Analysis
- max time kernel
149s - max time network
141s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
11/05/2026, 10:25
General
- Target 2026-05-11_41ae77013ed6ea0b90eee4b7c2bf2569_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 376KB
- Sample260511-mgff4aav6q
- SHA256 17bd530de84fbcc6bd559e13bb937b58a9cc1e7efd23184ad7c14b3cd444e859
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba
-
http://xytets.com:2345/t.asp?os=home
-
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 9 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 41 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 19 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 29 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 3 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-11_41ae77013ed6ea0b90eee4b7c2bf2569_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-11_41ae77013ed6ea0b90eee4b7c2bf2569_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\zurmkecwuomhezxr.exeC:\Temp\zurmkecwuomhezxr.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hbzurmkecw.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\hbzurmkecw.exeC:\Temp\hbzurmkecw.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hbzurmkecw.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_hbzurmkecw.exeC:\Temp\i_hbzurmkecw.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\trmjecwuom.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\trmjecwuom.exeC:\Temp\trmjecwuom.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_trmjecwuom.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_trmjecwuom.exeC:\Temp\i_trmjecwuom.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\woljdbvtoi.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\woljdbvtoi.exeC:\Temp\woljdbvtoi.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_woljdbvtoi.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_woljdbvtoi.exeC:\Temp\i_woljdbvtoi.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\igbytqlgdq.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\igbytqlgdq.exeC:\Temp\igbytqlgdq.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_igbytqlgdq.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_igbytqlgdq.exeC:\Temp\i_igbytqlgdq.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\lidbvtnlfd.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\lidbvtnlfd.exeC:\Temp\lidbvtnlfd.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_lidbvtnlfd.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_lidbvtnlfd.exeC:\Temp\i_lidbvtnlfd.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\sqkidavsnl.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\sqkidavsnl.exeC:\Temp\sqkidavsnl.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_sqkidavsnl.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_sqkidavsnl.exeC:\Temp\i_sqkidavsnl.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fzxspkicau.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\fzxspkicau.exeC:\Temp\fzxspkicau.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fzxspkicau.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_fzxspkicau.exeC:\Temp\i_fzxspkicau.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pmhfcxupnh.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\pmhfcxupnh.exeC:\Temp\pmhfcxupnh.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pmhfcxupnh.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_pmhfcxupnh.exeC:\Temp\i_pmhfcxupnh.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jhbzurmkec.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\jhbzurmkec.exeC:\Temp\jhbzurmkec.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jhbzurmkec.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_jhbzurmkec.exeC:\Temp\i_jhbzurmkec.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rmjebwuomg.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\rmjebwuomg.exeC:\Temp\rmjebwuomg.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rmjebwuomg.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_rmjebwuomg.exeC:\Temp\i_rmjebwuomg.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ywrojgbztr.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ywrojgbztr.exeC:\Temp\ywrojgbztr.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ywrojgbztr.exe ups_ins3⤵
