Analysis
- max time kernel
149s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
24/10/2026, 11:24
General
- Target 2026-10-22_6073293a8d06b871b163a4c306b34341_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
- Size 365KB
- Sample261024-nhxx7styay
- SHA256 7f2346384c58633526f8b0f24aacbb45aeee83a44a90b3fb5302b2620ff9ee33
Score
10/10
Malware Config
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 43 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
- Suspicious use of AdjustPrivilegeToken 20 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-22_6073293a8d06b871b163a4c306b34341_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_6073293a8d06b871b163a4c306b34341_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\bwtomgeywrojgbzt.exeC:\Temp\bwtomgeywrojgbzt.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\eywqojdbzq.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\eywqojdbzq.exeC:\Temp\eywqojdbzq.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_eywqojdbzq.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_eywqojdbzq.exeC:\Temp\i_eywqojdbzq.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ywqoigbysq.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ywqoigbysq.exeC:\Temp\ywqoigbysq.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ywqoigbysq.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ywqoigbysq.exeC:\Temp\i_ywqoigbysq.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qnlfdavqnl.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\qnlfdavqnl.exeC:\Temp\qnlfdavqnl.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qnlfdavqnl.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_qnlfdavqnl.exeC:\Temp\i_qnlfdavqnl.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\avsnlfdxvp.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\avsnlfdxvp.exeC:\Temp\avsnlfdxvp.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_avsnlfdxvp.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_avsnlfdxvp.exeC:\Temp\i_avsnlfdxvp.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fdxvpnhfzx.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\fdxvpnhfzx.exeC:\Temp\fdxvpnhfzx.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fdxvpnhfzx.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_fdxvpnhfzx.exeC:\Temp\i_fdxvpnhfzx.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\khczusmkec.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\khczusmkec.exeC:\Temp\khczusmkec.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_khczusmkec.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_khczusmkec.exeC:\Temp\i_khczusmkec.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mjecwurmke.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\mjecwurmke.exeC:\Temp\mjecwurmke.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mjecwurmke.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_mjecwurmke.exeC:\Temp\i_mjecwurmke.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bzurmjebwu.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\bzurmjebwu.exeC:\Temp\bzurmjebwu.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bzurmjebwu.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_bzurmjebwu.exeC:\Temp\i_bzurmjebwu.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jgebwtomge.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\jgebwtomge.exeC:\Temp\jgebwtomge.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jgebwtomge.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_jgebwtomge.exeC:\Temp\i_jgebwtomge.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\dbvtolgeyw.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\dbvtolgeyw.exeC:\Temp\dbvtolgeyw.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_dbvtolgeyw.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_dbvtolgeyw.exeC:\Temp\i_dbvtolgeyw.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\igbykidavt.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\igbykidavt.exeC:\Temp\igbykidavt.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_igbykidavt.exe ups_ins3⤵
-
C:\Temp\i_igbykidavt.exeC:\Temp\i_igbykidavt.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ligaysqkid.exe ups_run3⤵
