Analysis
- max time kernel
149s - max time network
141s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
29/05/2026, 10:50
General
- Target 2026-05-29_b51973ca793b7d0acfdadfc72646ae6d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 376KB
- Sample260529-mxnseahy21
- SHA256 cb36d1584b04235b7552ecbc1d7d83cdffe070804c4d2b9bfeaf703b4b07abe4
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba
-
http://xytets.com:2345/t.asp?os=home
-
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 9 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 41 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 19 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 29 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 3 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-29_b51973ca793b7d0acfdadfc72646ae6d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-29_b51973ca793b7d0acfdadfc72646ae6d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\zxrpkzusmkecwupm.exeC:\Temp\zxrpkzusmkecwupm.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fzxrpjecrm.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\fzxrpjecrm.exeC:\Temp\fzxrpjecrm.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fzxrpjecrm.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_fzxrpjecrm.exeC:\Temp\i_fzxrpjecrm.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\cwuomhezpj.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\cwuomhezpj.exeC:\Temp\cwuomhezpj.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_cwuomhezpj.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_cwuomhezpj.exeC:\Temp\i_cwuomhezpj.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\oljebwtomg.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\oljebwtomg.exeC:\Temp\oljebwtomg.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_oljebwtomg.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_oljebwtomg.exeC:\Temp\i_oljebwtomg.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gdywqoigay.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\gdywqoigay.exeC:\Temp\gdywqoigay.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gdywqoigay.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_gdywqoigay.exeC:\Temp\i_gdywqoigay.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ytqlfdyvqo.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ytqlfdyvqo.exeC:\Temp\ytqlfdyvqo.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ytqlfdyvqo.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ytqlfdyvqo.exeC:\Temp\i_ytqlfdyvqo.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nlfdxvifay.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\nlfdxvifay.exeC:\Temp\nlfdxvifay.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nlfdxvifay.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_nlfdxvifay.exeC:\Temp\i_nlfdxvifay.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\dxvpnifaxs.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\dxvpnifaxs.exeC:\Temp\dxvpnifaxs.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_dxvpnifaxs.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_dxvpnifaxs.exeC:\Temp\i_dxvpnifaxs.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pkhcaxspnh.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\pkhcaxspnh.exeC:\Temp\pkhcaxspnh.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pkhcaxspnh.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_pkhcaxspnh.exeC:\Temp\i_pkhcaxspnh.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\kecwupmhfz.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\kecwupmhfz.exeC:\Temp\kecwupmhfz.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_kecwupmhfz.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_kecwupmhfz.exeC:\Temp\i_kecwupmhfz.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\khczusecwu.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\khczusecwu.exeC:\Temp\khczusecwu.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_khczusecwu.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_khczusecwu.exeC:\Temp\i_khczusecwu.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bztrljebwu.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\bztrljebwu.exeC:\Temp\bztrljebwu.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bztrljebwu.exe ups_ins3⤵
-
C:\Temp\i_bztrljebwu.exeC:\Temp\i_bztrljebwu.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wqojgbytrl.exe ups_run3⤵
-
C:\Temp\wqojgbytrl.exeC:\Temp\wqojgbytrl.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wqojgbytrl.exe ups_ins3⤵
-
C:\Temp\i_wqojgbytrl.exeC:\Temp\i_wqojgbytrl.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jdbvtnlfdy.exe ups_run3⤵
-
C:\Temp\jdbvtnlfdy.exeC:\Temp\jdbvtnlfdy.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jdbvtnlfdy.exe ups_ins3⤵
-
C:\Temp\i_jdbvtnlfdy.exeC:\Temp\i_jdbvtnlfdy.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ljdbvtnlyv.exe ups_run3⤵
-
C:\Temp\ljdbvtnlyv.exeC:\Temp\ljdbvtnlyv.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ljdbvtnlyv.exe ups_ins3⤵
-
C:\Temp\i_ljdbvtnlyv.exeC:\Temp\i_ljdbvtnlyv.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\avsnlfdxvq.exe ups_run3⤵
-
C:\Temp\avsnlfdxvq.exeC:\Temp\avsnlfdxvq.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_avsnlfdxvq.exe ups_ins3⤵
-
C:\Temp\i_avsnlfdxvq.exeC:\Temp\i_avsnlfdxvq.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nhfaxsqkic.exe ups_run3⤵
-
C:\Temp\nhfaxsqkic.exeC:\Temp\nhfaxsqkic.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nhfaxsqkic.exe ups_ins3⤵
-
C:\Temp\i_nhfaxsqkic.exeC:\Temp\i_nhfaxsqkic.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\cwupnhfzxs.exe ups_run3⤵
