Temp\i_fdxvpnhfdx.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hfcxvpnhfz.exe ups_run3⤵
-
C:\Temp\hfcxvpnhfz.exeC:\Temp\hfcxvpnhfz.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hfcxvpnhfz.exe ups_ins3⤵
-
C:\Temp\i_hfcxvpnhfz.exeC:\Temp\i_hfcxvpnhfz.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\cwupmhfzxr.exe ups_run3⤵
-
C:\Temp\cwupmhfzxr.exeC:\Temp\cwupmhfzxr.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_cwupmhfzxr.exe ups_ins3⤵
-
C:\Temp\i_cwupmhfzxr.exeC:\Temp\i_cwupmhfzxr.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\uomkecwurm.exe ups_run3⤵
-
C:\Temp\uomkecwurm.exeC:\Temp\uomkecwurm.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_uomkecwurm.exe ups_ins3⤵
-
C:\Temp\i_uomkecwurm.exeC:\Temp\i_uomkecwurm.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mgbztrljdb.exe ups_run3⤵
-
C:\Temp\mgbztrljdb.exeC:\Temp\mgbztrljdb.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mgbztrljdb.exe ups_ins3⤵
-
C:\Temp\i_mgbztrljdb.exeC:\Temp\i_mgbztrljdb.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jgbytrljdb.exe ups_run3⤵
-
C:\Temp\jgbytrljdb.exeC:\Temp\jgbytrljdb.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jgbytrljdb.exe ups_ins3⤵
-
C:\Temp\i_jgbytrljdb.exeC:\Temp\i_jgbytrljdb.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ytqligaytq.exe ups_run3⤵
-
C:\Temp\ytqligaytq.exeC:\Temp\ytqligaytq.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ytqligaytq.exe ups_ins3⤵
-
C:\Temp\i_ytqligaytq.exeC:\Temp\i_ytqligaytq.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\idavtnlfdy.exe ups_run3⤵
-
C:\Temp\idavtnlfdy.exeC:\Temp\idavtnlfdy.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x2f0,0x7ff8641ec188,0x7ff8641ec194,0x7ff8641ec1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1800,i,466532062755732943,9495871665245350513,524288 --field-trial-handle=2076,i,16992133150428889263,13679557659549574349,262144 --variations-seed-version --mojo-platform-channel-handle=2104 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1568,i,4176264874606447490,16533128196942571859,262144 --field-trial-handle=2076,i,16992133150428889263,13679557659549574349,262144 --variations-seed-version --mojo-platform-channel-handle=2072 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2460,i,2298488009109051031,3818625352136736064,524288 --field-trial-handle=2076,i,16992133150428889263,13679557659549574349,262144 --variations-seed-version --mojo-platform-channel-handle=2620 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3500,i,13171312831693488428,14019141657152876473,2097152 --field-trial-handle=2076,i,16992133150428889263,13679557659549574349,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3520,i,771656774302449180,15506929905355677080,2097152 --field-trial-handle=2076,i,16992133150428889263,13679557659549574349,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4132,i,7464147060852106283,7517742224485109124,2097152 --field-trial-handle=2076,i,16992133150428889263,13679557659549574349,262144 --variations-seed-version --mojo-platform-channel-handle=4144 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4156,i,16064204676387318198,2995778758921889894,2097152 --field-trial-handle=2076,i,16992133150428889263,13679557659549574349,262144 --variations-seed-version --mojo-platform-channel-handle=4160 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4272,i,3625596202513005358,5809395033542676979,2097152 --field-trial-handle=2076,i,16992133150428889263,13679557659549574349,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4172,i,8380134753287986594,14965193417317136369,2097152 --field-trial-handle=2076,i,16992133150428889263,13679557659549574349,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3952,i,5014229415953707942,14422425783574282633,524288 --field-trial-handle=2076,i,16992133150428889263,13679557659549574349,262144 --variations-seed-version --mojo-platform-channel-handle=3964 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3956,i,14683073926419089820,13484866788883779827,524288 --field-trial-handle=2076,i,16992133150428889263,13679557659549574349,262144 --variations-seed-version --mojo-platform-channel-handle=3964 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4292,i,4756528222412374642,6818770732241791226,524288 --field-trial-handle=2076,i,16992133150428889263,13679557659549574349,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5256,i,16453511661652741214,94276510788109578,524288 --field-trial-handle=2076,i,16992133150428889263,13679557659549574349,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5980,i,14626803454715746724,18169347551306931266,524288 --field-trial-handle=2076,i,16992133150428889263,13679557659549574349,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:144⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.execookie_exporter.exe --cookie-json=11285⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6036,i,11812850797871995186,13058323315408216244,524288 --field-trial-handle=2076,i,16992133150428889263,13679557659549574349,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6036,i,11812850797871995186,13058323315408216244,524288 --field-trial-handle=2076,i,16992133150428889263,13679557659549574349,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5988,i,12740759783713824147,11002372315841700052,524288 --field-trial-handle=2076,i,16992133150428889263,13679557659549574349,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6360,i,12512435755169784224,17661983560138405240,524288 --field-trial-handle=2076,i,16992133150428889263,13679557659549574349,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5980,i,2933379647586967621,1853331839034913171,524288 --field-trial-handle=2076,i,16992133150428889263,13679557659549574349,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6712,i,4351192651923010229,11678487641262049660,524288 --field-trial-handle=2076,i,16992133150428889263,13679557659549574349,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6420,i,2969879162393409386,14093155271913256616,524288 --field-trial-handle=2076,i,16992133150428889263,13679557659549574349,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4172,i,768250009407641868,11155088823810600981,524288 --field-trial-handle=2076,i,16992133150428889263,13679557659549574349,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4256,i,15491737762216372930,8197588143919293141,524288 --field-trial-handle=2076,i,16992133150428889263,13679557659549574349,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5072,i,12481106061260438710,17124685726313413895,524288 --field-trial-handle=2076,i,16992133150428889263,13679557659549574349,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5416,i,17953615563813445117,12130808435108733297,524288 --field-trial-handle=2076,i,16992133150428889263,13679557659549574349,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7024,i,3312340276950301803,312613897554902931,524288 --field-trial-handle=2076,i,16992133150428889263,13679557659549574349,262144 --variations-seed-version --mojo-platform-channel-handle=3948 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7040,i,9772240051484399208,3977530385201787177,524288 --field-trial-handle=2076,i,16992133150428889263,13679557659549574349,262144 --variations-seed-version --mojo-platform-channel-handle=5660 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6104,i,2306377201908602647,17786154511795302327,524288 --field-trial-handle=2076,i,16992133150428889263,13679557659549574349,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4412,i,18425484076493356195,15226209902576839187,262144 --field-trial-handle=2076,i,16992133150428889263,13679557659549574349,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5804,i,16807759632514565307,9483802088042794808,524288 --field-trial-handle=2076,i,16992133150428889263,13679557659549574349,262144 --variations-seed-version --mojo-platform-channel-handle=5640 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\geywqobytrljdbvt.sysC:\Temp\geywqobytrljdbvt.sys1⤵
- Executes dropped EXE
-
C:\Temp\dbwtnlgdyw.sysC:\Temp\dbwtnlgdyw.sys1⤵
- Executes dropped EXE
-
C:\Temp\qoigaysqli.sysC:\Temp\qoigaysqli.sys1⤵
- Executes dropped EXE
-
C:\Temp\dxvpnifaxs.sysC:\Temp\dxvpnifaxs.sys1⤵
- Executes dropped EXE
-
C:\Temp\axsqkicavs.sysC:\Temp\axsqkicavs.sys1⤵
- Executes dropped EXE
-
C:\Temp\pkicausmkf.sysC:\Temp\pkicausmkf.sys1⤵
- Executes dropped EXE
-
C:\Temp\hfzxrpkhcz.sysC:\Temp\hfzxrpkhcz.sys1⤵
- Executes dropped EXE
-
C:\Temp\ezwrojhbzt.sysC:\Temp\ezwrojhbzt.sys1⤵
- Executes dropped EXE
-
C:\Temp\ztrmjhbztr.sysC:\Temp\ztrmjhbztr.sys1⤵
- Executes dropped EXE
-
C:\Temp\wqojgbztrl.sysC:\Temp\wqojgbztrl.sys1⤵
- Executes dropped EXE
-
C:\Temp\qoigbysqlj.sysC:\Temp\qoigbysqlj.sys1⤵
- Executes dropped EXE
-
C:\Temp\kidavtnlfd.sysC:\Temp\kidavtnlfd.sys1⤵
-
C:\Temp\vpnifaxsqk.sysC:\Temp\vpnifaxsqk.sys1⤵
-
C:\Temp\pnhfaxsqki.sysC:\Temp\pnhfaxsqki.sys1⤵
-
C:\Temp\mhfzxrpkhc.sysC:\Temp\mhfzxrpkhc.sys1⤵
-
C:\Temp\ezurmkecwu.sysC:\Temp\ezurmkecwu.sys1⤵
-
C:\Temp\bzxrmjeczu.sysC:\Temp\bzxrmjeczu.sys1⤵
-
C:\Temp\wrojhbztrl.sysC:\Temp\wrojhbztrl.sys1⤵
-
C:\Temp\igbytrljdb.sysC:\Temp\igbytrljdb.sys1⤵
-
C:\Temp\tnlfdyvqoi.sysC:\Temp\tnlfdyvqoi.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CreateProcess.exe
axsqkicavs.sys
dbwtnlgdyw.sys
dxvpnifaxs.sys
fdxvqnigay.exe
geywqobytrljdbvt.exe
geywqobytrljdbvt.sys
i_fdxvqnigay.exe
i_kicausmhfz.exe
i_lgeywoigyt.exe
i_tnlgdywqoi.exe
i_vqnifaysqk.exe
kicausmhfz.exe
lgeywoigyt.exe
qoigaysqli.sys
tnlgdywqoi.exe
vqnifaysqk.exe
protocols.json
settings.dat
BookmarkMergedSurfaceOrdering
the-real-index
SiteList-Enterprise.json
Edge Profile.ico
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
Preferences
Preferences
Secure Preferences
sync_diagnostic.log
8aaddb0f-50d0-4987-8b6c-27ea647a1379.tmp
office_endpoints_list.json
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
nav_config.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
9aeeddc0-4ae6-4eaf-b992-420ffb556c5e.tmp
beecfe33-5e3b-46f1-9e4f-5a9a9a4221c3.tmp
10bf94fa-79b2-4018-9585-c25bad404a50.tmp
content_new.js
manifest.json
manifest.json
manifest.json
manifest.json
memory/388-573-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/540-540-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/932-577-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/956-596-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1348-699-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1356-492-0x0000024369C90000-0x0000024369D66000-memory.dmp
memory/1400-569-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2028-788-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2372-784-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2928-592-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3036-659-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3036-695-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3036-673-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3036-629-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3044-753-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3064-445-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3348-674-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3348-657-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3896-528-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3904-709-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3904-686-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4604-495-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4636-758-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4820-63-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4908-722-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4908-755-0x0000000000010000-0x00000000000AB000-memory.dmp