Analysis
- user interaction
yes - max time kernel
735s - max time network
770s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
13/08/2026, 18:37
General
- Target procexp64.exe
- Size 2.3MB
- Sample260813-w9tc4aej21
- SHA256 d2c9351b60208915647b56e902bcecd87b9694b5b406e09500396f64f826b5ff
Malware Config
Signatures
- Drops file in Drivers directory 1 IoCs
- Sets service image path in registry 3 TTPs 1 IoCs
This determines the executable launched when a service starts. It can be used to establish persistence.
- Adds Run key to start application 2 TTPs 1 IoCs
- Downloads MZ/PE file 1 IoCs
- Drops desktop.ini file(s) 4 IoCs
- Enumerates connected drives 3 TTPs 47 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs
- Network Share Discovery 1 TTPs
Attempt to gather information on host network.
- Drops file in System32 directory 51 IoCs
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks system information in the registry 2 TTPs 12 IoCs
System information is often read in order to detect sandboxing environments.
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 30 IoCs
- Executes dropped EXE 31 IoCs
- Loads dropped DLL 64 IoCs
- Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs
When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 24 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 6 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
- Checks SCSI registry key(s) 3 TTPs 23 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 58 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 15 IoCs
- Modifies data under HKEY_USERS 11 IoCs
- Modifies registry class 64 IoCs
- Modifies system certificate store 2 TTPs 3 IoCs
- NTFS ADS 2 IoCs
- Runs .reg file with regedit 2 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 3 IoCs
- Suspicious behavior: LoadsDriver 1 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 29 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 46 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\procexp64.exe"C:\Users\Admin\AppData\Local\Temp\procexp64.exe"1⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Enumerates connected drives
- Checks system information in the registry
- Checks SCSI registry key(s)
- Checks processor information in registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffcbda1c728,0x7ffcbda1c734,0x7ffcbda1c7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1460,i,9689177460469357156,11333968892681209609,524288 --field-trial-handle=2572,i,234430789101520167,5490618190341144677,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2600 /prefetch:112⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1596,i,16721919040248709719,15458730971496775906,262144 --field-trial-handle=2572,i,234430789101520167,5490618190341144677,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2548 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2068,i,3415532716092522871,12152152779315084398,524288 --field-trial-handle=2572,i,234430789101520167,5490618190341144677,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2628 /prefetch:132⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3256,i,4786235560071270460,10742258495249262248,2097152 --field-trial-handle=2572,i,234430789101520167,5490618190341144677,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3452 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3260,i,16472026317244241915,13995417486976430024,2097152 --field-trial-handle=2572,i,234430789101520167,5490618190341144677,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3472 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4336,i,2255339236961484928,13628565937433459090,2097152 --field-trial-handle=2572,i,234430789101520167,5490618190341144677,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4352 /prefetch:92⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4664,i,4655500852531515835,5414046135516678570,2097152 --field-trial-handle=2572,i,234430789101520167,5490618190341144677,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4696 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5592,i,8799847851180189153,16193743318259829854,524288 --field-trial-handle=2572,i,234430789101520167,5490618190341144677,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5600 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6028,i,14709043798499234937,2065771217807671381,524288 --field-trial-handle=2572,i,234430789101520167,5490618190341144677,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6044 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6036,i,7984758214422006014,10550049137415651067,524288 --field-trial-handle=2572,i,234430789101520167,5490618190341144677,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6048 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6040,i,10094257267291277373,2338158240580946150,524288 --field-trial-handle=2572,i,234430789101520167,5490618190341144677,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6056 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=4368,i,17770194514544286091,16317760265552873545,2097152 --field-trial-handle=2572,i,234430789101520167,5490618190341144677,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6036 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6116,i,16516101696825528696,6656779212482250797,2097152 --field-trial-handle=2572,i,234430789101520167,5490618190341144677,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6132 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=3600,i,10882995483619840220,8840329377952461617,262144 --field-trial-handle=2572,i,234430789101520167,5490618190341144677,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3260 /prefetch:102⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=3528,i,17103729641787591413,4244959691200373503,2097152 --field-trial-handle=2572,i,234430789101520167,5490618190341144677,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3676 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5880,i,952549844186775994,7753602745128122668,2097152 --field-trial-handle=2572,i,234430789101520167,5490618190341144677,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3728 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=3656,i,9823727843039165371,5270307049335335502,2097152 --field-trial-handle=2572,i,234430789101520167,5490618190341144677,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3516 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=3564,i,10912203909520268090,8139302185533132410,2097152 --field-trial-handle=2572,i,234430789101520167,5490618190341144677,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5904 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4336,i,14714158763778437897,10110730447135440407,524288 --field-trial-handle=2572,i,234430789101520167,5490618190341144677,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6040 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4676,i,16406851684325299113,5565583405907463340,524288 --field-trial-handle=2572,i,234430789101520167,5490618190341144677,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4328 /prefetch:142⤵
