Analysis
- user interaction
yes - max time kernel
899s - max time network
876s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
04/05/2026, 09:41
General
- Target sample.html
- Size 271KB
- Sample260504-ln48csfw91
- SHA256 4bcf15d6512bdceea21556c88767bdeff5668e0201c71589cdbe742d807eef0f
Score
10/10
Malware Config
Signatures
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
- Downloads MZ/PE file 2 IoCs
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 19 IoCs
- Loads dropped DLL 64 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 64 IoCs
- Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 2 IoCs
When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Kills process with taskkill 2 IoCs
- Modifies Control Panel 6 IoCs
- Modifies data under HKEY_USERS 5 IoCs
- Modifies registry class 64 IoCs
- NTFS ADS 2 IoCs
- Suspicious behavior: EnumeratesProcesses 12 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 25 IoCs
- Suspicious use of SetWindowsHookEx 5 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html2⤵
- Loads dropped DLL
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x24c,0x7ffaa283c188,0x7ffaa283c194,0x7ffaa283c1a03⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1764,i,260316018883531044,13891298124175164364,524288 --field-trial-handle=2152,i,17445276849398165178,15256755819745342820,262144 --variations-seed-version --mojo-platform-channel-handle=2164 /prefetch:113⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1644,i,5422129097024827879,7365898267348285489,262144 --field-trial-handle=2152,i,17445276849398165178,15256755819745342820,262144 --variations-seed-version --mojo-platform-channel-handle=2136 /prefetch:23⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2508,i,210811424741116354,7910954649716806011,524288 --field-trial-handle=2152,i,17445276849398165178,15256755819745342820,262144 --variations-seed-version --mojo-platform-channel-handle=2564 /prefetch:133⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3420,i,9027946416488781459,5171239652956867056,2097152 --field-trial-handle=2152,i,17445276849398165178,15256755819745342820,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3424,i,5868472969660270998,4539480444800349054,2097152 --field-trial-handle=2152,i,17445276849398165178,15256755819745342820,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5080,i,6949494073638762825,16680237455198065086,524288 --field-trial-handle=2152,i,17445276849398165178,15256755819745342820,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5084,i,11227454477897002037,9717447755080687565,524288 --field-trial-handle=2152,i,17445276849398165178,15256755819745342820,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,9826257810418815828,6214985794908277365,524288 --field-trial-handle=2152,i,17445276849398165178,15256755819745342820,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5936,i,12338041824811880246,1101123976530615609,524288 --field-trial-handle=2152,i,17445276849398165178,15256755819745342820,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:143⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.execookie_exporter.exe --cookie-json=11284⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,9826257810418815828,6214985794908277365,524288 --field-trial-handle=2152,i,17445276849398165178,15256755819745342820,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6256,i,12980535006543508469,16519335313107961777,524288 --field-trial-handle=2152,i,17445276849398165178,15256755819745342820,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6260,i,6486701350136617848,13921207672500433040,524288 --field-trial-handle=2152,i,17445276849398165178,15256755819745342820,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6264,i,6693951174003708520,14909598491713262491,524288 --field-trial-handle=2152,i,17445276849398165178,15256755819745342820,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6252,i,5521882165256561819,12599540948243772735,524288 --field-trial-handle=2152,i,17445276849398165178,15256755819745342820,262144 --variations-seed-version --mojo-platform-channel-handle=564 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6372,i,6526497755038032036,6647649872668037794,524288 --field-trial-handle=2152,i,17445276849398165178,15256755819745342820,262144 --variations-seed-version --mojo-platform-channel-handle=6388 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5900,i,6364436748585522637,14084640286421989667,2097152 --field-trial-handle=2152,i,17445276849398165178,15256755819745342820,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3728,i,9714953217150096691,9792514331515342544,524288 --field-trial-handle=2152,i,17445276849398165178,15256755819745342820,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5100,i,8626228596507568692,3050238100328648719,524288 --field-trial-handle=2152,i,17445276849398165178,15256755819745342820,262144 --variations-seed-version --mojo-platform-channel-handle=4840 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=5640,i,17214025352518403158,7863465553623838404,2097152 --field-trial-handle=2152,i,17445276849398165178,15256755819745342820,262144 --variations-seed-version --mojo-platform-channel-handle=6556 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=5656,i,7119648563208400025,4775709132848240491,2097152 --field-trial-handle=2152,i,17445276849398165178,15256755819745342820,262144 --variations-seed-version --mojo-platform-channel-handle=6768 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=5212,i,16339108864656939454,11947283665064257244,2097152 --field-trial-handle=2152,i,17445276849398165178,15256755819745342820,262144 --variations-seed-version --mojo-platform-channel-handle=6680 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6952,i,2091929153134942156,3041531576699310507,2097152 --field-trial-handle=2152,i,17445276849398165178,15256755819745342820,262144 --variations-seed-version --mojo-platform-channel-handle=6980 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7036,i,11478309250566347237,8421583928998505163,2097152 --field-trial-handle=2152,i,17445276849398165178,15256755819745342820,262144 --variations-seed-version --mojo-platform-channel-handle=6924 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=5320,i,11628406257073763607,18122415391139513264,2097152 --field-trial-handle=2152,i,17445276849398165178,15256755819745342820,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5352,i,945652499560723185,15722409999004625273,524288 --field-trial-handle=2152,i,17445276849398165178,15256755819745342820,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=5344,i,651932161261254600,4440960527077523562,2097152 --field-trial-handle=2152,i,17445276849398165178,15256755819745342820,262144 --variations-seed-version --mojo-platform-channel-handle=6720 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3396,i,15241698974184119619,12566514718568519817,524288 --field-trial-handle=2152,i,17445276849398165178,15256755819745342820,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=4752,i,17966635034916143659,12041839375867822912,2097152 --field-trial-handle=2152,i,17445276849398165178,15256755819745342820,262144 --variations-seed-version --mojo-platform-channel-handle=7040 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7420,i,9419951975742703107,8146659581386451548,524288 --field-trial-handle=2152,i,17445276849398165178,15256755819745342820,262144 --variations-seed-version --mojo-platform-channel-handle=7408 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7504,i,6901301944212107611,5715741433568760190,262144 --field-trial-handle=2152,i,17445276849398165178,15256755819745342820,262144 --variations-seed-version --mojo-platform-channel-handle=7512 /prefetch:103⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7520,i,16333460865778144614,9177748498276901664,524288 --field-trial-handle=2152,i,17445276849398165178,15256755819745342820,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:143⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
-
-
C:\Users\Admin\Downloads\PowerToysSetup-0.99.1-x64.exe"C:\Users\Admin\Downloads\PowerToysSetup-0.99.1-x64.exe"3⤵
- Executes dropped EXE
-
C:\Windows\TEMP\{24A112A3-D43D-4122-83FF-EE7B5E1DBBCE}\.ba\wixstdba.exe"C:\Windows\TEMP\{24A112A3-D43D-4122-83FF-EE7B5E1DBBCE}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{3563CDC0-3997-4AD6-AF60-305DD513805F} {D68DBBED-E129-42F7-B2CB-799B66B2E716}4⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Windows\TEMP\{24A112A3-D43D-4122-83FF-EE7B5E1DBBCE}\.be\PowerToysSetup-0.99.1-x64.exe"C:\Windows\TEMP\{24A112A3-D43D-4122-83FF-EE7B5E1DBBCE}\.be\PowerToysSetup-0.99.1-x64.exe" -q -burn.elevated BurnPipe.{ED738944-2B36-4844-8228-916C6D076507} {A922D130-781D-4F8C-9A4D-C6A81506A7A2} 54404⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:25⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\ProgramData\Package Cache\439A8989D4069C0616DBFE7F9488ECE1D173FEB234706C45F47E5AA9DB98D155\terminate_powertoys.cmd"5⤵
