Analysis
- max time kernel
149s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
01/11/2026, 04:47
General
- Target 2026-10-30_29231d0c9a943d4b33247ed614802413_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
- Size 365KB
- Sample261101-fezcvsh17q
- SHA256 643a5824ca7862b84e7147ec17544b5bfbecb5629f8bf84d374bca00dda41195
Score
10/10
Malware Config
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-30_29231d0c9a943d4b33247ed614802413_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-30_29231d0c9a943d4b33247ed614802413_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\zurmkecwuomhezxr.exeC:\Temp\zurmkecwuomhezxr.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\czusmkhczx.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\czusmkhczx.exeC:\Temp\czusmkhczx.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_czusmkhczx.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_czusmkhczx.exeC:\Temp\i_czusmkhczx.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mjecwuomge.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\mjecwuomge.exeC:\Temp\mjecwuomge.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mjecwuomge.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_mjecwuomge.exeC:\Temp\i_mjecwuomge.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\omgbztrljd.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\omgbztrljd.exeC:\Temp\omgbztrljd.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_omgbztrljd.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_omgbztrljd.exeC:\Temp\i_omgbztrljd.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\lgeywqoiga.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\lgeywqoiga.exeC:\Temp\lgeywqoiga.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_lgeywqoiga.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_lgeywqoiga.exeC:\Temp\i_lgeywqoiga.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qlidbvtolf.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\qlidbvtolf.exeC:\Temp\qlidbvtolf.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qlidbvtolf.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_qlidbvtolf.exeC:\Temp\i_qlidbvtolf.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\davsnlfdxv.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\davsnlfdxv.exeC:\Temp\davsnlfdxv.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_davsnlfdxv.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_davsnlfdxv.exeC:\Temp\i_davsnlfdxv.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nifaxsqkic.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\nifaxsqkic.exeC:\Temp\nifaxsqkic.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nifaxsqkic.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_nifaxsqkic.exeC:\Temp\i_nifaxsqkic.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pfzxrpkhcz.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\pfzxrpkhcz.exeC:\Temp\pfzxrpkhcz.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pfzxrpkhcz.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_pfzxrpkhcz.exeC:\Temp\i_pfzxrpkhcz.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\smkecwupmk.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\smkecwupmk.exeC:\Temp\smkecwupmk.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_smkecwupmk.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_smkecwupmk.exeC:\Temp\i_smkecwupmk.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jhbzxrpjhb.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\jhbzxrpjhb.exeC:\Temp\jhbzxrpjhb.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jhbzxrpjhb.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_jhbzxrpjhb.exeC:\Temp\i_jhbzxrpjhb.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ebwtomgeyw.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ebwtomgeyw.exeC:\Temp\ebwtomgeyw.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ebwtomgeyw.exe ups_ins3⤵
-
C:\Temp\i_ebwtomgeyw.exeC:\Temp\i_ebwtomgeyw.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jdbzwrojyt.exe ups_run3⤵
-