- NTFS ADS
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6056,i,7171264257128623443,4032001709621533625,2097152 --field-trial-handle=2572,i,234430789101520167,5490618190341144677,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6196 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6520,i,6954487430245876166,6898651174762297002,2097152 --field-trial-handle=2572,i,234430789101520167,5490618190341144677,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6488 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=5792,i,1915969056383115020,11084065182959763730,2097152 --field-trial-handle=2572,i,234430789101520167,5490618190341144677,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6140 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=3944,i,1575039246836880321,10484418221563799444,2097152 --field-trial-handle=2572,i,234430789101520167,5490618190341144677,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6192 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=5696,i,3188498932917940836,5831004109348590303,2097152 --field-trial-handle=2572,i,234430789101520167,5490618190341144677,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5944 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=3640,i,15086257320599085062,11805072242999856156,2097152 --field-trial-handle=2572,i,234430789101520167,5490618190341144677,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5716 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=6352,i,18098814797436028214,5836441700030905333,2097152 --field-trial-handle=2572,i,234430789101520167,5490618190341144677,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6376 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=6072,i,12133783605277930918,4002371732503071628,2097152 --field-trial-handle=2572,i,234430789101520167,5490618190341144677,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5924 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=6276,i,3732073659832790898,7761612431737021842,2097152 --field-trial-handle=2572,i,234430789101520167,5490618190341144677,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3600 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=5816,i,13269652809786322007,10544270735495214085,2097152 --field-trial-handle=2572,i,234430789101520167,5490618190341144677,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6084 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5904,i,13621827042702628749,14284885609319601933,524288 --field-trial-handle=2572,i,234430789101520167,5490618190341144677,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3640 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=6692,i,14461042065808492853,7724872916400059309,524288 --field-trial-handle=2572,i,234430789101520167,5490618190341144677,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6316 /prefetch:122⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --metrics-shmem-handle=6652,i,11668808861329561623,13014811194254756766,2097152 --field-trial-handle=2572,i,234430789101520167,5490618190341144677,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6744 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --metrics-shmem-handle=6644,i,497011585961038307,3438065569730796079,2097152 --field-trial-handle=2572,i,234430789101520167,5490618190341144677,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --metrics-shmem-handle=7008,i,16372532317509654730,17918773930670159879,2097152 --field-trial-handle=2572,i,234430789101520167,5490618190341144677,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6892 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --metrics-shmem-handle=7012,i,4916433118689239111,14515154257847834680,2097152 --field-trial-handle=2572,i,234430789101520167,5490618190341144677,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6908 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --metrics-shmem-handle=7128,i,8165973532947597125,14141025496311768382,2097152 --field-trial-handle=2572,i,234430789101520167,5490618190341144677,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6924 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --metrics-shmem-handle=7312,i,2155223755515771333,2733759498312020148,2097152 --field-trial-handle=2572,i,234430789101520167,5490618190341144677,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7284 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --metrics-shmem-handle=7520,i,873010361436834558,18136488546666124783,2097152 --field-trial-handle=2572,i,234430789101520167,5490618190341144677,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7512 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --metrics-shmem-handle=6932,i,13090932922592059338,14246595957017678735,2097152 --field-trial-handle=2572,i,234430789101520167,5490618190341144677,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7148 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --metrics-shmem-handle=6496,i,6641053110796523499,4634478664352404982,2097152 --field-trial-handle=2572,i,234430789101520167,5490618190341144677,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6568 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6932,i,15180405428241834850,8955496954421064811,524288 --field-trial-handle=2572,i,234430789101520167,5490618190341144677,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6788 /prefetch:142⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
-
-
C:\Users\Admin\Downloads\7z2602-x64.exe"C:\Users\Admin\Downloads\7z2602-x64.exe"2⤵
- Executes dropped EXE
- Modifies registry class
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\system32\werfault.exewerfault.exe /hc /shared Global\8fdc69e0d23944678d1820e6a64f7ba1 /t 3716 /p 36201⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Enumerates system info in registry
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\werfault.exewerfault.exe /hc /shared Global\481ee0401b284840b1c658d537c418ec /t 5464 /p 42081⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\werfault.exewerfault.exe /hc /shared Global\870e79eeca334b23a19ebced7fb0669a /t 5696 /p 18601⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\7-Zip\7z.exe"C:\Program Files\7-Zip\7z.exe" "C:\Users\Admin\Downloads\Image-Line.FL.Studio.Producer.Edition.25.1.6.4997.x64.All.Plugins.Edition.rar"2⤵
- Executes dropped EXE
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files\7-Zip\7z.exe"C:\Program Files\7-Zip\7z.exe" "C:\Users\Admin\Downloads\Image-Line.FL.Studio.Producer.Edition.25.1.6.4997.x64.All.Plugins.Edition.rar"1⤵
- Executes dropped EXE
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\Image-Line.FL.Studio.Producer.Edition.25.1.6.4997.x64.All.Plugins.Edition.rar"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
