Analysis
-
max time kernel
1400s -
max time network
1401s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
04-09-2022 09:48
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://grand-theft-auto-vice-city.en.softonic.com/?ex=DINS-162.0
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
https://grand-theft-auto-vice-city.en.softonic.com/?ex=DINS-162.0
Resource
win10v2004-20220812-en
General
-
Target
https://grand-theft-auto-vice-city.en.softonic.com/?ex=DINS-162.0
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Temp\4176_1821953927\us_tv_and_film.txt
Signatures
-
Downloads MZ/PE file
-
Executes dropped EXE 37 IoCs
Processes:
Rockstar-Games-Launcher-Grand_Theft_Auto_V.exegta5_exe-rockstar-games-outbyte-pc-repair.exeInstaller.exevc_redist.x86.exevc_redist.x86.exevc_redist.x64.exevc_redist.x64.exeRockstarService.exeRockstarService.exeRockstarService.exeLauncherPatcher.exeLauncher.exeRockstarService.exeRockstarService.exeRockstarService.exeRockstarService.exeRockstarService.exeRockstarService.exeRockstarService.exeRockstarService.exeRockstarService.exePCRepair.exeRockstarService.exeLauncher.exeRockstarErrorHandler.exeRockstarService.exeRockstarService.exeSocial-Club-Setup.exeSocialClubHelper.exeSocialClubHelper.exeSocialClubHelper.exeSocialClubHelper.exeSocialClubHelper.exeSocialClubHelper.exeSocialClubHelper.exePCRepair.exeRockstarService.exepid process 560 Rockstar-Games-Launcher-Grand_Theft_Auto_V.exe 6692 gta5_exe-rockstar-games-outbyte-pc-repair.exe 1800 Installer.exe 7072 vc_redist.x86.exe 2888 vc_redist.x86.exe 5992 vc_redist.x64.exe 3316 vc_redist.x64.exe 4048 RockstarService.exe 5904 RockstarService.exe 2816 RockstarService.exe 1124 LauncherPatcher.exe 6052 Launcher.exe 6332 RockstarService.exe 6296 RockstarService.exe 6408 RockstarService.exe 2252 RockstarService.exe 1404 RockstarService.exe 3588 RockstarService.exe 3396 RockstarService.exe 2208 RockstarService.exe 4772 RockstarService.exe 2944 PCRepair.exe 1292 RockstarService.exe 6588 Launcher.exe 1996 RockstarErrorHandler.exe 1980 RockstarService.exe 5204 RockstarService.exe 2064 Social-Club-Setup.exe 4900 SocialClubHelper.exe 936 SocialClubHelper.exe 4120 SocialClubHelper.exe 4044 SocialClubHelper.exe 5984 SocialClubHelper.exe 6096 SocialClubHelper.exe 6628 SocialClubHelper.exe 5548 PCRepair.exe 924 RockstarService.exe -
Registers COM server for autorun 1 TTPs 7 IoCs
Processes:
dxdiag.exeregsvr32.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\InprocServer32\ = "C:\\Windows\\SYSTEM32\\dxdiagn.dll" dxdiag.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\InprocServer32\ThreadingModel = "Apartment" dxdiag.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A65B8071-3BFE-4213-9A5B-491DA4461CA7}\InprocServer32 dxdiag.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{93469602-4134-4012-A6BC-E58C2E9A7D28}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{93469602-4134-4012-A6BC-E58C2E9A7D28}\InprocServer32\ = "C:\\PROGRA~2\\Outbyte\\PCREPA~1\\BROWSE~3.DLL" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{93469602-4134-4012-A6BC-E58C2E9A7D28}\InprocServer32\ThreadingModel = "Free" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\InprocServer32 dxdiag.exe -
Checks BIOS information in registry 2 TTPs 3 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
Installer.exePCRepair.exePCRepair.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Installer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion PCRepair.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion PCRepair.exe -
Checks computer location settings 2 TTPs 10 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Installer.exeRockstar-Games-Launcher-Grand_Theft_Auto_V.exeLauncherPatcher.exeLauncher.exeSocialClubHelper.exeSocialClubHelper.exegta5_exe-rockstar-games-outbyte-pc-repair.exeLauncher.exeSocialClubHelper.exeSocialClubHelper.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation Installer.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation Rockstar-Games-Launcher-Grand_Theft_Auto_V.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation LauncherPatcher.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation Launcher.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation SocialClubHelper.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation SocialClubHelper.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation gta5_exe-rockstar-games-outbyte-pc-repair.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation Launcher.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation SocialClubHelper.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation SocialClubHelper.exe -
Loads dropped DLL 64 IoCs
Processes:
gta5_exe-rockstar-games-outbyte-pc-repair.exeInstaller.exevc_redist.x86.exevc_redist.x64.exeregsvr32.exeregsvr32.exePCRepair.exeLauncher.exeSocialClubHelper.exeSocialClubHelper.exeSocialClubHelper.exeSocialClubHelper.exeSocialClubHelper.exeSocialClubHelper.exepid process 6692 gta5_exe-rockstar-games-outbyte-pc-repair.exe 6692 gta5_exe-rockstar-games-outbyte-pc-repair.exe 6692 gta5_exe-rockstar-games-outbyte-pc-repair.exe 6692 gta5_exe-rockstar-games-outbyte-pc-repair.exe 1800 Installer.exe 1800 Installer.exe 1800 Installer.exe 1800 Installer.exe 1800 Installer.exe 1800 Installer.exe 1800 Installer.exe 1800 Installer.exe 1800 Installer.exe 1800 Installer.exe 1800 Installer.exe 1800 Installer.exe 1800 Installer.exe 1800 Installer.exe 1800 Installer.exe 1800 Installer.exe 1800 Installer.exe 1800 Installer.exe 1800 Installer.exe 2888 vc_redist.x86.exe 3316 vc_redist.x64.exe 1800 Installer.exe 1800 Installer.exe 3608 regsvr32.exe 3608 regsvr32.exe 5876 regsvr32.exe 5876 regsvr32.exe 5876 regsvr32.exe 2944 PCRepair.exe 2944 PCRepair.exe 2944 PCRepair.exe 2944 PCRepair.exe 2944 PCRepair.exe 2944 PCRepair.exe 2944 PCRepair.exe 2944 PCRepair.exe 2944 PCRepair.exe 2944 PCRepair.exe 2944 PCRepair.exe 2944 PCRepair.exe 2944 PCRepair.exe 2944 PCRepair.exe 2944 PCRepair.exe 6588 Launcher.exe 6588 Launcher.exe 6588 Launcher.exe 4900 SocialClubHelper.exe 4900 SocialClubHelper.exe 936 SocialClubHelper.exe 936 SocialClubHelper.exe 4120 SocialClubHelper.exe 936 SocialClubHelper.exe 4120 SocialClubHelper.exe 936 SocialClubHelper.exe 936 SocialClubHelper.exe 4044 SocialClubHelper.exe 4044 SocialClubHelper.exe 5984 SocialClubHelper.exe 5984 SocialClubHelper.exe 6096 SocialClubHelper.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
msedge.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run msedge.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 22 IoCs
Processes:
RockstarService.exedxdiag.exedescription ioc process File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\42B9A473B4DAF01285A36B4D3C7B1662_178C086B699FD6C56B804AF3EF759CB5 RockstarService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66AE3BFDF94A732B262342AD2154B86E_1C3770C1FB472ED01DC6B5C78747CAC5 RockstarService.exe File created \??\c:\windows\system32\driverstore\filerepository\input.inf_amd64_adeb6424513f60a2\input.PNF dxdiag.exe File created \??\c:\windows\system32\driverstore\filerepository\keyboard.inf_amd64_5938c699b80ebb8f\keyboard.PNF dxdiag.exe File created \??\c:\windows\system32\driverstore\filerepository\hdaudbus.inf_amd64_533c8d455025cc59\hdaudbus.PNF dxdiag.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\42B9A473B4DAF01285A36B4D3C7B1662_178C086B699FD6C56B804AF3EF759CB5 RockstarService.exe File created C:\Windows\System32\DriverStore\FileRepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF dxdiag.exe File created C:\Windows\System32\DriverStore\FileRepository\usbport.inf_amd64_254cd5ae09de6b08\usbport.PNF dxdiag.exe File created \??\c:\windows\system32\driverstore\filerepository\msmouse.inf_amd64_1793a485b491b199\msmouse.PNF dxdiag.exe File created C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_amd64_0d06b6638bdb4763\mshdc.PNF dxdiag.exe File created C:\Windows\System32\DriverStore\FileRepository\machine.inf_amd64_b748590104fe1c15\machine.PNF dxdiag.exe File created \??\c:\windows\system32\driverstore\filerepository\usbport.inf_amd64_254cd5ae09de6b08\usbport.PNF dxdiag.exe File created C:\Windows\System32\DriverStore\FileRepository\msmouse.inf_amd64_1793a485b491b199\msmouse.PNF dxdiag.exe File created C:\Windows\System32\DriverStore\FileRepository\keyboard.inf_amd64_5938c699b80ebb8f\keyboard.PNF dxdiag.exe File created C:\Windows\System32\DriverStore\FileRepository\hdaudbus.inf_amd64_533c8d455025cc59\hdaudbus.PNF dxdiag.exe File created \??\c:\windows\system32\driverstore\filerepository\netrtl64.inf_amd64_8e9c2368fe308df2\netrtl64.PNF dxdiag.exe File created \??\c:\windows\system32\driverstore\filerepository\mshdc.inf_amd64_0d06b6638bdb4763\mshdc.PNF dxdiag.exe File created \??\c:\windows\system32\driverstore\filerepository\machine.inf_amd64_b748590104fe1c15\machine.PNF dxdiag.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66AE3BFDF94A732B262342AD2154B86E_1C3770C1FB472ED01DC6B5C78747CAC5 RockstarService.exe File created \??\c:\windows\system32\driverstore\filerepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF dxdiag.exe File created C:\Windows\System32\DriverStore\FileRepository\input.inf_amd64_adeb6424513f60a2\input.PNF dxdiag.exe File created C:\Windows\System32\DriverStore\FileRepository\netrtl64.inf_amd64_8e9c2368fe308df2\netrtl64.PNF dxdiag.exe -
Drops file in Program Files directory 64 IoCs
Processes:
