Analysis
- user interaction
yes - max time kernel
648s - max time network
636s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
04/08/2026, 22:40
General
- Target https://gta-6.techylist.com/
- Sample260804-2lmtashh76
Score
8/10
Malware Config
Signatures
- Downloads MZ/PE file 3 IoCs
- Uses Session Manager for persistence 2 TTPs 2 IoCs
Creates Session Manager registry key to run executable early in system boot.
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 13 IoCs
- Loads dropped DLL 28 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks for any installed AV software in registry 1 TTPs 5 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 2 IoCs
- Drops desktop.ini file(s) 2 IoCs
- Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Network Share Discovery 1 TTPs
Attempt to gather information on host network.
- Writes to the Master Boot Record (MBR) 1 TTPs 5 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Drops file in System32 directory 2 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 3 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 36 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 16 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 9 IoCs
- Modifies data under HKEY_USERS 36 IoCs
- Modifies registry class 43 IoCs
- Suspicious behavior: EnumeratesProcesses 37 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs
- Suspicious use of AdjustPrivilegeToken 51 IoCs
- Suspicious use of FindShellTrayWindow 56 IoCs
- Suspicious use of SendNotifyMessage 43 IoCs
- Suspicious use of SetWindowsHookEx 5 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://gta-6.techylist.com/1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7fffd884c188,0x7fffd884c194,0x7fffd884c1a02⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1928,i,16868129843427056301,7436945855722575627,524288 --field-trial-handle=2428,i,4495677244675624293,9955166777450274439,262144 --variations-seed-version --mojo-platform-channel-handle=2844 /prefetch:32⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2304,i,5982525060365482024,10828150668794854271,524288 --field-trial-handle=2428,i,4495677244675624293,9955166777450274439,262144 --variations-seed-version --mojo-platform-channel-handle=2860 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,17916073971072596997,9255930388563480559,262144 --field-trial-handle=2428,i,4495677244675624293,9955166777450274439,262144 --variations-seed-version --mojo-platform-channel-handle=2388 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,3791579475956615750,16877737099026140366,2097152 --field-trial-handle=2428,i,4495677244675624293,9955166777450274439,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,16817605774570606361,6909566949054119022,2097152 --field-trial-handle=2428,i,4495677244675624293,9955166777450274439,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4168,i,2030018191137839182,5153101999668273676,2097152 --field-trial-handle=2428,i,4495677244675624293,9955166777450274439,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4164,i,11773485361558916323,16159462925826804415,2097152 --field-trial-handle=2428,i,4495677244675624293,9955166777450274439,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3424,i,4571671070592160574,5309662330284726189,524288 --field-trial-handle=2428,i,4495677244675624293,9955166777450274439,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3476,i,18160811464319029378,13296628482668770565,524288 --field-trial-handle=2428,i,4495677244675624293,9955166777450274439,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5692,i,6817012609687893665,10605642238473815701,524288 --field-trial-handle=2428,i,4495677244675624293,9955166777450274439,262144 --variations-seed-version --mojo-platform-channel-handle=5620 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5692,i,6817012609687893665,10605642238473815701,524288 --field-trial-handle=2428,i,4495677244675624293,9955166777450274439,262144 --variations-seed-version --mojo-platform-channel-handle=5620 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6352,i,16882872850476076870,5281284217955606287,524288 --field-trial-handle=2428,i,4495677244675624293,9955166777450274439,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6344,i,154292667194414439,10591818330261970655,524288 --field-trial-handle=2428,i,4495677244675624293,9955166777450274439,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6364,i,5121931947810949801,17525859677507174726,524288 --field-trial-handle=2428,i,4495677244675624293,9955166777450274439,262144 --variations-seed-version --mojo-platform-channel-handle=4840 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=2136,i,12675502936546571309,7126742736099828538,2097152 --field-trial-handle=2428,i,4495677244675624293,9955166777450274439,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4836,i,9955452871847707955,13571581191928758843,524288 --field-trial-handle=2428,i,4495677244675624293,9955166777450274439,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=3544,i,14216094823965606956,15759434106108275990,2097152 --field-trial-handle=2428,i,4495677244675624293,9955166777450274439,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5736,i,11446103285546152406,11539152676713474780,2097152 --field-trial-handle=2428,i,4495677244675624293,9955166777450274439,262144 --variations-seed-version --mojo-platform-channel-handle=6588 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6304,i,15955901483550561564,6063057318443504645,2097152 --field-trial-handle=2428,i,4495677244675624293,9955166777450274439,262144 --variations-seed-version --mojo-platform-channel-handle=6692 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=4164,i,3219720127004628893,102810835137017902,2097152 --field-trial-handle=2428,i,4495677244675624293,9955166777450274439,262144 --variations-seed-version --mojo-platform-channel-handle=6872 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=7108,i,3110691297719079343,12092038432203656956,2097152 --field-trial-handle=2428,i,4495677244675624293,9955166777450274439,262144 --variations-seed-version --mojo-platform-channel-handle=7096 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6172,i,12317932957836129,7136634491245663839,524288 --field-trial-handle=2428,i,4495677244675624293,9955166777450274439,262144 --variations-seed-version --mojo-platform-channel-handle=7060 /prefetch:82⤵
- Modifies registry class
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7008,i,13756622190897284991,10119471097303360694,524288 --field-trial-handle=2428,i,4495677244675624293,9955166777450274439,262144 --variations-seed-version --mojo-platform-channel-handle=6688 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6644,i,11097710073125664053,11604404870418703068,524288 --field-trial-handle=2428,i,4495677244675624293,9955166777450274439,262144 --variations-seed-version --mojo-platform-channel-handle=6616 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=6620,i,3596228218045428524,11082220006078324479,2097152 --field-trial-handle=2428,i,4495677244675624293,9955166777450274439,262144 --variations-seed-version --mojo-platform-channel-handle=7328 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7584,i,11129323094485741751,2145796493418719094,524288 --field-trial-handle=2428,i,4495677244675624293,9955166777450274439,262144 --variations-seed-version --mojo-platform-channel-handle=7208 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7732,i,15833877912680102680,16860750846722145266,524288 --field-trial-handle=2428,i,4495677244675624293,9955166777450274439,262144 --variations-seed-version --mojo-platform-channel-handle=7136 /prefetch:82⤵
-
-
