Analysis
- max time kernel
150s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
31/10/2026, 20:03
General
- Target 2026-10-30_c5a4cc8a26e2009a060d99b5e9611bf5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
- Size 381KB
- Sample261031-ysnsdszvcs
- SHA256 2f90b8fc1c2cad4d80ea242033747e8b807114732202908881c24bdead554827
Score
10/10
Malware Config
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
- Suspicious use of AdjustPrivilegeToken 20 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-30_c5a4cc8a26e2009a060d99b5e9611bf5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-30_c5a4cc8a26e2009a060d99b5e9611bf5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\dbvtnlfdbvtnlidb.exeC:\Temp\dbvtnlfdbvtnlidb.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\lgdytnlgbw.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\lgdytnlgbw.exeC:\Temp\lgdytnlgbw.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_lgdytnlgbw.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_lgdytnlgbw.exeC:\Temp\i_lgdytnlgbw.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\aysqlfdxvp.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\aysqlfdxvp.exeC:\Temp\aysqlfdxvp.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_aysqlfdxvp.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_aysqlfdxvp.exeC:\Temp\i_aysqlfdxvp.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vpnkfdxvpn.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\vpnkfdxvpn.exeC:\Temp\vpnkfdxvpn.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vpnkfdxvpn.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_vpnkfdxvpn.exeC:\Temp\i_vpnkfdxvpn.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zurpnkfcwu.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\zurpnkfcwu.exeC:\Temp\zurpnkfcwu.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zurpnkfcwu.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_zurpnkfcwu.exeC:\Temp\i_zurpnkfcwu.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fcwrmkeczx.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\fcwrmkeczx.exeC:\Temp\fcwrmkeczx.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fcwrmkeczx.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_fcwrmkeczx.exeC:\Temp\i_fcwrmkeczx.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pjecwurmke.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\pjecwurmke.exeC:\Temp\pjecwurmke.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pjecwurmke.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_pjecwurmke.exeC:\Temp\i_pjecwurmke.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\omgebztrlj.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\omgebztrlj.exeC:\Temp\omgebztrlj.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_omgebztrlj.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_omgebztrlj.exeC:\Temp\i_omgebztrlj.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qljdbvtroi.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\qljdbvtroi.exeC:\Temp\qljdbvtroi.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qljdbvtroi.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_qljdbvtroi.exeC:\Temp\i_qljdbvtroi.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vtqljdbvtn.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\vtqljdbvtn.exeC:\Temp\vtqljdbvtn.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vtqljdbvtn.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_vtqljdbvtn.exeC:\Temp\i_vtqljdbvtn.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qnlfdyvqni.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\qnlfdyvqni.exeC:\Temp\qnlfdyvqni.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qnlfdyvqni.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_qnlfdyvqni.exeC:\Temp\i_qnlfdyvqni.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vsnkfdxvpn.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\vsnkfdxvpn.exeC:\Temp\vsnkfdxvpn.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vsnkfdxvpn.exe ups_ins3⤵
-
C:\Temp\i_vsnkfdxvpn.exeC:\Temp\i_vsnkfdxvpn.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fzxvpnhfcx.exe ups_run3⤵
