Analysis
- max time kernel
150s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
15/10/2026, 07:55
General
- Target 2026-10-13_9bb985a7de6e7f66644006c77a76bcb0_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 361KB
- Sample261015-jsahfazyft
- SHA256 31844e8a1223c05b24e9d60ca1d7e552b36b82a5001a4f44fdb7d76d7a01623c
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba
-
http://xytets.com:2345/t.asp?os=home
-
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 13 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-13_9bb985a7de6e7f66644006c77a76bcb0_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-13_9bb985a7de6e7f66644006c77a76bcb0_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\ztrojhbztrpjhbzt.exeC:\Temp\ztrojhbztrpjhbzt.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bwtrljebzr.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\bwtrljebzr.exeC:\Temp\bwtrljebzr.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bwtrljebzr.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_bwtrljebzr.exeC:\Temp\i_bwtrljebzr.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\toljdbwtol.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\toljdbwtol.exeC:\Temp\toljdbwtol.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_toljdbwtol.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_toljdbwtol.exeC:\Temp\i_toljdbwtol.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\igbvtqljdb.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\igbvtqljdb.exeC:\Temp\igbvtqljdb.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_igbvtqljdb.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_igbvtqljdb.exeC:\Temp\i_igbvtqljdb.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\igaysqlida.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\igaysqlida.exeC:\Temp\igaysqlida.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_igaysqlida.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_igaysqlida.exeC:\Temp\i_igaysqlida.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ayspkicaus.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ayspkicaus.exeC:\Temp\ayspkicaus.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ayspkicaus.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ayspkicaus.exeC:\Temp\i_ayspkicaus.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xvpnhfzxsm.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\xvpnhfzxsm.exeC:\Temp\xvpnhfzxsm.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xvpnhfzxsm.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_xvpnhfzxsm.exeC:\Temp\i_xvpnhfzxsm.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pjhfzxupmh.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\pjhfzxupmh.exeC:\Temp\pjhfzxupmh.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pjhfzxupmh.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_pjhfzxupmh.exeC:\Temp\i_pjhfzxupmh.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xrpmhezwrp.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\xrpmhezwrp.exeC:\Temp\xrpmhezwrp.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xrpmhezwrp.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_xrpmhezwrp.exeC:\Temp\i_xrpmhezwrp.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hezwjgeywu.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\hezwjgeywu.exeC:\Temp\hezwjgeywu.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hezwjgeywu.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_hezwjgeywu.exeC:\Temp\i_hezwjgeywu.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gbywqomjeb.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\gbywqomjeb.exeC:\Temp\gbywqomjeb.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gbywqomjeb.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_gbywqomjeb.exeC:\Temp\i_gbywqomjeb.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\dbvtqljgby.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\dbvtqljgby.exeC:\Temp\dbvtqljgby.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_dbvtqljgby.exe ups_ins3⤵
-