C:\Users\Admin\Downloads\Setup.exe"C:\Users\Admin\Downloads\Setup.exe"2⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7876,i,7559732602933870178,1089070183380485102,262144 --field-trial-handle=2428,i,4495677244675624293,9955166777450274439,262144 --variations-seed-version --mojo-platform-channel-handle=7320 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6104,i,18375501700680118888,6233182360599711733,524288 --field-trial-handle=2428,i,4495677244675624293,9955166777450274439,262144 --variations-seed-version --mojo-platform-channel-handle=7904 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8032,i,11785579834782051135,1403495692067135686,524288 --field-trial-handle=2428,i,4495677244675624293,9955166777450274439,262144 --variations-seed-version --mojo-platform-channel-handle=8040 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6756,i,9443642259497724292,4025848929545872000,524288 --field-trial-handle=2428,i,4495677244675624293,9955166777450274439,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3580,i,5521451210199303832,9867624117468626111,524288 --field-trial-handle=2428,i,4495677244675624293,9955166777450274439,262144 --variations-seed-version --mojo-platform-channel-handle=8032 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3344,i,5296537491038627742,6127727012874630432,524288 --field-trial-handle=2428,i,4495677244675624293,9955166777450274439,262144 --variations-seed-version --mojo-platform-channel-handle=3352 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3740,i,10204102302886358528,7602380882452381825,524288 --field-trial-handle=2428,i,4495677244675624293,9955166777450274439,262144 --variations-seed-version --mojo-platform-channel-handle=3748 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\PCAppStore\PcAppStoreSRV.exe"C:\Program Files (x86)\PCAppStore\PcAppStoreSRV.exe"1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\PCAppStore\AutoUpdater.exe"C:\Program Files (x86)\PCAppStore\AutoUpdater.exe" /i /step=init2⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\PCAppStore\PcAppStore.exe"C:\Program Files (x86)\PCAppStore\PcAppStore.exe" /src=installer2⤵
- Downloads MZ/PE file
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2047 --user-data-dir="C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --mojo-named-platform-channel-pipe=5572.5844.54804918754790992293⤵
- Drops file in Program Files directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler "--user-data-dir=C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x160,0x164,0x168,0x13c,0x170,0x7fffd3e2b078,0x7fffd3e2b084,0x7fffd3e2b0904⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView" --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2047 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1728,i,8457279190233643006,15693510100185567898,262144 --variations-seed-version --mojo-platform-channel-handle=1724 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView" --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2047 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2036,i,8457279190233643006,15693510100185567898,262144 --variations-seed-version --mojo-platform-channel-handle=2052 /prefetch:34⤵
- Drops file in Program Files directory
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView" --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2047 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1740,i,8457279190233643006,15693510100185567898,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView" --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2047 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3628,i,8457279190233643006,15693510100185567898,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView" --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2047 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3956,i,8457279190233643006,15693510100185567898,262144 --variations-seed-version --mojo-platform-channel-handle=4008 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView" --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2047 