-
-
C:\Users\Admin\Desktop\Image-Line.FL.Studio.Producer.Edition.25.1.6.4997.x64.All.Plugins.Edition\flstudio_win64_25.1.6.4997.exe"C:\Users\Admin\Desktop\Image-Line.FL.Studio.Producer.Edition.25.1.6.4997.x64.All.Plugins.Edition\flstudio_win64_25.1.6.4997.exe"1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsqB679.tmp\tempfile.ps1"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsqB679.tmp\tempfile.ps1"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsqB679.tmp\tempfile.ps1"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsqB679.tmp\tempfile.ps1"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsqB679.tmp\tempfile.ps1"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsqB679.tmp\tempfile.ps1"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsqB679.tmp\tempfile.ps1"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebView2RuntimeInstallerX64.exe"C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebView2RuntimeInstallerX64.exe" /silent /install2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\Microsoft\Temp\EUFA8C.tmp\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\Temp\EUFA8C.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20WebView2%20Runtime&needsadmin=Prefers"3⤵
- Event Triggered Execution: Image File Execution Options Injection
- Checks system information in the registry
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.61\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.61\MicrosoftEdgeUpdateComRegisterShell64.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.61\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.61\MicrosoftEdgeUpdateComRegisterShell64.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.61\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.61\MicrosoftEdgeUpdateComRegisterShell64.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNjEiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNjEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NUE0QUVGRTgtRTc5MS00OEFBLUI1NjMtQ0Y5RTcyMDg5RDBFfSIgdXNlcmlkPSJ7N0IyMEMwMTEtQTA4OC00NkRDLUIyNkItRTI0QzczODNBRTNDfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntBOTA5MDg3MS1EOUJGLTQwMzYtQTM4OS1FQjVCNEU4QTAyRDh9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iMTYiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4yMjAwMC40OTMiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iREFEWSIgcHJvZHVjdF9uYW1lPSJEYWR5IHN1cGVyIHBvd2VyZnVsIFBDIi8-PGV4cCBldGFnPSImcXVvdDtzVGFURlVvZFZPNmJnOXlubGpzQ3VscUMyTldZYmpiVEpEbHRmQ1B3VnlnPSZxdW90OyIvPjxhcHAgYXBwaWQ9IntGM0M0RkUwMC1FRkQ1LTQwM0ItOTU2OS0zOThBMjBGMUJBNEF9IiB2ZXJzaW9uPSIxLjMuMTk1LjY1IiBuZXh0dmVyc2lvbj0iMS4zLjE5NS42MSIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTE2MTIyNzEwNjciIGluc3RhbGxfdGltZV9tcz0iNTE1Ii8-PC9hcHA-PC9yZXF1ZXN0Pg4⤵
- Checks system information in the registry
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20WebView2%20Runtime&needsadmin=Prefers" /installsource offline /sessionid "{5A4AEFE8-E791-48AA-B563-CF9E72089D0E}" /silent /offlinedir "{E14BB079-008B-41AC-8FD5-6E11635F0E83}"4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\SYSTEM32\regsvr32.exeregsvr32.exe /s "C:\Program Files\Image-Line\FL Studio ASIO\ILWASAPI2ASIO_x64.dll"2⤵
- Loads dropped DLL
-
-
C:\Program Files\Image-Line\FL Studio 2025\System\Installers\FL Cloud Plugins Installer.exe"C:\Program Files\Image-Line\FL Studio 2025\System\Installers\FL Cloud Plugins Installer.exe" /verysilent2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\is-G9932.tmp\FL Cloud Plugins Installer.tmp"C:\Users\Admin\AppData\Local\Temp\is-G9932.tmp\FL Cloud Plugins Installer.tmp" /SL5="$180032,29842025,844800,C:\Program Files\Image-Line\FL Studio 2025\System\Installers\FL Cloud Plugins Installer.exe" /verysilent3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\is-UKNIM.tmp\VC_redist.x64.exe"C:\Users\Admin\AppData\Local\Temp\is-UKNIM.tmp\VC_redist.x64.exe" /quiet /norestart /repair4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\Temp\{C908C503-C614-4E5B-824A-7FB1471DAA32}\.cr\VC_redist.x64.exe"C:\Windows\Temp\{C908C503-C614-4E5B-824A-7FB1471DAA32}\.cr\VC_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-UKNIM.tmp\VC_redist.x64.exe" -burn.filehandle.attached=568 -burn.filehandle.self=692 /quiet /norestart /repair5⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Windows\Temp\{94EE8D6F-CA30-45CC-A4B0-09C460ABEFFF}\.be\VC_redist.x64.exe"C:\Windows\Temp\{94EE8D6F-CA30-45CC-A4B0-09C460ABEFFF}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{F739B2D0-2B45-402C-89BC-E37F446802A9} {A81DD651-57C6-4B12-8816-3F664C0733B5} 58886⤵
- Adds Run key to start application
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={c649ede4-f16a-4486-a117-dcc2f2a35165} -burn.filehandle.self=1056 -burn.embedded BurnPipe.{A3AF1445-2914-4291-9195-8C3B0EC5DE6F} {B04D815F-29C4-4423-94AE-B6C6C8DE480C} 58967⤵
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=544 -burn.filehandle.self=560 -uninstall -quiet -burn.related.upgrade -burn.ancestors={c649ede4-f16a-4486-a117-dcc2f2a35165} -burn.filehandle.self=1056 -burn.embedded BurnPipe.{A3AF1445-2914-4291-9195-8C3B0EC5DE6F} {B04D815F-29C4-4423-94AE-B6C6C8DE480C} 58968⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{1AB8675C-5D30-4AEB-B412-A54E2AC2B5F8} {CEDAC7AE-A8F8-419F-A7B2-03D0FED91B59} 52809⤵
- System Location Discovery: System Language Discovery
-
-
-
-
-
-
-
-
-
C:\Windows\regedit.exe"regedit.exe" "C:\Users\Admin\Desktop\Image-Line.FL.Studio.Producer.Edition.25.1.6.4997.x64.All.Plugins.Edition\FL Studio 25.1.reg"1⤵
- Runs .reg file with regedit
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc1⤵
- Checks system information in the registry
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNjEiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNjEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NUE0QUVGRTgtRTc5MS00OEFBLUI1NjMtQ0Y5RTcyMDg5RDBFfSIgdXNlcmlkPSJ7N0IyMEMwMTEtQTA4OC00NkRDLUIyNkItRTI0QzczODNBRTNDfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7QkYwNTYyNEYtMTY4RC00MzI5LTlCQ0QtNTQ1OTc0REZFODY4fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjE2IiBkaXNrX3R5cGU9IjIiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMjIwMDAuNDkzIiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IkRBRFkiIHByb2R1Y3RfbmFtZT0iRGFkeSBzdXBlciBwb3dlcmZ1bCBQQyIvPjxleHAgZXRhZz0iJnF1b3Q7c1RhVEZVb2RWTzZiZzl5bmxqc0N1bHFDMk5XWWJqYlRKRGx0ZkNQd1Z5Zz0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNjLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iMTQwLjAuNzMzOS44MSIgbmV4dHZlcnNpb249IiIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iOTEiIGluc3RhbGxkYXRldGltZT0iMTc3ODczMDA2OCIgb29iZV9pbnN0YWxsX3RpbWU9IjEzNDIzMjAyNTc2NDYxMDAwMCI-PGV2ZW50IGV2ZW50dHlwZT0iMzEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjIxNzk4NjIiIHN5c3RlbV91cHRpbWVfdGlja3M9IjExNjE3MTE0NTUxIi8-PC9hcHA-PC9yZXF1ZXN0Pg2⤵
- Checks system information in the registry
