Analysis
- max time kernel
149s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
01/11/2026, 02:08
General
- Target 2026-10-30_597c7078f7389bc7675bbe1872afe7c1_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 361KB
- Sample261101-ck32fssse1
- SHA256 c2c226d7a4f44c85c4a23a8b3cc53fd545ef803c3f282351f9c2b734d681d3d0
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba
-
http://xytets.com:2345/t.asp?os=home
-
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-30_597c7078f7389bc7675bbe1872afe7c1_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-30_597c7078f7389bc7675bbe1872afe7c1_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\mgezwrpjhbztrmje.exeC:\Temp\mgezwrpjhbztrmje.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mjebwuomez.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\mjebwuomez.exeC:\Temp\mjebwuomez.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mjebwuomez.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_mjebwuomez.exeC:\Temp\i_mjebwuomez.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jgbywqomge.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\jgbywqomge.exeC:\Temp\jgbywqomge.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jgbywqomge.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_jgbywqomge.exeC:\Temp\i_jgbywqomge.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ljdbvtnlgd.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ljdbvtnlgd.exeC:\Temp\ljdbvtnlgd.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ljdbvtnlgd.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ljdbvtnlgd.exeC:\Temp\i_ljdbvtnlgd.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gayvqnifay.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\gayvqnifay.exeC:\Temp\gayvqnifay.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gayvqnifay.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_gayvqnifay.exeC:\Temp\i_gayvqnifay.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nifayspkic.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\nifayspkic.exeC:\Temp\nifayspkic.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nifayspkic.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_nifayspkic.exeC:\Temp\i_nifayspkic.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xspkhfzxsp.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\xspkhfzxsp.exeC:\Temp\xspkhfzxsp.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xspkhfzxsp.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_xspkhfzxsp.exeC:\Temp\i_xspkhfzxsp.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jhczxrpkec.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\jhczxrpkec.exeC:\Temp\jhczxrpkec.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jhczxrpkec.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_jhczxrpkec.exeC:\Temp\i_jhczxrpkec.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mhecwuomhe.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\mhecwuomhe.exeC:\Temp\mhecwuomhe.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mhecwuomhe.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_mhecwuomhe.exeC:\Temp\i_mhecwuomhe.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jgeywurmjd.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\jgeywurmjd.exeC:\Temp\jgeywurmjd.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jgeywurmjd.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_jgeywurmjd.exeC:\Temp\i_jgeywurmjd.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rojhbztolj.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\rojhbztolj.exeC:\Temp\rojhbztolj.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rojhbztolj.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_rojhbztolj.exeC:\Temp\i_rojhbztolj.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qoigaytqlj.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\qoigaytqlj.exeC:\Temp\qoigaytqlj.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qoigaytqlj.exe ups_ins3⤵
-
C:\Temp\i_qoigaytqlj.exeC:\Temp\i_qoigaytqlj.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\tqlidbvtnl.exe ups_run3⤵
-
C:\Temp\tqlidbvtnl.exeC:\Temp\tqlidbvtnl.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_tqlidbvtnl.exe ups_ins3⤵
-
C:\Temp\i_tqlidbvtnl.exeC:\Temp\i_tqlidbvtnl.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\dyvqnifdav.exe ups_run3⤵
-
C:\Temp\dyvqnifdav.exeC:\Temp\dyvqnifdav.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_dyvqnifdav.exe ups_ins3⤵
-
C:\Temp\i_dyvqnifdav.exeC:\Temp\i_dyvqnifdav.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\sqkicxusnk.exe ups_run3⤵
-
C:\Temp\sqkicxusnk.exeC:\Temp\sqkicxusnk.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_sqkicxusnk.exe ups_ins3⤵
-
C:\Temp\i_sqkicxusnk.exeC:\Temp\i_sqkicxusnk.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\upnkecxupn.exe ups_run3⤵
-
C:\Temp\upnkecxupn.exeC:\Temp\upnkecxupn.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_upnkecxupn.exe ups_ins3⤵
-
C:\Temp\i_upnkecxupn.exeC:\Temp\i_upnkecxupn.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\urpmheczus.exe ups_run3⤵
-
C:\Temp\urpmheczus.exeC:\Temp\urpmheczus.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_urpmheczus.exe ups_ins3⤵
-
C:\Temp\i_urpmheczus.exeC:\Temp\i_urpmheczus.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\cwupmgezwr.exe ups_run3⤵