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=4628,i,8457279190233643006,15693510100185567898,262144 --variations-seed-version --mojo-platform-channel-handle=4588 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --noerrdialogs --user-data-dir="C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView" --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2047 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=3968,i,8457279190233643006,15693510100185567898,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:84⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView" --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2047 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=5172,i,8457279190233643006,15693510100185567898,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView" --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2047 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4632,i,8457279190233643006,15693510100185567898,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView" --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2047 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=956,i,8457279190233643006,15693510100185567898,262144 --variations-seed-version --mojo-platform-channel-handle=4416 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView" --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2047 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=5196,i,8457279190233643006,15693510100185567898,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:84⤵
-
-
-
C:\Program Files (x86)\PCAppStore\download\ccsetup_online_setup.exe"C:\Program Files (x86)\PCAppStore\download\ccsetup_online_setup.exe" /Silent3⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\Temp\asw-020eb05d-06ba-4d1f-bf7d-906572ea2665\common\icarus.exeC:\Windows\Temp\asw-020eb05d-06ba-4d1f-bf7d-906572ea2665\common\icarus.exe /icarus-info-path:C:\Windows\Temp\asw-020eb05d-06ba-4d1f-bf7d-906572ea2665\icarus-info.xml /install /Silent4⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\Temp\asw-020eb05d-06ba-4d1f-bf7d-906572ea2665\piriform-ccl\icarus.exeC:\Windows\Temp\asw-020eb05d-06ba-4d1f-bf7d-906572ea2665\piriform-ccl\icarus.exe /Silent /er_master:master_ep_6c34a424-0a09-465c-8828-a052361593aa /er_ui:ui_ep_b876f014-e3e1-45a0-9abd-806bb41da799 /er_slave:piriform-ccl_slave_ep_bff3e351-c2c1-4bfc-a74a-a35e04bc35a6 /slave:piriform-ccl5⤵
- Downloads MZ/PE file
- Uses Session Manager for persistence
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Drops file in Program Files directory
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
-
-
-
C:\Program Files (x86)\PCAppStore\Watchdog.exe"C:\Program Files (x86)\PCAppStore\Watchdog.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\PCAppStore\PCAppStore.exe"C:\Program Files (x86)\PCAppStore\PCAppStore.exe" /src=shortcut1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Piriform\CCleaner 7\CCleaner_service.exe"C:\Program Files\Piriform\CCleaner 7\CCleaner_service.exe" service run1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- Drops desktop.ini file(s)
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ""C:\Windows\System32\Dism.exe" /Online /Cleanup-Image /AnalyzeComponentStore /English /NoRestart > "C:\Windows\TEMP\aits_dism9f6deb0093a38c1a.txt" 2>&1"2⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Dism.exe"C:\Windows\System32\Dism.exe" /Online /Cleanup-Image /AnalyzeComponentStore /English /NoRestart3⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\TEMP\5115DF0B-0588-4C97-841E-34D9D449340C\dismhost.exeC:\Windows\TEMP\5115DF0B-0588-4C97-841E-34D9D449340C\dismhost.exe {FFB72014-5C89-4F8C-8C30-EAC5689E8999}4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
-
-
-
-