Installer.exeSocial-Club-Setup.exeRockstar-Games-Launcher-Grand_Theft_Auto_V.exedescription ioc process File created C:\Program Files (x86)\Outbyte\PC Repair\is-UICCG.tmp Installer.exe File created C:\Program Files (x86)\Outbyte\PC Repair\is-VKLFR.tmp Installer.exe File opened for modification C:\Program Files\Rockstar Games\Social Club\locales\sr.pak Social-Club-Setup.exe File opened for modification C:\Program Files (x86)\Rockstar Games\Social Club\locales\fil.pak Social-Club-Setup.exe File opened for modification C:\Program Files\Rockstar Games\Social Club\libEGL.dll Social-Club-Setup.exe File opened for modification C:\Program Files\Rockstar Games\Social Club\libGLESv2.dll Social-Club-Setup.exe File opened for modification C:\Program Files\Rockstar Games\Social Club\cef.pak Social-Club-Setup.exe File opened for modification C:\Program Files\Rockstar Games\Social Club\locales\ar.pak Social-Club-Setup.exe File opened for modification C:\Program Files (x86)\Rockstar Games\Social Club\locales\id.pak Social-Club-Setup.exe File created C:\Program Files\Rockstar Games\Launcher\Launcher.rpf Rockstar-Games-Launcher-Grand_Theft_Auto_V.exe File created C:\Program Files (x86)\Outbyte\PC Repair\is-F661M.tmp Installer.exe File opened for modification C:\Program Files\Rockstar Games\Social Club\locales\en-US.pak Social-Club-Setup.exe File opened for modification C:\Program Files\Rockstar Games\Social Club\SocialClubHelper.exe Social-Club-Setup.exe File created C:\Program Files\Rockstar Games\Launcher\api-ms-win-crt-string-l1-1-0.dll Rockstar-Games-Launcher-Grand_Theft_Auto_V.exe File created C:\Program Files (x86)\Outbyte\PC Repair\Lang\is-00001.tmp Installer.exe File created C:\Program Files (x86)\Rockstar Games\Social Club\locales\nb.pak Social-Club-Setup.exe File opened for modification C:\Program Files\Rockstar Games\Social Club\SocialClubD3D12Renderer.dll Social-Club-Setup.exe File created C:\Program Files\Rockstar Games\Launcher\api-ms-win-core-heap-l1-1-0.dll Rockstar-Games-Launcher-Grand_Theft_Auto_V.exe File created C:\Program Files (x86)\Outbyte\PC Repair\Data\is-7PK6D.tmp Installer.exe File created C:\Program Files\Rockstar Games\Social Club\locales\uk.pak Social-Club-Setup.exe File opened for modification C:\Program Files (x86)\Rockstar Games\Social Club\chrome_elf.dll Social-Club-Setup.exe File created C:\Program Files\Rockstar Games\Social Club\locales\sv.pak Social-Club-Setup.exe File created C:\Program Files (x86)\Rockstar Games\Social Club\locales\te.pak Social-Club-Setup.exe File created C:\Program Files\Rockstar Games\Social Club\SocialClubVulkanLayer.json Social-Club-Setup.exe File created C:\Program Files (x86)\Rockstar Games\Social Club\locales\es-419.pak Social-Club-Setup.exe File created C:\Program Files (x86)\Rockstar Games\Social Club\locales\nl.pak Social-Club-Setup.exe File created C:\Program Files\Rockstar Games\Launcher\api-ms-win-core-errorhandling-l1-1-0.dll Rockstar-Games-Launcher-Grand_Theft_Auto_V.exe File created C:\Program Files\Rockstar Games\Social Club\locales\kn.pak Social-Club-Setup.exe File created C:\Program Files (x86)\Rockstar Games\Social Club\locales\ja.pak Social-Club-Setup.exe File created C:\Program Files (x86)\Rockstar Games\Social Club\chrome_elf.dll Social-Club-Setup.exe File created C:\Program Files (x86)\Outbyte\PC Repair\is-OP232.tmp Installer.exe File created C:\Program Files (x86)\Outbyte\PC Repair\is-S6R0G.tmp Installer.exe File opened for modification C:\Program Files\Rockstar Games\Social Club\locales\sv.pak Social-Club-Setup.exe File opened for modification C:\Program Files\Rockstar Games\Social Club\SocialClubVulkanLayer.json Social-Club-Setup.exe File opened for modification C:\Program Files (x86)\Rockstar Games\Social Club\locales\el.pak Social-Club-Setup.exe File created C:\Program Files (x86)\Rockstar Games\Social Club\locales\fr.pak Social-Club-Setup.exe File created C:\Program Files (x86)\Rockstar Games\Social Club\locales\kn.pak Social-Club-Setup.exe File created C:\Program Files (x86)\Rockstar Games\Social Club\locales\pl.pak Social-Club-Setup.exe File created C:\Program Files (x86)\Outbyte\PC Repair\is-MV6RJ.tmp Installer.exe File created C:\Program Files (x86)\Outbyte\PC Repair\is-QF46E.tmp Installer.exe File opened for modification C:\Program Files (x86)\Rockstar Games\Social Club\locales\pl.pak Social-Club-Setup.exe File opened for modification C:\Program Files\Rockstar Games\Social Club\locales\gu.pak Social-Club-Setup.exe File created C:\Program Files\Rockstar Games\Launcher\api-ms-win-crt-private-l1-1-0.dll Rockstar-Games-Launcher-Grand_Theft_Auto_V.exe File created C:\Program Files (x86)\Outbyte\PC Repair\Data\is-VUAK1.tmp Installer.exe File opened for modification C:\Program Files\Rockstar Games\Social Club\locales\es.pak Social-Club-Setup.exe File created C:\Program Files (x86)\Rockstar Games\Social Club\locales\ar.pak Social-Club-Setup.exe File created C:\Program Files\Rockstar Games\Social Club\socialclub.dll Social-Club-Setup.exe File created C:\Program Files (x86)\Outbyte\PC Repair\is-UG27A.tmp Installer.exe File created C:\Program Files\Rockstar Games\Social Club\locales\da.pak Social-Club-Setup.exe File created C:\Program Files (x86)\Outbyte\PC Repair\Data\is-LKCJD.tmp Installer.exe File opened for modification C:\Program Files\Rockstar Games\Social Club\locales\ru.pak Social-Club-Setup.exe File created C:\Program Files\Rockstar Games\Social Club\locales\zh-CN.pak Social-Club-Setup.exe File created C:\Program Files (x86)\Rockstar Games\Social Club\locales\ml.pak Social-Club-Setup.exe File created C:\Program Files (x86)\Rockstar Games\Social Club\locales\mr.pak Social-Club-Setup.exe File created C:\Program Files (x86)\Rockstar Games\Social Club\locales\th.pak Social-Club-Setup.exe File created C:\Program Files\Rockstar Games\Launcher\api-ms-win-crt-convert-l1-1-0.dll Rockstar-Games-Launcher-Grand_Theft_Auto_V.exe File created C:\Program Files (x86)\Outbyte\PC Repair\is-LPDQ3.tmp Installer.exe File opened for modification C:\Program Files\Rockstar Games\Social Club\locales\da.pak Social-Club-Setup.exe File opened for modification C:\Program Files (x86)\Rockstar Games\Social Club\locales\ko.pak Social-Club-Setup.exe File created C:\Program Files\Rockstar Games\Social Club\locales\it.pak Social-Club-Setup.exe File created C:\Program Files\Rockstar Games\Social Club\locales\ml.pak Social-Club-Setup.exe File created C:\Program Files (x86)\Rockstar Games\Social Club\locales\zh-CN.pak Social-Club-Setup.exe File opened for modification C:\Program Files\Rockstar Games\Social Club\socialclub.dll Social-Club-Setup.exe File created C:\Program Files\Rockstar Games\Launcher\RockstarSteamHelper.exe Rockstar-Games-Launcher-Grand_Theft_Auto_V.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
dxdiag.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 dxdiag.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID dxdiag.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 dxdiag.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID dxdiag.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\CompatibleIDs dxdiag.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs dxdiag.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
Launcher.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ Launcher.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Launcher.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz Launcher.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
RockstarService.exeRockstarService.exeRockstarService.exeRockstarService.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates RockstarService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs RockstarService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA RockstarService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs RockstarService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs RockstarService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot RockstarService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs RockstarService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople RockstarService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs RockstarService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople RockstarService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates RockstarService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs RockstarService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed RockstarService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root RockstarService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates RockstarService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates RockstarService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs RockstarService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs RockstarService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs RockstarService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust RockstarService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates RockstarService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs RockstarService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA RockstarService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed RockstarService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs RockstarService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs RockstarService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates RockstarService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs RockstarService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs RockstarService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs RockstarService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates RockstarService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates RockstarService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs RockstarService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs RockstarService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates RockstarService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs RockstarService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs RockstarService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs RockstarService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates RockstarService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs RockstarService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs RockstarService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs RockstarService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs RockstarService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs RockstarService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs RockstarService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs RockstarService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates RockstarService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs RockstarService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust RockstarService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates RockstarService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs RockstarService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs RockstarService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs RockstarService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs RockstarService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust RockstarService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs RockstarService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates RockstarService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs RockstarService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root RockstarService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates RockstarService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust RockstarService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates RockstarService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates RockstarService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing RockstarService.exe -
