Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
02/06/2026, 03:28
General
- Target 2026-06-02_bd57458acd6a3a3783caf20ce863a858_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 722KB
- Sample260602-d1lmsacz2w
- SHA256 d46e338adb7c2ecd0a4f5fe7d2babb5b8f37ec3344a3198b29586d23576356ff
Score
9/10
Malware Config
Signatures
- Custom signatureDetects executables containing bas64 encoded gzip files 1 IoCs
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 9 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 41 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 19 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 29 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 3 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_bd57458acd6a3a3783caf20ce863a858_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-02_bd57458acd6a3a3783caf20ce863a858_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\ecwuomhezxrpjhbz.exeC:\Temp\ecwuomhezxrpjhbz.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pjhbzurmke.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\pjhbzurmke.exeC:\Temp\pjhbzurmke.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pjhbzurmke.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_pjhbzurmke.exeC:\Temp\i_pjhbzurmke.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\trmjecwuom.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\trmjecwuom.exeC:\Temp\trmjecwuom.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_trmjecwuom.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_trmjecwuom.exeC:\Temp\i_trmjecwuom.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\geztrojhbz.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\geztrojhbz.exeC:\Temp\geztrojhbz.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_geztrojhbz.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_geztrojhbz.exeC:\Temp\i_geztrojhbz.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\igbytrljdb.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\igbytrljdb.exeC:\Temp\igbytrljdb.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_igbytrljdb.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_igbytrljdb.exeC:\Temp\i_igbytrljdb.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vqoigavqni.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\vqoigavqni.exeC:\Temp\vqoigavqni.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vqoigavqni.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_vqoigavqni.exeC:\Temp\i_vqoigavqni.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\aysqkidavt.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\aysqkidavt.exeC:\Temp\aysqkidavt.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_aysqkidavt.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_aysqkidavt.exeC:\Temp\i_aysqkidavt.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\aysqkausnk.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\aysqkausnk.exeC:\Temp\aysqkausnk.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_aysqkausnk.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_aysqkausnk.exeC:\Temp\i_aysqkausnk.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pkhfzxspkh.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\pkhfzxspkh.exeC:\Temp\pkhfzxspkh.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pkhfzxspkh.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_pkhfzxspkh.exeC:\Temp\i_pkhfzxspkh.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mhezxrpjhc.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\mhezxrpjhc.exeC:\Temp\mhezxrpjhc.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mhezxrpjhc.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_mhezxrpjhc.exeC:\Temp\i_mhezxrpjhc.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ztrmjebwuo.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ztrmjebwuo.exeC:\Temp\ztrmjebwuo.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ztrmjebwuo.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ztrmjebwuo.exeC:\Temp\i_ztrmjebwuo.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wuojhtolge.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\wuojhtolge.exeC:\Temp\wuojhtolge.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wuojhtolge.exe ups_ins3⤵
-
C:\Temp\i_wuojhtolge.exeC:\Temp\i_wuojhtolge.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gbvtolgeyw.exe ups_run3⤵
-
C:\Temp\gbvtolgeyw.exeC:\Temp\gbvtolgeyw.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gbvtolgeyw.exe ups_ins3⤵
-
C:\Temp\i_gbvtolgeyw.exeC:\Temp\i_gbvtolgeyw.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\tqlgdywqoi.exe ups_run3⤵
-
C:\Temp\tqlgdywqoi.exeC:\Temp\tqlgdywqoi.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_tqlgdywqoi.exe ups_ins3⤵
-
C:\Temp\i_tqlgdywqoi.exeC:\Temp\i_tqlgdywqoi.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\dyvqnigays.exe ups_run3⤵
-
C:\Temp\dyvqnigays.exeC:\Temp\dyvqnigays.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_dyvqnigays.exe ups_ins3⤵
-
C:\Temp\i_dyvqnigays.exeC:\Temp\i_dyvqnigays.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ankfdxspki.exe ups_run3⤵
-
C:\Temp\ankfdxspki.exeC:\Temp\ankfdxspki.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ankfdxspki.exe ups_ins3⤵
-
C:\Temp\i_ankfdxspki.exeC:\Temp\i_ankfdxspki.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\smkicaupnh.exe ups_run3⤵
-
C:\Temp\smkicaupnh.exeC:\Temp\smkicaupnh.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_smkicaupnh.exe ups_ins3⤵
