Analysis
- max time kernel
148s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
28/10/2026, 20:28
General
- Target 2026-10-27_d3c75b9419db60147a7d19888c92f39a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 361KB
- Sample261028-y84hsaez31
- SHA256 430100def610c860a1e1de0085e0567d6ec0528d6b770680bfff26fb3ba1a993
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba
-
http://xytets.com:2345/t.asp?os=home
-
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-27_d3c75b9419db60147a7d19888c92f39a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-27_d3c75b9419db60147a7d19888c92f39a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\atnlfdyvqoigaynl.exeC:\Temp\atnlfdyvqoigaynl.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\sqolgdyvqn.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\sqolgdyvqn.exeC:\Temp\sqolgdyvqn.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_sqolgdyvqn.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_sqolgdyvqn.exeC:\Temp\i_sqolgdyvqn.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\sqnigaytqk.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\sqnigaytqk.exeC:\Temp\sqnigaytqk.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_sqnigaytqk.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_sqnigaytqk.exeC:\Temp\i_sqnigaytqk.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\axvpnkifay.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\axvpnkifay.exeC:\Temp\axvpnkifay.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_axvpnkifay.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_axvpnkifay.exeC:\Temp\i_axvpnkifay.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nkfzxspkhf.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\nkfzxspkhf.exeC:\Temp\nkfzxspkhf.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nkfzxspkhf.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_nkfzxspkhf.exeC:\Temp\i_nkfzxspkhf.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\eczurpmhcz.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\eczurpmhcz.exeC:\Temp\eczurpmhcz.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_eczurpmhcz.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_eczurpmhcz.exeC:\Temp\i_eczurpmhcz.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\omjecwuomg.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\omjecwuomg.exeC:\Temp\omjecwuomg.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_omjecwuomg.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_omjecwuomg.exeC:\Temp\i_omjecwuomg.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\trmjecwuom.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\trmjecwuom.exeC:\Temp\trmjecwuom.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_trmjecwuom.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_trmjecwuom.exeC:\Temp\i_trmjecwuom.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rolgebvtqo.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\rolgebvtqo.exeC:\Temp\rolgebvtqo.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rolgebvtqo.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_rolgebvtqo.exeC:\Temp\i_rolgebvtqo.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gaysqoigay.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\gaysqoigay.exeC:\Temp\gaysqoigay.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gaysqoigay.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_gaysqoigay.exeC:\Temp\i_gaysqoigay.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fdbvtnlfda.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\fdbvtnlfda.exeC:\Temp\fdbvtnlfda.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fdbvtnlfda.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_fdbvtnlfda.exeC:\Temp\i_fdbvtnlfda.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fdavsnlfdx.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\fdavsnlfdx.exeC:\Temp\fdavsnlfdx.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fdavsnlfdx.exe ups_ins3⤵
-
C:\Temp\i_fdavsnlfdx.exeC:\Temp\i_fdavsnlfdx.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\caxspnhfax.exe ups_run3⤵
-
C:\Temp\caxspnhfax.exeC:\Temp\caxspnhfax.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_caxspnhfax.exe ups_ins3⤵
-
C:\Temp\i_caxspnhfax.exeC:\Temp\i_caxspnhfax.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\causmkecxr.exe ups_run3⤵
-
C:\Temp\causmkecxr.exeC:\Temp\causmkecxr.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_causmkecxr.exe ups_ins3⤵
-
C:\Temp\i_causmkecxr.exeC:\Temp\i_causmkecxr.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bzxrpmhfzx.exe ups_run3⤵
-
C:\Temp\bzxrpmhfzx.exeC:\Temp\bzxrpmhfzx.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bzxrpmhfzx.exe ups_ins3⤵
-
C:\Temp\i_bzxrpmhfzx.exeC:\Temp\i_bzxrpmhfzx.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jhbzwromje.exe ups_run3⤵
-
C:\Temp\jhbzwromje.exeC:\Temp\jhbzwromje.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jhbzwromje.exe ups_ins3⤵
-
C:\Temp\i_jhbzwromje.exeC:\Temp\i_jhbzwromje.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rojgebwtrl.exe ups_run3⤵
-
C:\Temp\rojgebwtrl.exeC:\Temp\rojgebwtrl.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rojgebwtrl.exe ups_ins3⤵
-
C:\Temp\i_rojgebwtrl.exeC:\Temp\i_rojgebwtrl.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ebvqoigwql.exe ups_run3⤵