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{2253CF18-88E6-4ECA-A660-F6FD292DCBB3}\MicrosoftEdgeWebview_X64_138.0.3351.65.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{2253CF18-88E6-4ECA-A660-F6FD292DCBB3}\MicrosoftEdgeWebview_X64_138.0.3351.65.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level2⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{2253CF18-88E6-4ECA-A660-F6FD292DCBB3}\EDGEMITMP_60DCA.tmp\setup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{2253CF18-88E6-4ECA-A660-F6FD292DCBB3}\EDGEMITMP_60DCA.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{2253CF18-88E6-4ECA-A660-F6FD292DCBB3}\MicrosoftEdgeWebview_X64_138.0.3351.65.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level3⤵
- Drops file in Windows directory
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{2253CF18-88E6-4ECA-A660-F6FD292DCBB3}\EDGEMITMP_60DCA.tmp\setup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{2253CF18-88E6-4ECA-A660-F6FD292DCBB3}\EDGEMITMP_60DCA.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=138.0.7204.97 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{2253CF18-88E6-4ECA-A660-F6FD292DCBB3}\EDGEMITMP_60DCA.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=138.0.3351.65 --initial-client-data=0x230,0x234,0x238,0x20c,0x23c,0x7ff794e2d4c8,0x7ff794e2d4d4,0x7ff794e2d4e04⤵
- Drops file in Windows directory
- Executes dropped EXE
-
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNjEiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNjEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NUE0QUVGRTgtRTc5MS00OEFBLUI1NjMtQ0Y5RTcyMDg5RDBFfSIgdXNlcmlkPSJ7N0IyMEMwMTEtQTA4OC00NkRDLUIyNkItRTI0QzczODNBRTNDfSIgaW5zdGFsbHNvdXJjZT0ib2ZmbGluZSIgcmVxdWVzdGlkPSJ7OTg3QkU1MkMtRUM0Qy00N0MzLUE3MEEtMEVFQ0YxNTRDRDYyfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjE2IiBkaXNrX3R5cGU9IjIiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMjIwMDAuNDkzIiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IkRBRFkiIHByb2R1Y3RfbmFtZT0iRGFkeSBzdXBlciBwb3dlcmZ1bCBQQyIvPjxleHAgZXRhZz0iJnF1b3Q7SGh2SElXcFVOWlRNblYyVlQxbGUzZjVZSlE5T1NvVEQ2TXhIRGxBODlQZz0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjMwMTcyMjYtRkUyQS00Mjk1LThCREYtMDBDM0E5QTdFNEM1fSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMTM4LjAuMzM1MS42NSIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiIgZXhwZXJpbWVudHM9ImNvbnNlbnQ9ZmFsc2UiIGluc3RhbGxhZ2U9IjkxIj48dXBkYXRlY2hlY2svPjxldmVudCBldmVudHR5cGU9IjkiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjExNjIyMjcwOTI0IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTE2MjI0MjY4OTkiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxMTYzNDkyNjg2MiIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjYiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjExNjUyMTE0MjExIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMTk2NzU3IiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxMjI4NTIzOTUxMiIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgZG93bmxvYWRlZD0iMTgwMDc4NjcyIiB0b3RhbD0iMTgwMDc4NjcyIiBwYWNrYWdlX2NhY2hlX3Jlc3VsdD0iMSIgaW5zdGFsbF90aW1lX21zPSI2MzI5NyIvPjwvYXBwPjwvcmVxdWVzdD42⤵
- Checks system information in the registry
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\wermgr.exe"C:\Windows\system32\wermgr.exe" "-outproc" "0" "3956" "904" "808" "816" "0" "0" "0" "0" "0" "0" "0" "0"2⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
-
-
C:\Windows\regedit.exe"regedit.exe" "C:\Users\Admin\Desktop\Image-Line.FL.Studio.Producer.Edition.25.1.6.4997.x64.All.Plugins.Edition\FL Studio 25.1.reg"1⤵
- Runs .reg file with regedit
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:21⤵
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
-
C:\ProgramData\Package Cache\{c649ede4-f16a-4486-a117-dcc2f2a35165}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{c649ede4-f16a-4486-a117-dcc2f2a35165}\VC_redist.x64.exe" /burn.runonce1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{c649ede4-f16a-4486-a117-dcc2f2a35165}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{c649ede4-f16a-4486-a117-dcc2f2a35165}\VC_redist.x64.exe" /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260813203937.log"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{c649ede4-f16a-4486-a117-dcc2f2a35165}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{c649ede4-f16a-4486-a117-dcc2f2a35165}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{c649ede4-f16a-4486-a117-dcc2f2a35165}\VC_redist.x64.exe" -burn.filehandle.attached=544 -burn.filehandle.self=560 /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260813203937.log"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{c649ede4-f16a-4486-a117-dcc2f2a35165}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{c649ede4-f16a-4486-a117-dcc2f2a35165}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{7D74DCFB-135F-438F-B875-3EB284C0CD56} {47B096A4-7F8B-4A7B-BB80-69D28CF228C6} 22604⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Program Files\Image-Line\FL Studio 2025\FL64.exe"C:\Program Files\Image-Line\FL Studio 2025\FL64.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Executes dropped EXE
- Loads dropped DLL
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\138.0.3351.65\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\138.0.3351.65\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=FL64.exe --webview-exe-version=25.1.6.4997 --user-data-dir="C:\Users\Admin\AppData\Roaming\Image-Line\Edge\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --mojo-named-platform-channel-pipe=5520.1588.115429081020712801552⤵
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\138.0.3351.65\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\138.0.3351.65\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\Image-Line\Edge\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\Image-Line\Edge\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=138.0.7204.97 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\138.0.3351.65\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=138.0.3351.65 --initial-client-data=0x15c,0x160,0x164,0x138,0x178,0x7ffcaa61a178,0x7ffcaa61a184,0x7ffcaa61a1903⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\138.0.3351.65\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\138.0.3351.65\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\Image-Line\Edge\EBWebView" --webview-exe-name=FL64.exe --webview-exe-version=25.1.6.4997 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=1864,i,12883842965627735797,17270353143311650259,262144 --enable-features=ForceSWDCompWhenDCompFallbackRequired,msAggressiveCacheTrimming,msCustomDataPartition,msWebView2NoTabForScreenShare,msWindowsTaskManager --disable-features=BackForwardCache,BackgroundTabLoadingFromPerformanceManager,CloseOmniboxPopupOnInactiveAreaClick,CollectAVProductsInfo,CollectCodeIntegrityInfo,EnableHangWatcher,FilterAdsOnAbusiveSites,GetWifiProtocol,LoginDetection,MediaFoundationCameraUsageMonitoring,PreconnectToSearch,SafetyHub,SegmentationPlatform,SpareRendererForSitePerProcess,Ukm,WebPayments,msAITrackerClassification,msAbydosForWindowlessWV2,msAffirmVirtualCard,msAllowChromeWebstore,msAllowMSAPrtSSOForNonMSAProfile,msApplicationGuard,msAskBeforeClosingMultipleTabs,msAutoToggleAADPrtSSOForNonAADProfile,msAutofillEdgeCoupons,msAutofillEdgeCouponsAutoApply,msAutofillEdgeServiceRequest,msAutofillEnableEdgeSuggestions,msAutomaticTabFreeze,msBrowserSettingsSupported,msCoarseGeolocationService,msDataProtection,msDesktopMode,msDesktopRewards,msDisableVariationsSeedFetchThrottling,msEEProactiveHistory,msETFOffstoreExtensionFileDataCollection,msETFPasswordTheftDNRActionSignals,msEdgeAdPlatformUI,msEdgeAddWebCapturetoCollections,msEdgeAutofillShowDeployedPassword,msEdgeCaptureSelectionInPDF,msEdgeCloudConfigService,msEdgeCloudConfigServiceV2,msEdgeCohorts,msEdgeCollectionsPrismExperiment1,msEdgeCollectionsPrismOverallMigration,msEdgeComposeNext,msEdgeEnableNurturingFramework,msEdgeEnclavePrefsBasic,msEdgeEnclavePrefsNotification,msEdgeFaviconService,msEdgeHJTelemetry,msEdgeHubAppSkype,msEdgeImageEditorUI,msEdgeLinkDoctor,msEdgeMouseGestureDefaultEnabled,msEdgeMouseGestureSupported,msEdgeNewDeviceFre,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgePDFCMHighlightUX,msEdgePasswordIris,msEdgePasswordIrisSaveBubble,msEdgeProngPersonalization,msEdgeReadingView,msEdgeRose,msEdgeScreenshotUI,msEdgeSendTabToSelf,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingPersistentStorage,msEdgeShoppingUI,msEdgeSmartFind,msEdgeSuperDragDefaultEnabled,msEdgeSuperDragDropSupported,msEdgeTipping,msEdgeTranslate,msEdgeUseCaptivePortalService,msEdgeWebCapture,msEdgeWebCaptureUniformExperience,msEdgeWebContentFilteringFeedback,msEdgeWorkSearchBanner,msEnableCustomJobMemoryLimitsOnXbox,msEnableMIPForPDF,msEnablePdfUpsell,msEnableThirdPartyScanning,msEnableWebSignInCta,msEnableWebToBrowserSignIn,msEndpointDlp,msEntityExtraction,msExtensionTelemetryFramework,msExternalTaskManager,msFileSystemAccessDirectoryIterationBlocklistCheck,msForceBrowserSignIn,msForeignSessionsPage,msGeolocationAccessService,msGeolocationOSLocationPermissionFallback,msGeolocationSQMService,msGeolocationService,msGrowthInfraLaunchSourceLogging,msGuidedSwitchAllowed,msHubPinPersist,msImplicitSignin,msIrm,msIrmv2,msKlarnaVirtualCard,msLlmConsumerDlpPurview,msLoadStatistics,msLogIsEdgePinnedToTaskbarOnLaunch,msMIPCrossTenantPdfViewSupport,msMdatpWebSiteDlp,msNotificationPermissionForPWA,msNumberOfSitesToPin,msNurturingSitePinningWithWindowsConsent,msOnHoverSearchInSidebar,msOpenOfficeDocumentsInWebViewer,msPasswordBreachDetection,msPdfAnnotationsVisibility,msPdfDataRecovery,msPdfDigitalSignatureRead,msPdfFreeText,msPdfFreeTextForCJK,msPdfHighlightMode,msPdfInking,msPdfKeyphraseSupport,msPdfOOUI,msPdfPopupMarkerRenderer,msPdfShare,msPdfSharedLibrary,msPdfTextNote,msPdfTextNoteMoreMenu,msPdfThumbnailCache,msPdfUnderside,msPdfViewRestore,msPersonalizationUMA,msPriceComparison,msPromptDefaultHandlerForPDF,msReactiveSearch,msReadAloud,msReadAloudPdf,msRedirectToShoreline,msRevokeExtensions,msSaasDlp,msShoppingTrigger,msShorelineSearch,msShorelineSearchFindOnPageWebUI,msShowOfflineGameEntrance,msShowReadAloudIconInAddressBar,msShowUXForAADPrtSSOForNonAADProfile,msSitePinningWithoutUi,msSuspendMessageForNewSessionWhenHavingPendingNavigation,msSyncEdgeCollections,msTabResourceStats,msTokenizationAutofillInlineEnabled,msTouchMode,msTriggeringSignalGenerator,msUserUnderstanding,msVideoSuperResolutionUI,msWalletBuyNow,msWalletCheckout,msWalletDiagnosticDataLogger,msWalletHubEntry,msWalletHubIntlP3,msWalletPartialCard,msWalletPasswordCategorization,msWalletPasswordCategorizationPlatformExpansion,msWalletTokenizationCardMetadata,msWalletTokenizedAutofill,msWebAssist,msWebAssistHistorySearchService,msWebOOUI,msWindowsUserActivities,msZipPayVirtualCard --variations-seed-version --mojo-platform-channel-handle=1888 /prefetch:113⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\138.0.3351.65\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\138.0.3351.65\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\Image-Line\Edge\EBWebView" --webview-exe-name=FL64.exe --webview-exe-version=25.1.6.4997 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1864,i,12883842965627735797,17270353143311650259,262144 --enable-features=ForceSWDCompWhenDCompFallbackRequired,msAggressiveCacheTrimming,msCustomDataPartition,msWebView2NoTabForScreenShare,msWindowsTaskManager --disable-features=BackForwardCache,BackgroundTabLoadingFromPerformanceManager,CloseOmniboxPopupOnInactiveAreaClick,CollectAVProductsInfo,CollectCodeIntegrityInfo,EnableHangWatcher,FilterAdsOnAbusiveSites,GetWifiProtocol,LoginDetection,MediaFoundationCameraUsageMonitoring,PreconnectToSearch,SafetyHub,SegmentationPlatform,SpareRendererForSitePerProcess,Ukm,WebPayments,msAITrackerClassification,msAbydosForWindowlessWV2,msAffirmVirtualCard,msAllowChromeWebstore,msAllowMSAPrtSSOForNonMSAProfile,msApplicationGuard,msAskBeforeClosingMultipleTabs,msAutoToggleAADPrtSSOForNonAADProfile,msAutofillEdgeCoupons,msAutofillEdgeCouponsAutoApply,msAutofillEdgeServiceRequest,msAutofillEnableEdgeSuggestions,msAutomaticTabFreeze,msBrowserSettingsSupported,msCoarseGeolocationService,msDataProtection,msDesktopMode,msDesktopRewards,msDisableVariationsSeedFetchThrottling,msEEProactiveHistory,msETFOffstoreExtensionFileDataCollection,msETFPasswordTheftDNRActionSignals,msEdgeAdPlatformUI,msEdgeAddWebCapturetoCollections,msEdgeAutofillShowDeployedPassword,msEdgeCaptureSelectionInPDF,msEdgeCloudConfigService,msEdgeCloudConfigServiceV2,msEdgeCohorts,msEdgeCollectionsPrismExperiment1,msEdgeCollectionsPrismOverallMigration,msEdgeComposeNext,msEdgeEnableNurturingFramework,msEdgeEnclavePrefsBasic,msEdgeEnclavePrefsNotification,msEdgeFaviconService,msEdgeHJTelemetry,msEdgeHubAppSkype,msEdgeImageEditorUI,msEdgeLinkDoctor,msEdgeMouseGestureDefaultEnabled,msEdgeMouseGestureSupported,msEdgeNewDeviceFre,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgePDFCMHighlightUX,msEdgePasswordIris,msEdgePasswordIrisSaveBubble,msEdgeProngPersonalization,msEdgeReadingView,msEdgeRose,msEdgeScreenshotUI,msEdgeSendTabToSelf,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingPersistentStorage,msEdgeShoppingUI,msEdgeSmartFind,msEdgeSuperDragDefaultEnabled,msEdgeSuperDragDropSupported,msEdgeTipping,msEdgeTranslate,msEdgeUseCaptivePortalService,msEdgeWebCapture,msEdgeWebCaptureUniformExperience,msEdgeWebContentFilteringFeedback,msEdgeWorkSearchBanner,msEnableCustomJobMemoryLimitsOnXbox,msEnableMIPForPDF,msEnablePdfUpsell,msEnableThirdPartyScanning,msEnableWebSignInCta,msEnableWebToBrowserSignIn,msEndpointDlp,msEntityExtraction,msExtensionTelemetryFramework,msExternalTaskManager,msFileSystemAccessDirectoryIterationBlocklistCheck,msForceBrowserSignIn,msForeignSessionsPage,msGeolocationAccessService,msGeolocationOSLocationPermissionFallback,msGeolocationSQMService,msGeolocationService,msGrowthInfraLaunchSourceLogging,msGuidedSwitchAllowed,msHubPinPersist,msImplicitSignin,msIrm,msIrmv2,msKlarnaVirtualCard,msLlmConsumerDlpPurview,msLoadStatistics,msLogIsEdgePinnedToTaskbarOnLaunch,msMIPCrossTenantPdfViewSupport,msMdatpWebSiteDlp,msNotificationPermissionForPWA,msNumberOfSitesToPin,msNurturingSitePinningWithWindowsConsent,msOnHoverSearchInSidebar,msOpenOfficeDocumentsInWebViewer,msPasswordBreachDetection,msPdfAnnotationsVisibility,msPdfDataRecovery,msPdfDigitalSignatureRead,msPdfFreeText,msPdfFreeTextForCJK,msPdfHighlightMode,msPdfInking,msPdfKeyphraseSupport,msPdfOOUI,msPdfPopupMarkerRenderer,msPdfShare,msPdfSharedLibrary,msPdfTextNote,msPdfTextNoteMoreMenu,msPdfThumbnailCache,msPdfUnderside,msPdfViewRestore,msPersonalizationUMA,msPriceComparison,msPromptDefaultHandlerForPDF,msReactiveSearch,msReadAloud,msReadAloudPdf,msRedirectToShoreline,msRevokeExtensions,msSaasDlp,msShoppingTrigger,msShorelineSearch,msShorelineSearchFindOnPageWebUI,msShowOfflineGameEntrance,msShowReadAloudIconInAddressBar,msShowUXForAADPrtSSOForNonAADProfile,msSitePinningWithoutUi,msSuspendMessageForNewSessionWhenHavingPendingNavigation,msSyncEdgeCollections,msTabResourceStats,msTokenizationAutofillInlineEnabled,msTouchMode,msTriggeringSignalGenerator,msUserUnderstanding,msVideoSuperResolutionUI,msWalletBuyNow,msWalletCheckout,msWalletDiagnosticDataLogger,msWalletHubEntry,msWalletHubIntlP3,msWalletPartialCard,msWalletPasswordCategorization,msWalletPasswordCategorizationPlatformExpansion,msWalletTokenizationCardMetadata,msWalletTokenizedAutofill,msWebAssist,msWebAssistHistorySearchService,msWebOOUI,msWindowsUserActivities,msZipPayVirtualCard --variations-seed-version --mojo-platform-channel-handle=1860 /prefetch:23⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\138.0.3351.65\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\138.0.3351.65\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\Image-Line\Edge\EBWebView" --webview-exe-name=FL64.exe --webview-exe-version=25.1.6.4997 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=1864,i,12883842965627735797,17270353143311650259,262144 --enable-features=ForceSWDCompWhenDCompFallbackRequired,msAggressiveCacheTrimming,msCustomDataPartition,msWebView2NoTabForScreenShare,msWindowsTaskManager --disable-features=BackForwardCache,BackgroundTabLoadingFromPerformanceManager,CloseOmniboxPopupOnInactiveAreaClick,CollectAVProductsInfo,CollectCodeIntegrityInfo,EnableHangWatcher,FilterAdsOnAbusiveSites,GetWifiProtocol,LoginDetection,MediaFoundationCameraUsageMonitoring,PreconnectToSearch,SafetyHub,SegmentationPlatform,SpareRendererForSitePerProcess,Ukm,WebPayments,msAITrackerClassification,msAbydosForWindowlessWV2,msAffirmVirtualCard,msAllowChromeWebstore,msAllowMSAPrtSSOForNonMSAProfile,msApplicationGuard,msAskBeforeClosingMultipleTabs,msAutoToggleAADPrtSSOForNonAADProfile,msAutofillEdgeCoupons,msAutofillEdgeCouponsAutoApply,msAutofillEdgeServiceRequest,msAutofillEnableEdgeSuggestions,msAutomaticTabFreeze,msBrowserSettingsSupported,msCoarseGeolocationService,msDataProtection,msDesktopMode,msDesktopRewards,msDisableVariationsSeedFetchThrottling,msEEProactiveHistory,msETFOffstoreExtensionFileDataCollection,msETFPasswordTheftDNRActionSignals,msEdgeAdPlatformUI,msEdgeAddWebCapturetoCollections,msEdgeAutofillShowDeployedPassword,msEdgeCaptureSelectionInPDF,msEdgeCloudConfigService,msEdgeCloudConfigServiceV2,msEdgeCohorts,msEdgeCollectionsPrismExperiment1,msEdgeCollectionsPrismOverallMigration,msEdgeComposeNext,msEdgeEnableNurturingFramework,msEdgeEnclavePrefsBasic,msEdgeEnclavePrefsNotification,msEdgeFaviconService,msEdgeHJTelemetry,msEdgeHubAppSkype,msEdgeImageEditorUI,msEdgeLinkDoctor,msEdgeMouseGestureDefaultEnabled,msEdgeMouseGestureSupported,msEdgeNewDeviceFre,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgePDFCMHighlightUX,msEdgePasswordIris,msEdgePasswordIrisSaveBubble,msEdgeProngPersonalization,msEdgeReadingView,msEdgeRose,msEdgeScreenshotUI,msEdgeSendTabToSelf,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingPersistentStorage,msEdgeShoppingUI,msEdgeSmartFind,msEdgeSuperDragDefaultEnabled,msEdgeSuperDragDropSupported,msEdgeTipping,msEdgeTranslate,msEdgeUseCaptivePortalService,msEdgeWebCapture,msEdgeWebCaptureUniformExperience,msEdgeWebContentFilteringFeedback,msEdgeWorkSearchBanner,msEnableCustomJobMemoryLimitsOnXbox,msEnableMIPForPDF,msEnablePdfUpsell,msEnableThirdPartyScanning,msEnableWebSignInCta,msEnableWebToBrowserSignIn,msEndpointDlp,msEntityExtraction,msExtensionTelemetryFramework,msExternalTaskManager,msFileSystemAccessDirectoryIterationBlocklistCheck,msForceBrowserSignIn,msForeignSessionsPage,msGeolocationAccessService,msGeolocationOSLocationPermissionFallback,msGeolocationSQMService,msGeolocationService,msGrowthInfraLaunchSourceLogging,msGuidedSwitchAllowed,msHubPinPersist,msImplicitSignin,msIrm,msIrmv2,msKlarnaVirtualCard,msLlmConsumerDlpPurview,msLoadStatistics,msLogIsEdgePinnedToTaskbarOnLaunch,msMIPCrossTenantPdfViewSupport,msMdatpWebSiteDlp,msNotificationPermissionForPWA,msNumberOfSitesToPin,msNurturingSitePinningWithWindowsConsent,msOnHoverSearchInSidebar,msOpenOfficeDocumentsInWebViewer,msPasswordBreachDetection,msPdfAnnotationsVisibility,msPdfDataRecovery,msPdfDigitalSignatureRead,msPdfFreeText,msPdfFreeTextForCJK,msPdfHighlightMode,msPdfInking,msPdfKeyphraseSupport,msPdfOOUI,msPdfPopupMarkerRenderer,msPdfShare,msPdfSharedLibrary,msPdfTextNote,msPdfTextNoteMoreMenu,msPdfThumbnailCache,msPdfUnderside,msPdfViewRestore,msPersonalizationUMA,msPriceComparison,msPromptDefaultHandlerForPDF,msReactiveSearch,msReadAloud,msReadAloudPdf,msRedirectToShoreline,msRevokeExtensions,msSaasDlp,msShoppingTrigger,msShorelineSearch,msShorelineSearchFindOnPageWebUI,msShowOfflineGameEntrance,msShowReadAloudIconInAddressBar,msShowUXForAADPrtSSOForNonAADProfile,msSitePinningWithoutUi,msSuspendMessageForNewSessionWhenHavingPendingNavigation,msSyncEdgeCollections,msTabResourceStats,msTokenizationAutofillInlineEnabled,msTouchMode,msTriggeringSignalGenerator,msUserUnderstanding,msVideoSuperResolutionUI,msWalletBuyNow,msWalletCheckout,msWalletDiagnosticDataLogger,msWalletHubEntry,msWalletHubIntlP3,msWalletPartialCard,msWalletPasswordCategorization,msWalletPasswordCategorizationPlatformExpansion,msWalletTokenizationCardMetadata,msWalletTokenizedAutofill,msWebAssist,msWebAssistHistorySearchService,msWebOOUI,msWindowsUserActivities,msZipPayVirtualCard --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:133⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\138.0.3351.65\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\138.0.3351.65\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\Image-Line\Edge\EBWebView" --webview-exe-name=FL64.exe --webview-exe-version=25.1.6.4997 