C:\Program Files\Piriform\CCleaner 7\CCleaner.exe"C:\Program Files\Piriform\CCleaner 7\CCleaner.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=CCleaner.exe --webview-exe-version=7.10.1464.0 --user-data-dir="C:\Users\Admin\AppData\Roaming\CCleaner\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --enable-features=msWebView2EnableDraggableRegions --mojo-named-platform-channel-pipe=8028.8132.26079650411959065622⤵
- Drops file in Program Files directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\CCleaner\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\CCleaner\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x17c,0x180,0x184,0x158,0x1b8,0x7fffd3e2b078,0x7fffd3e2b084,0x7fffd3e2b0903⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\CCleaner\EBWebView" --webview-exe-name=CCleaner.exe --webview-exe-version=7.10.1464.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1776,i,5521384445992546710,1776051187398620526,262144 --enable-features=msWebView2EnableDraggableRegions --variations-seed-version --mojo-platform-channel-handle=1772 /prefetch:23⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\CCleaner\EBWebView" --webview-exe-name=CCleaner.exe --webview-exe-version=7.10.1464.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2024,i,5521384445992546710,1776051187398620526,262144 --enable-features=msWebView2EnableDraggableRegions --variations-seed-version --mojo-platform-channel-handle=2064 /prefetch:33⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\CCleaner\EBWebView" --webview-exe-name=CCleaner.exe --webview-exe-version=7.10.1464.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2292,i,5521384445992546710,1776051187398620526,262144 --enable-features=msWebView2EnableDraggableRegions --variations-seed-version --mojo-platform-channel-handle=2504 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\CCleaner\EBWebView" --webview-exe-name=CCleaner.exe --webview-exe-version=7.10.1464.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3480,i,5521384445992546710,1776051187398620526,262144 --enable-features=msWebView2EnableDraggableRegions --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\CCleaner\EBWebView" --webview-exe-name=CCleaner.exe --webview-exe-version=7.10.1464.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=4936,i,5521384445992546710,1776051187398620526,262144 --enable-features=msWebView2EnableDraggableRegions --variations-seed-version --mojo-platform-channel-handle=4952 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\CCleaner\EBWebView" --webview-exe-name=CCleaner.exe --webview-exe-version=7.10.1464.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=5172,i,5521384445992546710,1776051187398620526,262144 --enable-features=msWebView2EnableDraggableRegions --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\CCleaner\EBWebView" --webview-exe-name=CCleaner.exe --webview-exe-version=7.10.1464.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=4652,i,5521384445992546710,1776051187398620526,262144 --enable-features=msWebView2EnableDraggableRegions --variations-seed-version --mojo-platform-channel-handle=4540 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\CCleaner\EBWebView" --webview-exe-name=CCleaner.exe --webview-exe-version=7.10.1464.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=4656,i,5521384445992546710,1776051187398620526,262144 --enable-features=msWebView2EnableDraggableRegions --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\CCleaner\EBWebView" --webview-exe-name=CCleaner.exe --webview-exe-version=7.10.1464.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4896,i,5521384445992546710,1776051187398620526,262144 --enable-features=msWebView2EnableDraggableRegions --variations-seed-version --mojo-platform-channel-handle=4784 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\CCleaner\EBWebView" --webview-exe-name=CCleaner.exe --webview-exe-version=7.10.1464.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=5016,i,5521384445992546710,1776051187398620526,262144 --enable-features=msWebView2EnableDraggableRegions --variations-seed-version --mojo-platform-channel-handle=4548 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\CCleaner\EBWebView" --webview-exe-name=CCleaner.exe --webview-exe-version=7.10.1464.