Analysis
- max time kernel
149s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
23/10/2026, 17:35
General
- Target 2026-10-22_da61952f7713c2be87808a0b5c733131_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 361KB
- Sample261023-v6c19stx3n
- SHA256 88a6f4283bdb595d7da733dd5b5d264ff9ea69662345649a0699c795edd1306b
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba
-
http://xytets.com:2345/t.asp?os=home
-
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 43 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
- Suspicious use of AdjustPrivilegeToken 20 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-22_da61952f7713c2be87808a0b5c733131_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_da61952f7713c2be87808a0b5c733131_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\omhecwurmjeczurp.exeC:\Temp\omhecwurmjeczurp.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wurmkecwto.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\wurmkecwto.exeC:\Temp\wurmkecwto.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wurmkecwto.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_wurmkecwto.exeC:\Temp\i_wurmkecwto.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ljebztrljg.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ljebztrljg.exeC:\Temp\ljebztrljg.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ljebztrljg.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ljebztrljg.exeC:\Temp\i_ljebztrljg.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jdbvtolgby.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\jdbvtolgby.exeC:\Temp\jdbvtolgby.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jdbvtolgby.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_jdbvtolgby.exeC:\Temp\i_jdbvtolgby.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\igaywtqlig.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\igaywtqlig.exeC:\Temp\igaywtqlig.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_igaywtqlig.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_igaywtqlig.exeC:\Temp\i_igaywtqlig.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fdyvtnlfdx.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\fdyvtnlfdx.exeC:\Temp\fdyvtnlfdx.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fdyvtnlfdx.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_fdyvtnlfdx.exeC:\Temp\i_fdyvtnlfdx.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\causnkicau.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\causnkicau.exeC:\Temp\causnkicau.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_causnkicau.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_causnkicau.exeC:\Temp\i_causnkicau.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\causmkecxu.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\causmkecxu.exeC:\Temp\causmkecxu.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_causmkecxu.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_causmkecxu.exeC:\Temp\i_causmkecxu.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rpjhfzxusm.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\rpjhfzxusm.exeC:\Temp\rpjhfzxusm.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rpjhfzxusm.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_rpjhfzxusm.exeC:\Temp\i_rpjhfzxusm.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fzxrmkecwu.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\fzxrmkecwu.exeC:\Temp\fzxrmkecwu.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fzxrmkecwu.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_fzxrmkecwu.exeC:\Temp\i_fzxrmkecwu.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ywrojhbztr.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ywrojhbztr.exeC:\Temp\ywrojhbztr.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ywrojhbztr.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ywrojhbztr.exeC:\Temp\i_ywrojhbztr.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ojgbytrljd.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ojgbytrljd.exeC:\Temp\ojgbytrljd.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ojgbytrljd.exe ups_ins3⤵
-
C:\Temp\i_ojgbytrljd.exeC:\Temp\i_ojgbytrljd.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\eywqojgayt.exe ups_run3⤵