-
C:\Temp\fzxvpnhfcx.exeC:\Temp\fzxvpnhfcx.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fzxvpnhfcx.exe ups_ins3⤵
-
C:\Temp\i_fzxvpnhfcx.exeC:\Temp\i_fzxvpnhfcx.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pjhczusmke.exe ups_run3⤵
-
C:\Temp\pjhczusmke.exeC:\Temp\pjhczusmke.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pjhczusmke.exe ups_ins3⤵
-
C:\Temp\i_pjhczusmke.exeC:\Temp\i_pjhczusmke.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pjhczusmke.exe ups_run3⤵
-
C:\Temp\pjhczusmke.exeC:\Temp\pjhczusmke.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pjhczusmke.exe ups_ins3⤵
-
C:\Temp\i_pjhczusmke.exeC:\Temp\i_pjhczusmke.exe ups_ins4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mjebztrlje.exe ups_run3⤵
-
C:\Temp\mjebztrlje.exeC:\Temp\mjebztrlje.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mjebztrlje.exe ups_ins3⤵
-
C:\Temp\i_mjebztrlje.exeC:\Temp\i_mjebztrlje.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\tqojgbztrl.exe ups_run3⤵
-
C:\Temp\tqojgbztrl.exeC:\Temp\tqojgbztrl.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_tqojgbztrl.exe ups_ins3⤵
-
C:\Temp\i_tqojgbztrl.exeC:\Temp\i_tqojgbztrl.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\dywqoigayt.exe ups_run3⤵
-
C:\Temp\dywqoigayt.exeC:\Temp\dywqoigayt.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_dywqoigayt.exe ups_ins3⤵
-
C:\Temp\i_dywqoigayt.exeC:\Temp\i_dywqoigayt.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\sqnlfdaytq.exe ups_run3⤵
-
C:\Temp\sqnlfdaytq.exeC:\Temp\sqnlfdaytq.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_sqnlfdaytq.exe ups_ins3⤵
-
C:\Temp\i_sqnlfdaytq.exeC:\Temp\i_sqnlfdaytq.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xvsnkidavs.exe ups_run3⤵
-
C:\Temp\xvsnkidavs.exeC:\Temp\xvsnkidavs.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xvsnkidavs.exe ups_ins3⤵
-
C:\Temp\i_xvsnkidavs.exeC:\Temp\i_xvsnkidavs.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pnifaxvkfc.exe ups_run3⤵
-
C:\Temp\pnifaxvkfc.exeC:\Temp\pnifaxvkfc.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pnifaxvkfc.exe ups_ins3⤵
-
C:\Temp\i_pnifaxvkfc.exeC:\Temp\i_pnifaxvkfc.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7fff2c51c188,0x7fff2c51c194,0x7fff2c51c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1824,i,17907111706239720410,10195706977541191403,524288 --field-trial-handle=2220,i,2110889626633907517,12991679490768717595,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1592,i,5449612805887256327,3399436650398645869,262144 --field-trial-handle=2220,i,2110889626633907517,12991679490768717595,262144 --variations-seed-version --mojo-platform-channel-handle=2216 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2548,i,16223301225776825952,9330650260741143843,524288 --field-trial-handle=2220,i,2110889626633907517,12991679490768717595,262144 --variations-seed-version --mojo-platform-channel-handle=3048 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3544,i,11741376772343299124,1546148009165414436,2097152 --field-trial-handle=2220,i,2110889626633907517,12991679490768717595,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3548,i,5073311836284820841,8900411092658877028,2097152 --field-trial-handle=2220,i,2110889626633907517,12991679490768717595,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4216,i,3529659931401676271,10919240157989285348,2097152 --field-trial-handle=2220,i,2110889626633907517,12991679490768717595,262144 --variations-seed-version --mojo-platform-channel-handle=4800 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4288,i,14685783038535800722,12908905887514866146,2097152 --field-trial-handle=2220,i,2110889626633907517,12991679490768717595,262144 --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3756,i,3698455329100455509,17778501337258439441,524288 --field-trial-handle=2220,i,2110889626633907517,12991679490768717595,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5268,i,2975950139312538678,10369558808689634596,2097152 --field-trial-handle=2220,i,2110889626633907517,12991679490768717595,262144 --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3688,i,16128149564864819093,15992336443292590995,2097152 --field-trial-handle=2220,i,2110889626633907517,12991679490768717595,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3508,i,13555022236183462373,12020952889454275629,524288 --field-trial-handle=2220,i,2110889626633907517,12991679490768717595,262144 --variations-seed-version --mojo-platform-channel-handle=3832 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3568,i,7913510980610927123,8327829813914903816,524288 --field-trial-handle=2220,i,2110889626633907517,12991679490768717595,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6232,i,15851039717279362734,1991749494732421876,524288 --field-trial-handle=2220,i,2110889626633907517,12991679490768717595,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6232,i,15851039717279362734,1991749494732421876,524288 --field-trial-handle=2220,i,2110889626633907517,12991679490768717595,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,14902473081697962069,1330390088008785212,524288 --field-trial-handle=2220,i,2110889626633907517,12991679490768717595,262144 --variations-seed-version --mojo-platform-channel-handle=6468 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6628,i,2757648933841176316,2432989381474074172,524288 --field-trial-handle=2220,i,2110889626633907517,12991679490768717595,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6956,i,8853207971902968349,16532446945345664222,524288 --field-trial-handle=2220,i,2110889626633907517,12991679490768717595,262144 --variations-seed-version --mojo-platform-channel-handle=6960 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6492,i,3624688193804893838,3888860902772607292,524288 --field-trial-handle=2220,i,2110889626633907517,12991679490768717595,262144 --variations-seed-version --mojo-platform-channel-handle=6624 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4400,i,5815752640941844940,893863426752176212,524288 --field-trial-handle=2220,i,2110889626633907517,12991679490768717595,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4864,i,1868534478107634235,8779913582939592630,524288 --field-trial-handle=2220,i,2110889626633907517,12991679490768717595,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4832,i,17573726661758328468,5152005298065026466,524288 --field-trial-handle=2220,i,2110889626633907517,12991679490768717595,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2936,i,8356707656580430014,13436745205628961742,524288 --field-trial-handle=2220,i,2110889626633907517,12991679490768717595,262144 --variations-seed-version --mojo-platform-channel-handle=2520 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5776,i,7910626326289554952,16739323109597473849,524288 --field-trial-handle=2220,i,2110889626633907517,12991679490768717595,262144 --variations-seed-version --mojo-platform-channel-handle=3748 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6476,i,12311946544365660350,7416019083852942552,524288 --field-trial-handle=2220,i,2110889626633907517,12991679490768717595,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=924,i,2105070625264309488,12339625760761522262,524288 --field-trial-handle=2220,i,2110889626633907517,12991679490768717595,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3812,i,2676715149460375639,3298915388487134567,524288 --field-trial-handle=2220,i,2110889626633907517,12991679490768717595,262144 --variations-seed-version --mojo-platform-channel-handle=3820 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5660,i,2646966287796184151,5011107083632183829,262144 --field-trial-handle=2220,i,2110889626633907517,12991679490768717595,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3800,i,3964676278842702028,4519542780082432030,524288 --field-trial-handle=2220,i,2110889626633907517,12991679490768717595,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6212,i,11675116941655091197,8600667027751902129,524288 --field-trial-handle=2220,i,2110889626633907517,12991679490768717595,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\dbvtnlfdbvtnlidb.sysC:\Temp\dbvtnlfdbvtnlidb.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Temp\avsqkidavs.sysC:\Temp\avsqkidavs.sys1⤵