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4668,i,5521384445992546710,1776051187398620526,262144 --enable-features=msWebView2EnableDraggableRegions --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\CCleaner\EBWebView" --webview-exe-name=CCleaner.exe --webview-exe-version=7.10.1464.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4736,i,5521384445992546710,1776051187398620526,262144 --enable-features=msWebView2EnableDraggableRegions --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:83⤵
-
-
-
C:\Program Files\Common Files\Piriform\Icarus\piriform-ccl\icarus.exe"C:\Program Files\Common Files\Piriform\Icarus\piriform-ccl\icarus.exe"1⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Discovery
Browser Information Discovery
1Network Share Discovery
1Peripheral Device Discovery
2Query Registry
7Software Discovery
1Security Software Discovery
1System Information Discovery
7System Location Discovery
1System Language Discovery
1System Time Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
AutoUpdater.exe
PCAppStore.exe
PCAppStoreSRV.exe
ReadMe.txt
Uninstaller.exe
protocols.json
settings.dat
settings.dat
throttle_store.dat
f_000004
f_000024
f_00002d
the-real-index
the-real-index
data_0
data_1
data_2
data_3
MANIFEST-000001
Network Persistent State
Network Persistent State~RFe5a6311.TMP
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity~RFe59a29f.TMP
Preferences
Preferences
Preferences~RFe59a195.TMP
CURRENT
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State~RFe594627.TMP
Watchdog.exe
1029723924.html
1259544006.html
cache_setup.json
cache_setup.json
ccsetup_online_setup.exe
pcappstore.ico
CCleaner.exe
CCleanerBugReport.exe
CCleanerDU.dll
CCleanerReactivator.exe
CCleaner_service.exe
WebView2Loader.dll
avDump.exe
ccleaner.ini
concrt140.dll
config.def
config.def
opm.ini
pc_health.json
pc_health.json
pc_health.json
pc_health.json
pc_health.json
pc_health.json
pc_health.json
pc_health.json
pc_health.json
pc_health.json
pc_health.json
pc_health.json
pc_health.json
pc_health.json
pc_health.json
persistent_data.json
persistent_data.json
persistent_data.json
persistent_data.json
persistent_data.json
persistent_data.json
persistent_data.json
persistent_data.json
settings.ini
About.css
AllGood.svg
AllGood2.svg
AmazonPrime_Icon.svg
Amazon_Music_Icon.svg
Arc_Browser_Icon.svg
AttentionModal.css
BottomPanel.css
Button.css
ButtonSettings.css
CCleaner_Beta_Icon_24_24.svg
CCleaner_Icon.svg
CleaningProgress.css
CloseBrowsersModal.css
CloudDriveCleaner.css
ClutterCleared.svg
ClutterCleared2.svg
CustomClean.css
Dashboard_CatBalloons.svg
Dashboard_CatBalloons2.svg
Dashboard_PersonCards.svg
Dashboard_PersonCards2.svg
Dashboard_PersonContemplating.svg
Dashboard_PersonContemplating2.svg
Dashboard_PersonReading.svg
Dashboard_PersonReading2.svg
Dashboard_PersonScanning.svg
Dashboard_PersonScanning2.svg
Dashboard_PersonUsingLaptop.svg
Dashboard_PersonUsingLaptop2.svg
Dashboard_Pinwheel.svg
Dashboard_Pinwheel2.svg
Debug.css
DescriptionTooltip.css
DriveList.css
Dropdown.css
ErrorModal.css
FocusTime.svg
FocusTime2.svg
FreedUpSpace.svg
FreedUpSpace2.svg
General.css
Healthy_Laptop_Bar.svg
Healthy_Laptop_Bar2.svg
Help.css
IdeasPortal.css
InputFolder.css
IpmBanner.css
Kamo_Icon.svg
LaptopRocket.svg
LaptopTrashCan.svg
LaptopTrashCan2.svg
LaptopWithBin.svg
LaptopWithBin2.svg
MenuItem.css
Moderate_Laptop_Bar.svg
Moderate_Laptop_Bar2.svg
MoreInformation.svg
MoreInformation2.svg
MySubscription.css
OnboardingModal.css
OverlayScrollbar.css
PaintShopPro_Icon.svg
PeopleSearching.svg
PeopleSearching2.svg
PeopleWithKite.svg
PeopleWithKite2.svg
PersonCleaning.svg
PersonHoldingAttentionSign.svg
PersonHoldingAttentionSign2.svg
PersonHoldingBrokenCable.svg
PersonHoldingBrokenCable2.svg
PersonHoldingCards.svg
