Analysis
- max time kernel
8s - max time network
154s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
10/08/2026, 01:59
General
- Target 2026-08-10_c00958f3da4daec1725c5d7767be60cd_amadey_elex_smoke-loader.exe
- Size 708KB
- Sample260810-cejevsde53
- SHA256 064e453a36e97ceee237b2f6aebb49f7046fe109eecdb3b0afd8083d70ae4a9b
Score
8/10
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs
- Creates a file in the Startup directory 1 TTPs 1 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
- Power Settings 1 TTPs 10 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
- Drops file in System32 directory 2 IoCs
- Sets desktop wallpaper using registry 2 TTPs 1 IoCs
- Drops file in Windows directory 4 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
- Executes a command shell one-liner 1 TTPs 4 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 12 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 42 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Modifies data under HKEY_USERS 12 IoCs
- Modifies registry class 8 IoCs
- Suspicious behavior: EnumeratesProcesses 52 IoCs
- Suspicious use of AdjustPrivilegeToken 23 IoCs
- Suspicious use of FindShellTrayWindow 7 IoCs
- Suspicious use of SendNotifyMessage 4 IoCs
- Suspicious use of SetWindowsHookEx 52 IoCs
- Suspicious use of WriteProcessMemory 17 IoCs
- System policy modification 1 TTPs 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_c00958f3da4daec1725c5d7767be60cd_amadey_elex_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-10_c00958f3da4daec1725c5d7767be60cd_amadey_elex_smoke-loader.exe"1⤵
- Event Triggered Execution: Image File Execution Options Injection
- Creates a file in the Startup directory
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powercfg -setacvalueindex SCHEME_CURRENT 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 02⤵
- Power Settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\powercfg.exepowercfg -setacvalueindex SCHEME_CURRENT 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powercfg -setdcvalueindex SCHEME_CURRENT 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 02⤵
- Power Settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\powercfg.exepowercfg -setdcvalueindex SCHEME_CURRENT 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powercfg -setacvalueindex SCHEME_CURRENT 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 02⤵
- Power Settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\powercfg.exepowercfg -setacvalueindex SCHEME_CURRENT 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powercfg -setdcvalueindex SCHEME_CURRENT 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 02⤵
- Power Settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\powercfg.exepowercfg -setdcvalueindex SCHEME_CURRENT 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powercfg -SetActive SCHEME_CURRENT2⤵
- Power Settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\powercfg.exepowercfg -SetActive SCHEME_CURRENT3⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\Magnify.exeC:\Windows\System32\Magnify.exe2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reagentc.exe /disable2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\ReAgentc.exereagentc.exe /disable3⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c bcdedit /set {globalsettings} advancedoptions false2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c bcdedit /set {bootmgr} displaybootmenu no2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c bcdedit /timeout 02⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.google.com/2⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f4,0x2f8,0x2fc,0x2f0,0x39c,0x7ffb0613c188,0x7ffb0613c194,0x7ffb0613c1a03⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1548,i,6017173966114954976,307650416702693670,262144 --field-trial-handle=2540,i,9984549308706808692,8384213670635792101,262144 --variations-seed-version --mojo-platform-channel-handle=2536 /prefetch:23⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1680,i,6592093185736303418,8161347827663911347,524288 --field-trial-handle=2540,i,9984549308706808692,8384213670635792101,262144 --variations-seed-version --mojo-platform-channel-handle=2568 /prefetch:113⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2220,i,9682471010565110099,1848978528321340052,524288 --field-trial-handle=2540,i,9984549308706808692,8384213670635792101,262144 --variations-seed-version --mojo-platform-channel-handle=3304 /prefetch:133⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3568,i,3767897329816012292,11592772660157263148,2097152 --field-trial-handle=2540,i,9984549308706808692,8384213670635792101,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3572,i,16527272353617451718,3417373016211614581,2097152 --field-trial-handle=2540,i,9984549308706808692,8384213670635792101,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4292,i,5264946926513440214,8827655165679858893,2097152 --field-trial-handle=2540,i,9984549308706808692,8384213670635792101,262144 --variations-seed-version --mojo-platform-channel-handle=4908 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4304,i,3146457371120333582,8979563291980783150,2097152 --field-trial-handle=2540,i,9984549308706808692,8384213670635792101,262144 --variations-seed-version --mojo-platform-channel-handle=4912 /prefetch:93⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5412,i,6957502711137329828,10894301658657803060,2097152 --field-trial-handle=2540,i,9984549308706808692,8384213670635792101,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5628,i,16962728884190567214,8646665954798787200,524288 --field-trial-handle=2540,i,9984549308706808692,8384213670635792101,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5536,i,9062139065867785812,4486095979722506302,524288 --field-trial-handle=2540,i,9984549308706808692,8384213670635792101,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4240,i,14265957378032846706,381709596452464298,524288 --field-trial-handle=2540,i,9984549308706808692,8384213670635792101,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5772,i,3778866220281011259,14812401770895571978,2097152 --field-trial-handle=2540,i,9984549308706808692,8384213670635792101,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3864,i,8776991783485122894,13566599554008622124,524288 --field-trial-handle=2540,i,9984549308706808692,8384213670635792101,262144 --variations-seed-version --mojo-platform-channel-handle=3816 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3864,i,8776991783485122894,13566599554008622124,524288 --field-trial-handle=2540,i,9984549308706808692,8384213670635792101,262144 --variations-seed-version --mojo-platform-channel-handle=3816 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=7132,i,8675568866365042794,10599590056725955492,2097152 --field-trial-handle=2540,i,9984549308706808692,8384213670635792101,262144 --variations-seed-version --mojo-platform-channel-handle=7064 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=920,i,4059403663106236311,1424733150879600837,524288 --field-trial-handle=2540,i,9984549308706808692,8384213670635792101,262144 --variations-seed-version --mojo-platform-channel-handle=6928 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=916,i,984300616863677575,15169084685900848621,524288 --field-trial-handle=2540,i,9984549308706808692,8384213670635792101,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4956,i,8047725367174259858,2710071451479255330,524288 --field-trial-handle=2540,i,9984549308706808692,8384213670635792101,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=7248,i,6564819207767496040,1088411477875756095,2097152 --field-trial-handle=2540,i,9984549308706808692,8384213670635792101,262144 --variations-seed-version --mojo-platform-channel-handle=7264 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=7432,i,6455729616434014833,7781874944878539617,2097152 --field-trial-handle=2540,i,9984549308706808692,8384213670635792101,262144 --variations-seed-version --mojo-platform-channel-handle=7472 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6336,i,6507563748062050519,7997632433934999078,524288 --field-trial-handle=2540,i,9984549308706808692,8384213670635792101,262144 --variations-seed-version --mojo-platform-channel-handle=4956 /prefetch:123⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7132,i,17006745261455858899,16345749420889109961,2097152 --field-trial-handle=2540,i,9984549308706808692,8384213670635792101,262144 --variations-seed-version --mojo-platform-channel-handle=7596 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7868,i,4791863808379360468,15010614836163657209,524288 --field-trial-handle=2540,i,9984549308706808692,8384213670635792101,262144 --variations-seed-version --mojo-platform-channel-handle=7688 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7904,i,10561395532843197250,6463271876033297478,524288 --field-trial-handle=2540,i,9984549308706808692,8384213670635792101,262144 --variations-seed-version --mojo-platform-channel-handle=7000 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=8104,i,4926655921382063819,2256483415570221814,2097152 --field-trial-handle=2540,i,9984549308706808692,8384213670635792101,262144 --variations-seed-version --mojo-platform-channel-handle=8132 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=8124,i,14230639629872332853,18122801562764104664,2097152 --field-trial-handle=2540,i,9984549308706808692,8384213670635792101,262144 --variations-seed-version --mojo-platform-channel-handle=8276 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8420,i,7447313178679354445,9522819271624578314,524288 --field-trial-handle=2540,i,9984549308706808692,8384213670635792101,262144 --variations-seed-version --mojo-platform-channel-handle=8720 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=8560,i,1497772748637885127,8314836986476982575,2097152 --field-trial-handle=2540,i,9984549308706808692,8384213670635792101,262144 --variations-seed-version --mojo-platform-channel-handle=7172 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=8732,i,7302213916656871992,17720406852279860891,2097152 --field-trial-handle=2540,i,9984549308706808692,8384213670635792101,262144 --variations-seed-version --mojo-platform-channel-handle=8852 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=8588,i,1297731169750853170,14245859958173859325,2097152 --field-trial-handle=2540,i,9984549308706808692,8384213670635792101,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9076,i,14258909704043610442,12084732720156967561,524288 --field-trial-handle=2540,i,9984549308706808692,8384213670635792101,262144 --variations-seed-version --mojo-platform-channel-handle=9080 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=8896,i,4725040727278967240,12528901150463062110,2097152 --field-trial-handle=2540,i,9984549308706808692,8384213670635792101,262144 --variations-seed-version --mojo-platform-channel-handle=9360 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9040,i,4989234777957943860,14375595315140387579,524288 --field-trial-handle=2540,i,9984549308706808692,8384213670635792101,262144 --variations-seed-version --mojo-platform-channel-handle=9260 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9076,i,8468833369811215689,1477165779003567923,524288 --field-trial-handle=2540,i,9984549308706808692,8384213670635792101,262144 --variations-seed-version --mojo-platform-channel-handle=7752 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6828,i,9151603449377166894,14467840796870938055,524288 --field-trial-handle=2540,i,9984549308706808692,8384213670635792101,262144 --variations-seed-version --mojo-platform-channel-handle=6876 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=9516,i,7255256095731271797,3939019172831532365,262144 --field-trial-handle=2540,i,9984549308706808692,8384213670635792101,262144 --variations-seed-version --mojo-platform-channel-handle=7404 /prefetch:103⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=9680,i,10721103091488528614,1114262115511793092,2097152 --field-trial-handle=2540,i,9984549308706808692,8384213670635792101,262144 --variations-seed-version --mojo-platform-channel-handle=9664 /prefetch:13⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.bing.com/2⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.wikipedia.org/2⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.reddit.com/2⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.github.com/2⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.google.com/2⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.bing.com/2⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.wikipedia.org/2⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.reddit.com/2⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.github.com/2⤵
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s BDESVC1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\userinit.exeC:\Windows\system32\userinit.exe1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE2⤵
- Boot or Logon Autostart Execution: Active Setup
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\system32\userinit.exeC:\Windows\system32\userinit.exe1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE2⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Windows\system32\userinit.exeC:\Windows\system32\userinit.exe1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE2⤵
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
-
C:\Windows\system32\userinit.exeC:\Windows\system32\userinit.exe1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE2⤵
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\system32\userinit.exeC:\Windows\system32\userinit.exe1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE2⤵
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\system32\userinit.exeC:\Windows\system32\userinit.exe1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE2⤵
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
-
C:\Windows\system32\userinit.exeC:\Windows\system32\userinit.exe1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE2⤵
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\system32\userinit.exeC:\Windows\system32\userinit.exe1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE2⤵
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
-
C:\Windows\system32\userinit.exeC:\Windows\system32\userinit.exe1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE2⤵
