Analysis
- max time kernel
148s - max time network
151s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
02/06/2026, 12:33
General
- Target 2026-06-02_a79dc5b60cd2ad9410cef0df21dbc0b7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 722KB
- Sample260602-prjbvaev8q
- SHA256 8d027ea46c9d3768a1f450fc8af32030ac598dcd614e5c3d3be9efa894cc3171
Score
9/10
Malware Config
Signatures
- Detects executables containing bas64 encoded gzip files 1 IoCs
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 13 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 41 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 19 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 29 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 3 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_a79dc5b60cd2ad9410cef0df21dbc0b7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-02_a79dc5b60cd2ad9410cef0df21dbc0b7_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\rpjhbzurmkecwuom.exeC:\Temp\rpjhbzurmkecwuom.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zxrpjhbzrm.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\zxrpjhbzrm.exeC:\Temp\zxrpjhbzrm.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zxrpjhbzrm.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_zxrpjhbzrm.exeC:\Temp\i_zxrpjhbzrm.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\eywrojhbzt.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\eywrojhbzt.exeC:\Temp\eywrojhbzt.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_eywrojhbzt.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_eywrojhbzt.exeC:\Temp\i_eywrojhbzt.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vtolgdywqo.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\vtolgdywqo.exeC:\Temp\vtolgdywqo.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vtolgdywqo.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_vtolgdywqo.exeC:\Temp\i_vtolgdywqo.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\oigbytqljd.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\oigbytqljd.exeC:\Temp\oigbytqljd.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_oigbytqljd.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_oigbytqljd.exeC:\Temp\i_oigbytqljd.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\avtnlfdyvq.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\avtnlfdyvq.exeC:\Temp\avtnlfdyvq.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_avtnlfdyvq.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_avtnlfdyvq.exeC:\Temp\i_avtnlfdyvq.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nlfdxvqkic.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\nlfdxvqkic.exeC:\Temp\nlfdxvqkic.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nlfdxvqkic.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_nlfdxvqkic.exeC:\Temp\i_nlfdxvqkic.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fcxvpnhfzx.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\fcxvpnhfzx.exeC:\Temp\fcxvpnhfzx.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fcxvpnhfzx.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_fcxvpnhfzx.exeC:\Temp\i_fcxvpnhfzx.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hcauspkicx.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\hcauspkicx.exeC:\Temp\hcauspkicx.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hcauspkicx.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_hcauspkicx.exeC:\Temp\i_hcauspkicx.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\upmhbzurmk.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\upmhbzurmk.exeC:\Temp\upmhbzurmk.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_upmhbzurmk.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_upmhbzurmk.exeC:\Temp\i_upmhbzurmk.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gezwrojhbz.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\gezwrojhbz.exeC:\Temp\gezwrojhbz.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gezwrojhbz.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_gezwrojhbz.exeC:\Temp\i_gezwrojhbz.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\trljebwtom.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\trljebwtom.exeC:\Temp\trljebwtom.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_trljebwtom.exe ups_ins3⤵
-
C:\Temp\i_trljebwtom.exeC:\Temp\i_trljebwtom.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qljdbvtgdy.exe ups_run3⤵
-
C:\Temp\qljdbvtgdy.exeC:\Temp\qljdbvtgdy.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qljdbvtgdy.exe ups_ins3⤵
-
C:\Temp\i_qljdbvtgdy.exeC:\Temp\i_qljdbvtgdy.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\idbvtnlgdy.exe ups_run3⤵
-
C:\Temp\idbvtnlgdy.exeC:\Temp\idbvtnlgdy.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_idbvtnlgdy.exe ups_ins3⤵
-
C:\Temp\i_idbvtnlgdy.exeC:\Temp\i_idbvtnlgdy.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\sqnigaysnl.exe ups_run3⤵
-
C:\Temp\sqnigaysnl.exeC:\Temp\sqnigaysnl.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_sqnigaysnl.exe ups_ins3⤵
-
C:\Temp\i_sqnigaysnl.exeC:\Temp\i_sqnigaysnl.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\kfdxvpnifa.exe ups_run3⤵
-
C:\Temp\kfdxvpnifa.exeC:\Temp\kfdxvpnifa.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_kfdxvpnifa.exe ups_ins3⤵
-
C:\Temp\i_kfdxvpnifa.exeC:\Temp\i_kfdxvpnifa.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\kfcausmcxu.exe ups_run3⤵
-
C:\Temp\kfcausmcxu.exeC:\Temp\kfcausmcxu.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_kfcausmcxu.exe ups_ins3⤵