-
C:\Windows\system32\taskkill.exetaskkill /IM PowerToys.exe6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5844,i,5284196061104640829,17131591671206328216,524288 --field-trial-handle=2152,i,17445276849398165178,15256755819745342820,262144 --variations-seed-version --mojo-platform-channel-handle=7780 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,6639202800856181463,2229439431507038020,524288 --field-trial-handle=2152,i,17445276849398165178,15256755819745342820,262144 --variations-seed-version --mojo-platform-channel-handle=7544 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7536,i,1429754096843363604,13811842893849504546,524288 --field-trial-handle=2152,i,17445276849398165178,15256755819745342820,262144 --variations-seed-version --mojo-platform-channel-handle=7724 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7932,i,17669575419443191623,4237597515701967665,524288 --field-trial-handle=2152,i,17445276849398165178,15256755819745342820,262144 --variations-seed-version --mojo-platform-channel-handle=7936 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=3744,i,246477671428511858,13910579700282322235,2097152 --field-trial-handle=2152,i,17445276849398165178,15256755819745342820,262144 --variations-seed-version --mojo-platform-channel-handle=7800 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7940,i,9093779883009755684,513189938907164877,524288 --field-trial-handle=2152,i,17445276849398165178,15256755819745342820,262144 --variations-seed-version --mojo-platform-channel-handle=6992 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7448,i,5431027324712805465,15579181582138281331,524288 --field-trial-handle=2152,i,17445276849398165178,15256755819745342820,262144 --variations-seed-version --mojo-platform-channel-handle=7772 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=7840,i,15370115826526716429,4152302750299803892,2097152 --field-trial-handle=2152,i,17445276849398165178,15256755819745342820,262144 --variations-seed-version --mojo-platform-channel-handle=7860 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=8160,i,11789523503103528572,6807846444502758062,2097152 --field-trial-handle=2152,i,17445276849398165178,15256755819745342820,262144 --variations-seed-version --mojo-platform-channel-handle=7532 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6836,i,8364354533134424392,12298879074832272124,524288 --field-trial-handle=2152,i,17445276849398165178,15256755819745342820,262144 --variations-seed-version --mojo-platform-channel-handle=6824 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8296,i,13795653833472669355,2939187033638878530,524288 --field-trial-handle=2152,i,17445276849398165178,15256755819745342820,262144 --variations-seed-version --mojo-platform-channel-handle=8308 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2992,i,16258300978864068671,3146153733366559990,524288 --field-trial-handle=2152,i,17445276849398165178,15256755819745342820,262144 --variations-seed-version --mojo-platform-channel-handle=8164 /prefetch:143⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5424,i,9454124627825895236,5122923332060208052,524288 --field-trial-handle=2152,i,17445276849398165178,15256755819745342820,262144 --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8320,i,8063133829169854866,5972513599711775918,524288 --field-trial-handle=2152,i,17445276849398165178,15256755819745342820,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,6566340594687707162,11250119685473636111,524288 --field-trial-handle=2152,i,17445276849398165178,15256755819745342820,262144 --variations-seed-version --mojo-platform-channel-handle=6556 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5048,i,3646842393925058308,5949523311366603611,524288 --field-trial-handle=2152,i,17445276849398165178,15256755819745342820,262144 --variations-seed-version --mojo-platform-channel-handle=7788 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5448,i,10097216101131040903,12236140898642538786,524288 --field-trial-handle=2152,i,17445276849398165178,15256755819745342820,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:143⤵