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=1864,i,12883842965627735797,17270353143311650259,262144 --enable-features=ForceSWDCompWhenDCompFallbackRequired,msAggressiveCacheTrimming,msCustomDataPartition,msWebView2NoTabForScreenShare,msWindowsTaskManager --disable-features=BackForwardCache,BackgroundTabLoadingFromPerformanceManager,CloseOmniboxPopupOnInactiveAreaClick,CollectAVProductsInfo,CollectCodeIntegrityInfo,EnableHangWatcher,FilterAdsOnAbusiveSites,GetWifiProtocol,LoginDetection,MediaFoundationCameraUsageMonitoring,PreconnectToSearch,SafetyHub,SegmentationPlatform,SpareRendererForSitePerProcess,Ukm,WebPayments,msAITrackerClassification,msAbydosForWindowlessWV2,msAffirmVirtualCard,msAllowChromeWebstore,msAllowMSAPrtSSOForNonMSAProfile,msApplicationGuard,msAskBeforeClosingMultipleTabs,msAutoToggleAADPrtSSOForNonAADProfile,msAutofillEdgeCoupons,msAutofillEdgeCouponsAutoApply,msAutofillEdgeServiceRequest,msAutofillEnableEdgeSuggestions,msAutomaticTabFreeze,msBrowserSettingsSupported,msCoarseGeolocationService,msDataProtection,msDesktopMode,msDesktopRewards,msDisableVariationsSeedFetchThrottling,msEEProactiveHistory,msETFOffstoreExtensionFileDataCollection,msETFPasswordTheftDNRActionSignals,msEdgeAdPlatformUI,msEdgeAddWebCapturetoCollections,msEdgeAutofillShowDeployedPassword,msEdgeCaptureSelectionInPDF,msEdgeCloudConfigService,msEdgeCloudConfigServiceV2,msEdgeCohorts,msEdgeCollectionsPrismExperiment1,msEdgeCollectionsPrismOverallMigration,msEdgeComposeNext,msEdgeEnableNurturingFramework,msEdgeEnclavePrefsBasic,msEdgeEnclavePrefsNotification,msEdgeFaviconService,msEdgeHJTelemetry,msEdgeHubAppSkype,msEdgeImageEditorUI,msEdgeLinkDoctor,msEdgeMouseGestureDefaultEnabled,msEdgeMouseGestureSupported,msEdgeNewDeviceFre,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgePDFCMHighlightUX,msEdgePasswordIris,msEdgePasswordIrisSaveBubble,msEdgeProngPersonalization,msEdgeReadingView,msEdgeRose,msEdgeScreenshotUI,msEdgeSendTabToSelf,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingPersistentStorage,msEdgeShoppingUI,msEdgeSmartFind,msEdgeSuperDragDefaultEnabled,msEdgeSuperDragDropSupported,msEdgeTipping,msEdgeTranslate,msEdgeUseCaptivePortalService,msEdgeWebCapture,msEdgeWebCaptureUniformExperience,msEdgeWebContentFilteringFeedback,msEdgeWorkSearchBanner,msEnableCustomJobMemoryLimitsOnXbox,msEnableMIPForPDF,msEnablePdfUpsell,msEnableThirdPartyScanning,msEnableWebSignInCta,msEnableWebToBrowserSignIn,msEndpointDlp,msEntityExtraction,msExtensionTelemetryFramework,msExternalTaskManager,msFileSystemAccessDirectoryIterationBlocklistCheck,msForceBrowserSignIn,msForeignSessionsPage,msGeolocationAccessService,msGeolocationOSLocationPermissionFallback,msGeolocationSQMService,msGeolocationService,msGrowthInfraLaunchSourceLogging,msGuidedSwitchAllowed,msHubPinPersist,msImplicitSignin,msIrm,msIrmv2,msKlarnaVirtualCard,msLlmConsumerDlpPurview,msLoadStatistics,msLogIsEdgePinnedToTaskbarOnLaunch,msMIPCrossTenantPdfViewSupport,msMdatpWebSiteDlp,msNotificationPermissionForPWA,msNumberOfSitesToPin,msNurturingSitePinningWithWindowsConsent,msOnHoverSearchInSidebar,msOpenOfficeDocumentsInWebViewer,msPasswordBreachDetection,msPdfAnnotationsVisibility,msPdfDataRecovery,msPdfDigitalSignatureRead,msPdfFreeText,msPdfFreeTextForCJK,msPdfHighlightMode,msPdfInking,msPdfKeyphraseSupport,msPdfOOUI,msPdfPopupMarkerRenderer,msPdfShare,msPdfSharedLibrary,msPdfTextNote,msPdfTextNoteMoreMenu,msPdfThumbnailCache,msPdfUnderside,msPdfViewRestore,msPersonalizationUMA,msPriceComparison,msPromptDefaultHandlerForPDF,msReactiveSearch,msReadAloud,msReadAloudPdf,msRedirectToShoreline,msRevokeExtensions,msSaasDlp,msShoppingTrigger,msShorelineSearch,msShorelineSearchFindOnPageWebUI,msShowOfflineGameEntrance,msShowReadAloudIconInAddressBar,msShowUXForAADPrtSSOForNonAADProfile,msSitePinningWithoutUi,msSuspendMessageForNewSessionWhenHavingPendingNavigation,msSyncEdgeCollections,msTabResourceStats,msTokenizationAutofillInlineEnabled,msTouchMode,msTriggeringSignalGenerator,msUserUnderstanding,msVideoSuperResolutionUI,msWalletBuyNow,msWalletCheckout,msWalletDiagnosticDataLogger,msWalletHubEntry,msWalletHubIntlP3,msWalletPartialCard,msWalletPasswordCategorization,msWalletPasswordCategorizationPlatformExpansion,msWalletTokenizationCardMetadata,msWalletTokenizedAutofill,msWebAssist,msWebAssistHistorySearchService,msWebOOUI,msWindowsUserActivities,msZipPayVirtualCard --variations-seed-version --mojo-platform-channel-handle=3324 /prefetch:13⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004C0 0x00000000000004E41⤵
-
C:\Windows\system32\werfault.exewerfault.exe /h /shared Global\41c3c871114140ba9438c027fe176557 /t 4352 /p 55201⤵
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Defense Evasion
Modify Registry
3Subvert Trust Controls
2Install Root Certificate
1SIP and Trust Provider Hijacking
1Discovery
Browser Information Discovery
1Network Share Discovery
1Peripheral Device Discovery
2Query Registry
7System Information Discovery
6System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1System Time Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
e63825a.rbs
e638266.rbs
e63826d.rbs
e63827c.rbs
setup.exe
MicrosoftEdgeUpdate.exe
7-zip.dll
7z.dll
7z.exe
7zFM.exe
7zG.exe
Uninstall.exe
Exteriors.nfo
Monster Kick 005.nfo
snare 4 v7 rr1.wav
Olbaid Compendium.ini
RD_Hat_6.wav
FL Studio Mobile.png
Installed.nfo
Loop timestretching (4 bars).fst
BAS Elec Bass P Hook NUC.mrp
SFX Big Vinyl Skip FG.mrp
SFX PitchShifter (MW) FG.mrp
SYN Analog Meets Digital FG.mrp
Unstable FM ToTc.tbio
Bass T.tbio
Plastiq.tbio
Quickie ToTc.tbio
ATM Industrial ToTc.tbio
ATM Universe ToTc.tbio
BAS Archetype ToTc.tbio
BAS Monster Moog ToTc.tbio
LED Stinger ToTc.tbio
PAD Beauty ToTc.tbio
Moron's Organ ToTc.tbio
PolyEurothane ToTc.tbio
Sequence Me ToTc.tbio
Shtick ToTc.tbio
TarnceArp ToTc.tbio
Thin Synth ToTc.tbio
Cyborg.tbio
EthnicString.tbio
GargleSynth ToTc.tbio
Persona ToTc.tbio
Scrape ToTc.tbio
Sharper ToTc.tbio
T-III Super Saw ToTc.tbio
Yup, Another 1 ToTc.tbio
ZaP ToTc.tbio
Brazen ToTc.tbio
KeyPad ToTc.tbio
Lore ToTc.tbio
Noxious ToTc.tbio
Pure Plain ToTc.tbio
Reson ToTc.tbio
Sands of Time ToTc.tbio
Off-Scale Harmonics ToTc.tbio
Calm Backing ToTc.tbio
Stereo ToTc.tbio
Traveler ToTc.tbio
Industrial Hazard ToTc.tbio
Criminal Intent ToTc.tbio
Nutron ToTc.tbio
Volume Pedal II ToTc.tbio
Sequencer Food ToTc.tbio
Stab-Synth ToTc.tbio
DRM Snare 2.tbio
KBD Like A Wurly.tbio
PAD Neptune NUC.tbio
Env filter - default.fnv
Env filter - flat.fnv
VFX Script.fst
Emphasis.fst
Hyper Chorus.fst
Low Lifter.fst
VFX Script.nfo
VFX Script.png
Kepler Exo.fst
Effects.nfo
Hardcore.fst
Fruity Peak Controller.fst
Fruity X-Y-Z Controller.fst
Emphasis.nfo
Emphasis.png
Fruity Soft Clipper.fst
Fruity Soft Clipper.nfo
Fruity Soft Clipper.png
Maximus.fst
Fruity Filter.fst
Frequency Splitter.fst
Low Lifter.nfo
Low Lifter.png
Spreader.nfo
Spreader.png
Hyper Chorus.nfo