-
C:\Temp\i_kfcausmcxu.exeC:\Temp\i_kfcausmcxu.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\czusmkecwu.exe ups_run3⤵
-
C:\Temp\czusmkecwu.exeC:\Temp\czusmkecwu.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_czusmkecwu.exe ups_ins3⤵
-
C:\Temp\i_czusmkecwu.exeC:\Temp\i_czusmkecwu.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\trmjecwuom.exe ups_run3⤵
-
C:\Temp\trmjecwuom.exeC:\Temp\trmjecwuom.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_trmjecwuom.exe ups_ins3⤵
-
C:\Temp\i_trmjecwuom.exeC:\Temp\i_trmjecwuom.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\omgeywqojh.exe ups_run3⤵
-
C:\Temp\omgeywqojh.exeC:\Temp\omgeywqojh.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_omgeywqojh.exe ups_ins3⤵
-
C:\Temp\i_omgeywqojh.exeC:\Temp\i_omgeywqojh.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x300,0x7ffb9017c188,0x7ffb9017c194,0x7ffb9017c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,4618211123400939109,4910601946196944107,262144 --field-trial-handle=2268,i,18201391229232933706,17690353538119111921,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1812,i,1062185940578218387,7392305677080015388,524288 --field-trial-handle=2268,i,18201391229232933706,17690353538119111921,262144 --variations-seed-version --mojo-platform-channel-handle=1936 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2392,i,2098260567787355772,10759713527779496557,524288 --field-trial-handle=2268,i,18201391229232933706,17690353538119111921,262144 --variations-seed-version --mojo-platform-channel-handle=3032 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3400,i,3594295827138231272,1730408718272282920,2097152 --field-trial-handle=2268,i,18201391229232933706,17690353538119111921,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,5797443798305647299,13705129506991239620,2097152 --field-trial-handle=2268,i,18201391229232933706,17690353538119111921,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4180,i,15625674378776844936,12130844069966515672,2097152 --field-trial-handle=2268,i,18201391229232933706,17690353538119111921,262144 --variations-seed-version --mojo-platform-channel-handle=4184 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4224,i,9323371093826147066,593019246670180887,2097152 --field-trial-handle=2268,i,18201391229232933706,17690353538119111921,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4240,i,18318512528856220025,8592490579864820453,2097152 --field-trial-handle=2268,i,18201391229232933706,17690353538119111921,262144 --variations-seed-version --mojo-platform-channel-handle=4456 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4252,i,309474631562388376,7330452996847418000,2097152 --field-trial-handle=2268,i,18201391229232933706,17690353538119111921,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3616,i,14585801543043236777,6138969257279969554,524288 --field-trial-handle=2268,i,18201391229232933706,17690353538119111921,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5372,i,10525880640130254740,9646116162050916634,524288 --field-trial-handle=2268,i,18201391229232933706,17690353538119111921,262144 --variations-seed-version --mojo-platform-channel-handle=4872 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4908,i,8937427101724341604,15605732992304587308,524288 --field-trial-handle=2268,i,18201391229232933706,17690353538119111921,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3620,i,14961277255952722212,15091472703193296549,524288 --field-trial-handle=2268,i,18201391229232933706,17690353538119111921,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6124,i,4389710054553690830,17491311171697573515,524288 --field-trial-handle=2268,i,18201391229232933706,17690353538119111921,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:144⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.execookie_exporter.exe --cookie-json=11405⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6136,i,9190699486030982078,10839979972008458191,524288 --field-trial-handle=2268,i,18201391229232933706,17690353538119111921,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6136,i,9190699486030982078,10839979972008458191,524288 --field-trial-handle=2268,i,18201391229232933706,17690353538119111921,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6336,i,13534466877902168084,8691628950858015704,524288 --field-trial-handle=2268,i,18201391229232933706,17690353538119111921,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6424,i,4404086321788900856,1788933969196122435,524288 --field-trial-handle=2268,i,18201391229232933706,17690353538119111921,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6200,i,507286509643534486,16847566911635239167,524288 --field-trial-handle=2268,i,18201391229232933706,17690353538119111921,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6876,i,12178690400066295473,14837871245923147822,524288 --field-trial-handle=2268,i,18201391229232933706,17690353538119111921,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6380,i,3732492598063853858,5221764001444982843,524288 --field-trial-handle=2268,i,18201391229232933706,17690353538119111921,262144 --variations-seed-version --mojo-platform-channel-handle=6524 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4236,i,2141124766407828124,15719613483891213650,524288 --field-trial-handle=2268,i,18201391229232933706,17690353538119111921,262144 --variations-seed-version --mojo-platform-channel-handle=4168 