PersonHoldingCards2.svg
PersonHoldingStopSign.svg
PersonHoldingStopSign2.svg
PersonHoldingSuccessSign.svg
PersonHoldingSuccessSign2.svg
PersonLevitating.svg
PersonLevitating2.svg
Poor_Laptop_Bar.svg
Poor_Laptop_Bar2.svg
Privacy.css
PrivacyResults.css
PrivacyScanResults.css
Progress.css
Progress2.css
Progress3.css
Progress4.css
Progress5.css
Progress6.css
Progress7.css
ProhibitedCountryModal.css
Recuva_Icon.svg
RegistryFixed.svg
RegistryFixed2.svg
ResolveIssuesResults.css
ResolveIssuesScanResults.css
ResolveIssuesScanUpsell.css
RestartModal.css
RestartServiceModal.css
Results.css
Results2.css
ResultsCleaning.css
ResultsDisable.css
ResultsEnable.css
ResultsOptimize.css
ResultsRemove.css
ResultsScan.css
ResultsScan2.css
ResultsScan3.css
ResultsUpdate.css
ResultsUpdate2.css
ScanProgress.css
ScanResults.css
Scheduling.css
Settings.css
SettingsOverlay.css
Shield_UAC.svg
ShutdownModal.css
SpaceResults.css
SpaceScanResults.css
Speccy_Icon.svg
Statistics.css
StatusIcon.css
StepHeader.css
Stepper.css
SummaryResults.css
TabList.css
Table.css
TableCollapsible.css
TableThreeLevelsCollapsible.css
TextEllipses.css
TextWithLink.css
Theme_Auto_Icon.svg
Theme_Dark_Icon.svg
Theme_Light_Icon.svg
Titlebar.css
TopPanel.css
TrackersRemoved.svg
TrackersRemoved2.svg
Updated.svg
Updated2.svg
Updates.css
ViewDetailsModal.css
Welcome.css
Welcome2.css
Welcome3.css
Welcome4.css
Welcome5.css
Welcome6.css
Welcome7.css
Welcome8.css
Welcome_PersonSpringCleaning.svg
Welcome_PersonSpringCleaning2.svg
ccleaner-dark-additional.css
ccleaner-light-additional.css
driver_updater.css
frame.css
index.css
privacy2.css
processed.css
resolve_issues.css
results3.css
rules.css
service.css
settings2.css
space.css
spawn-ccleaner-dark.css
spawn-ccleaner.css
About.js
AttentionModal.js
BottomPanel.js
Button.js
ButtonSettings.js
Checkbox.js
CheckboxLead.js
CleaningProgress.js
CloseBrowsersModal.js
CloudDriveCleaner.js
CustomClean.js
CustomClean2.js
Dashboard_Boost_Icon.js
Dashboard_Browser_Icon.js
Dashboard_Fast_Icon.js
Dashboard_Scan_Icon.js
Debug.js
DescriptionTooltip.js
DiskAnalyzer.js
DriveList.js
DriverUpdater.js
Dropdown.js
ErrorModal.js
General.js
GenericProgramIcon.js
Grayed_Ellipse_Icon.js
HealthCheck.js
Help.js
History_Icon.js
IconButton.js
IdeasPortal.js
Illustration.js
Input.js
InputFolder.js
IpmBanner.js
MenuItem.js
MySubscription.js
OnboardingModal.js
OverlayScrollbar.js
PageHeader.js
PageTitle.js
PerformanceOptimizer.js
Privacy.js
PrivacyResults.js
PrivacyScanResults.js
ProgramInstallerModal.js
Progress.js
Progress2.js
Progress3.js
Progress4.js
Progress5.js
Progress6.js
Progress7.js
Progress8.js
ProhibitedCountryModal.js
RadioButton.js
ResolveIssuesResults.js
ResolveIssuesScanResults.js
ResolveIssuesScanUpsell.js
RestartModal.js
RestartServiceErrorModal.js
RestartServiceModal.js
Results2.js
Results3.js
ResultsCleaning.js
ResultsDisable.js
ResultsEnable.js
ResultsOptimize.js
ResultsRemove.js
ResultsScan.js
ResultsScan2.js
ResultsScan3.js
ResultsUpdate.js
ResultsUpdate2.js
RocketWithBadge_Icon.js
Rocket_Icon.js
Router.js
ScanProgress.js
ScanResults.js
Scheduling.js
Select.js
Settings.js
SettingsOverlay.js
ShutdownModal.js
SoftwareRemover.js
SoftwareUpdater.js
SpaceResults.js
SpaceScanResults.js
StartupManager.js
Statistics.js
StatusIcon.js
StepHeader.js
Stepper.js
SummaryResults.js
Switch.js
TabList.js
Table.js
TableCollapsible.js
TableThreeLevelsCollapsible.js
TextEllipses.js
TextWithLink.js
Theme_Light_Icon.js
TimeSinceText.js
Titlebar.js
TopPanel.js
Updates.js
ViewDetailsModal.js
Welcome.js
Welcome2.js
Welcome3.js
Welcome4.js
Welcome5.js
Welcome6.js
Welcome7.js
Welcome8.js
accessibility_audit.js
analytics.js
ar.js
be.js
bg.js
bn.js
ca.js
chunk.js
constants.js
constants2.js
cs.js
custom_clean.js
da.js
de.js
driver_updater.js
el.js
en.js
errors.js
errors2.js
errors3.js
es_ES.js
et.js
fa.js
feedback.js
fi.js
fr.js
he.js
hi.js
hr.js
hu.js
id.js
index-client.js
index.npm.js
it.js
ja.js