-
C:\Temp\ligaysqkid.exeC:\Temp\ligaysqkid.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ligaysqkid.exe ups_ins3⤵
-
C:\Temp\i_ligaysqkid.exeC:\Temp\i_ligaysqkid.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nkicavsqki.exe ups_run3⤵
-
C:\Temp\nkicavsqki.exeC:\Temp\nkicavsqki.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nkicavsqki.exe ups_ins3⤵
-
C:\Temp\i_nkicavsqki.exeC:\Temp\i_nkicavsqki.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fzxrpkhcau.exe ups_run3⤵
-
C:\Temp\fzxrpkhcau.exeC:\Temp\fzxrpkhcau.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fzxrpkhcau.exe ups_ins3⤵
-
C:\Temp\i_fzxrpkhcau.exeC:\Temp\i_fzxrpkhcau.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\smkhcauspk.exe ups_run3⤵
-
C:\Temp\smkhcauspk.exeC:\Temp\smkhcauspk.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_smkhcauspk.exe ups_ins3⤵
-
C:\Temp\i_smkhcauspk.exeC:\Temp\i_smkhcauspk.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\omkeczurmk.exe ups_run3⤵
-
C:\Temp\omkeczurmk.exeC:\Temp\omkeczurmk.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_omkeczurmk.exe ups_ins3⤵
-
C:\Temp\i_omkeczurmk.exeC:\Temp\i_omkeczurmk.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ojhbzwrojg.exe ups_run3⤵
-
C:\Temp\ojhbzwrojg.exeC:\Temp\ojhbzwrojg.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ojhbzwrojg.exe ups_ins3⤵
-
C:\Temp\i_ojhbzwrojg.exeC:\Temp\i_ojhbzwrojg.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\omgeywtolj.exe ups_run3⤵
-
C:\Temp\omgeywtolj.exeC:\Temp\omgeywtolj.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_omgeywtolj.exe ups_ins3⤵
-
C:\Temp\i_omgeywtolj.exeC:\Temp\i_omgeywtolj.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wtqoigdywt.exe ups_run3⤵
-
C:\Temp\wtqoigdywt.exeC:\Temp\wtqoigdywt.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wtqoigdywt.exe ups_ins3⤵
-
C:\Temp\i_wtqoigdywt.exeC:\Temp\i_wtqoigdywt.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\lidavtnlfd.exe ups_run3⤵
-
C:\Temp\lidavtnlfd.exeC:\Temp\lidavtnlfd.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_lidavtnlfd.exe ups_ins3⤵
-
C:\Temp\i_lidavtnlfd.exeC:\Temp\i_lidavtnlfd.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ff89e72c188,0x7ff89e72c194,0x7ff89e72c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1872,i,12378707277149371741,14735988965140168453,524288 --field-trial-handle=2488,i,10870214660906988280,12812994079880910331,262144 --variations-seed-version --mojo-platform-channel-handle=2516 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1600,i,2929131670799000491,9784422413968190935,262144 --field-trial-handle=2488,i,10870214660906988280,12812994079880910331,262144 --variations-seed-version --mojo-platform-channel-handle=2484 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2184,i,2333377705306933869,10210459530429159643,524288 --field-trial-handle=2488,i,10870214660906988280,12812994079880910331,262144 --variations-seed-version --mojo-platform-channel-handle=2592 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3620,i,14355394792890352326,10636370686894722567,2097152 --field-trial-handle=2488,i,10870214660906988280,12812994079880910331,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3624,i,15290084586933617556,15975371182146798921,2097152 --field-trial-handle=2488,i,10870214660906988280,12812994079880910331,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4364,i,12823125241035949856,15368456451280003735,2097152 --field-trial-handle=2488,i,10870214660906988280,12812994079880910331,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4376,i,14003688774472290421,9932419020546949852,2097152 --field-trial-handle=2488,i,10870214660906988280,12812994079880910331,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3828,i,7163484808840593894,712939495379006637,2097152 --field-trial-handle=2488,i,10870214660906988280,12812994079880910331,262144 --variations-seed-version --mojo-platform-channel-handle=3804 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5444,i,10341885975682548034,10406743979576341203,524288 --field-trial-handle=2488,i,10870214660906988280,12812994079880910331,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5508,i,12005207689696804916,2303237781406439662,2097152 --field-trial-handle=2488,i,10870214660906988280,12812994079880910331,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5268,i,15069898488021696699,13464894333724282921,524288 --field-trial-handle=2488,i,10870214660906988280,12812994079880910331,262144 --variations-seed-version --mojo-platform-channel-handle=3832 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3784,i,10515404532958166473,4765004967774186762,524288 --field-trial-handle=2488,i,10870214660906988280,12812994079880910331,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6172,i,183259099359780742,12648399588451600914,524288 --field-trial-handle=2488,i,10870214660906988280,12812994079880910331,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6172,i,183259099359780742,12648399588451600914,524288 --field-trial-handle=2488,i,10870214660906988280,12812994079880910331,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5360,i,9251800778705435750,7148188561432153938,524288 --field-trial-handle=2488,i,10870214660906988280,12812994079880910331,262144 --variations-seed-version --mojo-platform-channel-handle=3796 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3776,i,3952821309348512784,7751811540553021605,524288 --field-trial-handle=2488,i,10870214660906988280,12812994079880910331,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6292,i,14056749139053975172,8412243144242048108,524288 --field-trial-handle=2488,i,10870214660906988280,12812994079880910331,262144 --variations-seed-version --mojo-platform-channel-handle=6388 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6384,i,5523186259274463909,13337376953246871369,524288 --field-trial-handle=2488,i,10870214660906988280,12812994079880910331,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6284,i,13790719708730633268,18349164669348804400,2097152 --field-trial-handle=2488,i,10870214660906988280,12812994079880910331,262144 --variations-seed-version --mojo-platform-channel-handle=6604 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5072,i,12952470808514770245,13260601678780878836,524288 --field-trial-handle=2488,i,10870214660906988280,12812994079880910331,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,10827099189271244507,9505963742149227139,524288 --field-trial-handle=2488,i,10870214660906988280,12812994079880910331,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6152,i,14919165635333843844,2567661380054497639,524288 --field-trial-handle=2488,i,10870214660906988280,12812994079880910331,262144 --variations-seed-version --mojo-platform-channel-handle=6844 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=2804,i,4156142821840209780,8979532577707792366,2097152 --field-trial-handle=2488,i,10870214660906988280,12812994079880910331,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5256,i,8998216534404755419,14858586201296386668,524288 --field-trial-handle=2488,i,10870214660906988280,12812994079880910331,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5728,i,5044208773191347886,13813882209379635236,524288 --field-trial-handle=2488,i,10870214660906988280,12812994079880910331,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=924,i,14995545013104266483,16551778820033033297,524288 --field-trial-handle=2488,i,10870214660906988280,12812994079880910331,262144 --variations-seed-version --mojo-platform-channel-handle=6700 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=6700,i,3154375279007105452,11450838430632095462,2097152 --field-trial-handle=2488,i,10870214660906988280,12812994079880910331,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,13793366291586949010,16499925179895172166,524288 --field-trial-handle=2488,i,10870214660906988280,12812994079880910331,262144 --variations-seed-version --mojo-platform-channel-handle=6644 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6716,i,2343402123099919935,4571171656840435672,262144 --field-trial-handle=2488,i,10870214660906988280,12812994079880910331,262144 --variations-seed-version --mojo-platform-channel-handle=744 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3584,i,14405942525475794129,7630973168356467483,524288 --field-trial-handle=2488,i,10870214660906988280,12812994079880910331,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\bwtomgeywrojgbzt.sysC:\Temp\bwtomgeywrojgbzt.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Temp\daytqoigyt.sysC:\Temp\daytqoigyt.sys1⤵