C:\Temp\i_dbvtqljgby.exeC:\Temp\i_dbvtqljgby.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nligavsqlf.exe ups_run3⤵
-
C:\Temp\nligavsqlf.exeC:\Temp\nligavsqlf.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nligavsqlf.exe ups_ins3⤵
-
C:\Temp\i_nligavsqlf.exeC:\Temp\i_nligavsqlf.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vtnlfdaysq.exe ups_run3⤵
-
C:\Temp\vtnlfdaysq.exeC:\Temp\vtnlfdaysq.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vtnlfdaysq.exe ups_ins3⤵
-
C:\Temp\i_vtnlfdaysq.exeC:\Temp\i_vtnlfdaysq.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\sqnicaxsqk.exe ups_run3⤵
-
C:\Temp\sqnicaxsqk.exeC:\Temp\sqnicaxsqk.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_sqnicaxsqk.exe ups_ins3⤵
-
C:\Temp\i_sqnicaxsqk.exeC:\Temp\i_sqnicaxsqk.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\smkfcxuspk.exe ups_run3⤵
-
C:\Temp\smkfcxuspk.exeC:\Temp\smkfcxuspk.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_smkfcxuspk.exe ups_ins3⤵
-
C:\Temp\i_smkfcxuspk.exeC:\Temp\i_smkfcxuspk.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\smkecwuomk.exe ups_run3⤵
-
C:\Temp\smkecwuomk.exeC:\Temp\smkecwuomk.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_smkecwuomk.exe ups_ins3⤵
-
C:\Temp\i_smkecwuomk.exeC:\Temp\i_smkecwuomk.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zwrpmhezwu.exe ups_run3⤵
-
C:\Temp\zwrpmhezwu.exeC:\Temp\zwrpmhezwu.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zwrpmhezwu.exe ups_ins3⤵
-
C:\Temp\i_zwrpmhezwu.exeC:\Temp\i_zwrpmhezwu.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\trojgecwto.exe ups_run3⤵
-
C:\Temp\trojgecwto.exeC:\Temp\trojgecwto.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_trojgecwto.exe ups_ins3⤵
-
C:\Temp\i_trojgecwto.exeC:\Temp\i_trojgecwto.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gbywqoigby.exe ups_run3⤵
-
C:\Temp\gbywqoigby.exeC:\Temp\gbywqoigby.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gbywqoigby.exe ups_ins3⤵
-
C:\Temp\i_gbywqoigby.exeC:\Temp\i_gbywqoigby.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jdbvtqljdb.exe ups_run3⤵
-
C:\Temp\jdbvtqljdb.exeC:\Temp\jdbvtqljdb.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffbf240c188,0x7ffbf240c194,0x7ffbf240c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1904,i,12245791155376385658,1547556223513876709,524288 --field-trial-handle=2616,i,7013070693231837645,13992081773021808091,262144 --variations-seed-version --mojo-platform-channel-handle=2704 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2240,i,16234763416606023564,15407177085548197777,524288 --field-trial-handle=2616,i,7013070693231837645,13992081773021808091,262144 --variations-seed-version --mojo-platform-channel-handle=3004 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1660,i,156579514354188547,13299540582563793532,262144 --field-trial-handle=2616,i,7013070693231837645,13992081773021808091,262144 --variations-seed-version --mojo-platform-channel-handle=2612 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3576,i,16657515458607124663,9371405075589705781,2097152 --field-trial-handle=2616,i,7013070693231837645,13992081773021808091,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3584,i,17826528836640858502,17338370226717420302,2097152 --field-trial-handle=2616,i,7013070693231837645,13992081773021808091,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4276,i,13291461078452663866,7705444535093837252,2097152 --field-trial-handle=2616,i,7013070693231837645,13992081773021808091,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4184,i,6045438629333334295,8742991066535533872,2097152 --field-trial-handle=2616,i,7013070693231837645,13992081773021808091,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5316,i,12094052947548367767,1808836122672281714,524288 --field-trial-handle=2616,i,7013070693231837645,13992081773021808091,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5476,i,15628858787906061800,11923889554998526459,2097152 --field-trial-handle=2616,i,7013070693231837645,13992081773021808091,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3772,i,9126784880129289335,16897708665805027436,2097152 --field-trial-handle=2616,i,7013070693231837645,13992081773021808091,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,5907362638634503740,743035202569760084,524288 --field-trial-handle=2616,i,7013070693231837645,13992081773021808091,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,5907362638634503740,743035202569760084,524288 --field-trial-handle=2616,i,7013070693231837645,13992081773021808091,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3768,i,9950423716448090193,6780146614187742570,524288 --field-trial-handle=2616,i,7013070693231837645,13992081773021808091,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3756,i,8912519095064182367,8239592923272208748,524288 --field-trial-handle=2616,i,7013070693231837645,13992081773021808091,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5272,i,6936080133437813037,14944088547060061819,524288 --field-trial-handle=2616,i,7013070693231837645,13992081773021808091,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6696,i,17412117892833454101,17646399018737107854,524288 --field-trial-handle=2616,i,7013070693231837645,13992081773021808091,262144 --variations-seed-version --mojo-platform-channel-handle=6688 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5572,i,3504231599326330868,15682427100835836298,2097152 --field-trial-handle=2616,i,7013070693231837645,13992081773021808091,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5172,i,5269590886442174430,14522561549978881811,524288 --field-trial-handle=2616,i,7013070693231837645,13992081773021808091,262144 --variations-seed-version --mojo-platform-channel-handle=4960 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5176,i,17966940971120085188,6836604417870772128,524288 --field-trial-handle=2616,i,7013070693231837645,13992081773021808091,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5160,i,3877072929819314498,7618272878318820695,524288 --field-trial-handle=2616,i,7013070693231837645,13992081773021808091,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=3620,i,7926784317039611370,577879176013538447,2097152 --field-trial-handle=2616,i,7013070693231837645,13992081773021808091,262144 --variations-seed-version --mojo-platform-channel-handle=4960 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6696,i,867253180970877330,15070368086541956469,524288 --field-trial-handle=2616,i,7013070693231837645,13992081773021808091,262144 --variations-seed-version --mojo-platform-channel-handle=6568 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,5675868678234070641,15725160123079202315,524288 --field-trial-handle=2616,i,7013070693231837645,13992081773021808091,262144 --variations-seed-version --mojo-platform-channel-handle=1748 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5312,i,13716808065641987918,3802957799721637606,524288 --field-trial-handle=2616,i,7013070693231837645,13992081773021808091,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=6468,i,11367334795214297715,15756767751850808625,2097152 --field-trial-handle=2616,i,7013070693231837645,13992081773021808091,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5052,i,9198796926063644494,7309770493166395593,524288 --field-trial-handle=2616,i,7013070693231837645,13992081773021808091,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6020,i,6349864726740491943,14900880573315685406,262144 --field-trial-handle=2616,i,7013070693231837645,13992081773021808091,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6020,i,12749564518589582963,833144500706414388,524288 --field-trial-handle=2616,i,7013070693231837645,13992081773021808091,262144 --variations-seed-version --mojo-platform-channel-handle=6564 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5772,i,144551105950460624,943769388106549076,524288 --field-trial-handle=2616,i,7013070693231837645,13992081773021808091,262144 --variations-seed-version --mojo-platform-channel-handle=5780 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\ztrojhbztrpjhbzt.sysC:\Temp\ztrojhbztrpjhbzt.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Temp\ywqoljgbzt.sysC:\Temp\ywqoljgbzt.sys1⤵
- Executes dropped EXE
