Analysis
- max time kernel
148s - max time network
154s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
15/10/2026, 16:42
General
- Target 2026-10-13_30b6ce52b5650ff5e551345d2bbc8f8e_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 361KB
- Sample261015-t734eaav3m
- SHA256 f8d44cd666516ac4f8d3aad5118d7073c99c7983a0c9ba5103197eff51e8d6e7
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba
-
http://xytets.com:2345/t.asp?os=home
-
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-13_30b6ce52b5650ff5e551345d2bbc8f8e_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-13_30b6ce52b5650ff5e551345d2bbc8f8e_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\dbvtnlgdywqoigdy.exeC:\Temp\dbvtnlgdywqoigdy.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\igaysqlidb.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\igaysqlidb.exeC:\Temp\igaysqlidb.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_igaysqlidb.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_igaysqlidb.exeC:\Temp\i_igaysqlidb.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qkigaysqki.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\qkigaysqki.exeC:\Temp\qkigaysqki.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qkigaysqki.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_qkigaysqki.exeC:\Temp\i_qkigaysqki.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\cxvpnkicax.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\cxvpnkicax.exeC:\Temp\cxvpnkicax.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_cxvpnkicax.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_cxvpnkicax.exeC:\Temp\i_cxvpnkicax.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fcxusmkfcx.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\fcxusmkfcx.exeC:\Temp\fcxusmkfcx.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fcxusmkfcx.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_fcxusmkfcx.exeC:\Temp\i_fcxusmkfcx.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ecwupmhfzx.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ecwupmhfzx.exeC:\Temp\ecwupmhfzx.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ecwupmhfzx.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ecwupmhfzx.exeC:\Temp\i_ecwupmhfzx.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mkezxromhe.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\mkezxromhe.exeC:\Temp\mkezxromhe.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mkezxromhe.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_mkezxromhe.exeC:\Temp\i_mkezxromhe.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jdbzwuomge.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\jdbzwuomge.exeC:\Temp\jdbzwuomge.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jdbzwuomge.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_jdbzwuomge.exeC:\Temp\i_jdbzwuomge.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qomjebwuom.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\qomjebwuom.exeC:\Temp\qomjebwuom.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qomjebwuom.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_qomjebwuom.exeC:\Temp\i_qomjebwuom.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\trlgdywqoi.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\trlgdywqoi.exeC:\Temp\trlgdywqoi.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_trlgdywqoi.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_trlgdywqoi.exeC:\Temp\i_trlgdywqoi.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qnlidavsqo.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\qnlidavsqo.exeC:\Temp\qnlidavsqo.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qnlidavsqo.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_qnlidavsqo.exeC:\Temp\i_qnlidavsqo.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ysqcausqki.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ysqcausqki.exeC:\Temp\ysqcausqki.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ysqcausqki.exe ups_ins3⤵
-
C:\Temp\i_ysqcausqki.exeC:\Temp\i_ysqcausqki.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\usqkicaxvs.exe ups_run3⤵
-