- Executes dropped EXE
-
C:\Temp\ayvqnigays.sysC:\Temp\ayvqnigays.sys1⤵
- Executes dropped EXE
-
C:\Temp\ysqkifdxvp.sysC:\Temp\ysqkifdxvp.sys1⤵
- Executes dropped EXE
-
C:\Temp\hfaxsqkica.sysC:\Temp\hfaxsqkica.sys1⤵
- Executes dropped EXE
-
C:\Temp\fcaurpmhfc.sysC:\Temp\fcaurpmhfc.sys1⤵
- Executes dropped EXE
-
C:\Temp\rpjhczxrpk.sysC:\Temp\rpjhczxrpk.sys1⤵
- Executes dropped EXE
-
C:\Temp\hbzurmkecw.sysC:\Temp\hbzurmkecw.sys1⤵
- Executes dropped EXE
-
C:\Temp\geywurljdb.sysC:\Temp\geywurljdb.sys1⤵
- Executes dropped EXE
-
C:\Temp\oiytqoigby.sysC:\Temp\oiytqoigby.sys1⤵
- Executes dropped EXE
-
C:\Temp\dbytqoigdb.sysC:\Temp\dbytqoigdb.sys1⤵
- Executes dropped EXE
-
C:\Temp\ligaysqkig.sysC:\Temp\ligaysqkig.sys1⤵
-
C:\Temp\kicavsnkic.sysC:\Temp\kicavsnkic.sys1⤵
-
C:\Temp\nkfcxuspki.sysC:\Temp\nkfcxuspki.sys1⤵
-
C:\Temp\pkhczxspkh.sysC:\Temp\pkhczxspkh.sys1⤵
-
C:\Temp\mjhfzwurpj.sysC:\Temp\mjhfzwurpj.sys1⤵
-
C:\Temp\mgeywrojhb.sysC:\Temp\mgeywrojhb.sys1⤵
-
C:\Temp\ztrljebztr.sysC:\Temp\ztrljebztr.sys1⤵
-
C:\Temp\vtrligeywq.sysC:\Temp\vtrligeywq.sys1⤵
-
C:\Temp\igaysqliga.sysC:\Temp\igaysqliga.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
avsnlfdxvp.exe
ayvqnigays.sys
bwtomgeywrojgbzt.exe
bwtomgeywrojgbzt.sys
daytqoigyt.sys
eywqojdbzq.exe
fdxvpnhfzx.exe
hfaxsqkica.sys
i_avsnlfdxvp.exe
i_eywqojdbzq.exe
i_fdxvpnhfzx.exe
i_qnlfdavqnl.exe
i_ywqoigbysq.exe
qnlfdavqnl.exe
ysqkifdxvp.sys
ywqoigbysq.exe
2f1f9852-a101-4a8a-9e9b-23f320ebe533.tmp
68da5968-4f40-4ad1-afb8-9305d9e95f38.tmp
6b371403-92e9-4842-a1ad-f68a8fe57e13.tmp
920f56f4-baae-49dc-8e56-55892bac281e.tmp
98d301e0-a936-414d-bf20-f892ae83216b.tmp
settings.dat
settings.dat
565cb9b9-531e-4cb8-a84f-81fc5d11981f.tmp
94ff659c-4aa0-48d5-b92d-55ea9d946be2.tmp
9748f02b-1866-4ebe-a43a-47a93686ee1f.tmp
temp-index
the-real-index
add31a7f-60cb-4acf-b04f-7d5bf6a1850e.tmp
dasherSettingSchema.json
175ae9ff-5b49-41da-8a46-ad84a131f454.tmp
30306da5-f0bc-482d-970b-64257980ed6a.tmp
b7bebe89-2ef3-4dd4-8fb9-aaee2cecf05a.tmp
bdca2a9f-4e53-4cee-8237-12c467970dcf.tmp
e514bf3d-d7a4-40e4-b9fa-0c62f97af834.tmp
c745899b-88c8-4716-9a6c-aace2d00da50.tmp
c9c5c83b-6951-487f-a78f-a73832bcba53.tmp
0d0e208d-195b-4620-94cc-cb058e6aa014.tmp
7ccc28cb-d63f-4c45-b0c8-6f8ce53ee3ed.tmp
metadata.json
3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
6614ebfb-4c5d-4a2e-a2c0-5662a3fe5d46.tmp
metadata.json
6b61ab8e-d4ee-4ebe-96a5-9715b4ee08be.tmp
e7351bbf-b8c6-4f82-963a-91e1a2b5420f.tmp
content.js
messages.json
manifest.json
manifest.json
manifest.json
manifest.json
CreateProcess.exe
memory/600-535-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/708-735-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1224-713-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1524-635-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1652-621-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1968-691-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2128-66-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2800-579-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3276-675-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3544-655-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3884-434-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4400-483-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4420-523-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4536-687-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4828-555-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4856-575-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5396-511-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5668-717-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5744-609-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5820-559-0x0000000000010000-0x00000000000AB000-memory.dmp