Modifies registry class 64 IoCs
Processes:
regsvr32.exePCRepair.exedxdiag.exeregsvr32.exeRockstarService.exeInstaller.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3A3310BE-83DD-4E80-AC51-242D3A7D7F73}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\pcr\shell\open\command PCRepair.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\ = "DxDiagClassObject Class" dxdiag.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F2C6F7D1-ED32-49E5-9919-69E12C17AF7C}\1.0\ = "BrowserPluginsAgentCOM64" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F2C6F7D1-ED32-49E5-9919-69E12C17AF7C}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\Outbyte\\PC Repair\\" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3CC2E0D5-193C-4192-B8BA-AFEF0AB6A2FD}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3CC2E0D5-193C-4192-B8BA-AFEF0AB6A2FD}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{93469602-4134-4012-A6BC-E58C2E9A7D28}\InprocServer32\ = "C:\\PROGRA~2\\Outbyte\\PCREPA~1\\BROWSE~3.DLL" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\pcr\shell PCRepair.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\VersionIndependentProgID dxdiag.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F2C6F7D1-ED32-49E5-9919-69E12C17AF7C}\1.0\0\win32\ = "C:\\Program Files (x86)\\Outbyte\\PC Repair\\BrowserPluginsHelper.Agent.x64.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3CC2E0D5-193C-4192-B8BA-AFEF0AB6A2FD} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{93469602-4134-4012-A6BC-E58C2E9A7D28}\TypeLib\ = "{F2C6F7D1-ED32-49E5-9919-69E12C17AF7C}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F2C6F7D1-ED32-49E5-9919-FDF6143A53E1}\1.0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A3310BE-83DD-4E80-AC51-242D3A7D7F73}\ = "IBrowserPluginsAgent32" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3CC2E0D5-193C-4192-B8BA-AFEF0AB6A2FD}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{93469602-4134-4012-A6BC-E58C2E9A7D28}\ = "Outbyte BrowserPluginsAgent64" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{93469602-4134-4012-A6BC-E58C2E9A7D28}\Version\ = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{93469602-4134-4012-A6BC-F5ED88675F39}\ProgID\ = "BrowserPluginsAgentCOM32.BrowserPluginsAgent32" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{93469602-4134-4012-A6BC-E58C2E9A7D28}\DllSurrogate regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F2C6F7D1-ED32-49E5-9919-FDF6143A53E1}\1.0\0\win32\ = "C:\\Program Files (x86)\\Outbyte\\PC Repair\\BrowserPluginsHelper.Agent.x32.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{93469602-4134-4012-A6BC-F5ED88675F39}\ = "Outbyte BrowserPluginsAgent32" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\rockstar\shell\open\command RockstarService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider\CurVer\ = "DxDiag.DxDiagClassObject.1" dxdiag.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\rockstar\shell\open RockstarService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\ForceRemove\ = "Programmable" dxdiag.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3CC2E0D5-193C-4192-B8BA-AFEF0AB6A2FD}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3CC2E0D5-193C-4192-B8BA-AFEF0AB6A2FD} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{93469602-4134-4012-A6BC-F5ED88675F39}\Version regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A3310BE-83DD-4E80-AC51-242D3A7D7F73}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\rockstar\shell RockstarService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID Installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject.1\ = "DxDiagClassObject Class" dxdiag.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F2C6F7D1-ED32-49E5-9919-69E12C17AF7C} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{93469602-4134-4012-A6BC-E58C2E9A7D28}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BrowserPluginsAgentCOM64.BrowserPluginsAgent64 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F2C6F7D1-ED32-49E5-9919-FDF6143A53E1} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{93469602-4134-4012-A6BC-F5ED88675F39}\InprocServer32\ThreadingModel = "Free" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{93469602-4134-4012-A6BC-F5ED88675F39}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\rockstar\shell\open\command\ = "\"C:\\Program Files\\Rockstar Games\\Launcher\\Launcher.exe\" \"%1\"" RockstarService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject.1 dxdiag.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider\CLSID dxdiag.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BrowserPluginsAgentCOM32.BrowserPluginsAgent32\Clsid\ = "{93469602-4134-4012-A6BC-F5ED88675F39}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\InprocServer32 dxdiag.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider\ = "DxDiagProvider Class" dxdiag.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3CC2E0D5-193C-4192-B8BA-AFEF0AB6A2FD}\TypeLib\ = "{F2C6F7D1-ED32-49E5-9919-69E12C17AF7C}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A65B8071-3BFE-4213-9A5B-491DA4461CA7}\ProgID dxdiag.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{93469602-4134-4012-A6BC-E58C2E9A7D28} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F2C6F7D1-ED32-49E5-9919-FDF6143A53E1}\1.0\0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3A3310BE-83DD-4E80-AC51-242D3A7D7F73}\ = "IBrowserPluginsAgent32" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\pcr\shell\open PCRepair.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node Installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3A3310BE-83DD-4E80-AC51-242D3A7D7F73}\TypeLib\ = "{F2C6F7D1-ED32-49E5-9919-FDF6143A53E1}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\pcr\shell\open\command\ = "\"C:\\Program Files (x86)\\Outbyte\\PC Repair\\PCRepair.exe\" /uri:\"%1\"" PCRepair.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{93469602-4134-4012-A6BC-F5ED88675F39}\Version\ = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\rockstar\ = "URL:rockstar Protocol" RockstarService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{561338B5-05A6-998D-8416-FE576B60608A}\Version\Assembly = d7b56d343efeb4a0ec6776f919e70ae1d7b56d343efeb4a0ec6776f919e70ae188ad8cbb5ed3f66b83a8a2cdf194269c890bb34aebd806e41a50d3bd9c0b4765219909f09e75dec0927ff4e8152284cd219909f09e75dec0927ff4e8152284cd59b5414605bae21e9735786eb516d3f8de1283c2aff9bf99d33ed2740c86bbd2f8157495fe950fa4a01046bb55f00dad0f20aa1b1adfe602954529934d03147d Installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F2C6F7D1-ED32-49E5-9919-69E12C17AF7C}\1.0\HELPDIR regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{93469602-4134-4012-A6BC-E58C2E9A7D28}\ProgID\ = "BrowserPluginsAgentCOM64.BrowserPluginsAgent64" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F2C6F7D1-ED32-49E5-9919-FDF6143A53E1}\1.0\FLAGS regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F2C6F7D1-ED32-49E5-9919-FDF6143A53E1}\1.0\FLAGS\ = "0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3A3310BE-83DD-4E80-AC51-242D3A7D7F73} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3A3310BE-83DD-4E80-AC51-242D3A7D7F73}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{93469602-4134-4012-A6BC-F5ED88675F39} regsvr32.exe -
Processes:
RockstarService.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 RockstarService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 RockstarService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c000000010000000400000000080000190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa604000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 RockstarService.exe -
NTFS ADS 2 IoCs
Processes:
msedge.exedescription ioc process File opened for modification C:\Users\Admin\Downloads\Unconfirmed 720515.crdownload:SmartScreen msedge.exe File opened for modification C:\Users\Admin\Downloads\Unconfirmed 646887.crdownload:SmartScreen msedge.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exemsedge.exeRockstar-Games-Launcher-Grand_Theft_Auto_V.exeInstaller.exeLauncher.exeRockstarService.exeRockstarService.exepid process 2492 msedge.exe 2492 msedge.exe 4176 msedge.exe 4176 msedge.exe 2988 identity_helper.exe 2988 identity_helper.exe 2212 msedge.exe 2212 msedge.exe 2212 msedge.exe 2212 msedge.exe 1308 msedge.exe 1308 msedge.exe 5204 msedge.exe 5204 msedge.exe 560 Rockstar-Games-Launcher-Grand_Theft_Auto_V.exe 560 Rockstar-Games-Launcher-Grand_Theft_Auto_V.exe 1800 Installer.exe 1800 Installer.exe 6052 Launcher.exe 6052 Launcher.exe 6052 Launcher.exe 6052 Launcher.exe 6052 Launcher.exe 6052 Launcher.exe 6052 Launcher.exe 6052 Launcher.exe 6052 Launcher.exe 6052 Launcher.exe 6052 Launcher.exe 6052 Launcher.exe 6052 Launcher.exe 6052 Launcher.exe 6052 Launcher.exe 6052 Launcher.exe 6052 Launcher.exe 6052 Launcher.exe 6052 Launcher.exe 6052 Launcher.exe 6052 Launcher.exe 6052 Launcher.exe 6296 RockstarService.exe 6296 RockstarService.exe 6296 RockstarService.exe 6296 RockstarService.exe 6296 RockstarService.exe 6296 RockstarService.exe 6052 Launcher.exe 6052 Launcher.exe 6052 Launcher.exe 6052 Launcher.exe 6052 Launcher.exe 6052 Launcher.exe 6052 Launcher.exe 6052 Launcher.exe 4772 RockstarService.exe 4772 RockstarService.exe 4772 RockstarService.exe 4772 RockstarService.exe 6052 Launcher.exe 6052 Launcher.exe 6052 Launcher.exe 6052 Launcher.exe 4772 RockstarService.exe 4772 RockstarService.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Launcher.exepid process 6588 Launcher.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 64 IoCs
Processes:
msedge.exepid process 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe -
Suspicious use of AdjustPrivilegeToken 11 IoCs
Processes:
AUDIODG.EXEPCRepair.exePCRepair.exedescription pid process Token: 33 6736 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 6736 AUDIODG.EXE Token: SeShutdownPrivilege 2944 PCRepair.exe Token: SeCreatePagefilePrivilege 2944 PCRepair.exe Token: SeSecurityPrivilege 2944 PCRepair.exe Token: SeTakeOwnershipPrivilege 2944 PCRepair.exe Token: SeSecurityPrivilege 2944 PCRepair.exe Token: SeTakeOwnershipPrivilege 2944 PCRepair.exe Token: SeShutdownPrivilege 5548 PCRepair.exe Token: SeCreatePagefilePrivilege 5548 PCRepair.exe Token: SeDebugPrivilege 5548 PCRepair.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
msedge.exepid process 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe -
Suspicious use of SendNotifyMessage 12 IoCs
Processes:
msedge.exeLauncher.exeLauncher.exepid process 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 6052 Launcher.exe 6052 Launcher.exe 6588 Launcher.exe 6588 Launcher.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
dxdiag.exepid process 6656 dxdiag.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
cmd.exemsedge.exedescription pid process target process PID 4736 wrote to memory of 4176 4736 cmd.exe msedge.exe PID 4736 wrote to memory of 4176 4736 cmd.exe msedge.exe PID 4176 wrote to memory of 220 4176 msedge.exe msedge.exe PID 4176 wrote to memory of 220 4176 msedge.exe msedge.exe PID 4176 wrote to memory of 4204 4176 msedge.exe msedge.exe PID 4176 wrote to memory of 4204 4176 msedge.exe msedge.exe PID 4176 wrote to memory of 4204 4176 msedge.exe msedge.exe PID 4176 wrote to memory of 4204 4176 msedge.exe msedge.exe PID 4176 wrote to memory of 4204 4176 msedge.exe msedge.exe PID 4176 wrote to memory of 4204 4176 msedge.exe msedge.exe PID 4176 wrote to memory of 4204 4176 msedge.exe msedge.exe PID 4176 wrote to memory of 4204 4176 msedge.exe msedge.exe PID 4176 wrote to memory of 4204 4176 msedge.exe msedge.exe PID 4176 wrote to memory of 4204 4176 msedge.exe msedge.exe PID 4176 wrote to memory of 4204 4176 msedge.exe msedge.exe PID 4176 wrote to memory of 4204 4176 msedge.exe msedge.exe PID 4176 wrote to memory of 4204 4176 msedge.exe msedge.exe PID 4176 wrote to memory of 4204 4176 msedge.exe msedge.exe PID 4176 wrote to memory of 4204 4176 msedge.exe msedge.exe PID 4176 wrote to memory of 4204 4176 msedge.exe msedge.exe PID 4176 wrote to memory of 4204 4176 msedge.exe msedge.exe PID 4176 wrote to memory of 4204 4176 msedge.exe msedge.exe PID 4176 wrote to memory of 4204 4176 msedge.exe msedge.exe PID 4176 wrote to memory of 4204 4176 msedge.exe msedge.exe PID 4176 wrote to memory of 4204 4176 msedge.exe msedge.exe PID 4176 wrote to memory of 4204 4176 msedge.exe msedge.exe PID 4176 wrote to memory of 4204 4176 msedge.exe msedge.exe PID 4176 wrote to memory of 4204 4176 msedge.exe msedge.exe PID 4176 wrote to memory of 4204 4176 msedge.exe msedge.exe PID 4176 wrote to memory of 4204 4176 msedge.exe msedge.exe PID 4176 wrote to memory of 4204 4176 msedge.exe msedge.exe PID 4176 wrote to memory of 4204 4176 msedge.exe msedge.exe PID 4176 wrote to memory of 4204 4176 msedge.exe msedge.exe PID 4176 wrote to memory of 4204 4176 msedge.exe msedge.exe PID 4176 wrote to memory of 4204 4176 msedge.exe msedge.exe PID 4176 wrote to memory of 4204 4176 msedge.exe msedge.exe PID 4176 wrote to memory of 4204 4176 msedge.exe msedge.exe PID 4176 wrote to memory of 4204 4176 msedge.exe msedge.exe PID 4176 wrote to memory of 4204 4176 msedge.exe msedge.exe PID 4176 wrote to memory of 4204 4176 msedge.exe msedge.exe PID 4176 wrote to memory of 4204 4176 msedge.exe msedge.exe PID 4176 wrote to memory of 4204 4176 msedge.exe msedge.exe PID 4176 wrote to memory of 4204 4176 msedge.exe msedge.exe PID 4176 wrote to memory of 4204 4176 msedge.exe msedge.exe PID 4176 wrote to memory of 2492 4176 msedge.exe msedge.exe PID 4176 wrote to memory of 2492 4176 msedge.exe msedge.exe PID 4176 wrote to memory of 2868 4176 msedge.exe msedge.exe PID 4176 wrote to memory of 2868 4176 msedge.exe msedge.exe PID 4176 wrote to memory of 2868 4176 msedge.exe msedge.exe PID 4176 wrote to memory of 2868 4176 msedge.exe msedge.exe PID 4176 wrote to memory of 2868 4176 msedge.exe msedge.exe PID 4176 wrote to memory of 2868 4176 msedge.exe msedge.exe PID 4176 wrote to memory of 2868 4176 msedge.exe msedge.exe PID 4176 wrote to memory of 2868 4176 msedge.exe msedge.exe PID 4176 wrote to memory of 2868 4176 msedge.exe msedge.exe PID 4176 wrote to memory of 2868 4176 msedge.exe msedge.exe PID 4176 wrote to memory of 2868 4176 msedge.exe msedge.exe PID 4176 wrote to memory of 2868 4176 msedge.exe msedge.exe PID 4176 wrote to memory of 2868 4176 msedge.exe msedge.exe PID 4176 wrote to memory of 2868 4176 msedge.exe msedge.exe PID 4176 wrote to memory of 2868 4176 msedge.exe msedge.exe PID 4176 wrote to memory of 2868 4176 msedge.exe msedge.exe PID 4176 wrote to memory of 2868 4176 msedge.exe msedge.exe PID 4176 wrote to memory of 2868 4176 msedge.exe msedge.exe
Processes
-
C:\Windows\system32\cmd.execmd /c start microsoft-edge:https://grand-theft-auto-vice-city.en.softonic.com/?ex=DINS-162.01⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument microsoft-edge:https://grand-theft-auto-vice-city.en.softonic.com/?ex=DINS-162.02⤵
- Adds Run key to start application
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffe995c46f8,0x7ffe995c4708,0x7ffe995c47183⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2268 /prefetch:23⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2324 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2696 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3864 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3884 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5020 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5604 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5716 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5816 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6044 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6552 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6896 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6912 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7036 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7812 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings3⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1c4,0x22c,0x7ff63a335460,0x7ff63a335470,0x7ff63a3354804⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7812 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7304 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3136 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7860 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7492 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8060 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6436 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6408 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6008 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3944 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7012 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7464 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7628 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6572 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7684 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6860 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6076 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8080 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6288 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5412 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8708 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8400 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8300 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9288 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8460 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9464 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9172 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8716 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6308 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9756 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=8836 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10040 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3144 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9820 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3316 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6308 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3164 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7176 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=8348 /prefetch:23⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2140 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=58 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2408 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=59 