-
C:\Temp\eywqojgayt.exeC:\Temp\eywqojgayt.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_eywqojgayt.exe ups_ins3⤵
-
C:\Temp\i_eywqojgayt.exeC:\Temp\i_eywqojgayt.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\yvtnlfdyvt.exe ups_run3⤵
-
C:\Temp\yvtnlfdyvt.exeC:\Temp\yvtnlfdyvt.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_yvtnlfdyvt.exe ups_ins3⤵
-
C:\Temp\i_yvtnlfdyvt.exeC:\Temp\i_yvtnlfdyvt.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vqnifdxvpn.exe ups_run3⤵
-
C:\Temp\vqnifdxvpn.exeC:\Temp\vqnifdxvpn.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vqnifdxvpn.exe ups_ins3⤵
-
C:\Temp\i_vqnifdxvpn.exeC:\Temp\i_vqnifdxvpn.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\dxvhfzxspn.exe ups_run3⤵
-
C:\Temp\dxvhfzxspn.exeC:\Temp\dxvhfzxspn.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_dxvhfzxspn.exe ups_ins3⤵
-
C:\Temp\i_dxvhfzxspn.exeC:\Temp\i_dxvhfzxspn.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pmkicaxrpn.exe ups_run3⤵
-
C:\Temp\pmkicaxrpn.exeC:\Temp\pmkicaxrpn.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pmkicaxrpn.exe ups_ins3⤵
-
C:\Temp\i_pmkicaxrpn.exeC:\Temp\i_pmkicaxrpn.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pmhezxrpmh.exe ups_run3⤵
-
C:\Temp\pmhezxrpmh.exeC:\Temp\pmhezxrpmh.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pmhezxrpmh.exe ups_ins3⤵
-
C:\Temp\i_pmhezxrpmh.exeC:\Temp\i_pmhezxrpmh.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mjeczxrojg.exe ups_run3⤵
-
C:\Temp\mjeczxrojg.exeC:\Temp\mjeczxrojg.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mjeczxrojg.exe ups_ins3⤵
-
C:\Temp\i_mjeczxrojg.exeC:\Temp\i_mjeczxrojg.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\trojgeywro.exe ups_run3⤵
-
C:\Temp\trojgeywro.exeC:\Temp\trojgeywro.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_trojgeywro.exe ups_ins3⤵
-
C:\Temp\i_trojgeywro.exeC:\Temp\i_trojgeywro.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jgbytrljdb.exe ups_run3⤵
-
C:\Temp\jgbytrljdb.exeC:\Temp\jgbytrljdb.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jgbytrljdb.exe ups_ins3⤵
-
C:\Temp\i_jgbytrljdb.exeC:\Temp\i_jgbytrljdb.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f4,0x2f8,0x2fc,0x2f0,0x398,0x7ffb8b56c188,0x7ffb8b56c194,0x7ffb8b56c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1688,i,17470188181707897800,15121778585506190609,262144 --field-trial-handle=2324,i,9986438153096840746,3112914012504306881,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1908,i,949775095397970836,507402251733488781,524288 --field-trial-handle=2324,i,9986438153096840746,3112914012504306881,262144 --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2552,i,11853420413197550784,18388086084272028413,524288 --field-trial-handle=2324,i,9986438153096840746,3112914012504306881,262144 --variations-seed-version --mojo-platform-channel-handle=2492 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3596,i,3606713652663050352,967422791086019861,2097152 --field-trial-handle=2324,i,9986438153096840746,3112914012504306881,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3604,i,12605295773162036085,16434910269559397973,2097152 --field-trial-handle=2324,i,9986438153096840746,3112914012504306881,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4292,i,18342389877201552720,11866759520191094592,2097152 --field-trial-handle=2324,i,9986438153096840746,3112914012504306881,262144 --variations-seed-version --mojo-platform-channel-handle=4560 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4340,i,17128023655795711430,8590670541324910351,2097152 --field-trial-handle=2324,i,9986438153096840746,3112914012504306881,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3800,i,7965357817683405981,13615473684357133450,2097152 --field-trial-handle=2324,i,9986438153096840746,3112914012504306881,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5504,i,3733235807587354666,7900999261666309877,524288 --field-trial-handle=2324,i,9986438153096840746,3112914012504306881,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3872,i,17158739971441513550,11860337749854290271,2097152 --field-trial-handle=2324,i,9986438153096840746,3112914012504306881,262144 --variations-seed-version --mojo-platform-channel-handle=3844 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5772,i,11846320123068486305,13710409849906922007,524288 --field-trial-handle=2324,i,9986438153096840746,3112914012504306881,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5772,i,11846320123068486305,13710409849906922007,524288 --field-trial-handle=2324,i,9986438153096840746,3112914012504306881,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3868,i,327323647643090616,12398426513033341559,524288 --field-trial-handle=2324,i,9986438153096840746,3112914012504306881,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3892,i,46962758773497070,13186933307823139380,524288 --field-trial-handle=2324,i,9986438153096840746,3112914012504306881,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5484,i,2867562350659588073,13929428292680570393,524288 --field-trial-handle=2324,i,9986438153096840746,3112914012504306881,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6116,i,16044011122603358688,10988575764181150722,524288 --field-trial-handle=2324,i,9986438153096840746,3112914012504306881,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6120,i,12164580095010673682,13935465176313181538,524288 --field-trial-handle=2324,i,9986438153096840746,3112914012504306881,262144 --variations-seed-version --mojo-platform-channel-handle=6816 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6824,i,16874870030692777317,13615151383074214283,524288 --field-trial-handle=2324,i,9986438153096840746,3112914012504306881,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6976,i,10727015560811634572,2024644255803432865,2097152 --field-trial-handle=2324,i,9986438153096840746,3112914012504306881,262144 --variations-seed-version --mojo-platform-channel-handle=7084 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4996,i,12465277342955170216,9563019804012772232,524288 --field-trial-handle=2324,i,9986438153096840746,3112914012504306881,262144 --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4988,i,3339556665711579041,17587226171076689620,524288 --field-trial-handle=2324,i,9986438153096840746,3112914012504306881,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5184,i,10425505355096374032,7997042726363040413,524288 --field-trial-handle=2324,i,9986438153096840746,3112914012504306881,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=2156,i,8593437404676393819,18179276974602039710,2097152 --field-trial-handle=2324,i,9986438153096840746,3112914012504306881,262144 --variations-seed-version --mojo-platform-channel-handle=2496 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4116,i,13341882092298722023,5462944724454325665,524288 --field-trial-handle=2324,i,9986438153096840746,3112914012504306881,262144 --variations-seed-version --mojo-platform-channel-handle=6788 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6068,i,11093300320379518672,2062998266178200099,524288 --field-trial-handle=2324,i,9986438153096840746,3112914012504306881,262144 --variations-seed-version --mojo-platform-channel-handle=6628 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,866783488070835040,17773974778021853722,524288 --field-trial-handle=2324,i,9986438153096840746,3112914012504306881,262144 --variations-seed-version --mojo-platform-channel-handle=912 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=6948,i,6403576785329821905,12101973210129912514,2097152 --field-trial-handle=2324,i,9986438153096840746,3112914012504306881,262144 --variations-seed-version --mojo-platform-channel-handle=6952 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6372,i,14098916499778005437,17472133472217312871,524288 --field-trial-handle=2324,i,9986438153096840746,3112914012504306881,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5388,i,9293641771810102538,971348261134419403,262144 --field-trial-handle=2324,i,9986438153096840746,3112914012504306881,262144 --variations-seed-version --mojo-platform-channel-handle=6580 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6228,i,3880574084591991191,16490959576245079128,524288 --field-trial-handle=2324,i,9986438153096840746,3112914012504306881,262144 --variations-seed-version --mojo-platform-channel-handle=3720 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\omhecwurmjeczurp.sysC:\Temp\omhecwurmjeczurp.sys1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Temp\rojhbztrlj.sysC:\Temp\rojhbztrlj.sys1⤵