-
C:\Temp\i_ywrojgbztr.exeC:\Temp\i_ywrojgbztr.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qljdbvtnlg.exe ups_run3⤵
-
C:\Temp\qljdbvtnlg.exeC:\Temp\qljdbvtnlg.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qljdbvtnlg.exe ups_ins3⤵
-
C:\Temp\i_qljdbvtnlg.exeC:\Temp\i_qljdbvtnlg.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gaysqlidbv.exe ups_run3⤵
-
C:\Temp\gaysqlidbv.exeC:\Temp\gaysqlidbv.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gaysqlidbv.exe ups_ins3⤵
-
C:\Temp\i_gaysqlidbv.exeC:\Temp\i_gaysqlidbv.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qkicavsnlf.exe ups_run3⤵
-
C:\Temp\qkicavsnlf.exeC:\Temp\qkicavsnlf.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qkicavsnlf.exe ups_ins3⤵
-
C:\Temp\i_qkicavsnlf.exeC:\Temp\i_qkicavsnlf.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hfaxspkica.exe ups_run3⤵
-
C:\Temp\hfaxspkica.exeC:\Temp\hfaxspkica.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hfaxspkica.exe ups_ins3⤵
-
C:\Temp\i_hfaxspkica.exeC:\Temp\i_hfaxspkica.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zusmkecwup.exe ups_run3⤵
-
C:\Temp\zusmkecwup.exeC:\Temp\zusmkecwup.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zusmkecwup.exe ups_ins3⤵
-
C:\Temp\i_zusmkecwup.exeC:\Temp\i_zusmkecwup.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xrpkecwupm.exe ups_run3⤵
-
C:\Temp\xrpkecwupm.exeC:\Temp\xrpkecwupm.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xrpkecwupm.exe ups_ins3⤵
-
C:\Temp\i_xrpkecwupm.exeC:\Temp\i_xrpkecwupm.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jecwuomgez.exe ups_run3⤵
-
C:\Temp\jecwuomgez.exeC:\Temp\jecwuomgez.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jecwuomgez.exe ups_ins3⤵
-
C:\Temp\i_jecwuomgez.exeC:\Temp\i_jecwuomgez.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wrljebwtom.exe ups_run3⤵
-
C:\Temp\wrljebwtom.exeC:\Temp\wrljebwtom.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wrljebwtom.exe ups_ins3⤵
-
C:\Temp\i_wrljebwtom.exeC:\Temp\i_wrljebwtom.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x2e4,0x2e8,0x234,0x368,0x7ffb7b30c188,0x7ffb7b30c194,0x7ffb7b30c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1756,i,3559841048588304160,2893208854533288283,262144 --field-trial-handle=2156,i,14658147060312406983,9494265225798007360,262144 --variations-seed-version --mojo-platform-channel-handle=2152 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1860,i,5554662650981664326,3263634151975878721,524288 --field-trial-handle=2156,i,14658147060312406983,9494265225798007360,262144 --variations-seed-version --mojo-platform-channel-handle=2468 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2580,i,6840744132538303731,14098160257515835060,524288 --field-trial-handle=2156,i,14658147060312406983,9494265225798007360,262144 --variations-seed-version --mojo-platform-channel-handle=2576 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3488,i,3776761900991374976,17992683817378781597,2097152 --field-trial-handle=2156,i,14658147060312406983,9494265225798007360,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3508,i,2907626205874952735,8739959368352606550,2097152 --field-trial-handle=2156,i,14658147060312406983,9494265225798007360,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4124,i,11493459313437211933,350794045345678785,2097152 --field-trial-handle=2156,i,14658147060312406983,9494265225798007360,262144 --variations-seed-version --mojo-platform-channel-handle=4184 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4136,i,6332695880566529547,3472370085787586252,2097152 --field-trial-handle=2156,i,14658147060312406983,9494265225798007360,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4168,i,5377247806959047955,14097985010369830541,2097152 --field-trial-handle=2156,i,14658147060312406983,9494265225798007360,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4228,i,7121381445477457714,361387902277900456,2097152 --field-trial-handle=2156,i,14658147060312406983,9494265225798007360,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,4581023110972813809,3606233569135777716,524288 --field-trial-handle=2156,i,14658147060312406983,9494265225798007360,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5388,i,6413504439716448940,9760012882524768703,524288 --field-trial-handle=2156,i,14658147060312406983,9494265225798007360,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5448,i,10593282903548013320,3999157019070258489,2097152 --field-trial-handle=2156,i,14658147060312406983,9494265225798007360,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=3968,i,13036378637240402019,13975263284801782097,2097152 --field-trial-handle=2156,i,14658147060312406983,9494265225798007360,262144 --variations-seed-version --mojo-platform-channel-handle=4180 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5440,i,7891468784491016537,1976015589640495263,524288 --field-trial-handle=2156,i,14658147060312406983,9494265225798007360,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4168,i,718391159272872903,10100689664126818088,524288 --field-trial-handle=2156,i,14658147060312406983,9494265225798007360,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6100,i,17440998014101786051,16583595083382418730,524288 --field-trial-handle=2156,i,14658147060312406983,9494265225798007360,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:144⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.execookie_exporter.exe --cookie-json=11285⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6152,i,15382647264808325541,1060545779354491584,524288 --field-trial-handle=2156,i,14658147060312406983,9494265225798007360,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6152,i,15382647264808325541,1060545779354491584,524288 --field-trial-handle=2156,i,14658147060312406983,9494265225798007360,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4512,i,11290176067441965124,17711664167067521777,524288 --field-trial-handle=2156,i,14658147060312406983,9494265225798007360,262144 --variations-seed-version --mojo-platform-channel-handle=4964 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4908,i,5418349216102849540,4082504643290468251,524288 --field-trial-handle=2156,i,14658147060312406983,9494265225798007360,262144 --variations-seed-version --mojo-platform-channel-handle=4948 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4980,i,5147163317681995950,18039524506805513640,524288 --field-trial-handle=2156,i,14658147060312406983,9494265225798007360,262144 --variations-seed-version --mojo-platform-channel-handle=4936 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4784,i,6574260644147446673,2876290564696479175,524288 --field-trial-handle=2156,i,14658147060312406983,9494265225798007360,262144 --variations-seed-version --mojo-platform-channel-handle=4912 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4776,i,10271429171241207101,3491316494844540366,524288 --field-trial-handle=2156,i,14658147060312406983,9494265225798007360,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4728,i,6679302678109630207,17228162472737643136,524288 --field-trial-handle=2156,i,14658147060312406983,9494265225798007360,262144 --variations-seed-version --mojo-platform-channel-handle=4740 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6556,i,11490296018318497349,16936787648740523097,524288 --field-trial-handle=2156,i,14658147060312406983,9494265225798007360,262144 --variations-seed-version --mojo-platform-channel-handle=4776 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4912,i,5006302570518530930,1159015465988030249,524288 --field-trial-handle=2156,i,14658147060312406983,9494265225798007360,262144 --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4360,i,2005323972794061071,14670779836756382298,524288 --field-trial-handle=2156,i,14658147060312406983,9494265225798007360,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4844,i,12827952128513604221,12191431563477512003,524288 --field-trial-handle=2156,i,14658147060312406983,9494265225798007360,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6220,i,7940818532487103484,13251926007937975133,524288 --field-trial-handle=2156,i,14658147060312406983,9494265225798007360,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5332,i,18015789102365827681,10316551320818524025,524288 --field-trial-handle=2156,i,14658147060312406983,9494265225798007360,262144 --variations-seed-version --mojo-platform-channel-handle=3440 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4884,i,17435115490858852857,10760033886039787529,262144 --field-trial-handle=2156,i,14658147060312406983,9494265225798007360,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5792,i,18013423753158276940,2343101564480404094,524288 --field-trial-handle=2156,i,14658147060312406983,9494265225798007360,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\zurmkecwuomhezxr.sysC:\Temp\zurmkecwuomhezxr.sys1⤵
- Executes dropped EXE
-
C:\Temp\ebwtrmjecw.sysC:\Temp\ebwtrmjecw.sys1⤵
- Executes dropped EXE
-
C:\Temp\rljebwuomg.sysC:\Temp\rljebwuomg.sys1⤵
- Executes dropped EXE
-
C:\Temp\tnlgdbvtol.sysC:\Temp\tnlgdbvtol.sys1⤵
- Executes dropped EXE
-
C:\Temp\ysqlidbvtn.sysC:\Temp\ysqlidbvtn.sys1⤵
- Executes dropped EXE
-
C:\Temp\faxsqkidxv.sysC:\Temp\faxsqkidxv.sys1⤵
- Executes dropped EXE
-
C:\Temp\xvpnhxspki.sysC:\Temp\xvpnhxspki.sys1⤵
- Executes dropped EXE
-
C:\Temp\kicausmhfz.sysC:\Temp\kicausmhfz.sys1⤵
- Executes dropped EXE
-
C:\Temp\upmhfzxrpj.sysC:\Temp\upmhfzxrpj.sys1⤵
- Executes dropped EXE
-
C:\Temp\bwuomgecwu.sysC:\Temp\bwuomgecwu.sys1⤵
- Executes dropped EXE
-
C:\Temp\lgeywqojgb.sysC:\Temp\lgeywqojgb.sys1⤵
- Executes dropped EXE
-
C:\Temp\geywqoigby.sysC:\Temp\geywqoigby.sys1⤵
-
C:\Temp\tnlgaytqlg.sysC:\Temp\tnlgaytqlg.sys1⤵
-
C:\Temp\dxvqnifays.sysC:\Temp\dxvqnifays.sys1⤵
-
C:\Temp\sqkicavsnk.sysC:\Temp\sqkicavsnk.sys1⤵
-
C:\Temp\sqkicausnk.sysC:\Temp\sqkicausnk.sys1⤵
-
C:\Temp\hczusmkecx.sysC:\Temp\hczusmkecx.sys1⤵
-
C:\Temp\urmjecwuom.sysC:\Temp\urmjecwuom.sys1⤵
-
C:\Temp\hbwtomgeyw.sysC:\Temp\hbwtomgeyw.sys1⤵
-
C:\Temp\ebwtolgeyw.sysC:\Temp\ebwtolgeyw.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CreateProcess.exe
ebwtrmjecw.sys
hbzurmkecw.exe
i_hbzurmkecw.exe
i_igbytqlgdq.exe
i_lidbvtnlfd.exe
i_trmjecwuom.exe
i_woljdbvtoi.exe
igbytqlgdq.exe
lidbvtnlfd.exe
rljebwuomg.sys
tnlgdbvtol.sys
trmjecwuom.exe
woljdbvtoi.exe
ysqlidbvtn.sys
zurmkecwuomhezxr.exe
zurmkecwuomhezxr.sys
blocklist
protocols.json
settings.dat
settings.dat
BookmarkMergedSurfaceOrdering
the-real-index
the-real-index~RFe588028.TMP
SiteList-Enterprise.json
Edge Profile.ico
HubApps
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
Preferences
Preferences
Secure Preferences
sync_diagnostic.log
CURRENT
MANIFEST-000001
fe8d5ce2-c688-4bbd-8f20-978dd25a4419.tmp
office_endpoints_list.json
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
nav_config.json
metadata.json
metadata.json
metadata.json
metadata.json
eaa3783e-b5bc-4e2f-901c-af97e0b8042f.tmp
813f9191-289b-40db-af54-481097e7114f.tmp
content_new.js
e12b8938-955c-4c6c-b5dd-4a79184fed95.tmp
8026bb67-b40d-473a-9590-cfe747304cd4.tmp
manifest.json
manifest.json
manifest.json
manifest.json
memory/128-856-0x0000000000970000-0x0000000000A4F000-memory.dmp
memory/228-666-0x00000000009A0000-0x0000000000A7F000-memory.dmp
memory/232-848-0x0000000000880000-0x000000000095F000-memory.dmp
memory/388-846-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/404-292-0x0000000000880000-0x000000000095F000-memory.dmp
memory/460-601-0x0000000000860000-0x000000000093F000-memory.dmp
memory/664-747-0x00000000009B0000-0x0000000000A8F000-memory.dmp
memory/704-655-0x00000000008D0000-0x00000000009AF000-memory.dmp
memory/760-249-0x0000000000830000-0x000000000090F000-memory.dmp
memory/956-211-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1016-774-0x00000000009D0000-0x0000000000AAF000-memory.dmp
memory/1040-891-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1092-812-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1108-730-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1152-853-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1284-641-0x0000000000820000-0x00000000008FF000-memory.dmp