C:\Temp\usqkicaxvs.exeC:\Temp\usqkicaxvs.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_usqkicaxvs.exe ups_ins3⤵
-
C:\Temp\i_usqkicaxvs.exeC:\Temp\i_usqkicaxvs.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\uspkhczusp.exe ups_run3⤵
-
C:\Temp\uspkhczusp.exeC:\Temp\uspkhczusp.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_uspkhczusp.exe ups_ins3⤵
-
C:\Temp\i_uspkhczusp.exeC:\Temp\i_uspkhczusp.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xrpjhecwup.exe ups_run3⤵
-
C:\Temp\xrpjhecwup.exeC:\Temp\xrpjhecwup.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xrpjhecwup.exe ups_ins3⤵
-
C:\Temp\i_xrpjhecwup.exeC:\Temp\i_xrpjhecwup.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bzxrpjhbzw.exe ups_run3⤵
-
C:\Temp\bzxrpjhbzw.exeC:\Temp\bzxrpjhbzw.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bzxrpjhbzw.exe ups_ins3⤵
-
C:\Temp\i_bzxrpjhbzw.exeC:\Temp\i_bzxrpjhbzw.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bwuomgebzt.exe ups_run3⤵
-
C:\Temp\bwuomgebzt.exeC:\Temp\bwuomgebzt.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bwuomgebzt.exe ups_ins3⤵
-
C:\Temp\i_bwuomgebzt.exeC:\Temp\i_bwuomgebzt.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bvtrljgbzt.exe ups_run3⤵
-
C:\Temp\bvtrljgbzt.exeC:\Temp\bvtrljgbzt.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bvtrljgbzt.exe ups_ins3⤵
-
C:\Temp\i_bvtrljgbzt.exeC:\Temp\i_bvtrljgbzt.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gdytqliday.exe ups_run3⤵
-
C:\Temp\gdytqliday.exeC:\Temp\gdytqliday.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gdytqliday.exe ups_ins3⤵
-
C:\Temp\i_gdytqliday.exeC:\Temp\i_gdytqliday.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qligdyvqnl.exe ups_run3⤵
-
C:\Temp\qligdyvqnl.exeC:\Temp\qligdyvqnl.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qligdyvqnl.exe ups_ins3⤵
-
C:\Temp\i_qligdyvqnl.exeC:\Temp\i_qligdyvqnl.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nlfdxvpnhf.exe ups_run3⤵
-
C:\Temp\nlfdxvpnhf.exeC:\Temp\nlfdxvpnhf.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffc4583c188,0x7ffc4583c194,0x7ffc4583c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1668,i,10813045196038175055,4843217053615824960,262144 --field-trial-handle=2348,i,8368035635213661310,2563391040972161787,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1844,i,17420575697531156559,17361209484629881374,524288 --field-trial-handle=2348,i,8368035635213661310,2563391040972161787,262144 --variations-seed-version --mojo-platform-channel-handle=2400 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2432,i,18094866590189095790,4240401945057757635,524288 --field-trial-handle=2348,i,8368035635213661310,2563391040972161787,262144 --variations-seed-version --mojo-platform-channel-handle=2788 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3588,i,17544523258916936480,9854374557032061153,2097152 --field-trial-handle=2348,i,8368035635213661310,2563391040972161787,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3612,i,16180661618187286607,2074903616486751479,2097152 --field-trial-handle=2348,i,8368035635213661310,2563391040972161787,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4300,i,10244767116248832836,2383797841286693956,2097152 --field-trial-handle=2348,i,8368035635213661310,2563391040972161787,262144 --variations-seed-version --mojo-platform-channel-handle=4608 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4312,i,6282393112294800087,9616093629551828190,2097152 --field-trial-handle=2348,i,8368035635213661310,2563391040972161787,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3752,i,11212781887059126472,3757925756534391260,2097152 --field-trial-handle=2348,i,8368035635213661310,2563391040972161787,262144 --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5468,i,12064979964142631216,13720312278876415136,524288 --field-trial-handle=2348,i,8368035635213661310,2563391040972161787,262144 --variations-seed-version --mojo-platform-channel-handle=3856 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3828,i,2653487052025865292,9648682454578406503,2097152 --field-trial-handle=2348,i,8368035635213661310,2563391040972161787,262144 --variations-seed-version --mojo-platform-channel-handle=3812 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3644,i,9724312040126291251,8004142371724801994,524288 --field-trial-handle=2348,i,8368035635213661310,2563391040972161787,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3632,i,6219547960374473555,15432249298760012795,524288 --field-trial-handle=2348,i,8368035635213661310,2563391040972161787,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6180,i,6655642658709130365,13859189077158232896,524288 --field-trial-handle=2348,i,8368035635213661310,2563391040972161787,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6180,i,6655642658709130365,13859189077158232896,524288 --field-trial-handle=2348,i,8368035635213661310,2563391040972161787,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3804,i,8805827051833555844,14040432119431253583,524288 --field-trial-handle=2348,i,8368035635213661310,2563391040972161787,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6512,i,8183713085738468880,4567969592548362707,524288 --field-trial-handle=2348,i,8368035635213661310,2563391040972161787,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6388,i,16450861687489843535,2508865659760178543,524288 --field-trial-handle=2348,i,8368035635213661310,2563391040972161787,262144 --variations-seed-version --mojo-platform-channel-handle=6672 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6728,i,11786634226487076283,15881122706921927033,524288 --field-trial-handle=2348,i,8368035635213661310,2563391040972161787,262144 --variations-seed-version --mojo-platform-channel-handle=3768 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6684,i,16582338360200764753,1557118440581211779,2097152 --field-trial-handle=2348,i,8368035635213661310,2563391040972161787,262144 --variations-seed-version --mojo-platform-channel-handle=6692 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3664,i,1381046628621479012,13587624670132054381,524288 --field-trial-handle=2348,i,8368035635213661310,2563391040972161787,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4596,i,9342415805335929088,4436208407983914428,524288 --field-trial-handle=2348,i,8368035635213661310,2563391040972161787,262144 --variations-seed-version --mojo-platform-channel-handle=4660 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4600,i,13868265711954777481,4111849948976200222,524288 --field-trial-handle=2348,i,8368035635213661310,2563391040972161787,262144 --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=2056,i,1576546835207932203,16826968347852211007,2097152 --field-trial-handle=2348,i,8368035635213661310,2563391040972161787,262144 --variations-seed-version --mojo-platform-channel-handle=3096 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6460,i,13255034086537939297,17017765879044482756,524288 --field-trial-handle=2348,i,8368035635213661310,2563391040972161787,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6168,i,3151307318088262486,14866663841428283311,524288 --field-trial-handle=2348,i,8368035635213661310,2563391040972161787,262144 --variations-seed-version --mojo-platform-channel-handle=6724 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=920,i,4135822177122265954,893009934316052893,524288 --field-trial-handle=2348,i,8368035635213661310,2563391040972161787,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=6228,i,4433456448383745544,9902525318929314322,2097152 --field-trial-handle=2348,i,8368035635213661310,2563391040972161787,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5428,i,16443152841846110935,4687258159552464876,524288 --field-trial-handle=2348,i,8368035635213661310,2563391040972161787,262144 --variations-seed-version --mojo-platform-channel-handle=3232 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3700,i,8015227802105615317,6110716088370545654,262144 --field-trial-handle=2348,i,8368035635213661310,2563391040972161787,262144 --variations-seed-version --mojo-platform-channel-handle=3856 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,14778901442397135547,11608269102879887342,524288 --field-trial-handle=2348,i,8368035635213661310,2563391040972161787,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\dbvtnlgdywqoigdy.sysC:\Temp\dbvtnlgdywqoigdy.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Temp\snlidavtqn.sysC:\Temp\snlidavtqn.sys1⤵