C:\Temp\jdbzwrojyt.exeC:\Temp\jdbzwrojyt.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jdbzwrojyt.exe ups_ins3⤵
-
C:\Temp\i_jdbzwrojyt.exeC:\Temp\i_jdbzwrojyt.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\oigbytqoig.exe ups_run3⤵
-
C:\Temp\oigbytqoig.exeC:\Temp\oigbytqoig.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_oigbytqoig.exe ups_ins3⤵
-
C:\Temp\i_oigbytqoig.exeC:\Temp\i_oigbytqoig.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\tnlfdxvqnl.exe ups_run3⤵
-
C:\Temp\tnlfdxvqnl.exeC:\Temp\tnlfdxvqnl.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_tnlfdxvqnl.exe ups_ins3⤵
-
C:\Temp\i_tnlfdxvqnl.exeC:\Temp\i_tnlfdxvqnl.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fdxvpnkfda.exe ups_run3⤵
-
C:\Temp\fdxvpnkfda.exeC:\Temp\fdxvpnkfda.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fdxvpnkfda.exe ups_ins3⤵
-
C:\Temp\i_fdxvpnkfda.exeC:\Temp\i_fdxvpnkfda.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pnifaxsqki.exe ups_run3⤵
-
C:\Temp\pnifaxsqki.exeC:\Temp\pnifaxsqki.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pnifaxsqki.exe ups_ins3⤵
-
C:\Temp\i_pnifaxsqki.exeC:\Temp\i_pnifaxsqki.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mkfcxuspkh.exe ups_run3⤵
-
C:\Temp\mkfcxuspkh.exeC:\Temp\mkfcxuspkh.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mkfcxuspkh.exe ups_ins3⤵
-
C:\Temp\i_mkfcxuspkh.exeC:\Temp\i_mkfcxuspkh.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jhezxrpjhf.exe ups_run3⤵
-
C:\Temp\jhezxrpjhf.exeC:\Temp\jhezxrpjhf.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jhezxrpjhf.exe ups_ins3⤵
-
C:\Temp\i_jhezxrpjhf.exeC:\Temp\i_jhezxrpjhf.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ljhbztrmje.exe ups_run3⤵
-
C:\Temp\ljhbztrmje.exeC:\Temp\ljhbztrmje.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ljhbztrmje.exe ups_ins3⤵
-
C:\Temp\i_ljhbztrmje.exeC:\Temp\i_ljhbztrmje.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\eywtomgeyw.exe ups_run3⤵
-
C:\Temp\eywtomgeyw.exeC:\Temp\eywtomgeyw.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f4,0x2f8,0x2fc,0x2f0,0x398,0x7ffd06e3c188,0x7ffd06e3c194,0x7ffd06e3c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,15734106334995708789,5464358266308651153,262144 --field-trial-handle=1860,i,7555886312981132977,11141155343381787616,262144 --variations-seed-version --mojo-platform-channel-handle=1892 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1944,i,9317995608864622838,14553953238373604422,524288 --field-trial-handle=1860,i,7555886312981132977,11141155343381787616,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2496,i,14949705263947637899,12002989367972801728,524288 --field-trial-handle=1860,i,7555886312981132977,11141155343381787616,262144 --variations-seed-version --mojo-platform-channel-handle=3220 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3540,i,4157822035341381499,2784241221586079226,2097152 --field-trial-handle=1860,i,7555886312981132977,11141155343381787616,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3544,i,8431636501228459123,11864144893887341202,2097152 --field-trial-handle=1860,i,7555886312981132977,11141155343381787616,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4292,i,12852310371756147889,10693346881007398381,2097152 --field-trial-handle=1860,i,7555886312981132977,11141155343381787616,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4316,i,18369570142985622582,3801612671465333883,2097152 --field-trial-handle=1860,i,7555886312981132977,11141155343381787616,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5296,i,7693157888633620901,10973520311810820909,524288 --field-trial-handle=1860,i,7555886312981132977,11141155343381787616,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5356,i,10774237250096603082,368764813563308264,2097152 --field-trial-handle=1860,i,7555886312981132977,11141155343381787616,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5092,i,5709685530171943370,1455608724821760465,524288 --field-trial-handle=1860,i,7555886312981132977,11141155343381787616,262144 --variations-seed-version --mojo-platform-channel-handle=3768 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3660,i,13822594492155949575,10750857786893732663,524288 --field-trial-handle=1860,i,7555886312981132977,11141155343381787616,262144 --variations-seed-version --mojo-platform-channel-handle=3828 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6084,i,12414741507715245726,13520198174485789495,524288 --field-trial-handle=1860,i,7555886312981132977,11141155343381787616,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6084,i,12414741507715245726,13520198174485789495,524288 --field-trial-handle=1860,i,7555886312981132977,11141155343381787616,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,12388339929351053609,16791903050958095712,524288 --field-trial-handle=1860,i,7555886312981132977,11141155343381787616,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6476,i,16987500881532296286,4206349036041331695,524288 --field-trial-handle=1860,i,7555886312981132977,11141155343381787616,262144 --variations-seed-version --mojo-platform-channel-handle=6468 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6624,i,5616502987606923013,11022592469925606809,2097152 --field-trial-handle=1860,i,7555886312981132977,11141155343381787616,262144 --variations-seed-version --mojo-platform-channel-handle=6640 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6844,i,6732265788115192459,2587247407206514387,524288 --field-trial-handle=1860,i,7555886312981132977,11141155343381787616,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6964,i,6816586572546647726,630913865284788598,524288 --field-trial-handle=1860,i,7555886312981132977,11141155343381787616,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6372,i,10513442006710570490,14918429490226725095,2097152 --field-trial-handle=1860,i,7555886312981132977,11141155343381787616,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4372,i,5958756859393967049,15262051635008710486,524288 --field-trial-handle=1860,i,7555886312981132977,11141155343381787616,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4328,i,7154646618232556238,1423682894329212660,524288 --field-trial-handle=1860,i,7555886312981132977,11141155343381787616,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4340,i,15907685924330733718,996563904155985030,524288 --field-trial-handle=1860,i,7555886312981132977,11141155343381787616,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=3676,i,6749916726745175324,8200088515023667601,2097152 --field-trial-handle=1860,i,7555886312981132977,11141155343381787616,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5380,i,14614101065545146292,13127961892432946118,524288 --field-trial-handle=1860,i,7555886312981132977,11141155343381787616,262144 --variations-seed-version --mojo-platform-channel-handle=6688 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,2589105856390247019,8817639354579948792,524288 --field-trial-handle=1860,i,7555886312981132977,11141155343381787616,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6180,i,1987599012445949420,14530906335221001483,524288 --field-trial-handle=1860,i,7555886312981132977,11141155343381787616,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7088,i,2644087664324973941,11839436954938455282,524288 --field-trial-handle=1860,i,7555886312981132977,11141155343381787616,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=5516,i,13910317610875423804,8828503733039879921,2097152 --field-trial-handle=1860,i,7555886312981132977,11141155343381787616,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5352,i,7451302542041044739,2698037506079079068,262144 --field-trial-handle=1860,i,7555886312981132977,11141155343381787616,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5684,i,15954360130484860118,3049060227084150359,524288 --field-trial-handle=1860,i,7555886312981132977,11141155343381787616,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\zurmkecwuomhezxr.sysC:\Temp\zurmkecwuomhezxr.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Temp\pmjecwuomg.sysC:\Temp\pmjecwuomg.sys1⤵