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6308 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=60 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6504 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=61 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10104 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=62 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=63 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7648 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=64 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8436 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=65 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2904 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=66 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7616 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=67 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3156 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=68 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6312 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=9072 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=70 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6396 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=71 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9384 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=72 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=73 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8332 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=74 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9252 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=75 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3860 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=76 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1264 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=77 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6292 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=78 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3476 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=79 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6932 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=80 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7404 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=81 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9704 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=82 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8112 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=83 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8724 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=84 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9788 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=85 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5860 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=86 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8760 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5816 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=88 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9616 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=89 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4124 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=90 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6940 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=91 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8780 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=92 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9708 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=93 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6232 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=94 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5848 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=95 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8796 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=9268 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=98 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6728 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3096 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8812 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=101 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8568 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=102 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8256 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=103 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2508 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=104 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7616 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=105 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7660 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=106 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5872 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=107 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7360 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=108 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7632 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=109 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3672 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=110 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8356 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=111 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6344 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=112 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2508 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=113 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4064 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=114 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4440 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=116 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7664 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=117 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6972 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=118 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10004 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=119 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7404 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=120 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9224 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=121 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6508 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=122 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3884 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=123 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10164 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=124 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5808 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7528 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=126 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3904 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=127 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=128 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10152 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=129 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6560 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=130 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8352 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=131 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6228 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=132 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6996 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=133 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10060 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=134 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8248 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=135 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=136 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1120 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=137 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8624 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=138 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8252 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=139 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6096 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=140 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5732 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=141 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8056 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=142 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6572 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=143 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5848 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=144 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5720 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=145 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1940 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=146 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7700 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=147 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9796 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=148 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9644 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=149 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9408 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=150 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9912 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=151 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1888 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=152 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6140 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=153 