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4804,i,1776140667917734391,6149197539867877272,524288 --field-trial-handle=2268,i,18201391229232933706,17690353538119111921,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4248,i,2592850170671206709,10225632620376875348,524288 --field-trial-handle=2268,i,18201391229232933706,17690353538119111921,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4828,i,7300534397762093825,15105639897031294393,524288 --field-trial-handle=2268,i,18201391229232933706,17690353538119111921,262144 --variations-seed-version --mojo-platform-channel-handle=2756 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5940,i,1187680713082506206,17967963957236191404,524288 --field-trial-handle=2268,i,18201391229232933706,17690353538119111921,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4508,i,1184304876784718354,7596914660053305250,524288 --field-trial-handle=2268,i,18201391229232933706,17690353538119111921,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=876,i,9310996895791535098,4075059675894192413,524288 --field-trial-handle=2268,i,18201391229232933706,17690353538119111921,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5088,i,9113765787337770227,9581856147497422252,524288 --field-trial-handle=2268,i,18201391229232933706,17690353538119111921,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6152,i,12693928089238204419,4190146941763176275,262144 --field-trial-handle=2268,i,18201391229232933706,17690353538119111921,262144 --variations-seed-version --mojo-platform-channel-handle=6620 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3572,i,2332908098149654935,2039132865486916438,524288 --field-trial-handle=2268,i,18201391229232933706,17690353538119111921,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\rpjhbzurmkecwuom.sysC:\Temp\rpjhbzurmkecwuom.sys1⤵
- Executes dropped EXE
-
C:\Temp\uomjebwuom.sysC:\Temp\uomjebwuom.sys1⤵
- Executes dropped EXE
-
C:\Temp\ojgbztrljd.sysC:\Temp\ojgbztrljd.sys1⤵
- Executes dropped EXE
-
C:\Temp\tqolgeywqo.sysC:\Temp\tqolgeywqo.sys1⤵
- Executes dropped EXE
-
C:\Temp\igaysqlidb.sysC:\Temp\igaysqlidb.sys1⤵
- Executes dropped EXE
-
C:\Temp\xvqnidavsn.sysC:\Temp\xvqnidavsn.sys1⤵
- Executes dropped EXE
-
C:\Temp\xvpnifaysq.sysC:\Temp\xvpnifaysq.sys1⤵
- Executes dropped EXE
-
C:\Temp\pkicausmkf.sysC:\Temp\pkicausmkf.sys1⤵
- Executes dropped EXE
-
C:\Temp\ezxrpjhbzu.sysC:\Temp\ezxrpjhbzu.sys1⤵
- Executes dropped EXE
-
C:\Temp\rpjhbzurmj.sysC:\Temp\rpjhbzurmj.sys1⤵
- Executes dropped EXE
-
C:\Temp\mgeywrojht.sysC:\Temp\mgeywrojht.sys1⤵
- Executes dropped EXE
-
C:\Temp\bwtomgeywq.sysC:\Temp\bwtomgeywq.sys1⤵
-
C:\Temp\qoigaytqli.sysC:\Temp\qoigaytqli.sys1⤵
-
C:\Temp\dxvqnlfdyv.sysC:\Temp\dxvqnlfdyv.sys1⤵
-
C:\Temp\aysqkicank.sysC:\Temp\aysqkicank.sys1⤵
-
C:\Temp\spkicausmk.sysC:\Temp\spkicausmk.sys1⤵
-
C:\Temp\nhfzxrpkhc.sysC:\Temp\nhfzxrpkhc.sys1⤵
-
C:\Temp\ecwupmhezx.sysC:\Temp\ecwupmhezx.sys1⤵
-
C:\Temp\ebwuomgezw.sysC:\Temp\ebwuomgezw.sys1⤵
-
C:\Temp\uolgeywqoj.sysC:\Temp\uolgeywqoj.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
avtnlfdyvq.exe
eywrojhbzt.exe
i_avtnlfdyvq.exe
i_eywrojhbzt.exe
i_oigbytqljd.exe
i_vtolgdywqo.exe
i_zxrpjhbzrm.exe
igaysqlidb.sys
oigbytqljd.exe
ojgbztrljd.sys
rpjhbzurmkecwuom.exe
rpjhbzurmkecwuom.sys
tqolgeywqo.sys
uomjebwuom.sys
vtolgdywqo.exe
zxrpjhbzrm.exe
90a4c75a-5e9f-4f60-902a-b52553021563.tmp
protocols.json
settings.dat
settings.dat
BookmarkMergedSurfaceOrdering
the-real-index
the-real-index~RFe588085.TMP
SiteList-Enterprise.json
Edge Profile.ico
HubApps
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
Preferences
Preferences
Secure Preferences
sync_diagnostic.log
OperationConfig
OperationConfig~RFe591c0a.TMP
office_endpoints_list.json
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
nav_config.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
67c66399-0477-4e55-b35e-4cb750867c03.tmp
6d4fa9ea-b33e-4558-8c9b-426d335f2c3d.tmp
content_new.js
8fb843e6-7039-4595-8e20-893d2e150636.tmp
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
CreateProcess.exe
memory/1000-604-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1720-621-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1744-543-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1888-581-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2280-814-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3248-641-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3444-671-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3716-809-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4220-74-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4384-577-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5196-796-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5196-811-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5256-805-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5256-775-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5256-684-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5292-530-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5576-734-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5672-785-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5672-746-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5756-453-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5804-557-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5912-714-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/6036-502-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/6036-531-0x0000000000010000-0x00000000000AB000-memory.dmp