ko.js
l10n.js
location.js
lodash.js
logging.js
lt.js
lv.js
ms.js
nb.js
nitro-ui-i18n.js
nl.js
onboarding.js
performance_optimizer.js
pl.js
preload-helper.js
privacy2.js
processed.js
pt_BR.js
pt_PT.js
resolve_issues.js
results.js
ro.js
ru.js
rules.js
selections.js
service.js
service2.js
service3.js
service4.js
service5.js
settings2.js
settings3.js
settings4.js
settings5.js
settings6.js
settings7.js
settings8.js
settings_state.js
sk.js
sl.js
software_remover.js
space.js
sr_CS.js
summary.js
sv_SE.js
th.js
tr.js
uk.js
updates_notification.js
ur_PK.js
vi.js
webview.js
zh_CN.js
zh_TW.js
frame.html
frame.js
index.html
index.js
libwaapi.dll
libwaheap.dll
libwalocal.dll
libwaresource.dll
libwautils.dll
libwavmodapi.dll
licenses-gui.txt
licenses-service-1.html
licenses-service-2.txt
DriverUpdEngTask.log
ccleaner_modules.log
msvcp140.dll
msvcp140_1.dll
msvcp140_2.dll
msvcp140_atomic_wait.dll
msvcp140_codecvt_ids.dll
readme.txt
ucrtbase.dll
vccorlib140.dll
vcruntime140.dll
vcruntime140_1.dll
vcruntime140_threads.dll
wa_3rd_party_host_32.exe
wa_3rd_party_host_64.exe
LICENSE
manifest.json
manifest.json
manifest.fingerprint
manifest.json
hyph-as.hyb
hyph-hi.hyb
hyph-nb.hyb
manifest.json
manifest.json
manifest.json
crl-set
manifest.json
MicrosoftEdgeWebview2Setup.exe
icarus.log
sfx.log
icarus.ini
icarus.ini
773CFF2C7835D48C4E76FE153DBA9F81_D9070B80E002B56309375EAD5B6A198F
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_C39E9DBC666D19C07EEE7CD1E11AF8BE
773CFF2C7835D48C4E76FE153DBA9F81_D9070B80E002B56309375EAD5B6A198F
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_C39E9DBC666D19C07EEE7CD1E11AF8BE
blocklist
settings.dat
settings.dat
LOG.old
LOG.old
MANIFEST-000001
BookmarkMergedSurfaceOrdering
f_000083
f_000084
f_000085
f_000086
f_0000ad
70f097800b7e703e_0
b3553646eca2933c_0
the-real-index
the-real-index
the-real-index~RFe588131.TMP
SiteList-Enterprise.json
Edge Profile.ico
History
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
Preferences
Preferences
Preferences
Secure Preferences
Secure Preferences
the-real-index
the-real-index~RFe5ca03f.TMP
index.txt
sync_diagnostic.log
fc5e88b4-0118-41ad-8cf9-8fd9b65d0486.tmp
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
RevisitationBloomfilter
RevisitationBloomfilter~RFe58fb14.TMP
c68fae63-548a-453b-9acd-7fbc841017d2.tmp
5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
pixel[2].gif
AutoUpdater.exe
settings.dat
settings.dat
index
the-real-index
the-real-index
29e42b29-5c21-42eb-a7d9-898d01dcaada.tmp
Network Persistent State
Network Persistent State~RFe5b7fac.TMP
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity~RFe5b5475.TMP
Preferences
Preferences
Preferences
Preferences~RFe5ac620.TMP
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State~RFe5a474b.TMP
crs.pb
ct_config.pb
kp_pinslist.pb
default.dic
Setup.exe
dism.log
icarus_rvrt.exe
bug_report.exe
icarus.exe
icarus_ui.exe
product-info.xml
ecoo.edat
icarus-info.xml
dump_process.exe
product-def.xml
setupui.cont
desktop.ini
memory/5160-748-0x00007FFFF4A30000-0x00007FFFF4A31000-memory.dmp
memory/5344-822-0x00007FFFF3E30000-0x00007FFFF3E31000-memory.dmp
memory/5344-821-0x00007FFFF3A40000-0x00007FFFF3A41000-memory.dmp
memory/6116-852-0x00007FFFF4A30000-0x00007FFFF4A31000-memory.dmp
memory/12412-4715-0x000001FFA48B0000-0x000001FFA48B1000-memory.dmp
memory/12412-4716-0x000001FFA48B0000-0x000001FFA48B1000-memory.dmp
memory/12412-4717-0x000001FFA48B0000-0x000001FFA48B1000-memory.dmp
memory/12412-4721-0x000001FFA48B0000-0x000001FFA48B1000-memory.dmp
memory/12412-4711-0x000001FFA48B0000-0x000001FFA48B1000-memory.dmp
memory/12412-4710-0x000001FFA48B0000-0x000001FFA48B1000-memory.dmp
memory/12412-4709-0x000001FFA48B0000-0x000001FFA48B1000-memory.dmp
memory/12412-4720-0x000001FFA48B0000-0x000001FFA48B1000-memory.dmp
memory/12412-4719-0x000001FFA48B0000-0x000001FFA48B1000-memory.dmp
memory/12412-4718-0x000001FFA48B0000-0x000001FFA48B1000-memory.dmp