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6204 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=154 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=155 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4456 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=156 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9452 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=158 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9424 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=159 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6100 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=161 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5020 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=10396 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=163 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=164 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8704 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=165 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6064 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=166 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11288 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=167 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8440 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8400 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=169 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9640 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=170 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9536 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=171 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7444 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=172 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7944 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=173 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6480 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=174 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6116 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=175 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=176 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8448 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=177 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11348 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=179 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8032 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=180 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5928 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=181 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4456 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=183 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9424 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=184 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7664 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=185 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9764 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=9452 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7476 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=188 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11088 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=189 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6176 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=190 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4000 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=191 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9732 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=192 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=193 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8632 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=194 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4496 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=195 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5688 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=196 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9400 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=198 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:13⤵
-
C:\Users\Admin\Downloads\gta5_exe-rockstar-games-outbyte-pc-repair.exe"C:\Users\Admin\Downloads\gta5_exe-rockstar-games-outbyte-pc-repair.exe"3⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\is-24459619.tmp\Installer.exe"C:\Users\Admin\AppData\Local\Temp\is-24459619.tmp\Installer.exe" /spid:6692 /splha:121004164⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks computer location settings
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\Outbyte\PC Repair\BrowserPluginsHelper.Agent.x64.dll"5⤵
- Registers COM server for autorun
- Loads dropped DLL
- Modifies registry class
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\Outbyte\PC Repair\BrowserPluginsHelper.Agent.x32.dll"5⤵
- Loads dropped DLL
- Modifies registry class
-
C:\Program Files (x86)\Outbyte\PC Repair\PCRepair.exe"C:\Program Files (x86)\Outbyte\PC Repair\PCRepair.exe" /Install /Debug /SendInfo /AutoStart5⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Loads dropped DLL
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Outbyte\PC Repair\PCRepair.exe"C:\Program Files (x86)\Outbyte\PC Repair\PCRepair.exe" /FromInstaller /AutoScan /Debug /TestQA5⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Downloads\Rockstar-Games-Launcher-Grand_Theft_Auto_V.exe"C:\Users\Admin\Downloads\Rockstar-Games-Launcher-Grand_Theft_Auto_V.exe"3⤵
- Executes dropped EXE
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Rockstar Games\Launcher\Redistributables\VCRed\vc_redist.x86.exe"C:\Program Files\Rockstar Games\Launcher\Redistributables\VCRed\vc_redist.x86.exe" /install /norestart /quiet4⤵
- Executes dropped EXE
-
C:\Windows\Temp\{116CDF51-394D-4EB6-9992-4C348CBFB94A}\.cr\vc_redist.x86.exe"C:\Windows\Temp\{116CDF51-394D-4EB6-9992-4C348CBFB94A}\.cr\vc_redist.x86.exe" -burn.clean.room="C:\Program Files\Rockstar Games\Launcher\Redistributables\VCRed\vc_redist.x86.exe" -burn.filehandle.attached=548 -burn.filehandle.self=524 /install /norestart /quiet5⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Program Files\Rockstar Games\Launcher\Redistributables\VCRed\vc_redist.x64.exe"C:\Program Files\Rockstar Games\Launcher\Redistributables\VCRed\vc_redist.x64.exe" /install /norestart /quiet4⤵
- Executes dropped EXE
-
C:\Windows\Temp\{00318E43-6450-45FA-AF2A-99CDEABF9BFB}\.cr\vc_redist.x64.exe"C:\Windows\Temp\{00318E43-6450-45FA-AF2A-99CDEABF9BFB}\.cr\vc_redist.x64.exe" -burn.clean.room="C:\Program Files\Rockstar Games\Launcher\Redistributables\VCRed\vc_redist.x64.exe" -burn.filehandle.attached=540 -burn.filehandle.self=648 /install /norestart /quiet5⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Program Files\Rockstar Games\Launcher\RockstarService.exe"C:\Program Files\Rockstar Games\Launcher\RockstarService.exe" stop4⤵
- Executes dropped EXE
-
C:\Program Files\Rockstar Games\Launcher\RockstarService.exe"C:\Program Files\Rockstar Games\Launcher\RockstarService.exe" uninstall4⤵
- Executes dropped EXE
-
C:\Program Files\Rockstar Games\Launcher\RockstarService.exe"C:\Program Files\Rockstar Games\Launcher\RockstarService.exe" install4⤵
- Executes dropped EXE
-
C:\Program Files\Rockstar Games\Launcher\LauncherPatcher.exe"C:\Program Files\Rockstar Games\Launcher\LauncherPatcher.exe"4⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Program Files\Rockstar Games\Launcher\Launcher.exe"C:\Program Files\Rockstar Games\Launcher\Launcher.exe"5⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SendNotifyMessage
-
C:\Program Files\Rockstar Games\Launcher\RockstarService.exe"C:\Program Files\Rockstar Games\Launcher\RockstarService.exe" start6⤵
- Executes dropped EXE
-
C:\Program Files\Rockstar Games\Launcher\RockstarService.exe"C:\Program Files\Rockstar Games\Launcher\RockstarService.exe" stop6⤵
- Executes dropped EXE
-
C:\Program Files\Rockstar Games\Launcher\RockstarService.exe"C:\Program Files\Rockstar Games\Launcher\RockstarService.exe" start6⤵
- Executes dropped EXE
-
C:\Program Files\Rockstar Games\Launcher\RockstarService.exe"C:\Program Files\Rockstar Games\Launcher\RockstarService.exe" start6⤵
- Executes dropped EXE
-
C:\Program Files\Rockstar Games\Launcher\RockstarService.exe"C:\Program Files\Rockstar Games\Launcher\RockstarService.exe" stop6⤵
- Executes dropped EXE
-
C:\Program Files\Rockstar Games\Launcher\RockstarService.exe"C:\Program Files\Rockstar Games\Launcher\RockstarService.exe" start6⤵
- Executes dropped EXE
-
C:\Windows\SYSTEM32\dxdiag.exedxdiag /t "C:\Users\Admin\AppData\Local\Rockstar Games\Launcher\dxdiag.txt"6⤵
- Registers COM server for autorun
- Drops file in System32 directory
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Rockstar Games\Launcher\RockstarService.exe"C:\Program Files\Rockstar Games\Launcher\RockstarService.exe" stop6⤵
- Executes dropped EXE
-
C:\Program Files\Rockstar Games\Launcher\Launcher.exe"C:\Program Files\Rockstar Games\Launcher\Launcher.exe" -upgrade6⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SendNotifyMessage
-
C:\Program Files\Rockstar Games\Launcher\ThirdParty\Crashpad\RockstarErrorHandler.exe"C:\Program Files\Rockstar Games\Launcher\ThirdParty//Crashpad//RockstarErrorHandler.exe" --no-rate-limit "--attachment=attachment_launcher.log=C:\Users\Admin\AppData\Local\Rockstar Games\rgsc\CrashLogs\launcher.log" "--database=C:\Users\Admin\AppData\Local\Rockstar Games\rgsc\CrashLogs\\" "--metrics-dir=C:\Users\Admin\AppData\Local\Rockstar Games\rgsc\CrashLogs\\" --url=https://submit.backtrace.io/bob/bcfcd610a5e9090722c12fe93ce88c188c7fb147d47b352462faca8e1e88a176/minidump --annotation=format=minidump --annotation=token=bcfcd610a5e9090722c12fe93ce88c188c7fb147d47b352462faca8e1e88a176 --initial-client-data=0x22c,0x230,0x234,0x224,0x238,0x7ff7ec1ce868,0x7ff7ec1ce8a8,0x7ff7ec1ce8807⤵
- Executes dropped EXE
-