-
C:\Temp\gdyvtqligd.sysC:\Temp\gdyvtqligd.sys1⤵
- Executes dropped EXE
-
C:\Temp\gaysqlidav.sysC:\Temp\gaysqlidav.sys1⤵
- Executes dropped EXE
-
C:\Temp\nlfdxvpnli.sysC:\Temp\nlfdxvpnli.sys1⤵
- Executes dropped EXE
-
C:\Temp\xvpnhfdxvp.sysC:\Temp\xvpnhfdxvp.sys1⤵
- Executes dropped EXE
-
C:\Temp\rpjhczusmk.sysC:\Temp\rpjhczusmk.sys1⤵
- Executes dropped EXE
-
C:\Temp\romkhczxro.sysC:\Temp\romkhczxro.sys1⤵
- Executes dropped EXE
-
C:\Temp\gecwuomgez.sysC:\Temp\gecwuomgez.sys1⤵
- Executes dropped EXE
-
C:\Temp\heywtoljeb.sysC:\Temp\heywtoljeb.sys1⤵
- Executes dropped EXE
-
C:\Temp\dbywqoigay.sysC:\Temp\dbywqoigay.sys1⤵
- Executes dropped EXE
-
C:\Temp\wqoigaywqo.sysC:\Temp\wqoigaywqo.sys1⤵
-
C:\Temp\vqnigdyvqn.sysC:\Temp\vqnigdyvqn.sys1⤵
-
C:\Temp\vsnkfdxvpn.sysC:\Temp\vsnkfdxvpn.sys1⤵
-
C:\Temp\pnhfcxupnk.sysC:\Temp\pnhfcxupnk.sys1⤵
-
C:\Temp\ausmkhfzxr.sysC:\Temp\ausmkhfzxr.sys1⤵
-
C:\Temp\czusmkecwu.sysC:\Temp\czusmkecwu.sys1⤵
-
C:\Temp\wrojhezwuo.sysC:\Temp\wrojhezwuo.sys1⤵
-
C:\Temp\dbwtoljdbw.sysC:\Temp\dbwtoljdbw.sys1⤵
-
C:\Temp\olgdywtolj.sysC:\Temp\olgdywtolj.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
ayspkicaus.exe
bwtrljebzr.exe
gaysqlidav.sys
gdyvtqligd.sys
i_ayspkicaus.exe
i_bwtrljebzr.exe
i_igaysqlida.exe
i_igbvtqljdb.exe
i_toljdbwtol.exe
igaysqlida.exe
igbvtqljdb.exe
nlfdxvpnli.sys
toljdbwtol.exe
xvpnhfdxvp.sys
ywqoljgbzt.sys
ztrojhbztrpjhbzt.exe
ztrojhbztrpjhbzt.sys
35846c63-de31-4024-b426-1707d06047b5.tmp
5f4da303-d32e-40c8-b725-e35d0991cbc1.tmp
64c3e1ef-4d9a-4930-aaf0-dd695b6040c3.tmp
9ec34a9a-5e8f-4b69-be7c-af8c128fabe1.tmp
e2af090c-1f1c-4ce8-aac5-82e0abd9ab78.tmp
settings.dat
settings.dat
16de9ef4-7730-4d77-9baf-5b03358efc7a.tmp
1f3b9f03-0c13-4f17-bad7-04cfc1933acc.tmp
5311d21e-1f55-4c3d-96ad-dce61238c8e4.tmp
temp-index
the-real-index
521a8233-08f4-43e2-83cd-92a3137a96b4.tmp
15666dc9-9aec-42c5-adc7-755903e13cec.tmp
706ff9b3-6c7d-4222-bfb5-01158004a032.tmp
e7690c3a-e4ba-41e4-97fc-5d33c1215c76.tmp
sync_diagnostic.log
d9785838-4112-4ff9-9b6b-9b6e331ad8a5.tmp
dd069a3c-f2f6-41ca-b081-409666aa0a49.tmp
ef81c5e3-b11b-44c0-982b-65c39cc62a39.tmp
cb15bfa5-0f62-4d79-a5d7-eedbf7926fa9.tmp
c5f4df1b-6ee1-4d7a-82a7-9c21615b937b.tmp
25c50d78-64f7-47c0-856c-8111a2694bf6.tmp
435e9692-ef07-4a01-9bb6-ab48d7668055.tmp
6c16f79b-83e3-4fc6-af01-ed340d6b32e2.tmp
7104a4da-4e67-4dd5-983d-886b7164a63d.tmp
d096a3f7-9f2e-431d-a50c-b9efa94efad1.tmp
1cc3b862-9b39-46f3-8a6f-e415a1ddf9eb.tmp
32f040e7-590b-467d-93f4-29e4be253c2f.tmp
48cec12d-4f15-45d3-9500-454b93e0078f.tmp
content.js
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
CreateProcess.exe
memory/1192-200-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1272-499-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1292-289-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1292-321-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1404-519-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1516-249-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2368-302-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2564-344-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2724-328-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2816-66-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2836-445-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2836-476-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2940-348-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3392-442-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3392-420-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3392-378-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4104-324-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4496-406-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5052-523-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5236-474-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5668-447-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5668-432-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5820-479-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5896-277-0x0000000000010000-0x00000000000AB000-memory.dmp