-
C:\Temp\i_smkicaupnh.exeC:\Temp\i_smkicaupnh.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fzxrpjhczu.exe ups_run3⤵
-
C:\Temp\fzxrpjhczu.exeC:\Temp\fzxrpjhczu.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fzxrpjhczu.exe ups_ins3⤵
-
C:\Temp\i_fzxrpjhczu.exeC:\Temp\i_fzxrpjhczu.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wrpjhbztrp.exe ups_run3⤵
-
C:\Temp\wrpjhbztrp.exeC:\Temp\wrpjhbztrp.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wrpjhbztrp.exe ups_ins3⤵
-
C:\Temp\i_wrpjhbztrp.exeC:\Temp\i_wrpjhbztrp.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ugeywrojhb.exe ups_run3⤵
-
C:\Temp\ugeywrojhb.exeC:\Temp\ugeywrojhb.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ugeywrojhb.exe ups_ins3⤵
-
C:\Temp\i_ugeywrojhb.exeC:\Temp\i_ugeywrojhb.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x328,0x7ffd0895c188,0x7ffd0895c194,0x7ffd0895c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1716,i,11541685482205830906,11165027561312145577,524288 --field-trial-handle=2324,i,7358633206847022090,6504179031470009825,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1552,i,13212127037018459447,14010327695246741838,262144 --field-trial-handle=2324,i,7358633206847022090,6504179031470009825,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2224,i,12356347505463216051,16569287809412503088,524288 --field-trial-handle=2324,i,7358633206847022090,6504179031470009825,262144 --variations-seed-version --mojo-platform-channel-handle=2624 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3528,i,10190023798596100828,442178838140917974,2097152 --field-trial-handle=2324,i,7358633206847022090,6504179031470009825,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3556,i,14843986601745106399,14517818704986620447,2097152 --field-trial-handle=2324,i,7358633206847022090,6504179031470009825,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4268,i,6733988913187621957,880301772694053522,2097152 --field-trial-handle=2324,i,7358633206847022090,6504179031470009825,262144 --variations-seed-version --mojo-platform-channel-handle=4720 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4284,i,13407667346779400870,13908537308899893841,2097152 --field-trial-handle=2324,i,7358633206847022090,6504179031470009825,262144 --variations-seed-version --mojo-platform-channel-handle=4724 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4296,i,4541361203265416275,2842275047952317102,2097152 --field-trial-handle=2324,i,7358633206847022090,6504179031470009825,262144 --variations-seed-version --mojo-platform-channel-handle=4736 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4308,i,16477105552257244683,7916403633544340613,2097152 --field-trial-handle=2324,i,7358633206847022090,6504179031470009825,262144 --variations-seed-version --mojo-platform-channel-handle=4748 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3688,i,1469634426585117767,6774683232628009483,524288 --field-trial-handle=2324,i,7358633206847022090,6504179031470009825,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5416,i,6744849195586523306,18441372870997827366,524288 --field-trial-handle=2324,i,7358633206847022090,6504179031470009825,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5588,i,6623781755298293346,12844111734583500390,524288 --field-trial-handle=2324,i,7358633206847022090,6504179031470009825,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5584,i,3906523147045302256,15020192564972370165,524288 --field-trial-handle=2324,i,7358633206847022090,6504179031470009825,262144 --variations-seed-version --mojo-platform-channel-handle=3752 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6216,i,16370332541216527387,10229982711239668038,524288 --field-trial-handle=2324,i,7358633206847022090,6504179031470009825,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6216,i,16370332541216527387,10229982711239668038,524288 --field-trial-handle=2324,i,7358633206847022090,6504179031470009825,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6304,i,7845153244400665514,17683559706571969692,524288 --field-trial-handle=2324,i,7358633206847022090,6504179031470009825,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:144⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.execookie_exporter.exe --cookie-json=11285⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6444,i,11072431682998468900,11495328487925330256,524288 --field-trial-handle=2324,i,7358633206847022090,6504179031470009825,262144 --variations-seed-version --mojo-platform-channel-handle=6440 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6532,i,11913701825047618074,8301105770797552088,524288 --field-trial-handle=2324,i,7358633206847022090,6504179031470009825,262144 --variations-seed-version --mojo-platform-channel-handle=6536 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6548,i,15773154365477998057,1748185377169670549,524288 --field-trial-handle=2324,i,7358633206847022090,6504179031470009825,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6436,i,4704231053284495940,1999578232990281526,524288 --field-trial-handle=2324,i,7358633206847022090,6504179031470009825,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6424,i,17440039400617456129,3615605670778266409,524288 --field-trial-handle=2324,i,7358633206847022090,6504179031470009825,262144 --variations-seed-version --mojo-platform-channel-handle=6556 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4996,i,4515394401859270240,16519684660471155266,524288 --field-trial-handle=2324,i,7358633206847022090,6504179031470009825,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3672,i,17529913573760445693,10479572009803448225,524288 --field-trial-handle=2324,i,7358633206847022090,6504179031470009825,262144 --variations-seed-version --mojo-platform-channel-handle=4968 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3732,i,13532076621120412206,3018327789252041207,524288 --field-trial-handle=2324,i,7358633206847022090,6504179031470009825,262144 --variations-seed-version --mojo-platform-channel-handle=4956 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3548,i,7803532908474891186,3814141771837789655,524288 --field-trial-handle=2324,i,7358633206847022090,6504179031470009825,262144 --variations-seed-version --mojo-platform-channel-handle=4904 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3500,i,3934328914354523682,7588077451570781856,524288 --field-trial-handle=2324,i,7358633206847022090,6504179031470009825,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=876,i,2767311590008589326,610361416860370019,524288 --field-trial-handle=2324,i,7358633206847022090,6504179031470009825,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3748,i,10690396827090059189,12534383295669825202,524288 --field-trial-handle=2324,i,7358633206847022090,6504179031470009825,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5760,i,16988836266979557244,17396895155650617696,262144 --field-trial-handle=2324,i,7358633206847022090,6504179031470009825,262144 --variations-seed-version --mojo-platform-channel-handle=4924 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5908,i,14260619307637727238,2291247447445504459,524288 --field-trial-handle=2324,i,7358633206847022090,6504179031470009825,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\ecwuomhezxrpjhbz.sysC:\Temp\ecwuomhezxrpjhbz.sys1⤵
- Executes dropped EXE
-
C:\Temp\pjhbztrmje.sysC:\Temp\pjhbztrmje.sys1⤵
- Executes dropped EXE
-
C:\Temp\rmjebwrojg.sysC:\Temp\rmjebwrojg.sys1⤵
- Executes dropped EXE
-
C:\Temp\wtolgeywqo.sysC:\Temp\wtolgeywqo.sys1⤵
- Executes dropped EXE
-
C:\Temp\gaytqlidbv.sysC:\Temp\gaytqlidbv.sys1⤵
- Executes dropped EXE
-
C:\Temp\sqlidavlfd.sysC:\Temp\sqlidavlfd.sys1⤵
- Executes dropped EXE
-
C:\Temp\kfdxvpnifa.sysC:\Temp\kfdxvpnifa.sys1⤵
- Executes dropped EXE
-
C:\Temp\cxupkicaup.sysC:\Temp\cxupkicaup.sys1⤵
- Executes dropped EXE
-
C:\Temp\xsmkfzxrpj.sysC:\Temp\xsmkfzxrpj.sys1⤵
- Executes dropped EXE
-
C:\Temp\rmkecwupez.sysC:\Temp\rmkecwupez.sys1⤵
- Executes dropped EXE
-
C:\Temp\gbztrljebw.sysC:\Temp\gbztrljebw.sys1⤵
- Executes dropped EXE
-
C:\Temp\omgeywqojg.sysC:\Temp\omgeywqojg.sys1⤵
-
C:\Temp\dbvtolgdyw.sysC:\Temp\dbvtolgdyw.sys1⤵
-
C:\Temp\ysqlavtnif.sysC:\Temp\ysqlavtnif.sys1⤵
-
C:\Temp\lfdxvqniga.sysC:\Temp\lfdxvqniga.sys1⤵
-
C:\Temp\cxupnhfaxs.sysC:\Temp\cxupnhfaxs.sys1⤵
-
C:\Temp\pkhcausmke.sysC:\Temp\pkhcausmke.sys1⤵
-
C:\Temp\pjhurmkezw.sysC:\Temp\pjhurmkezw.sys1⤵
-
C:\Temp\czuomgezwr.sysC:\Temp\czuomgezwr.sys1⤵
-
C:\Temp\tojgbztrlj.sysC:\Temp\tojgbztrlj.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CreateProcess.exe
ecwuomhezxrpjhbz.exe
ecwuomhezxrpjhbz.sys
gaytqlidbv.sys
geztrojhbz.exe
i_geztrojhbz.exe
i_igbytrljdb.exe
i_pjhbzurmke.exe
i_trmjecwuom.exe
i_vqoigavqni.exe
igbytrljdb.exe
pjhbztrmje.sys
pjhbzurmke.exe
rmjebwrojg.sys
trmjecwuom.exe
vqoigavqni.exe
wtolgeywqo.sys
protocols.json
settings.dat
BookmarkMergedSurfaceOrdering
the-real-index
SiteList-Enterprise.json
Edge Profile.ico
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
Preferences
Preferences
Secure Preferences
sync_diagnostic.log
c8ef9d27-0d00-4344-bf46-2958a493d625.tmp
office_endpoints_list.json
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
nav_config.json
metadata.json
metadata.json
metadata.json
metadata.json
dbafa7e8-2f2a-4cd6-b9ab-02cf91236563.tmp
255d2011-ba98-42d4-8cd1-ba9486de135e.tmp
880b1ec6-68a8-41bd-b173-b1f1f36ba391.tmp
d196a824-e77f-4ad1-8aa1-1b2371311d36.tmp
content_new.js
manifest.json
manifest.json
manifest.json
manifest.json
memory/236-515-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/240-529-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/588-733-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/816-550-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1148-663-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1920-642-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2396-562-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3168-776-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3316-441-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3324-574-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3328-63-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3820-815-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4120-803-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4144-719-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4424-706-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4612-490-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4716-643-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4716-617-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4792-597-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4980-686-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4980-716-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5096-778-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5096-764-0x0000000000010000-0x00000000000AB000-memory.dmp