C:\Program Files\Rockstar Games\Launcher\RockstarService.exe"C:\Program Files\Rockstar Games\Launcher\RockstarService.exe" start7⤵
- Executes dropped EXE
-
C:\Program Files\Rockstar Games\Launcher\Redistributables\SocialClub\Social-Club-Setup.exe"C:\Program Files\Rockstar Games\Launcher\Redistributables\SocialClub\Social-Club-Setup.exe" /silent7⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Program Files\Rockstar Games\Social Club\SocialClubHelper.exe"C:\Program Files\Rockstar Games\Social Club\SocialClubHelper.exe" --no-proxy-server --disable-spell-checking --disable-extensions --gpu-rasterization-msaa-sample-count=0 --canvas-msaa-sample-count=0 --lang=en --off-screen-rendering-enabled --rgsc-product-version=RockstarGames/2.1.5.1/1.0.63.962/launcher/PC --rgsc-pid=6588 --rgsc-ipc-channel-name=rgsc_ipc_19bc --rgsc-home-dir="C:\Users\Admin\Documents\Rockstar Games\Social Club\Launcher\Renderer\\"7⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
-
C:\Program Files\Rockstar Games\Social Club\SocialClubHelper.exe"C:\Program Files\Rockstar Games\Social Club\SocialClubHelper.exe" --type=gpu-process --field-trial-handle=1580,14383647201911206345,9995541274826902784,131072 --enable-features=CastMediaRouteProvider --disable-features=SpareRendererForSitePerProcess --no-sandbox --log-file="C:\Program Files\Rockstar Games\Social Club\debug.log" --log-severity=disable --product-version="Chrome/85.0.4183.102 RockstarGames/2.1.5.1/1.0.63.962/launcher/PC" --lang=en --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --log-file="C:\Program Files\Rockstar Games\Social Club\debug.log" --mojo-platform-channel-handle=1596 /prefetch:28⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Program Files\Rockstar Games\Social Club\SocialClubHelper.exe"C:\Program Files\Rockstar Games\Social Club\SocialClubHelper.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1580,14383647201911206345,9995541274826902784,131072 --enable-features=CastMediaRouteProvider --disable-features=SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=network --no-sandbox --log-file="C:\Program Files\Rockstar Games\Social Club\debug.log" --log-severity=disable --product-version="Chrome/85.0.4183.102 RockstarGames/2.1.5.1/1.0.63.962/launcher/PC" --lang=en --log-file="C:\Program Files\Rockstar Games\Social Club\debug.log" --mojo-platform-channel-handle=1980 /prefetch:88⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Program Files\Rockstar Games\Social Club\SocialClubHelper.exe"C:\Program Files\Rockstar Games\Social Club\SocialClubHelper.exe" --type=renderer --no-sandbox --log-file="C:\Program Files\Rockstar Games\Social Club\debug.log" --field-trial-handle=1580,14383647201911206345,9995541274826902784,131072 --enable-features=CastMediaRouteProvider --disable-features=SpareRendererForSitePerProcess --lang=en-US --log-file="C:\Program Files\Rockstar Games\Social Club\debug.log" --log-severity=disable --product-version="Chrome/85.0.4183.102 RockstarGames/2.1.5.1/1.0.63.962/launcher/PC" --disable-extensions --disable-spell-checking --device-scale-factor=1 --num-raster-threads=1 --gpu-rasterization-msaa-sample-count=0 --renderer-client-id=3 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2144 /prefetch:18⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
-
C:\Program Files\Rockstar Games\Social Club\SocialClubHelper.exe"C:\Program Files\Rockstar Games\Social Club\SocialClubHelper.exe" --type=renderer --no-sandbox --log-file="C:\Program Files\Rockstar Games\Social Club\debug.log" --field-trial-handle=1580,14383647201911206345,9995541274826902784,131072 --enable-features=CastMediaRouteProvider --disable-features=SpareRendererForSitePerProcess --disable-gpu-compositing --lang=en-US --log-file="C:\Program Files\Rockstar Games\Social Club\debug.log" --log-severity=disable --product-version="Chrome/85.0.4183.102 RockstarGames/2.1.5.1/1.0.63.962/launcher/PC" --disable-extensions --disable-spell-checking --device-scale-factor=1 --num-raster-threads=1 --gpu-rasterization-msaa-sample-count=0 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2508 /prefetch:18⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
-
C:\Program Files\Rockstar Games\Social Club\SocialClubHelper.exe"C:\Program Files\Rockstar Games\Social Club\SocialClubHelper.exe" --type=renderer --no-sandbox --log-file="C:\Program Files\Rockstar Games\Social Club\debug.log" --field-trial-handle=1580,14383647201911206345,9995541274826902784,131072 --enable-features=CastMediaRouteProvider --disable-features=SpareRendererForSitePerProcess --disable-gpu-compositing --lang=en-US --log-file="C:\Program Files\Rockstar Games\Social Club\debug.log" --log-severity=disable --product-version="Chrome/85.0.4183.102 RockstarGames/2.1.5.1/1.0.63.962/launcher/PC" --disable-extensions --disable-spell-checking --device-scale-factor=1 --num-raster-threads=1 --gpu-rasterization-msaa-sample-count=0 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2476 /prefetch:18⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
-
C:\Program Files\Rockstar Games\Social Club\SocialClubHelper.exe"C:\Program Files\Rockstar Games\Social Club\SocialClubHelper.exe" --type=gpu-process --field-trial-handle=1580,14383647201911206345,9995541274826902784,131072 --enable-features=CastMediaRouteProvider --disable-features=SpareRendererForSitePerProcess --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-sandbox --log-file="C:\Program Files\Rockstar Games\Social Club\debug.log" --log-severity=disable --product-version="Chrome/85.0.4183.102 RockstarGames/2.1.5.1/1.0.63.962/launcher/PC" --lang=en --gpu-preferences=MAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAIAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --log-file="C:\Program Files\Rockstar Games\Social Club\debug.log" --mojo-platform-channel-handle=2208 /prefetch:28⤵
- Executes dropped EXE
-
C:\Program Files\Rockstar Games\Launcher\RockstarService.exe"C:\Program Files\Rockstar Games\Launcher\RockstarService.exe" stop7⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=199 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6912 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=200 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9844 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=201 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9924 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=202 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6296 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=203 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10324 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=204 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8608 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=205 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8320 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6380 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=207 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6244 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=208 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10104 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=209 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7576 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=210 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11356 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=211 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6128 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=212 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8140 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=213 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5916 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=214 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4980 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=215 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1848 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=216 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6436 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=217 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=218 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7628 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17852543944351841192,11147844960576918788,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=219 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8488 /prefetch:13⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4c8 0x43c1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Program Files\Rockstar Games\Launcher\RockstarService.exe"C:\Program Files\Rockstar Games\Launcher\RockstarService.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Rockstar Games\Launcher\RockstarService.exe"C:\Program Files\Rockstar Games\Launcher\RockstarService.exe"1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
-
C:\Program Files\Rockstar Games\Launcher\RockstarService.exe"C:\Program Files\Rockstar Games\Launcher\RockstarService.exe"1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Rockstar Games\Launcher\RockstarService.exe"C:\Program Files\Rockstar Games\Launcher\RockstarService.exe"1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\??\pipe\LOCAL\crashpad_4176_ZUXCTCIHYKKSKMBTMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/220-133-0x0000000000000000-mapping.dmp
-
memory/468-147-0x0000000000000000-mapping.dmp
-
memory/820-151-0x0000000000000000-mapping.dmp
-
memory/876-159-0x0000000000000000-mapping.dmp
-
memory/924-591-0x00007FF731CB0000-0x00007FF731F39A00-memory.dmpFilesize
2.5MB
-
memory/988-196-0x0000000000000000-mapping.dmp
-
memory/1048-210-0x0000000000000000-mapping.dmp
-
memory/1292-517-0x00007FF731CB0000-0x00007FF731F39A00-memory.dmpFilesize
2.5MB
-
memory/1292-545-0x00007FF731CB0000-0x00007FF731F39A00-memory.dmpFilesize
2.5MB
-
memory/1404-468-0x00007FF6D2150000-0x00007FF6D236D200-memory.dmpFilesize
2.1MB
-
memory/1512-168-0x0000000000000000-mapping.dmp
-
memory/1800-406-0x0000000000B51000-0x000000000111F000-memory.dmpFilesize
5.8MB
-
memory/1800-396-0x0000000000B51000-0x000000000111F000-memory.dmpFilesize