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\system32\userinit.exeC:\Windows\system32\userinit.exe1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE2⤵
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\system32\userinit.exeC:\Windows\system32\userinit.exe1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE2⤵
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Event Triggered Execution
2Accessibility Features
1Image File Execution Options Injection
1Power Settings
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Event Triggered Execution
2Accessibility Features
1Image File Execution Options Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
settings.dat
settings.dat
f_000077
f_000078
f_000079
f_00007a
f_0000b7
f_0000c4
f_0000cd
f_000117
f_000118
f_00011a
SiteList-Enterprise.json
Edge Profile.ico
CURRENT
MANIFEST-000001
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Preferences
Preferences
Preferences
Preferences
Preferences
the-real-index
the-real-index~RFe5a31df.TMP
b087a98af929018a_0
the-real-index
sync_diagnostic.log
cbcc8dee-8845-4837-aef9-ee74ae165202.tmp
OperationConfig
OperationConfig~RFe5a43b1.TMP
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter~RFe5ac92d.TMP
299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
5a914eed-6f87-4784-8bfd-f7ee12971295.tmp
metadata.json
start2.bin
prep_Activatable Class_Hermes_perf.cache
prep_Activatable Class_Hermes_perf.cache
microsoftwindows.client[1].xml
510f32c0-1a73-4db1-89f8-f10eacf7cfce.tmp
content_new.js
memory/1624-1858-0x00000196840C0000-0x00000196841C0000-memory.dmp
memory/1624-2097-0x0000019680120000-0x0000019680387000-memory.dmp
memory/1624-1857-0x0000019681ED0000-0x0000019681EF0000-memory.dmp
memory/1624-1859-0x0000019684080000-0x00000196840A0000-memory.dmp
memory/1624-1873-0x0000019694540000-0x0000019694560000-memory.dmp
memory/1624-1804-0x0000019680450000-0x0000019680550000-memory.dmp
memory/1972-34-0x000001D401DE0000-0x000001D401EE0000-memory.dmp
memory/1972-6-0x000001D4001E0000-0x000001D4002E0000-memory.dmp
memory/1972-52-0x000001D4142A0000-0x000001D4142C0000-memory.dmp
memory/1972-38-0x000001D401C00000-0x000001D401C20000-memory.dmp
memory/1972-33-0x000001D4019C0000-0x000001D4019E0000-memory.dmp
memory/2480-803-0x0000022E3A000000-0x0000022E3A434000-memory.dmp
memory/3084-2691-0x00000263BDA40000-0x00000263BDD60000-memory.dmp
memory/3084-2533-0x0000026381DE0000-0x0000026381E00000-memory.dmp
memory/3084-2531-0x0000026381A20000-0x0000026381A40000-memory.dmp
memory/3084-2532-0x0000026381E20000-0x0000026381F20000-memory.dmp
memory/3084-2501-0x00000263801E0000-0x00000263802E0000-memory.dmp
memory/3084-2547-0x0000026394270000-0x0000026394290000-memory.dmp
memory/3104-2841-0x000001CB01CA0000-0x000001CB01CC0000-memory.dmp
memory/3104-2855-0x000001CB04220000-0x000001CB04240000-memory.dmp
memory/3104-2839-0x000001CB019F0000-0x000001CB01A10000-memory.dmp
memory/3104-2840-0x000001CB01E60000-0x000001CB01F60000-memory.dmp
memory/3104-2808-0x000001CB001E0000-0x000001CB002E0000-memory.dmp
memory/3552-1585-0x0000020CF51F0000-0x0000020CF5624000-memory.dmp
memory/4144-1587-0x00000174001E0000-0x00000174002E0000-memory.dmp
memory/4144-1638-0x00000174042E0000-0x0000017404300000-memory.dmp
memory/4144-1619-0x0000017401DE0000-0x0000017401EE0000-memory.dmp
memory/4144-1624-0x0000017401DA0000-0x0000017401DC0000-memory.dmp
memory/4144-1618-0x00000174019E0000-0x0000017401A00000-memory.dmp
memory/4180-184-0x0000000009C40000-0x0000000009E9F000-memory.dmp
memory/4672-3021-0x0000025759340000-0x0000025759645000-memory.dmp
memory/4908-1338-0x000001CD3D030000-0x000001CD3D6C1000-memory.dmp
memory/5168-580-0x0000028B01C00000-0x0000028B01C20000-memory.dmp
memory/5168-578-0x0000028B019C0000-0x0000028B019E0000-memory.dmp
memory/5168-594-0x0000028B142A0000-0x0000028B142C0000-memory.dmp
memory/5168-579-0x0000028B01DE0000-0x0000028B01EE0000-memory.dmp
memory/5168-548-0x0000028B001E0000-0x0000028B002E0000-memory.dmp
memory/6872-1197-0x0000019601DA0000-0x0000019601DC0000-memory.dmp
memory/6872-1165-0x00000196001E0000-0x00000196002E0000-memory.dmp
memory/6872-1211-0x00000196142A0000-0x00000196142C0000-memory.dmp
memory/6872-1164-0x00000196001E0000-0x00000196002E0000-memory.dmp
memory/6872-1195-0x00000196019C0000-0x00000196019E0000-memory.dmp
memory/6872-1196-0x0000019601EB0000-0x0000019601FB0000-memory.dmp
memory/6872-1166-0x00000196001E0000-0x00000196002E0000-memory.dmp
memory/6884-834-0x000001F2801E0000-0x000001F2802E0000-memory.dmp
memory/6884-880-0x000001F294320000-0x000001F294340000-memory.dmp
memory/6884-833-0x000001F2801E0000-0x000001F2802E0000-memory.dmp
memory/6884-835-0x000001F2801E0000-0x000001F2802E0000-memory.dmp
memory/6884-845-0x000001F281A60000-0x000001F281A80000-memory.dmp
memory/6884-866-0x000001F281DA0000-0x000001F281DC0000-memory.dmp
memory/6884-846-0x000001F284000000-0x000001F284100000-memory.dmp
memory/6892-1039-0x0000020B57000000-0x0000020B57691000-memory.dmp