memory/1516-751-0x00000000009D0000-0x0000000000AAF000-memory.dmp
memory/1544-777-0x0000000000960000-0x0000000000A3F000-memory.dmp
memory/1648-624-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1904-602-0x00000000008F0000-0x00000000009CF000-memory.dmp
memory/1976-623-0x0000000000960000-0x0000000000A3F000-memory.dmp
memory/2040-656-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2112-634-0x0000000000960000-0x0000000000A3F000-memory.dmp
memory/2164-732-0x0000000000820000-0x00000000008FF000-memory.dmp
memory/2212-340-0x00000000008E0000-0x00000000009BF000-memory.dmp
memory/2244-630-0x0000000000990000-0x0000000000A6F000-memory.dmp
memory/2292-690-0x00000000009A0000-0x0000000000A7F000-memory.dmp
memory/2408-294-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2420-773-0x00000000008D0000-0x00000000009AF000-memory.dmp
memory/2452-209-0x0000000000880000-0x000000000095F000-memory.dmp
memory/2492-893-0x0000000000A50000-0x0000000000B2F000-memory.dmp
memory/2572-707-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2896-269-0x00000000008D0000-0x00000000009AF000-memory.dmp
memory/2964-679-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3036-584-0x00000000009B0000-0x0000000000A8F000-memory.dmp
memory/3068-799-0x0000000000AE0000-0x0000000000BBF000-memory.dmp
memory/3100-710-0x0000000000970000-0x0000000000A4F000-memory.dmp
memory/3200-706-0x0000000000970000-0x0000000000A4F000-memory.dmp
memory/3256-914-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3484-770-0x0000000000AA0000-0x0000000000B7F000-memory.dmp
memory/3492-797-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3492-771-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3808-638-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3808-586-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3848-637-0x0000000000A20000-0x0000000000AFF000-memory.dmp
memory/3892-750-0x00000000008B0000-0x000000000098F000-memory.dmp
memory/3896-667-0x0000000000A60000-0x0000000000B3F000-memory.dmp
memory/3964-80-0x0000000000830000-0x000000000090F000-memory.dmp
memory/3976-261-0x00000000009C0000-0x0000000000A9F000-memory.dmp
memory/4080-748-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4080-778-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4092-339-0x0000000000980000-0x0000000000A5F000-memory.dmp
memory/4112-849-0x0000000000970000-0x0000000000A4F000-memory.dmp
memory/4216-263-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4308-845-0x0000000000A40000-0x0000000000B1F000-memory.dmp
memory/4312-626-0x00000000009C0000-0x0000000000A9F000-memory.dmp
memory/4336-709-0x0000000000A10000-0x0000000000AEF000-memory.dmp
memory/4340-270-0x00000000009E0000-0x0000000000ABF000-memory.dmp
memory/4348-852-0x0000000000A40000-0x0000000000B1F000-memory.dmp
memory/4372-733-0x0000000000990000-0x0000000000A6F000-memory.dmp
memory/4372-631-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4424-81-0x0000000000860000-0x000000000093F000-memory.dmp
memory/4452-250-0x0000000000960000-0x0000000000A3F000-memory.dmp
memory/4472-814-0x0000000000A60000-0x0000000000B3F000-memory.dmp
memory/4544-76-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4696-855-0x0000000000880000-0x000000000095F000-memory.dmp
memory/4708-800-0x0000000000840000-0x000000000091F000-memory.dmp
memory/4728-890-0x00000000009D0000-0x0000000000AAF000-memory.dmp
memory/4748-721-0x0000000000A20000-0x0000000000AFF000-memory.dmp
memory/4768-689-0x0000000000970000-0x0000000000A4F000-memory.dmp
memory/4772-811-0x0000000000A20000-0x0000000000AFF000-memory.dmp
memory/4964-640-0x0000000000990000-0x0000000000A6F000-memory.dmp
memory/5004-678-0x0000000000AF0000-0x0000000000BCF000-memory.dmp
memory/5028-815-0x0000000000A10000-0x0000000000AEF000-memory.dmp
memory/5064-627-0x00000000009A0000-0x0000000000A7F000-memory.dmp
memory/5080-633-0x0000000000A20000-0x0000000000AFF000-memory.dmp
memory/5092-894-0x0000000000A80000-0x0000000000B5F000-memory.dmp
memory/5096-913-0x00000000008A0000-0x000000000097F000-memory.dmp