5.8MB
-
memory/1800-411-0x0000000000B51000-0x000000000111F000-memory.dmpFilesize
5.8MB
-
memory/1800-423-0x000000000A2C0000-0x000000000A2F1000-memory.dmpFilesize
196KB
-
memory/1800-410-0x0000000000B51000-0x000000000111F000-memory.dmpFilesize
5.8MB
-
memory/1800-409-0x0000000000B51000-0x000000000111F000-memory.dmpFilesize
5.8MB
-
memory/1800-408-0x0000000000B51000-0x000000000111F000-memory.dmpFilesize
5.8MB
-
memory/1800-407-0x0000000000B51000-0x000000000111F000-memory.dmpFilesize
5.8MB
-
memory/1800-430-0x000000000AD80000-0x000000000ADA0000-memory.dmpFilesize
128KB
-
memory/1800-424-0x000000000A3C0000-0x000000000A6D9000-memory.dmpFilesize
3.1MB
-
memory/1800-404-0x0000000000B51000-0x000000000111F000-memory.dmpFilesize
5.8MB
-
memory/1800-425-0x000000000A3C1000-0x000000000A62F000-memory.dmpFilesize
2.4MB
-
memory/1800-426-0x000000000A9E0000-0x000000000AA03000-memory.dmpFilesize
140KB
-
memory/1800-405-0x0000000000B51000-0x000000000111F000-memory.dmpFilesize
5.8MB
-
memory/1800-403-0x0000000000B51000-0x000000000111F000-memory.dmpFilesize
5.8MB
-
memory/1800-402-0x0000000000B51000-0x000000000111F000-memory.dmpFilesize
5.8MB
-
memory/1800-427-0x000000000AA10000-0x000000000ABB1000-memory.dmpFilesize
1.6MB
-
memory/1800-401-0x0000000000B51000-0x000000000111F000-memory.dmpFilesize
5.8MB
-
memory/1800-400-0x0000000000B51000-0x000000000111F000-memory.dmpFilesize
5.8MB
-
memory/1800-399-0x0000000000B51000-0x000000000111F000-memory.dmpFilesize
5.8MB
-
memory/1800-398-0x0000000000B51000-0x000000000111F000-memory.dmpFilesize
5.8MB
-
memory/1800-397-0x0000000000B51000-0x000000000111F000-memory.dmpFilesize
5.8MB
-
memory/1800-413-0x0000000006AC0000-0x0000000006AE0000-memory.dmpFilesize
128KB
-
memory/1800-428-0x000000000AD20000-0x000000000AD78000-memory.dmpFilesize
352KB
-
memory/1800-198-0x0000000000000000-mapping.dmp
-
memory/1800-395-0x0000000000B51000-0x000000000111F000-memory.dmpFilesize
5.8MB
-
memory/1800-394-0x0000000000B50000-0x0000000001576000-memory.dmpFilesize
10.1MB
-
memory/1800-393-0x0000000000B51000-0x000000000111F000-memory.dmpFilesize
5.8MB
-
memory/1800-392-0x0000000001580000-0x0000000001D2C000-memory.dmpFilesize
7.7MB
-
memory/1800-391-0x0000000000700000-0x000000000075A000-memory.dmpFilesize
360KB
-
memory/1976-216-0x0000000000000000-mapping.dmp
-
memory/1980-542-0x00007FF731CB0000-0x00007FF731F39A00-memory.dmpFilesize
2.5MB
-
memory/1980-538-0x00007FF731CB0000-0x00007FF731F39A00-memory.dmpFilesize
2.5MB
-
memory/2208-204-0x0000000000000000-mapping.dmp
-
memory/2208-471-0x00007FF6D2150000-0x00007FF6D236D200-memory.dmpFilesize
2.1MB
-
memory/2212-241-0x0000000000000000-mapping.dmp
-
memory/2252-466-0x00007FF6D2150000-0x00007FF6D236D200-memory.dmpFilesize
2.1MB
-
memory/2252-465-0x00007FF6D2150000-0x00007FF6D236D200-memory.dmpFilesize
2.1MB
-
memory/2276-153-0x0000000000000000-mapping.dmp
-
memory/2376-202-0x0000000000000000-mapping.dmp
-
memory/2492-136-0x0000000000000000-mapping.dmp
-
memory/2512-218-0x0000000000000000-mapping.dmp
-
memory/2516-157-0x0000000000000000-mapping.dmp
-
memory/2608-214-0x0000000000000000-mapping.dmp
-
memory/2684-163-0x0000000000000000-mapping.dmp
-
memory/2708-145-0x0000000000000000-mapping.dmp
-
memory/2816-444-0x00007FF6D2150000-0x00007FF6D236D200-memory.dmpFilesize
2.1MB
-
memory/2868-139-0x0000000000000000-mapping.dmp
-
memory/2944-493-0x0000000001431000-0x00000000019FF000-memory.dmpFilesize
5.8MB
-
memory/2944-494-0x0000000001431000-0x00000000019FF000-memory.dmpFilesize
5.8MB
-
memory/2944-481-0x0000000000EA1000-0x0000000000EDC000-memory.dmpFilesize
236KB
-
memory/2944-480-0x0000000001150000-0x000000000132A000-memory.dmpFilesize
1.9MB
-
memory/2944-487-0x0000000001431000-0x00000000019FF000-memory.dmpFilesize
5.8MB
-
memory/2944-491-0x0000000001431000-0x00000000019FF000-memory.dmpFilesize
5.8MB
-
memory/2944-484-0x0000000001431000-0x00000000019FF000-memory.dmpFilesize
5.8MB
-
memory/2944-485-0x0000000001431000-0x00000000019FF000-memory.dmpFilesize
5.8MB
-
memory/2944-489-0x0000000001431000-0x00000000019FF000-memory.dmpFilesize
5.8MB
-
memory/2944-486-0x0000000001431000-0x00000000019FF000-memory.dmpFilesize
5.8MB
-
memory/2944-492-0x0000000001431000-0x00000000019FF000-memory.dmpFilesize
5.8MB
-
memory/2944-488-0x0000000001431000-0x00000000019FF000-memory.dmpFilesize
5.8MB
-
memory/2944-495-0x0000000001431000-0x00000000019FF000-memory.dmpFilesize
5.8MB
-
memory/2944-496-0x0000000001431000-0x00000000019FF000-memory.dmpFilesize
5.8MB
-
memory/2944-490-0x0000000001431000-0x00000000019FF000-memory.dmpFilesize
5.8MB
-
memory/2988-164-0x0000000000000000-mapping.dmp
-
memory/3084-243-0x0000000000000000-mapping.dmp
-
memory/3180-192-0x0000000000000000-mapping.dmp
-
memory/3200-149-0x0000000000000000-mapping.dmp
-
memory/3304-240-0x0000000000000000-mapping.dmp
-
memory/3396-469-0x00007FF6D2150000-0x00007FF6D236D200-memory.dmpFilesize
2.1MB
-
memory/3472-141-0x0000000000000000-mapping.dmp
-
memory/3588-470-0x00007FF6D2150000-0x00007FF6D236D200-memory.dmpFilesize
2.1MB
-
memory/3608-474-0x00000000023B0000-0x000000000255A000-memory.dmpFilesize
1.7MB
-
memory/3996-143-0x0000000000000000-mapping.dmp
-
memory/4048-442-0x00007FF6D2150000-0x00007FF6D236D200-memory.dmpFilesize
2.1MB
-
memory/4176-132-0x0000000000000000-mapping.dmp
-
memory/4204-135-0x0000000000000000-mapping.dmp
-
memory/4252-194-0x0000000000000000-mapping.dmp
-
memory/4276-161-0x0000000000000000-mapping.dmp
-
memory/4336-190-0x0000000000000000-mapping.dmp
-
memory/4424-253-0x0000000000000000-mapping.dmp
-
memory/4488-162-0x0000000000000000-mapping.dmp
-
memory/4508-170-0x0000000000000000-mapping.dmp
-
memory/4580-245-0x0000000000000000-mapping.dmp
-
memory/4680-166-0x0000000000000000-mapping.dmp
-
memory/4724-155-0x0000000000000000-mapping.dmp
-
memory/4772-477-0x00007FF6D2150000-0x00007FF6D236D200-memory.dmpFilesize
2.1MB
-
memory/4772-478-0x00007FF6D2150000-0x00007FF6D236D200-memory.dmpFilesize
2.1MB
-
memory/4772-519-0x00007FF6D2150000-0x00007FF6D236D200-memory.dmpFilesize
2.1MB
-
memory/4772-472-0x00007FF6D2150000-0x00007FF6D236D200-memory.dmpFilesize
2.1MB
-
memory/4772-473-0x00007FF6D2150000-0x00007FF6D236D200-memory.dmpFilesize
2.1MB
-
memory/4796-212-0x0000000000000000-mapping.dmp
-
memory/5172-208-0x0000000000000000-mapping.dmp
-
memory/5192-200-0x0000000000000000-mapping.dmp
-
memory/5192-172-0x0000000000000000-mapping.dmp
-
memory/5204-592-0x00007FF731CB0000-0x00007FF731F39A00-memory.dmpFilesize
2.5MB
-
memory/5204-539-0x00007FF731CB0000-0x00007FF731F39A00-memory.dmpFilesize
2.5MB
-
memory/5204-543-0x00007FF731CB0000-0x00007FF731F39A00-memory.dmpFilesize
2.5MB
-
memory/5204-549-0x00007FF731CB0000-0x00007FF731F39A00-memory.dmpFilesize
2.5MB
-
memory/5204-541-0x00007FF731CB0000-0x00007FF731F39A00-memory.dmpFilesize
2.5MB
-
memory/5204-548-0x00007FF731CB0000-0x00007FF731F39A00-memory.dmpFilesize
2.5MB
-
memory/5204-540-0x00007FF731CB0000-0x00007FF731F39A00-memory.dmpFilesize
2.5MB
-
memory/5204-550-0x00007FF731CB0000-0x00007FF731F39A00-memory.dmpFilesize
2.5MB
-
memory/5204-544-0x00007FF731CB0000-0x00007FF731F39A00-memory.dmpFilesize
2.5MB
-
memory/5428-174-0x0000000000000000-mapping.dmp
-
memory/5516-176-0x0000000000000000-mapping.dmp
-
memory/5636-178-0x0000000000000000-mapping.dmp
-
memory/5644-206-0x0000000000000000-mapping.dmp
-
memory/5704-180-0x0000000000000000-mapping.dmp
-
memory/5832-182-0x0000000000000000-mapping.dmp
-
memory/5848-184-0x0000000000000000-mapping.dmp
-
memory/5876-475-0x0000000000720000-0x0000000000733000-memory.dmpFilesize
76KB
-
memory/5904-443-0x00007FF6D2150000-0x00007FF6D236D200-memory.dmpFilesize
2.1MB
-
memory/5932-186-0x0000000000000000-mapping.dmp
-
memory/6052-456-0x00007FF6A85E0000-0x00007FF6ABCD0E00-memory.dmpFilesize
54.9MB
-
memory/6052-479-0x00007FF6A85E0000-0x00007FF6ABCD0E00-memory.dmpFilesize
54.9MB
-
memory/6052-476-0x00007FF6A85E0000-0x00007FF6ABCD0E00-memory.dmpFilesize
54.9MB
-
memory/6052-455-0x00007FF6A85E0000-0x00007FF6ABCD0E00-memory.dmpFilesize
54.9MB
-
memory/6052-457-0x00007FF6A85E0000-0x00007FF6ABCD0E00-memory.dmpFilesize
54.9MB
-
memory/6052-535-0x00007FF6A85E0000-0x00007FF6ABCD0E00-memory.dmpFilesize
54.9MB
-
memory/6080-188-0x0000000000000000-mapping.dmp
-
memory/6176-249-0x0000000000000000-mapping.dmp
-
memory/6292-247-0x0000000000000000-mapping.dmp
-
memory/6296-467-0x00007FF6D2150000-0x00007FF6D236D200-memory.dmpFilesize
2.1MB
-
memory/6296-464-0x00007FF6D2150000-0x00007FF6D236D200-memory.dmpFilesize
2.1MB
-
memory/6296-462-0x00007FF6D2150000-0x00007FF6D236D200-memory.dmpFilesize
2.1MB
-
memory/6296-460-0x00007FF6D2150000-0x00007FF6D236D200-memory.dmpFilesize
2.1MB
-
memory/6296-461-0x00007FF6D2150000-0x00007FF6D236D200-memory.dmpFilesize
2.1MB
-
memory/6332-458-0x00007FF6D2150000-0x00007FF6D236D200-memory.dmpFilesize
2.1MB
-
memory/6332-459-0x00007FF6D2150000-0x00007FF6D236D200-memory.dmpFilesize
2.1MB
-
memory/6408-463-0x00007FF6D2150000-0x00007FF6D236D200-memory.dmpFilesize
2.1MB
-
memory/6420-220-0x0000000000000000-mapping.dmp
-
memory/6532-222-0x0000000000000000-mapping.dmp
-
memory/6540-251-0x0000000000000000-mapping.dmp
-
memory/6548-224-0x0000000000000000-mapping.dmp
-
memory/6580-236-0x0000000000000000-mapping.dmp
-
memory/6588-546-0x00007FF7EB650000-0x00007FF7EED4DA00-memory.dmpFilesize
55.0MB
-
memory/6588-234-0x0000000000000000-mapping.dmp
-
memory/6588-537-0x00007FF7EB650000-0x00007FF7EED4DA00-memory.dmpFilesize
55.0MB
-
memory/6588-547-0x00007FF7EB650000-0x00007FF7EED4DA00-memory.dmpFilesize
55.0MB
-
memory/6588-536-0x00007FF7EB650000-0x00007FF7EED4DA00-memory.dmpFilesize
55.0MB
-
memory/6588-606-0x00007FF7EB650000-0x00007FF7EED4DA00-memory.dmpFilesize
55.0MB
-
memory/6660-238-0x0000000000000000-mapping.dmp
-
memory/6680-226-0x0000000000000000-mapping.dmp
-
memory/6692-389-0x00000000024E0000-0x00000000027F9000-memory.dmpFilesize
3.1MB
-
memory/6692-390-0x0000000002FC0000-0x00000000030AA000-memory.dmpFilesize
936KB
-
memory/6772-228-0x0000000000000000-mapping.dmp
-
memory/6868-230-0x0000000000000000-mapping.dmp
-
memory/6884-232-0x0000000000000000-mapping.dmp