-
C:\Temp\cwupnhfzxs.exeC:\Temp\cwupnhfzxs.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_cwupnhfzxs.exe ups_ins3⤵
-
C:\Temp\i_cwupnhfzxs.exeC:\Temp\i_cwupnhfzxs.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wusmkeuomh.exe ups_run3⤵
-
C:\Temp\wusmkeuomh.exeC:\Temp\wusmkeuomh.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wusmkeuomh.exe ups_ins3⤵
-
C:\Temp\i_wusmkeuomh.exeC:\Temp\i_wusmkeuomh.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pjhbzurmje.exe ups_run3⤵
-
C:\Temp\pjhbzurmje.exeC:\Temp\pjhbzurmje.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pjhbzurmje.exe ups_ins3⤵
-
C:\Temp\i_pjhbzurmje.exeC:\Temp\i_pjhbzurmje.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x340,0x7ff90420c188,0x7ff90420c194,0x7ff90420c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1804,i,561267129521937162,15552194125995223277,524288 --field-trial-handle=2160,i,4160550570482868224,25766556815396262,262144 --variations-seed-version --mojo-platform-channel-handle=2196 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1552,i,17542639281238128365,4992368012066914513,262144 --field-trial-handle=2160,i,4160550570482868224,25766556815396262,262144 --variations-seed-version --mojo-platform-channel-handle=2156 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2392,i,11022804565622984619,18316540977862454276,524288 --field-trial-handle=2160,i,4160550570482868224,25766556815396262,262144 --variations-seed-version --mojo-platform-channel-handle=2940 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3536,i,3477380123044683735,12583222966679989500,2097152 --field-trial-handle=2160,i,4160550570482868224,25766556815396262,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3540,i,10117231825125243182,18020216160841370114,2097152 --field-trial-handle=2160,i,4160550570482868224,25766556815396262,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,6851099256925144546,18226455821258563459,2097152 --field-trial-handle=2160,i,4160550570482868224,25766556815396262,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4280,i,10600807846963150048,13954346940098109111,2097152 --field-trial-handle=2160,i,4160550570482868224,25766556815396262,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4300,i,2695504506197975750,1234165622147929846,2097152 --field-trial-handle=2160,i,4160550570482868224,25766556815396262,262144 --variations-seed-version --mojo-platform-channel-handle=4588 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4312,i,3384448674979066458,954598232413794413,2097152 --field-trial-handle=2160,i,4160550570482868224,25766556815396262,262144 --variations-seed-version --mojo-platform-channel-handle=4608 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3652,i,15739836519316221445,18375359236040880328,524288 --field-trial-handle=2160,i,4160550570482868224,25766556815396262,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3688,i,235882931268411928,12679530862375886290,524288 --field-trial-handle=2160,i,4160550570482868224,25766556815396262,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=3688,i,17685422512415822290,2188721604782380846,2097152 --field-trial-handle=2160,i,4160550570482868224,25766556815396262,262144 --variations-seed-version --mojo-platform-channel-handle=4452 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=3664,i,17392797066172946801,2295266077866591491,2097152 --field-trial-handle=2160,i,4160550570482868224,25766556815396262,262144 --variations-seed-version --mojo-platform-channel-handle=3948 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4236,i,17866765753625850189,5927058279910029592,524288 --field-trial-handle=2160,i,4160550570482868224,25766556815396262,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4724,i,12691131617670854126,11331133262905633310,524288 --field-trial-handle=2160,i,4160550570482868224,25766556815396262,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6172,i,982770129359164807,12332439214730480654,524288 --field-trial-handle=2160,i,4160550570482868224,25766556815396262,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:144⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.execookie_exporter.exe --cookie-json=11285⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6176,i,15373241741326935512,9637032028277261112,524288 --field-trial-handle=2160,i,4160550570482868224,25766556815396262,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6176,i,15373241741326935512,9637032028277261112,524288 --field-trial-handle=2160,i,4160550570482868224,25766556815396262,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6428,i,2761931942343060534,4019612754620052014,524288 --field-trial-handle=2160,i,4160550570482868224,25766556815396262,262144 --variations-seed-version --mojo-platform-channel-handle=6440 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6624,i,5168273355254410852,17737943214950152079,524288 --field-trial-handle=2160,i,4160550570482868224,25766556815396262,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6248,i,14376822156567467943,8777116164619774759,524288 --field-trial-handle=2160,i,4160550570482868224,25766556815396262,262144 --variations-seed-version --mojo-platform-channel-handle=6612 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7040,i,3737147383833110239,3349840390617295514,524288 --field-trial-handle=2160,i,4160550570482868224,25766556815396262,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6436,i,9461678591265608276,11714124901794550484,524288 --field-trial-handle=2160,i,4160550570482868224,25766556815396262,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4280,i,8639008570594949528,16224764500763593061,524288 --field-trial-handle=2160,i,4160550570482868224,25766556815396262,262144 --variations-seed-version --mojo-platform-channel-handle=4712 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4380,i,15359982824877405744,251427314592457615,524288 --field-trial-handle=2160,i,4160550570482868224,25766556815396262,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3656,i,3511741415451267066,11947816295592902884,524288 --field-trial-handle=2160,i,4160550570482868224,25766556815396262,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4236,i,7878832961623057495,12462479251577016263,524288 --field-trial-handle=2160,i,4160550570482868224,25766556815396262,262144 --variations-seed-version --mojo-platform-channel-handle=6504 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6408,i,12088501588916319248,12666909865917468312,524288 --field-trial-handle=2160,i,4160550570482868224,25766556815396262,262144 --variations-seed-version --mojo-platform-channel-handle=6992 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=876,i,11943708906981205489,7178014119500243170,524288 --field-trial-handle=2160,i,4160550570482868224,25766556815396262,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3444,i,12394850484334157608,5317661613014465850,524288 --field-trial-handle=2160,i,4160550570482868224,25766556815396262,262144 --variations-seed-version --mojo-platform-channel-handle=6592 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3444,i,15679650656491840211,2874548258316078716,262144 --field-trial-handle=2160,i,4160550570482868224,25766556815396262,262144 --variations-seed-version --mojo-platform-channel-handle=880 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3408,i,16602825756556685959,4084023041876763708,524288 --field-trial-handle=2160,i,4160550570482868224,25766556815396262,262144 --variations-seed-version --mojo-platform-channel-handle=7124 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\zxrpkzusmkecwupm.sysC:\Temp\zxrpkzusmkecwupm.sys1⤵
- Executes dropped EXE
-
C:\Temp\kecwupmhez.sysC:\Temp\kecwupmhez.sys1⤵
- Executes dropped EXE
-
C:\Temp\ywrojhbztr.sysC:\Temp\ywrojhbztr.sys1⤵
- Executes dropped EXE
-
C:\Temp\rljdbvtolg.sysC:\Temp\rljdbvtolg.sys1⤵
- Executes dropped EXE
-
C:\Temp\olgeywqoig.sysC:\Temp\olgeywqoig.sys1⤵
- Executes dropped EXE
-
C:\Temp\yvqnigaysq.sysC:\Temp\yvqnigaysq.sys1⤵
- Executes dropped EXE
-
C:\Temp\nifaysqkid.sysC:\Temp\nifaysqkid.sys1⤵
- Executes dropped EXE
-
C:\Temp\axsqkicaus.sysC:\Temp\axsqkicaus.sys1⤵
- Executes dropped EXE
-
C:\Temp\zxspkicamk.sysC:\Temp\zxspkicamk.sys1⤵
- Executes dropped EXE
-
C:\Temp\rpjhczurmk.sysC:\Temp\rpjhczurmk.sys1⤵
- Executes dropped EXE
-
C:\Temp\jgezwrojhb.sysC:\Temp\jgezwrojhb.sys1⤵
- Executes dropped EXE
-
C:\Temp\gbztrljebw.sysC:\Temp\gbztrljebw.sys1⤵
-
C:\Temp\ywqoigbywi.sysC:\Temp\ywqoigbywi.sys1⤵
-
C:\Temp\sqljdbvtnl.sysC:\Temp\sqljdbvtnl.sys1⤵
-
C:\Temp\kidxvqniga.sysC:\Temp\kidxvqniga.sys1⤵
-
C:\Temp\xvpkicausn.sysC:\Temp\xvpkicausn.sys1⤵
-
C:\Temp\smkfcxupfz.sysC:\Temp\smkfcxupfz.sys1⤵
-
C:\Temp\kecxupmkez.sysC:\Temp\kecxupmkez.sys1⤵
-
C:\Temp\wuomhezxrp.sysC:\Temp\wuomhezxrp.sys1⤵
-
C:\Temp\gebwqojhbz.sysC:\Temp\gebwqojhbz.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CreateProcess.exe
cwuomhezpj.exe
fzxrpjecrm.exe
gdywqoigay.exe
i_cwuomhezpj.exe
i_fzxrpjecrm.exe
i_gdywqoigay.exe
i_oljebwtomg.exe
kecwupmhez.sys
olgeywqoig.sys
oljebwtomg.exe
rljdbvtolg.sys
ytqlfdyvqo.exe
ywrojhbztr.sys
zxrpkzusmkecwupm.exe
zxrpkzusmkecwupm.sys
protocols.json
settings.dat
settings.dat
09da0bf0-7449-4f7c-a969-870c86131741.tmp
BookmarkMergedSurfaceOrdering
temp-index
the-real-index~RFe586cbf.TMP
SiteList-Enterprise.json
HubApps
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
Preferences
Preferences
Secure Preferences
sync_diagnostic.log
OperationConfig
OperationConfig~RFe590e10.TMP
office_endpoints_list.json
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
nav_config.json
metadata.json
metadata.json
metadata.json
metadata.json
72282a1f-5412-4e96-8732-aecac73f190e.tmp
26969397-44c5-4bd5-b915-cf3b798e28a6.tmp
88e32e78-366b-4f8e-ae40-24d2f96db0a6.tmp
b416aed1-5e10-4b57-9d72-48f700aa3c4c.tmp
content_new.js
manifest.json
manifest.json
manifest.json
manifest.json
memory/1296-730-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1476-550-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1576-453-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1756-581-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2032-530-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2980-677-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3000-589-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3024-785-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3172-502-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3220-585-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3244-767-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3244-754-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3244-704-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3248-657-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3440-692-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3504-805-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4080-601-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4132-758-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4440-73-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4452-632-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4536-732-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4536-716-0x0000000000010000-0x00000000000AB000-memory.dmp