- Executes dropped EXE
-
C:\Temp\toljgeywro.sysC:\Temp\toljgeywro.sys1⤵
- Executes dropped EXE
-
C:\Temp\romgeywqoj.sysC:\Temp\romgeywqoj.sys1⤵
- Executes dropped EXE
-
C:\Temp\nigaytqlig.sysC:\Temp\nigaytqlig.sys1⤵
- Executes dropped EXE
-
C:\Temp\dayvqnifay.sysC:\Temp\dayvqnifay.sys1⤵
- Executes dropped EXE
-
C:\Temp\cankfdxvpn.sysC:\Temp\cankfdxvpn.sys1⤵
- Executes dropped EXE
-
C:\Temp\mkicaxspnh.sysC:\Temp\mkicaxspnh.sys1⤵
- Executes dropped EXE
-
C:\Temp\rpkhcaurpk.sysC:\Temp\rpkhcaurpk.sys1⤵
- Executes dropped EXE
-
C:\Temp\mhezwurmkh.sysC:\Temp\mhezwurmkh.sys1⤵
- Executes dropped EXE
-
C:\Temp\omhezwjgbz.sysC:\Temp\omhezwjgbz.sys1⤵
- Executes dropped EXE
-
C:\Temp\jdbwtomgeb.sysC:\Temp\jdbwtomgeb.sys1⤵
-
C:\Temp\oigeywtnlj.sysC:\Temp\oigeywtnlj.sys1⤵
-
C:\Temp\qoigaysqli.sysC:\Temp\qoigaysqli.sys1⤵
-
C:\Temp\ifdxvtqkif.sysC:\Temp\ifdxvtqkif.sys1⤵
-
C:\Temp\usnkfcxvsn.sysC:\Temp\usnkfcxvsn.sys1⤵
-
C:\Temp\pnhfzxspnh.sysC:\Temp\pnhfzxspnh.sys1⤵
-
C:\Temp\kecwurpjhf.sysC:\Temp\kecwurpjhf.sys1⤵
-
C:\Temp\wuomhezxrp.sysC:\Temp\wuomhezxrp.sys1⤵
-
C:\Temp\bywuomjebz.sysC:\Temp\bywuomjebz.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
czusmkhczx.exe
dayvqnifay.sys
i_czusmkhczx.exe
i_lgeywqoiga.exe
i_mjecwuomge.exe
i_omgbztrljd.exe
i_qlidbvtolf.exe
lgeywqoiga.exe
mjecwuomge.exe
nigaytqlig.sys
omgbztrljd.exe
pmjecwuomg.sys
qlidbvtolf.exe
romgeywqoj.sys
toljgeywro.sys
zurmkecwuomhezxr.exe
zurmkecwuomhezxr.sys
318096b0-88ba-4477-84d7-994553cf245e.tmp
46cef745-4024-45e3-b2c0-eef4c965b68a.tmp
598a5b20-3a5f-4681-a3ec-e72eb460774a.tmp
5e3bf508-8da9-46fc-8658-2fe6e44ce000.tmp
5f0b8a01-6270-4c8e-9c32-ca280a8cb08f.tmp
ec804ed3-48e2-4811-9c04-013a92f1d5e8.tmp
settings.dat
settings.dat
18df04f5-a3ea-44c9-bb76-4f0eb7870b0a.tmp
7485aa27-f4dd-4c0e-a810-01000bb78097.tmp
temp-index
the-real-index
4c705b7e-05ec-42ce-89ef-133a67d27efc.tmp
dasherSettingSchema.json
470d0d95-d1fe-45c0-801c-f85cefab5afb.tmp
Network Persistent State
a244b872-a565-473e-aeb4-15c76e352bc9.tmp
sync_diagnostic.log
c29d6233-8dc5-44fd-b4e6-0a8e84488963.tmp
cc50fcd1-befe-4820-ad83-1b62f7243bbe.tmp
dcb983e1-1faa-46fb-aae0-7707caea0f90.tmp
edbb7d54-c2ae-4a29-baec-07d4af47ab71.tmp
250c844e-d1f9-4fc2-90ea-9a27560a14da.tmp
OperationConfig
b362cc98-761a-41a3-9672-54fbb185cdfd.tmp
14bc7bb3-ec19-446a-9964-93c04a5f107b.tmp
16671476-1a9a-4840-a12a-23aa7dc5ed89.tmp
a38f9ed2-eec7-4076-b923-509137c504e4.tmp
de6da0c0-b11c-4428-b5a4-4209d9677bc7.tmp
3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
6d50925e-69e4-4f49-aeda-4c096cc52609.tmp
c964c271-260a-41a5-a573-ee10b0e3dc80.tmp
40c806a1-d541-44ee-bf6c-39c964769a85.tmp
67f991d1-76de-45f9-9b71-f49d389e16f7.tmp
messages.json
content.js
manifest.json
manifest.json
manifest.json
manifest.json
CreateProcess.exe
memory/952-678-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1044-703-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1440-538-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1672-582-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1880-578-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2312-654-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2740-558-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2768-513-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2768-531-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2900-640-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2980-722-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3500-64-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4104-436-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4532-612-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4752-698-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5292-485-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5368-666-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5500-562-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/6008-525-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/6012-746-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/6128-742-0x0000000000010000-0x00000000000AB000-memory.dmp