-
-
-
C:\Program Files\PowerToys\PowerToys.exe"C:\Program Files\PowerToys\PowerToys.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\PowerToys\WinUI3Apps\PowerToys.QuickAccess.exe"C:\Program Files\PowerToys\WinUI3Apps\PowerToys.QuickAccess.exe" --show-event="Local\PowerToysQuickAccess_5556_Show" --exit-event="Local\PowerToysQuickAccess_5556_Exit" --runner-pipe="\\.\pipe\powertoys_quick_access_runner_105a91bd-7c14-4a1c-9b23-cc679e749f26" --app-pipe="\\.\pipe\powertoys_quick_access_ui_105a91bd-7c14-4a1c-9b23-cc679e749f26"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies Control Panel
-
-
C:\Program Files\PowerToys\PowerToys.AlwaysOnTop.exe"C:\Program Files\PowerToys\PowerToys.AlwaysOnTop.exe" 55563⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies Control Panel
-
-
C:\Program Files\PowerToys\PowerToys.Awake.exePowerToys.Awake.exe --use-pt-config --pid 55563⤵
- Executes dropped EXE
- Suspicious use of SendNotifyMessage
-
-
C:\Program Files\PowerToys\WinUI3Apps\PowerToys.ImageResizer.exe"C:\Program Files\PowerToys\WinUI3Apps\PowerToys.ImageResizer.exe" --detect-ai3⤵
- Executes dropped EXE
- Modifies Control Panel
-
-
C:\Program Files\PowerToys\PowerToys.ColorPickerUI.exe"C:\Program Files\PowerToys\PowerToys.ColorPickerUI.exe" 55563⤵
- Executes dropped EXE
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe" x-cmdpal://background3⤵
-
-
C:\Program Files\PowerToys\PowerToys.FancyZones.exe"C:\Program Files\PowerToys\PowerToys.FancyZones.exe" 55563⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\PowerToys\WinUI3Apps\PowerToys.Settings.exe"C:\Program Files\PowerToys\WinUI3Apps\PowerToys.Settings.exe" \\.\pipe\powertoys_runner_e0e520fc-67ef-4849-bf66-f56c98136af8 \\.\pipe\powertoys_settings_e0e520fc-67ef-4849-bf66-f56c98136af8 5556 system true true true false false3⤵
- Executes dropped EXE
- Modifies Control Panel
-
-
C:\Program Files\PowerToys\PowerToys.ShortcutGuide.exe"C:\Program Files\PowerToys\PowerToys.ShortcutGuide.exe" 5556 telemetry3⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
-
-
C:\Program Files\PowerToys\WinUI3Apps\PowerToys.Peek.UI.exe"C:\Program Files\PowerToys\WinUI3Apps\PowerToys.Peek.UI.exe" 55562⤵
- Executes dropped EXE
- Modifies Control Panel
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\Package Cache\{39FF9837-4722-49F9-92B9-051A50B1E36F}\PowerToysSetup-0.99.1-x64.exe"C:\ProgramData\Package Cache\{39FF9837-4722-49F9-92B9-051A50B1E36F}\PowerToysSetup-0.99.1-x64.exe" /burn.runonce1⤵
- Executes dropped EXE
-
C:\ProgramData\Package Cache\{39FF9837-4722-49F9-92B9-051A50B1E36F}\PowerToysSetup-0.99.1-x64.exe"C:\ProgramData\Package Cache\{39FF9837-4722-49F9-92B9-051A50B1E36F}\PowerToysSetup-0.99.1-x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\powertoys-bootstrapper-msi-0.99.1_20260504104418.log"2⤵
- Executes dropped EXE
-
C:\Windows\TEMP\{6345ADB1-A7E1-4832-856F-F15B746B586F}\.ba\wixstdba.exe"C:\Windows\TEMP\{6345ADB1-A7E1-4832-856F-F15B746B586F}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{FA8E1B05-0C17-4198-956F-C6A7AAF36B7C} {405F73B5-FD3A-4ACC-BA67-8152E63FB077}3⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\ProgramData\Package Cache\{39FF9837-4722-49F9-92B9-051A50B1E36F}\PowerToysSetup-0.99.1-x64.exe"C:\ProgramData\Package Cache\{39FF9837-4722-49F9-92B9-051A50B1E36F}\PowerToysSetup-0.99.1-x64.exe" -q -burn.elevated BurnPipe.{12237080-AE28-4825-B789-4F10EC7CA8AE} {ED85B697-7432-4ADE-907F-BA18CF9B6DA8} 27083⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\ProgramData\Package Cache\439A8989D4069C0616DBFE7F9488ECE1D173FEB234706C45F47E5AA9DB98D155\terminate_powertoys.cmd"4⤵
-
C:\Windows\system32\taskkill.exetaskkill /IM PowerToys.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding DC67C98B2C8B74475CB31DB4441368E62⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\PowerToys\PowerToys.exe"C:\Program Files\PowerToys\\PowerToys.exe" --dont-elevate3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
-