- Executes dropped EXE
-
C:\Temp\vsnkfcxvpn.sysC:\Temp\vsnkfcxvpn.sys1⤵
- Executes dropped EXE
-
C:\Temp\zxspnkfcax.sysC:\Temp\zxspnkfcax.sys1⤵
- Executes dropped EXE
-
C:\Temp\hczxrpmhfz.sysC:\Temp\hczxrpmhfz.sys1⤵
- Executes dropped EXE
-
C:\Temp\hecwuomhec.sysC:\Temp\hecwuomhec.sys1⤵
- Executes dropped EXE
-
C:\Temp\jgeywurmjg.sysC:\Temp\jgeywurmjg.sys1⤵
- Executes dropped EXE
-
C:\Temp\geywrojgby.sysC:\Temp\geywrojgby.sys1⤵
- Executes dropped EXE
-
C:\Temp\ywtnlgdbyt.sysC:\Temp\ywtnlgdbyt.sys1⤵
- Executes dropped EXE
-
C:\Temp\vqnigaysql.sysC:\Temp\vqnigaysql.sys1⤵
- Executes dropped EXE
-
C:\Temp\pnlfdayspn.sysC:\Temp\pnlfdayspn.sys1⤵
- Executes dropped EXE
-
C:\Temp\kicausmkfd.sysC:\Temp\kicausmkfd.sys1⤵
-
C:\Temp\pkhfcxusmk.sysC:\Temp\pkhfcxusmk.sys1⤵
-
C:\Temp\mkeczusmke.sysC:\Temp\mkeczusmke.sys1⤵
-
C:\Temp\pjhbztrlje.sysC:\Temp\pjhbztrlje.sys1⤵
-
C:\Temp\zwromgebzt.sysC:\Temp\zwromgebzt.sys1⤵
-
C:\Temp\geywqoigey.sysC:\Temp\geywqoigey.sys1⤵
-
C:\Temp\ytqoigayvq.sysC:\Temp\ytqoigayvq.sys1⤵
-
C:\Temp\lfvpnlidav.sysC:\Temp\lfvpnlidav.sys1⤵
-
C:\Temp\snkidavsnk.sysC:\Temp\snkidavsnk.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
avsqkidavs.sys
aysqlfdxvp.exe
dbvtnlfdbvtnlidb.exe
dbvtnlfdbvtnlidb.sys
fcwrmkeczx.exe
hczxrpmhfz.sys
hecwuomhec.sys
i_aysqlfdxvp.exe
i_fcwrmkeczx.exe
i_lgdytnlgbw.exe
i_vpnkfdxvpn.exe
i_zurpnkfcwu.exe
lgdytnlgbw.exe
vpnkfdxvpn.exe
vsnkfcxvpn.sys
zurpnkfcwu.exe
zxspnkfcax.sys
0de39092-ff62-40a6-8c08-7370f3b28ae8.tmp
4ab93ad1-66b6-4b0f-a995-3d9e04c8b25d.tmp
73913c8c-b334-4e38-bf1a-574332f16662.tmp
77305a77-e917-4f04-abb5-94d4015e2cf6.tmp
settings.dat
settings.dat
177d416a-9e2c-45b8-bcce-59a0668c7c35.tmp
3a69c1ed-4818-4706-97a1-79d9bf9f6ce9.tmp
3f19d650-3b76-4cdd-af88-04370b9eb0f1.tmp
5a7d99f2-07fc-4cdb-bd5d-5284c0ce89c6.tmp
7e3280cf-1b05-4e42-9ede-eb831a1dbfeb.tmp
869e2ad2-872b-4dc7-9d49-9bf4d7893b98.tmp
LOG
the-real-index
9b225699-f270-4149-93b5-ce24351884ba.tmp
dasherSettingSchema.json
0ad440d9-55be-4e2d-af84-3f730d5e029f.tmp
7e3ee5d9-05df-41ea-b5ea-68747ce8df5f.tmp
b246241b-3507-41a4-a138-fdffc95e4706.tmp
sync_diagnostic.log
OperationConfig
cf48d50e-d077-4b1b-a5e9-712761c94d45.tmp
a75b179c-1e4c-4149-9b4d-eb43cc5307c0.tmp
064f2161-2427-43b7-8468-ad04f0b97424.tmp
3b946cb4-f1b4-4f14-84a7-769fd1445670.tmp
b55b46ed-0f66-4387-8154-d590cf5a165f.tmp
e18c5c85-230f-4f23-94a1-6f1b8ee75070.tmp
3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
877816c6-617b-484c-a750-117c799c900e.tmp
metadata.json
c9f7a6cb-0800-4dbf-8c75-0c3ea0ff440d.tmp
e8cf131e-2ab2-42f3-8141-36cbb162da9c.tmp
messages.json
content.js
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
CreateProcess.exe
memory/1008-677-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1008-663-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1284-696-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2632-477-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2632-508-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2716-575-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3116-740-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3136-569-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3188-605-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3920-744-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4132-639-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4260-62-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4408-701-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4504-633-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4544-720-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4764-515-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4808-428-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4952-553-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5048-528-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5168-549-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5300-502-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5552-675-0x0000000000010000-0x00000000000AB000-memory.dmp