- Executes dropped EXE
-
C:\Temp\qojgbywqom.sysC:\Temp\qojgbywqom.sys1⤵
- Executes dropped EXE
-
C:\Temp\igaywqoigd.sysC:\Temp\igaywqoigd.sys1⤵
- Executes dropped EXE
-
C:\Temp\nlfdbvtnlf.sysC:\Temp\nlfdbvtnlf.sys1⤵
- Executes dropped EXE
-
C:\Temp\axsqkicaxv.sysC:\Temp\axsqkicaxv.sys1⤵
- Executes dropped EXE
-
C:\Temp\kicausqkhf.sysC:\Temp\kicausqkhf.sys1⤵
- Executes dropped EXE
-
C:\Temp\usmkfcxupn.sysC:\Temp\usmkfcxupn.sys1⤵
- Executes dropped EXE
-
C:\Temp\czurpjhecz.sysC:\Temp\czurpjhecz.sys1⤵
- Executes dropped EXE
-
C:\Temp\bzwrojhbzt.sysC:\Temp\bzwrojhbzt.sys1⤵
- Executes dropped EXE
-
C:\Temp\bwtrojhbzt.sysC:\Temp\bwtrojhbzt.sys1⤵
- Executes dropped EXE
-
C:\Temp\ywqoljdbzt.sysC:\Temp\ywqoljdbzt.sys1⤵
-
C:\Temp\dyvqoigays.sysC:\Temp\dyvqoigays.sys1⤵
-
C:\Temp\vpnifdavsq.sysC:\Temp\vpnifdavsq.sys1⤵
-
C:\Temp\dxvpnhfaxv.sysC:\Temp\dxvpnhfaxv.sys1⤵
-
C:\Temp\vpnhfzxspk.sysC:\Temp\vpnhfzxspk.sys1⤵
-
C:\Temp\mkhczxrpkh.sysC:\Temp\mkhczxrpkh.sys1⤵
-
C:\Temp\xrpjhczpjh.sysC:\Temp\xrpjhczpjh.sys1⤵
-
C:\Temp\omjebzwrom.sysC:\Temp\omjebzwrom.sys1⤵
-
C:\Temp\gebwtolgey.sysC:\Temp\gebwtolgey.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
fdyvtnlfdx.exe
i_fdyvtnlfdx.exe
i_igaywtqlig.exe
i_jdbvtolgby.exe
i_ljebztrljg.exe
i_wurmkecwto.exe
igaywqoigd.sys
igaywtqlig.exe
jdbvtolgby.exe
ljebztrljg.exe
nlfdbvtnlf.sys
omhecwurmjeczurp.exe
omhecwurmjeczurp.sys
qojgbywqom.sys
rojhbztrlj.sys
wurmkecwto.exe
13ae5b7c-0be1-43de-a679-9df598988900.tmp
24564e3f-1f67-48ab-a4c0-84a810532de9.tmp
3f5b40d9-f1ed-47af-b9cc-4c36a64d9467.tmp
settings.dat
settings.dat
11b66188-097d-4754-8104-bd402a824988.tmp
605a0cb9-de70-40d9-8b46-2db09fddac52.tmp
81243275-bec1-4d83-80e3-39b9d674cbc2.tmp
the-real-index
7c2b14d3-3cc9-4cb7-9aeb-e5b5acb41a69.tmp
dasherSettingSchema.json
02d82ad7-bf1a-4106-83f0-08a89ee74671.tmp
124c38e5-ce6c-496f-afb7-1c125f7fc420.tmp
537c4ff7-5264-480d-9f42-a66d72c2d7ad.tmp
sync_diagnostic.log
aeb99338-2b3b-442e-a77b-62f387b926ba.tmp
bd2788fe-865a-41b4-b1e4-7b4c973dbb39.tmp
cf13e314-c65e-4ab4-aee1-c91877f2e4c7.tmp
1f1e63e2-1cd1-4074-8de7-0bd03ddd1582.tmp
OperationConfig
a4cdd7e8-ecba-4a6e-8110-a1a13891ab4d.tmp
4fb82cf5-2ce1-4f8b-a204-9910d55a0069.tmp
62da0947-a804-42eb-9381-c2d190ef8bd6.tmp
69b96765-6918-4b88-92cb-62748dcd15e0.tmp
e488a46e-2a7d-4cb0-81c3-85e3af526182.tmp
e5d04d53-1619-46f8-ba0a-ec6af17da11b.tmp
3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
8be8fe95-0624-4700-9b2d-eacde11c4b0e.tmp
metadata.json
adbe86d9-3a09-4cc1-a3f6-a98f5e9ee90e.tmp
e444d95e-3971-4699-aa93-7751ab3d9a34.tmp
messages.json
content.js
manifest.json
manifest.json
manifest.json
manifest.json
CreateProcess.exe
memory/200-529-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/252-731-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/876-646-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1280-557-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1716-518-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1784-686-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1784-650-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2144-574-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2156-67-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2848-682-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3100-616-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3216-712-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3364-480-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3660-715-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3660-708-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4032-430-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4124-553-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4220-670-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4268-604-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4304-516-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5596-549-0x0000000000010000-0x00000000000AB000-memory.dmp