Analysis
- max time kernel
150s - max time network
151s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
19/05/2026, 11:48
General
- Target 2026-05-19_515a5ba1b4aa75e91e13ca02e076da76_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 376KB
- Sample260519-nyl6msa15y
- SHA256 d9510be98080beba88a02ceadd094533aa359de5a1ae4d50640c79d989dab193
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba
-
http://xytets.com:2345/t.asp?os=home
-
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 9 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 41 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 19 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 29 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 3 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 19 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-19_515a5ba1b4aa75e91e13ca02e076da76_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-19_515a5ba1b4aa75e91e13ca02e076da76_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\lgeywqoigbytrljd.exeC:\Temp\lgeywqoigbytrljd.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\trljdbvtoi.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\trljdbvtoi.exeC:\Temp\trljdbvtoi.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_trljdbvtoi.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_trljdbvtoi.exeC:\Temp\i_trljdbvtoi.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\dbyvqlidyv.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\dbyvqlidyv.exeC:\Temp\dbyvqlidyv.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_dbyvqlidyv.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_dbyvqlidyv.exeC:\Temp\i_dbyvqlidyv.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pnigavsnlf.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\pnigavsnlf.exeC:\Temp\pnigavsnlf.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pnigavsnlf.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_pnigavsnlf.exeC:\Temp\i_pnigavsnlf.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vqkxusnkfd.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\vqkxusnkfd.exeC:\Temp\vqkxusnkfd.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vqkxusnkfd.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_vqkxusnkfd.exeC:\Temp\i_vqkxusnkfd.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zusmkecxus.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\zusmkecxus.exeC:\Temp\zusmkecxus.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zusmkecxus.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_zusmkecxus.exeC:\Temp\i_zusmkecxus.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ecxupjhczu.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ecxupjhczu.exeC:\Temp\ecxupjhczu.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ecxupjhczu.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ecxupjhczu.exeC:\Temp\i_ecxupjhczu.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mgeywrpjhb.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\mgeywrpjhb.exeC:\Temp\mgeywrpjhb.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mgeywrpjhb.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_mgeywrpjhb.exeC:\Temp\i_mgeywrpjhb.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rljebwtrlj.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\rljebwtrlj.exeC:\Temp\rljebwtrlj.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rljebwtrlj.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_rljebwtrlj.exeC:\Temp\i_rljebwtrlj.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\dywqoigbyt.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\dywqoigbyt.exeC:\Temp\dywqoigbyt.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_dywqoigbyt.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_dywqoigbyt.exeC:\Temp\i_dywqoigbyt.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gbvtnlfdyv.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\gbvtnlfdyv.exeC:\Temp\gbvtnlfdyv.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gbvtnlfdyv.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_gbvtnlfdyv.exeC:\Temp\i_gbvtnlfdyv.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\lfdxvqkida.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\lfdxvqkida.exeC:\Temp\lfdxvqkida.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_lfdxvqkida.exe ups_ins3⤵
-
C:\Temp\i_lfdxvqkida.exeC:\Temp\i_lfdxvqkida.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\snhfzxspki.exe ups_run3⤵
-
C:\Temp\snhfzxspki.exeC:\Temp\snhfzxspki.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_snhfzxspki.exe ups_ins3⤵
-
C:\Temp\i_snhfzxspki.exeC:\Temp\i_snhfzxspki.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fausnkfcau.exe ups_run3⤵
-
C:\Temp\fausnkfcau.exeC:\Temp\fausnkfcau.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fausnkfcau.exe ups_ins3⤵
-
C:\Temp\i_fausnkfcau.exeC:\Temp\i_fausnkfcau.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xrpkhcausm.exe ups_run3⤵
-
C:\Temp\xrpkhcausm.exeC:\Temp\xrpkhcausm.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xrpkhcausm.exe ups_ins3⤵
-
C:\Temp\i_xrpkhcausm.exeC:\Temp\i_xrpkhcausm.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jhbzurmkez.exe ups_run3⤵
-
C:\Temp\jhbzurmkez.exeC:\Temp\jhbzurmkez.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jhbzurmkez.exe ups_ins3⤵
-
C:\Temp\i_jhbzurmkez.exeC:\Temp\i_jhbzurmkez.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\trljdbwtom.exe ups_run3⤵
-
C:\Temp\trljdbwtom.exeC:\Temp\trljdbwtom.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_trljdbwtom.exe ups_ins3⤵