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 99B14A3D4D41790F3E1907CC4866A1C2 E Global\MSI00002⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k AppReadiness -p -s AppReadiness1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Program Files\WindowsApps\Microsoft.CommandPalette_0.10.11181.0_x64__8wekyb3d8bbwe\Microsoft.CmdPal.UI.exe"C:\Program Files\WindowsApps\Microsoft.CommandPalette_0.10.11181.0_x64__8wekyb3d8bbwe\Microsoft.CmdPal.UI.exe" x-cmdpal://background/2⤵
- Modifies registry class
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\PowerToys\WinUI3Apps\Microsoft.CmdPal.Ext.PowerToys.exe"C:\Program Files\PowerToys\WinUI3Apps\\Microsoft.CmdPal.Ext.PowerToys.exe" -RegisterProcessAsComServer -Embedding1⤵
- Executes dropped EXE
-
C:\Windows\system32\WerFault.exe"C:\Windows\system32\WerFault.exe" -k -lc WATCHDOG WATCHDOG-20260504-1047.dmp1⤵
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Defense Evasion
Modify Registry
1Subvert Trust Controls
1SIP and Trust Provider Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
e5ac9fb.rbs
PowerToys.ColorPickerUI.runtimeconfig.json
PowerToys.exe
Dia2Lib.dll
TraceReloggerLib.dll
PowerDisplay.Models.dll
PowerToys.ManagedTelemetry.dll
PowerToys.MouseJump.Common.dll
PowerToys.Interop.dll
PowerToys.ZoomItSettingsInterop.dll
backup_restore_settings.json
LargeTile.png
SmallTile.png
Logo.scale-200.png
SplashScreen.png
StoreLogo.png
PowerToys.ImageResizer.runtimeconfig.json
PowerToys (Preview).lnk
PowerToys (Preview).lnk~RFe5c287f.TMP
state.rsm
748726b4-148a-4fa7-89b2-0d6c6af2d85c.tmp
autofill_bypass_cache_forms.json
edge_autofill_global_block_list.json
v1FieldTypes.json
settings.dat
settings.dat
LOG.old
LOG.old
MANIFEST-000001
BookmarkMergedSurfaceOrdering
BrowsingTopicsState
f_0000ab
temp-index
the-real-index
the-real-index
SiteList-Enterprise.json
HubApps
000003.log
LOG
MANIFEST-000001
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Sdch Dictionaries
Preferences
Preferences
Preferences
Preferences
Secure Preferences
Secure Preferences
the-real-index
the-real-index
the-real-index~RFe5ce5a5.TMP
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
index.txt
index.txt
index.txt
the-real-index
the-real-index
the-real-index
the-real-index~RFe5cd549.TMP
sync_diagnostic.log
CURRENT
MANIFEST-000001
domain_actions.dll
data.txt
wallet-checkout-eligible-sites.json
wallet-notification-config.json
wallet-stable.json
wallet-tokenization-config.json
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter~RFe5944ef.TMP
Filtering Rules
LICENSE
typosquatting_list.pb
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
metadata.json
settings.json
powertoys-bootstrapper-msi-0.99.1_20260504104418_001_PowerToysSetup_0.99.1_x64.msi.log
TerminatePowerToys
WebView2
3816fd9a-1bda-4e20-8395-362be1bf8437.tmp
PowerToysSetup-0.99.1-x64.exe:Zone.Identifier
MSI2763.tmp
MSI39D6.tmp
MSIFA90.tmp
keys.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
edge_checkout_page_validator.js
manifest.json
notification_fast.bundle.js.LICENSE.txt
tokenized-card.bundle.js.LICENSE.txt
strings.json
manifest.json
BootstrapperApplicationData.xml
icon.ico
license.rtf
logo.png
thm.wxl
thm.xml
SilentFilesInUseBAFunction.dll
wixstdba.exe
PowerToysSetup-0.99.1-x64.exe
{7f46590f-3e96-4b9a-9867-4e90dd7c2480}_OnDiskSnapshotProp
memory/1396-4538-0x0000018A3CB90000-0x0000018A3CB9C000-memory.dmp
memory/1396-4326-0x0000018A34330000-0x0000018A34340000-memory.dmp
memory/2092-4514-0x00000237F0380000-0x00000237F038C000-memory.dmp
memory/2092-4229-0x00000237F0390000-0x00000237F03A2000-memory.dmp
memory/2092-4228-0x00000237F0380000-0x00000237F038C000-memory.dmp
memory/2432-4559-0x00007FF64B9D0000-0x00007FF64BAB9000-memory.dmp
memory/2708-1435-0x00007FF672E80000-0x00007FF672F69000-memory.dmp
memory/2708-2657-0x00007FF672E80000-0x00007FF672F69000-memory.dmp
memory/3276-1282-0x0000022046950000-0x000002204695C000-memory.dmp
memory/3276-5444-0x0000022046950000-0x000002204695C000-memory.dmp
memory/3564-4295-0x00007FFA7EAB0000-0x00007FFA7EAC0000-memory.dmp
memory/3564-4327-0x000002E43E2B0000-0x000002E43E2BC000-memory.dmp
memory/4772-98-0x000001C2E14D0000-0x000001C2E188B000-memory.dmp
memory/5232-4703-0x0000021C8C0D0000-0x0000021C8C0DC000-memory.dmp
memory/5556-4599-0x0000024D97CA0000-0x0000024D97CAC000-memory.dmp
memory/5936-1569-0x00007FF672E80000-0x00007FF672F69000-memory.dmp
memory/5936-2653-0x00007FF672E80000-0x00007FF672F69000-memory.dmp