- Executes dropped EXE
-
C:\Temp\kicavsqnig.sysC:\Temp\kicavsqnig.sys1⤵
- Executes dropped EXE
-
C:\Temp\fcxvpnkfcx.sysC:\Temp\fcxvpnkfcx.sys1⤵
- Executes dropped EXE
-
C:\Temp\ecwuspnhfz.sysC:\Temp\ecwuspnhfz.sys1⤵
- Executes dropped EXE
-
C:\Temp\jebzxupmhe.sysC:\Temp\jebzxupmhe.sys1⤵
- Executes dropped EXE
-
C:\Temp\rmjebwurmj.sysC:\Temp\rmjebwurmj.sys1⤵
- Executes dropped EXE
-
C:\Temp\ljgebwtomg.sysC:\Temp\ljgebwtomg.sys1⤵
- Executes dropped EXE
-
C:\Temp\ytqljdbytq.sysC:\Temp\ytqljdbytq.sys1⤵
- Executes dropped EXE
-
C:\Temp\qlidbvsqol.sysC:\Temp\qlidbvsqol.sys1⤵
- Executes dropped EXE
-
C:\Temp\xvtnlfdxvq.sysC:\Temp\xvtnlfdxvq.sys1⤵
- Executes dropped EXE
-
C:\Temp\xsqnhfaxvp.sysC:\Temp\xsqnhfaxvp.sys1⤵
-
C:\Temp\xrpnkfcaus.sysC:\Temp\xrpnkfcaus.sys1⤵
-
C:\Temp\hfzxupmhfz.sysC:\Temp\hfzxupmhfz.sys1⤵
-
C:\Temp\zwurpjhezw.sysC:\Temp\zwurpjhezw.sys1⤵
-
C:\Temp\zwrojgbztr.sysC:\Temp\zwrojgbztr.sys1⤵
-
C:\Temp\wtoljgbywt.sysC:\Temp\wtoljgbywt.sys1⤵
-
C:\Temp\ljdbvtolgd.sysC:\Temp\ljdbvtolgd.sys1⤵
-
C:\Temp\oigayvqnlf.sysC:\Temp\oigayvqnlf.sys1⤵
-
C:\Temp\nkfdaysqni.sysC:\Temp\nkfdaysqni.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
cxvpnkicax.exe
dbvtnlgdywqoigdy.exe
dbvtnlgdywqoigdy.sys
ecwupmhfzx.exe
ecwuspnhfz.sys
fcxusmkfcx.exe
fcxvpnkfcx.sys
i_cxvpnkicax.exe
i_ecwupmhfzx.exe
i_fcxusmkfcx.exe
i_igaysqlidb.exe
i_qkigaysqki.exe
igaysqlidb.exe
kicavsqnig.sys
qkigaysqki.exe
snlidavtqn.sys
14865e49-1d2d-4079-a761-0bf8013502da.tmp
1a4900d6-4d9d-497e-95ae-cf93ebd94dfd.tmp
3e83ed55-6212-482b-a63e-c732eaf436ff.tmp
5a076a1f-7dc3-440c-95f9-1275d32b91ee.tmp
8090eb34-2e6f-4618-ac50-2cc85a701194.tmp
settings.dat
settings.dat
0183f096-367f-4cc3-bcf0-cdebc85024ba.tmp
553eaac4-2b04-44a3-a4ea-e65eeedc1666.tmp
766594af-2004-4114-bc8d-e58e339bf712.tmp
7ccc21ba-d819-4c88-ab58-1079984ed148.tmp
temp-index
the-real-index
5322b468-6818-40c7-804b-66ff9cf31aec.tmp
dasherSettingSchema.json
21d9319c-8149-4bb8-b134-0084dbd5f67e.tmp
54b7bec8-ce9f-490c-9dea-8c17ee8b8087.tmp
6e7b0f47-630f-4035-a6ba-192d47c5674d.tmp
db1f97a9-29eb-4fbc-907e-aaec6ed7b094.tmp
0bf8f1c9-e456-4494-8054-085aee4fb178.tmp
OperationConfig
09feb71f-a71a-4e95-9f4c-ed02ed0292a7.tmp
6d4d70ee-a812-4ef2-9a78-83b9d9fb9282.tmp
ddc9883a-23ac-462f-97de-93e6f6e8c2ce.tmp
ec5bd625-cac1-488d-9415-ad97a9f7b3a6.tmp
330bf403-a4e7-4d84-9c46-19fb74880522.tmp
3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
68412536-8392-41e4-ab2e-e88291974cef.tmp
92eeda59-a178-4c3e-9218-1fbd83daf663.tmp
f18545e0-2991-4675-947c-e9b47839efcb.tmp
content.js
messages.json
manifest.json
manifest.json
manifest.json
manifest.json
CreateProcess.exe
memory/456-688-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/800-652-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/984-511-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1116-718-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1480-560-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2776-483-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3260-611-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3452-564-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4368-676-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4380-552-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4380-523-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4392-714-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4548-656-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5608-609-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5628-535-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5736-434-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5784-65-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5792-630-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5880-692-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5924-736-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/6052-556-0x0000000000010000-0x00000000000AB000-memory.dmp