-
C:\Temp\i_trljdbwtom.exeC:\Temp\i_trljdbwtom.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rljebwtomg.exe ups_run3⤵
-
C:\Temp\rljebwtomg.exeC:\Temp\rljebwtomg.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rljebwtomg.exe ups_ins3⤵
-
C:\Temp\i_rljebwtomg.exeC:\Temp\i_rljebwtomg.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gbytqljdby.exe ups_run3⤵
-
C:\Temp\gbytqljdby.exeC:\Temp\gbytqljdby.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gbytqljdby.exe ups_ins3⤵
-
C:\Temp\i_gbytqljdby.exeC:\Temp\i_gbytqljdby.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nlfdxvqnig.exe ups_run3⤵
-
C:\Temp\nlfdxvqnig.exeC:\Temp\nlfdxvqnig.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nlfdxvqnig.exe ups_ins3⤵
-
C:\Temp\i_nlfdxvqnig.exeC:\Temp\i_nlfdxvqnig.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x328,0x7ff9b72ec188,0x7ff9b72ec194,0x7ff9b72ec1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1828,i,17533834686494898746,10538432096620571833,524288 --field-trial-handle=2260,i,6426931185913431200,4616717274790625317,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1644,i,16928634277896064718,6889504628720099628,262144 --field-trial-handle=2260,i,6426931185913431200,4616717274790625317,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2396,i,7356407162398349687,1557265423163032239,524288 --field-trial-handle=2260,i,6426931185913431200,4616717274790625317,262144 --variations-seed-version --mojo-platform-channel-handle=1764 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3548,i,2354610823716482086,15540693899389212464,2097152 --field-trial-handle=2260,i,6426931185913431200,4616717274790625317,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3564,i,14911897003018758611,10084739031414284886,2097152 --field-trial-handle=2260,i,6426931185913431200,4616717274790625317,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4136,i,13137639155061372122,54030855018207701,2097152 --field-trial-handle=2260,i,6426931185913431200,4616717274790625317,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4220,i,2715384744872118838,8562879599435918217,2097152 --field-trial-handle=2260,i,6426931185913431200,4616717274790625317,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4284,i,18210709003726438661,11150218923578240341,2097152 --field-trial-handle=2260,i,6426931185913431200,4616717274790625317,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4296,i,11243159361733946687,7473167985750634709,2097152 --field-trial-handle=2260,i,6426931185913431200,4616717274790625317,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4264,i,14918376267934901149,1027111848882257829,524288 --field-trial-handle=2260,i,6426931185913431200,4616717274790625317,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4224,i,2750833899843291065,614141817808324990,524288 --field-trial-handle=2260,i,6426931185913431200,4616717274790625317,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5600,i,5748626517506645572,17423911039167860556,2097152 --field-trial-handle=2260,i,6426931185913431200,4616717274790625317,262144 --variations-seed-version --mojo-platform-channel-handle=5668 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=3656,i,11884870335460223435,12694326221653837878,2097152 --field-trial-handle=2260,i,6426931185913431200,4616717274790625317,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3840,i,5727165102012042639,13697838372007802760,524288 --field-trial-handle=2260,i,6426931185913431200,4616717274790625317,262144 --variations-seed-version --mojo-platform-channel-handle=3836 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3844,i,17433860033498814862,5390466722022075150,524288 --field-trial-handle=2260,i,6426931185913431200,4616717274790625317,262144 --variations-seed-version --mojo-platform-channel-handle=3776 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5908,i,13145096818507037294,3772106832481538325,524288 --field-trial-handle=2260,i,6426931185913431200,4616717274790625317,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:144⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.execookie_exporter.exe --cookie-json=11405⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6328,i,4908248017948163010,1918235280340222126,524288 --field-trial-handle=2260,i,6426931185913431200,4616717274790625317,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6328,i,4908248017948163010,1918235280340222126,524288 --field-trial-handle=2260,i,6426931185913431200,4616717274790625317,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5808,i,10685600268013477160,11061403274935814849,524288 --field-trial-handle=2260,i,6426931185913431200,4616717274790625317,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6692,i,4358862167904921179,410351699208937687,524288 --field-trial-handle=2260,i,6426931185913431200,4616717274790625317,262144 --variations-seed-version --mojo-platform-channel-handle=4628 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4608,i,14383465856152289222,2822364383008860297,524288 --field-trial-handle=2260,i,6426931185913431200,4616717274790625317,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6852,i,4027374270758724559,17154490953123498934,524288 --field-trial-handle=2260,i,6426931185913431200,4616717274790625317,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5156,i,14738948557684034791,3438055360333603909,524288 --field-trial-handle=2260,i,6426931185913431200,4616717274790625317,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4400,i,16419975556880859758,15994104612167218378,524288 --field-trial-handle=2260,i,6426931185913431200,4616717274790625317,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3524,i,12635897900044230655,9500092632690738398,524288 --field-trial-handle=2260,i,6426931185913431200,4616717274790625317,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4272,i,13807928144122765680,8266833449423584918,524288 --field-trial-handle=2260,i,6426931185913431200,4616717274790625317,262144 --variations-seed-version --mojo-platform-channel-handle=4408 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3836,i,16906006242888595078,217894305784040443,524288 --field-trial-handle=2260,i,6426931185913431200,4616717274790625317,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6500,i,8915625348561019812,9440870923409264845,524288 --field-trial-handle=2260,i,6426931185913431200,4616717274790625317,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5840,i,14583360388310451513,16412828343064988906,524288 --field-trial-handle=2260,i,6426931185913431200,4616717274790625317,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5040,i,1583127338164343915,1552357267425747262,524288 --field-trial-handle=2260,i,6426931185913431200,4616717274790625317,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5024,i,6744810271743411173,3406046090895525165,262144 --field-trial-handle=2260,i,6426931185913431200,4616717274790625317,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5228,i,6651200894134789612,3649127555264091019,524288 --field-trial-handle=2260,i,6426931185913431200,4616717274790625317,262144 --variations-seed-version --mojo-platform-channel-handle=6668 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\lgeywqoigbytrljd.sysC:\Temp\lgeywqoigbytrljd.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Temp\nlgdywqlig.sysC:\Temp\nlgdywqlig.sys1⤵
- Executes dropped EXE
-
C:\Temp\idavtnlfdx.sysC:\Temp\idavtnlfdx.sys1⤵
- Executes dropped EXE
-
C:\Temp\icavsnlfda.sysC:\Temp\icavsnlfda.sys1⤵
- Executes dropped EXE
-
C:\Temp\pkfzxspkhc.sysC:\Temp\pkfzxspkhc.sys1⤵
- Executes dropped EXE
-
C:\Temp\pkecwupmhe.sysC:\Temp\pkecwupmhe.sys1⤵
- Executes dropped EXE
-
C:\Temp\wrpmhezurm.sysC:\Temp\wrpmhezurm.sys1⤵
- Executes dropped EXE
-
C:\Temp\jhbwuomgey.sysC:\Temp\jhbwuomgey.sys1⤵
- Executes dropped EXE
-
C:\Temp\ljdbwtrljd.sysC:\Temp\ljdbwtrljd.sys1⤵
- Executes dropped EXE
-
C:\Temp\nlgdywqoig.sysC:\Temp\nlgdywqoig.sys1⤵
- Executes dropped EXE
-
C:\Temp\xvqnidxvqn.sysC:\Temp\xvqnidxvqn.sys1⤵
- Executes dropped EXE
-
C:\Temp\icavsnlfdx.sysC:\Temp\icavsnlfdx.sys1⤵
-
C:\Temp\mkfcxvpnhf.sysC:\Temp\mkfcxvpnhf.sys1⤵
-
C:\Temp\ecxupmhfzx.sysC:\Temp\ecxupmhfzx.sys1⤵
-
C:\Temp\rpjhbztrmj.sysC:\Temp\rpjhbztrmj.sys1⤵
-
C:\Temp\ojhbztrmje.sysC:\Temp\ojhbztrmje.sys1⤵
-
C:\Temp\wtomgeywro.sysC:\Temp\wtomgeywro.sys1⤵
-
C:\Temp\jdbvtnlgdy.sysC:\Temp\jdbvtnlgdy.sys1⤵
-
C:\Temp\vqnigaysqk.sysC:\Temp\vqnigaysqk.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
dbyvqlidyv.exe
i_dbyvqlidyv.exe
i_pnigavsnlf.exe
i_trljdbvtoi.exe
i_vqkxusnkfd.exe
icavsnlfda.sys
idavtnlfdx.sys
lgeywqoigbytrljd.exe
lgeywqoigbytrljd.sys
nlgdywqlig.sys
pkfzxspkhc.sys
pnigavsnlf.exe
trljdbvtoi.exe
vqkxusnkfd.exe
zusmkecxus.exe
5a094fd5-9fb4-48dd-b499-184694fed787.tmp
blocklist
protocols.json
settings.dat
settings.dat
5fcb574a-e302-45d8-8823-5e23e0a2fbb1.tmp
BookmarkMergedSurfaceOrdering
the-real-index
the-real-index~RFe58cdbb.TMP
SiteList-Enterprise.json
HubApps
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
Preferences
Preferences
Secure Preferences
sync_diagnostic.log
5891cd6a-673b-4c19-a26f-8c11d0935b92.tmp
office_endpoints_list.json
Local State
Local State
Local State
Local State
Local State
Local State
Local State
nav_config.json
metadata.json
metadata.json
metadata.json
metadata.json
24b53ac8-b019-4ebd-8bc6-8e8a3acf9018.tmp
1978f195-71d8-42e8-8a77-2418eeb1c4d2.tmp
8cca1e15-6146-4a11-a396-7c4b276b07c8.tmp
content_new.js
bd8e03cd-1f85-4e0e-aabd-9d6f9eb5172d.tmp
manifest.json
manifest.json
manifest.json
manifest.json
CreateProcess.exe
memory/240-839-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/488-755-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1440-777-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1440-801-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1512-505-0x000001854D920000-0x000001854DCDB000-memory.dmp
memory/1512-514-0x000001854D920000-0x000001854DCDB000-memory.dmp
memory/1644-599-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1644-594-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1864-60-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2060-654-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2512-545-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2788-619-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3440-517-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3504-598-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3668-634-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3972-813-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3972-849-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4072-723-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4248-565-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4476-800-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4568-466-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4688-743-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4908-671-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4908-700-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4976-699-0x0000000000010000-0x00000000000AB000-memory.dmp