-
C:\Temp\cwupmgezwr.exeC:\Temp\cwupmgezwr.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_cwupmgezwr.exe ups_ins3⤵
-
C:\Temp\i_cwupmgezwr.exeC:\Temp\i_cwupmgezwr.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jecwuoljhe.exe ups_run3⤵
-
C:\Temp\jecwuoljhe.exeC:\Temp\jecwuoljhe.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jecwuoljhe.exe ups_ins3⤵
-
C:\Temp\i_jecwuoljhe.exeC:\Temp\i_jecwuoljhe.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\olgdbvtqom.exe ups_run3⤵
-
C:\Temp\olgdbvtqom.exeC:\Temp\olgdbvtqom.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_olgdbvtqom.exe ups_ins3⤵
-
C:\Temp\i_olgdbvtqom.exeC:\Temp\i_olgdbvtqom.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vtnlgdywql.exe ups_run3⤵
-
C:\Temp\vtnlgdywql.exeC:\Temp\vtnlgdywql.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2c0,0x304,0x7ff999bfc188,0x7ff999bfc194,0x7ff999bfc1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1596,i,18087122222551512227,7710926075097261272,262144 --field-trial-handle=2244,i,13157349773661224603,9797905624994131673,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1868,i,4757203027459232971,637429276616124868,524288 --field-trial-handle=2244,i,13157349773661224603,9797905624994131673,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2476,i,6080433521373066986,2447735892476029429,524288 --field-trial-handle=2244,i,13157349773661224603,9797905624994131673,262144 --variations-seed-version --mojo-platform-channel-handle=2408 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3668,i,12242344223038986055,14399013715347264123,2097152 --field-trial-handle=2244,i,13157349773661224603,9797905624994131673,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3408,i,9986638945131335857,13047830082957808769,2097152 --field-trial-handle=2244,i,13157349773661224603,9797905624994131673,262144 --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4312,i,12108425155763889547,874517200547097733,2097152 --field-trial-handle=2244,i,13157349773661224603,9797905624994131673,262144 --variations-seed-version --mojo-platform-channel-handle=4956 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4332,i,5571783048788712725,17970388555185246671,2097152 --field-trial-handle=2244,i,13157349773661224603,9797905624994131673,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5424,i,7702273863819580012,14463957432553588438,524288 --field-trial-handle=2244,i,13157349773661224603,9797905624994131673,262144 --variations-seed-version --mojo-platform-channel-handle=4992 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3864,i,17685797064842194645,5449652278558060302,524288 --field-trial-handle=2244,i,13157349773661224603,9797905624994131673,262144 --variations-seed-version --mojo-platform-channel-handle=3808 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3840,i,10078075947697102163,1804978686209314230,524288 --field-trial-handle=2244,i,13157349773661224603,9797905624994131673,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,16281677650980088379,14241827600881502902,524288 --field-trial-handle=2244,i,13157349773661224603,9797905624994131673,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,16281677650980088379,14241827600881502902,524288 --field-trial-handle=2244,i,13157349773661224603,9797905624994131673,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6308,i,9575849579504815756,17877105361050993314,524288 --field-trial-handle=2244,i,13157349773661224603,9797905624994131673,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6296,i,1663247071305429109,1598055403199543768,524288 --field-trial-handle=2244,i,13157349773661224603,9797905624994131673,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6300,i,12644708774619136596,343432711061586087,524288 --field-trial-handle=2244,i,13157349773661224603,9797905624994131673,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6568,i,8702094870563430411,11445355496377910716,524288 --field-trial-handle=2244,i,13157349773661224603,9797905624994131673,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=4332,i,6699686776022686491,18327725976355121993,2097152 --field-trial-handle=2244,i,13157349773661224603,9797905624994131673,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5172,i,5423747476369312004,8841211928472665669,2097152 --field-trial-handle=2244,i,13157349773661224603,9797905624994131673,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5164,i,15299478306191456363,11747361456290529924,524288 --field-trial-handle=2244,i,13157349773661224603,9797905624994131673,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,5935676076643516561,1019675916833733066,524288 --field-trial-handle=2244,i,13157349773661224603,9797905624994131673,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6936,i,10802582095937040972,6000191807743390642,524288 --field-trial-handle=2244,i,13157349773661224603,9797905624994131673,262144 --variations-seed-version --mojo-platform-channel-handle=6988 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=4320,i,13608239943826328714,13906235078417357327,2097152 --field-trial-handle=2244,i,13157349773661224603,9797905624994131673,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5016,i,14489730658974760437,7340787098802814362,524288 --field-trial-handle=2244,i,13157349773661224603,9797905624994131673,262144 --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5424,i,983275837418370541,12554236433100704010,524288 --field-trial-handle=2244,i,13157349773661224603,9797905624994131673,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6768,i,3320959835162722743,6744998769542915796,524288 --field-trial-handle=2244,i,13157349773661224603,9797905624994131673,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=940,i,190373756297509931,11945267755467577405,524288 --field-trial-handle=2244,i,13157349773661224603,9797905624994131673,262144 --variations-seed-version --mojo-platform-channel-handle=936 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6220,i,6737493661178729171,1182635368455072225,262144 --field-trial-handle=2244,i,13157349773661224603,9797905624994131673,262144 --variations-seed-version --mojo-platform-channel-handle=6708 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3504,i,14122381238054637705,1150461465486022299,524288 --field-trial-handle=2244,i,13157349773661224603,9797905624994131673,262144 --variations-seed-version --mojo-platform-channel-handle=6892 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6032,i,14525102619260220997,10514325577981328141,524288 --field-trial-handle=2244,i,13157349773661224603,9797905624994131673,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\mgezwrpjhbztrmje.sysC:\Temp\mgezwrpjhbztrmje.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Temp\rojgbztroj.sysC:\Temp\rojgbztroj.sys1⤵
- Executes dropped EXE
-
C:\Temp\tqljdbvtnl.sysC:\Temp\tqljdbvtnl.sys1⤵
- Executes dropped EXE
-
C:\Temp\yvqoiysqki.sysC:\Temp\yvqoiysqki.sys1⤵
- Executes dropped EXE
-
C:\Temp\dxvpnifays.sysC:\Temp\dxvpnifays.sys1⤵
- Executes dropped EXE
-
C:\Temp\icausqkica.sysC:\Temp\icausqkica.sys1⤵
- Executes dropped EXE
-
C:\Temp\pjhczusmkh.sysC:\Temp\pjhczusmkh.sys1⤵
- Executes dropped EXE
-
C:\Temp\pjhbzurmke.sysC:\Temp\pjhbzurmke.sys1⤵
- Executes dropped EXE
-
C:\Temp\uomjhbzurp.sysC:\Temp\uomjhbzurp.sys1⤵
- Executes dropped EXE
-
C:\Temp\wrojhbztrl.sysC:\Temp\wrojhbztrl.sys1⤵
- Executes dropped EXE
-
C:\Temp\wqoigaywqo.sysC:\Temp\wqoigaywqo.sys1⤵
- Executes dropped EXE
-
C:\Temp\yvtnljdbql.sysC:\Temp\yvtnljdbql.sys1⤵
-
C:\Temp\davsqlidav.sysC:\Temp\davsqlidav.sys1⤵
-
C:\Temp\dxvpnkfdxv.sysC:\Temp\dxvpnkfdxv.sys1⤵
-
C:\Temp\vpnhfzxspk.sysC:\Temp\vpnhfzxspk.sys1⤵
-
C:\Temp\czusmkhfzx.sysC:\Temp\czusmkhfzx.sys1⤵
-
C:\Temp\eczurpjhbz.sysC:\Temp\eczurpjhbz.sys1⤵
-
C:\Temp\gecwuomgez.sysC:\Temp\gecwuomgez.sys1⤵
-
C:\Temp\ljdbytqomg.sysC:\Temp\ljdbytqomg.sys1⤵
-
C:\Temp\gaywqolgey.sysC:\Temp\gaywqolgey.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
dxvpnifays.sys
gayvqnifay.exe
i_gayvqnifay.exe
i_jgbywqomge.exe
i_ljdbvtnlgd.exe
i_mjebwuomez.exe
i_nifayspkic.exe
icausqkica.sys
jgbywqomge.exe
ljdbvtnlgd.exe
mgezwrpjhbztrmje.exe
mgezwrpjhbztrmje.sys
mjebwuomez.exe
nifayspkic.exe
rojgbztroj.sys
tqljdbvtnl.sys
yvqoiysqki.sys
1576761d-ec4c-4cc2-a8db-959b4a4117fb.tmp
29d99a93-e570-4e81-9ba4-2eebdca44496.tmp
40f533bc-e0a0-434c-8601-1c30d98c07e0.tmp
5690439e-ccbc-478d-b09a-02c6ce8ecfc0.tmp
5952d1af-c395-4982-9eb8-867e42c4f3d4.tmp
settings.dat
settings.dat
1a7ab9db-c3b5-473a-9a27-4309b76170a7.tmp
2a8544cc-b780-42d0-8b28-ce1d36f5230d.tmp
45e38c93-c073-47f2-ac80-913b9f0934e1.tmp
5b0e2919-414e-47c3-a2b8-f15fb6edbf7e.tmp
7fe26880-7dfc-4469-bcf9-52dd8b0506f4.tmp
temp-index
53bedfe5-b93a-466e-8f1c-2e30be096b05.tmp
dasherSettingSchema.json
112f85e3-c391-440a-b4ee-ce66c34e0fcc.tmp
2c226a8b-6e86-4cd7-9829-be9d1a947522.tmp
8a5b5a53-5f63-456a-9ab7-4c40e3ac018f.tmp
sync_diagnostic.log
a1f40e2f-c1b5-426d-8084-6903b0622631.tmp
OperationConfig
e17e18de-93ef-4143-83da-9589e1237b65.tmp
092a3603-ccb7-4e5d-b4f9-16f05851d443.tmp
8c5671dd-4b32-45db-8b02-f70325f77d23.tmp
a1f34b22-2832-4a83-ab14-093574ccd722.tmp
fcf61068-627a-4690-bca8-98715bcb5315.tmp
2e6cae39-0d17-4dae-a843-e9ffa39d4095.tmp
3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
metadata.json
186a44df-911c-46b9-90ea-4003f23a789e.tmp
a6ab5879-1036-4abc-8366-9698ab97a77d.tmp
messages.json
content.js
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
CreateProcess.exe
memory/1560-746-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1576-722-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2028-678-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2312-698-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3020-742-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3408-578-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4156-717-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4272-62-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4440-545-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4544-430-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4652-550-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4720-587-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4784-646-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5020-612-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5052-640-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5116-504-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5140-516-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5640-554-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/6028-479-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/6072-666-0x0000000000010000-0x00000000000AB000-memory.dmp