-
C:\Temp\ebvqoigwql.exeC:\Temp\ebvqoigwql.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ebvqoigwql.exe ups_ins3⤵
-
C:\Temp\i_ebvqoigwql.exeC:\Temp\i_ebvqoigwql.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vtqoigaysq.exe ups_run3⤵
-
C:\Temp\vtqoigaysq.exeC:\Temp\vtqoigaysq.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vtqoigaysq.exe ups_ins3⤵
-
C:\Temp\i_vtqoigaysq.exeC:\Temp\i_vtqoigaysq.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ayvqnigays.exe ups_run3⤵
-
C:\Temp\ayvqnigays.exeC:\Temp\ayvqnigays.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ayvqnigays.exe ups_ins3⤵
-
C:\Temp\i_ayvqnigays.exeC:\Temp\i_ayvqnigays.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xvpnifausq.exe ups_run3⤵
-
C:\Temp\xvpnifausq.exeC:\Temp\xvpnifausq.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7fff8cc8c188,0x7fff8cc8c194,0x7fff8cc8c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1708,i,9230188943470196159,6431095400790521451,262144 --field-trial-handle=2312,i,7341557663835928876,12485250920555054849,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1920,i,18436090109977233414,12846307676537340945,524288 --field-trial-handle=2312,i,7341557663835928876,12485250920555054849,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2540,i,10250503742082638977,3081158179853288216,524288 --field-trial-handle=2312,i,7341557663835928876,12485250920555054849,262144 --variations-seed-version --mojo-platform-channel-handle=2664 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3624,i,5815494786301912460,8563323113258534041,2097152 --field-trial-handle=2312,i,7341557663835928876,12485250920555054849,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3636,i,12171721948601349415,15784548904899838046,2097152 --field-trial-handle=2312,i,7341557663835928876,12485250920555054849,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4272,i,13217082181428934742,12385679484569187556,2097152 --field-trial-handle=2312,i,7341557663835928876,12485250920555054849,262144 --variations-seed-version --mojo-platform-channel-handle=4832 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4420,i,3020403358690004987,1709228156863506207,2097152 --field-trial-handle=2312,i,7341557663835928876,12485250920555054849,262144 --variations-seed-version --mojo-platform-channel-handle=4880 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5296,i,6356381219806446305,7755722767800635019,524288 --field-trial-handle=2312,i,7341557663835928876,12485250920555054849,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5340,i,13170881640134289603,13380220392162377341,2097152 --field-trial-handle=2312,i,7341557663835928876,12485250920555054849,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3928,i,18380504300315158582,1947758392809168643,524288 --field-trial-handle=2312,i,7341557663835928876,12485250920555054849,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3916,i,7468957433608384216,8878444791563776230,524288 --field-trial-handle=2312,i,7341557663835928876,12485250920555054849,262144 --variations-seed-version --mojo-platform-channel-handle=3900 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,2341455844009454868,13952596552553789190,524288 --field-trial-handle=2312,i,7341557663835928876,12485250920555054849,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,2341455844009454868,13952596552553789190,524288 --field-trial-handle=2312,i,7341557663835928876,12485250920555054849,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5312,i,10843075586367588623,1006052311883352843,524288 --field-trial-handle=2312,i,7341557663835928876,12485250920555054849,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6456,i,2513806849299861929,11502679632725070737,524288 --field-trial-handle=2312,i,7341557663835928876,12485250920555054849,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6668,i,12261871407754102796,13080806394869742595,2097152 --field-trial-handle=2312,i,7341557663835928876,12485250920555054849,262144 --variations-seed-version --mojo-platform-channel-handle=6676 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5256,i,8392268285167939444,4401040899061285795,524288 --field-trial-handle=2312,i,7341557663835928876,12485250920555054849,262144 --variations-seed-version --mojo-platform-channel-handle=4832 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5324,i,13688646750340311521,12743550786861384603,524288 --field-trial-handle=2312,i,7341557663835928876,12485250920555054849,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4412,i,10503599096952960046,5587309834566912935,524288 --field-trial-handle=2312,i,7341557663835928876,12485250920555054849,262144 --variations-seed-version --mojo-platform-channel-handle=4888 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3804,i,7194483596234154751,766361725964260005,524288 --field-trial-handle=2312,i,7341557663835928876,12485250920555054849,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3800,i,18164461619245050835,10784822028508624153,524288 --field-trial-handle=2312,i,7341557663835928876,12485250920555054849,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5724,i,18362550515593814400,4401402180966744128,524288 --field-trial-handle=2312,i,7341557663835928876,12485250920555054849,262144 --variations-seed-version --mojo-platform-channel-handle=5636 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6236,i,17978299798261916927,11837236634263922720,524288 --field-trial-handle=2312,i,7341557663835928876,12485250920555054849,262144 --variations-seed-version --mojo-platform-channel-handle=3320 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5180,i,10081681954512981484,17702797130057347212,524288 --field-trial-handle=2312,i,7341557663835928876,12485250920555054849,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6448,i,16484083981077683082,9524464547499237157,524288 --field-trial-handle=2312,i,7341557663835928876,12485250920555054849,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6240,i,4520723186567518489,2805608456416364493,262144 --field-trial-handle=2312,i,7341557663835928876,12485250920555054849,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3488,i,7215145426434694562,3771280715912070226,524288 --field-trial-handle=2312,i,7341557663835928876,12485250920555054849,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\atnlfdyvqoigaynl.sysC:\Temp\atnlfdyvqoigaynl.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Temp\vqnifdyvqo.sysC:\Temp\vqnifdyvqo.sys1⤵
- Executes dropped EXE
-
C:\Temp\fdxusqkica.sysC:\Temp\fdxusqkica.sys1⤵
- Executes dropped EXE
-
C:\Temp\hfzxvpkhfz.sysC:\Temp\hfzxvpkhfz.sys1⤵
- Executes dropped EXE
-
C:\Temp\pnhczxrpkh.sysC:\Temp\pnhczxrpkh.sys1⤵
- Executes dropped EXE
-
C:\Temp\jhezwurmke.sysC:\Temp\jhezwurmke.sys1⤵
- Executes dropped EXE
-
C:\Temp\romgbztrlj.sysC:\Temp\romgbztrlj.sys1⤵
- Executes dropped EXE
-
C:\Temp\oljdbvtrlj.sysC:\Temp\oljdbvtrlj.sys1⤵
- Executes dropped EXE
-
C:\Temp\trljdbytqo.sysC:\Temp\trljdbytqo.sys1⤵
- Executes dropped EXE
-
C:\Temp\oifdyvqoig.sysC:\Temp\oifdyvqoig.sys1⤵
- Executes dropped EXE
-
C:\Temp\aysqnlfdav.sysC:\Temp\aysqnlfdav.sys1⤵
- Executes dropped EXE
-
C:\Temp\fdausmkfcx.sysC:\Temp\fdausmkfcx.sys1⤵
-
C:\Temp\kfcxuspnhf.sysC:\Temp\kfcxuspnhf.sys1⤵
-
C:\Temp\bzxrmkhczx.sysC:\Temp\bzxrmkhczx.sys1⤵
-
C:\Temp\jhbztrmjhe.sysC:\Temp\jhbztrmjhe.sys1⤵
-
C:\Temp\wtrhbzwtrl.sysC:\Temp\wtrhbzwtrl.sys1⤵
-
C:\Temp\eywqojgbzt.sysC:\Temp\eywqojgbzt.sys1⤵
-
C:\Temp\vtqljdbvtn.sysC:\Temp\vtqljdbvtn.sys1⤵
-
C:\Temp\aysqoigays.sysC:\Temp\aysqoigays.sys1⤵
-
C:\Temp\ifaysnkida.sysC:\Temp\ifaysnkida.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
atnlfdyvqoigaynl.exe
atnlfdyvqoigaynl.sys
axvpnkifay.exe
eczurpmhcz.exe
fdxusqkica.sys
hfzxvpkhfz.sys
i_axvpnkifay.exe
i_eczurpmhcz.exe
i_nkfzxspkhf.exe
i_sqnigaytqk.exe
i_sqolgdyvqn.exe
jhezwurmke.sys
nkfzxspkhf.exe
pnhczxrpkh.sys
sqnigaytqk.exe
sqolgdyvqn.exe
vqnifdyvqo.sys
0aaa788f-b3a3-4086-ad9c-c46b124093b6.tmp
1490a7da-bacf-4de6-9e20-6f1dc192df60.tmp
5eb552f7-a25e-451e-aed3-43c0f6e2225e.tmp
settings.dat
settings.dat
2fa9da26-5c72-48f9-b22f-fb74e8c89fd2.tmp
6e58b0bf-d6dc-4936-83e9-96db51e49062.tmp
7504152b-468e-4d95-88dd-48320e2b20de.tmp
the-real-index
the-real-index
8c05952f-84d2-4f1e-8373-b345518ab55d.tmp
dasherSettingSchema.json
08a00761-175a-481e-9067-da775fe9fbe2.tmp
58ad3272-d921-40ae-97a7-abb5981b66fb.tmp
c4fdea7f-5632-4789-b91b-03b8f11cf97b.tmp
sync_diagnostic.log
c3d1fd8a-b407-42e9-97e2-05fdd2a16732.tmp
d7860e13-3c91-450d-8079-702403dac0de.tmp
eecdfc09-2b30-4af1-b6d0-b733b80b2073.tmp
6a881fe3-aedf-4ac6-8eb5-5882dacf1416.tmp
a37a3077-9d73-452a-aca6-3ee8eccfd453.tmp
112aa607-288b-4612-84ee-164012c78e9d.tmp
3b1ed5f4-b4ee-4b2e-8990-8b7230eaf4b6.tmp
80a19c5e-7052-49d1-9972-c220a6259267.tmp
ec16d175-1efb-4c20-86d1-eab3234220c1.tmp
ecab99ce-9a29-4e9d-80a5-60205e943842.tmp
3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
4f98417b-4beb-4b11-9d60-df50ed355f4c.tmp
9c7ce9f3-110a-4eca-8346-88289f495fc5.tmp
f50d220d-cc31-4120-846f-fc3be3502488.tmp
f6c3341e-4719-4b4f-a9e8-e7de985ec55b.tmp
messages.json
content.js
manifest.json
manifest.json
manifest.json
manifest.json
CreateProcess.exe
memory/1044-538-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1064-721-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1284-584-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1568-680-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2564-717-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2600-692-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2820-539-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2820-524-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3252-483-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3252-66-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3368-564-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4328-648-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4604-660-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5004-614-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5208-560-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5448-696-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5448-739-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5576-434-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5576-489-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5848-626-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5848-568-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/6132-531-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/6132-512-0x0000000000010000-0x00000000000AB000-memory.dmp