Hyper Chorus.png
Transporter.fst
Transporter.nfo
Vintage Chorus.fst
Vintage Chorus.nfo
Vintage Chorus.png
Vintage Phaser.fst
Vintage Phaser.nfo
Vintage Phaser.png
Pitch Shifter.fst
Pitch Shifter.nfo
Pitch Shifter.png
Fruity Delay 3.fst
LuxeVerb.fst
LuxeVerb.nfo
LuxeVerb.png
Multiband Delay.fst
Multiband Delay.nfo
Multiband Delay.png
FL Studio Mobile Rack FX.fst
FL Studio Mobile Rack FX.nfo
FL Studio Mobile Rack FX.png
Fruity HTML NoteBook.fst
Fruity LSD.fst
Fruity LSD.nfo
Fruity LSD.png
Patcher.nfo
Patcher.png
Tuner.fst
VFX Color Mapper.fst
VFX Color Mapper.nfo
VFX Color Mapper.png
VFX Envelope.fst
VFX Envelope.nfo
VFX Envelope.png
VFX Key Mapper.fst
VFX Key Mapper.nfo
VFX Key Mapper.png
VFX Keyboard Splitter.fst
VFX Keyboard Splitter.nfo
VFX Keyboard Splitter.png
VFX Level Scaler.fst
VFX Level Scaler.nfo
VFX Level Scaler.png
VFX Sequencer.fst
VFX Sequencer.nfo
VFX Sequencer.png
Razer Chroma.fst
Razer Chroma.nfo
Razer Chroma.png
Generators.nfo
Transistor Bass.fst
BassDrum.fst
Drumaxx.fst
FPC.fst
Sampler.fst
FL Studio Mobile Rack.fst
FL Studio Mobile Rack.nfo
FL Studio Mobile Rack.png
Harmor.fst
Kepler Exo.nfo
Kepler Exo.png
Kepler.fst
Kepler.nfo
Kepler.png
Sytrus.fst
Audio Clip.fst
Automation Clip.fst
ReWired.fst
ReWired.nfo
ReWired.png
Control Surface.fst
Control Surface.nfo
Control Surface.png
Fruity Formula Controller.fst
Fruity Formula Controller.nfo
Fruity Formula Controller.png
Fruity Peak Controller.nfo
Fruity Peak Controller.png
Fruity X-Y Controller.fst
Fruity X-Y Controller.nfo
Fruity X-Y Controller.png
Fruity X-Y-Z Controller.nfo
Fruity X-Y-Z Controller.png
Fruity Convolver.fst
Fruity Convolver.nfo
Fruity Convolver.png
Fruity Delay 2.fst
Fruity Delay 2.nfo
Fruity Delay 2.png
Fruity Delay 3.nfo
Fruity Delay 3.png
Fruity Delay Bank.fst
Fruity Delay Bank.nfo
Fruity Delay Bank.png
Fruity Reeverb 2.fst
Fruity Reeverb 2.nfo
Fruity Reeverb 2.png
Distructor.fst
Distructor.nfo
Distructor.png
Fruity Blood Overdrive.fst
Fruity Blood Overdrive.nfo
Fruity Blood Overdrive.png
Fruity Fast Dist.fst
Fruity Fast Dist.nfo
Fruity Fast Dist.png
Fruity Squeeze.fst
Fruity Squeeze.nfo
Fruity Squeeze.png
Fruity WaveShaper.fst
Fruity WaveShaper.nfo
Fruity WaveShaper.png
Hardcore.nfo
Hardcore.png
Fruity Compressor.fst
Fruity Compressor.nfo
Fruity Compressor.png
Fruity Limiter.fst
Fruity Limiter.nfo
Fruity Limiter.png
Fruity Multiband Compressor.fst
Fruity Multiband Compressor.nfo
Fruity Multiband Compressor.png
Maximus.nfo
Maximus.png
Soundgoodizer.fst
Soundgoodizer.nfo
Soundgoodizer.png
Transient Processor.fst
Transient Processor.nfo
Transient Processor.png
EQUO.fst
EQUO.nfo
EQUO.png
Frequency Splitter.nfo
Frequency Splitter.png
Fruity Filter.nfo
Fruity Filter.png
Fruity Love Philter.fst
Fruity Love Philter.nfo
Fruity Love Philter.png
Fruity Parametric EQ 2.fst
Fruity Parametric EQ 2.nfo
Fruity Parametric EQ.fst
Fruity Parametric EQ.nfo
Fruity Parametric EQ.png
Fruity Chorus.fst
Fruity Chorus.nfo
Fruity Chorus.png
Fruity Flanger.fst
Fruity Flanger.nfo
Fruity Flanger.png
Fruity Flangus.fst
Fruity Flangus.nfo
Fruity Flangus.png
Fruity Phaser.fst
Fruity Phaser.nfo
Fruity Phaser.png
Fruity Balance.fst
Fruity Balance.nfo
Fruity Balance.png
Fruity PanOMatic.fst
Fruity PanOMatic.nfo
Fruity PanOMatic.png
Fruity Send.fst
Fruity Send.nfo
Fruity Send.png
Fruity Stereo Enhancer.fst
Fruity Stereo Enhancer.nfo
Fruity Stereo Enhancer.png
Fruity Stereo Shaper.fst
Fruity Stereo Shaper.nfo
Fruity Stereo Shaper.png
Spreader.fst
Edison.fst
Edison.nfo
Edison.png
Effector.fst
Effector.nfo
Effector.png
Frequency Shifter.fst
Frequency Shifter.nfo
Frequency Shifter.png
Fruity Scratcher.fst
Fruity Scratcher.nfo
Fruity Scratcher.png
Fruity Vocoder.fst
Fruity Vocoder.nfo
Fruity Vocoder.png
Gross Beat.fst
Gross Beat.nfo
Gross Beat.png
Newtime.fst
Newtime.nfo
Newtime.png
Newtone.fst
Newtone.nfo
Newtone.png
Pitcher.fst
Pitcher.nfo
Pitcher.png
Transporter.png
Vocodex.fst
Vocodex.nfo
Vocodex.png
Patcher.fst
Fruity Big Clock.fst
Fruity Big Clock.nfo
Fruity Big Clock.png
Fruity HTML NoteBook.nfo
Fruity HTML NoteBook.png
Fruity NoteBook 2.fst
Fruity NoteBook 2.nfo
Fruity NoteBook 2.png
Fruity NoteBook.fst
Fruity NoteBook.nfo
Fruity NoteBook.png
Fruity Spectroman.fst
Fruity Spectroman.nfo
Fruity Spectroman.png
Fruity dB Meter.fst
Fruity dB Meter.nfo
Fruity dB Meter.png
Tuner.nfo
Tuner.png
Wave Candy.fst
Wave Candy.nfo
Wave Candy.png
ZGameEditor Visualizer.fst
ZGameEditor Visualizer.nfo
ZGameEditor Visualizer.png
Fruity Envelope Controller.fst
Fruity Envelope Controller.nfo
Fruity Envelope Controller.png
Fruity Keyboard Controller.fst
Fruity Keyboard Controller.nfo
Fruity Keyboard Controller.png
BassDrum.nfo
BassDrum.png
Drumaxx.nfo
Drumaxx.png
Drumpad.fst
Drumpad.nfo
Drumpad.png
FPC.nfo
FPC.png
Fruit Kick.fst
Fruit Kick.nfo
Fruit Kick.png
Fruity DrumSynth Live.fst
Fruity DrumSynth Live.nfo
Fruity DrumSynth Live.png
Fruity Slicer.fst
Fruity Slicer.nfo
Fruity Slicer.png
Ogun.fst
Ogun.nfo
Ogun.png
Slicex.fst
Slicex.nfo
Slicex.png
Dashboard.fst
Dashboard.nfo
Dashboard.png
MIDI Out.fst
MIDI Out.nfo
MIDI Out.png
BooBass.fst
BooBass.nfo
BooBass.png
FL Keys.fst
FL Keys.nfo
FL Keys.png
FL Studio Mobile.fst
FL Studio Mobile.nfo
Fruity Voltage Controller.fst
Fruity Voltage Controller.nfo
Fruity Voltage Controller.png
Layer.fst
Layer.nfo
Layer.png
SoundFont Player.fst
SoundFont Player.nfo
SoundFont Player.png
Patcher.fst
DirectWave.fst
DirectWave.nfo
DirectWave.png
Fruity Granulizer.fst
Fruity Granulizer.nfo
Fruity Granulizer.png
Sampler.nfo
Sampler.png
Wave Traveller.fst
Wave Traveller.nfo
Wave Traveller.png
3x Osc.fst
3x Osc.nfo
3x Osc.png
FLEX.fst
FLEX.nfo
FLEX.png
Fruity DX10.fst
Fruity DX10.nfo
Fruity DX10.png
GMS.fst
GMS.nfo
GMS.png
Harmless.fst
Harmless.nfo
Harmless.png
MiniSynth.fst
MiniSynth.nfo
MiniSynth.png
PoiZone.fst
PoiZone.nfo
PoiZone.png
Sawer.fst
Sawer.nfo
Sawer.png
SimSynth.fst
SimSynth.nfo
SimSynth.png
Sytrus.nfo
Sytrus.png
Toxic Biohazard.fst
Toxic Biohazard.nfo
Toxic Biohazard.png
Transistor Bass.nfo
Transistor Bass.png
Autogun.fst
Autogun.nfo
Autogun.png
BeepMap.fst
BeepMap.nfo
BeepMap.png
Harmor.nfo
Harmor.png
Morphine.fst
Morphine.nfo
Morphine.png
Plucked!.fst
Plucked!.nfo
Plucked!.png
Sakura.fst
Sakura.nfo
Sakura.png
Fruity Dance.fst
Fruity Dance.nfo
Fruity Dance.png
Fruity Video Player.fst
Fruity Video Player.nfo
Fruity Video Player.png
Installed.nfo
Empty.flp
FL64.exe
Env filter - asymmetry.fnv
Env filter - small knee.fnv
Plugin.nfo
Plugin.nfo
Blur - alt.fnv
Blur - default.fnv
Blur - narrow.fnv
Blur - pulse.fnv
Denoiser - default.fnv
Furnace.bmp
Pedal_compressor.tga
Spectrum.bmp
Spreader_Info.rtf
Youlean Time Bar.zgeproj
EQ - 15Hz - 18kHz cut.fnv
EQ - 40Hz cut.fnv
EQ - key points.fnv
Spectral mask - default.fnv
12dB steps.bmp
Charcoal.bmp
Deeper furnace.bmp
Glacier.bmp
Temperature.bmp
The Matrix.bmp
Vintage Hat Cl 04.dmpatch
Electro Perc 09.dmpatch
HipHop Perc 03.dmpatch
Hardcore 02.dmptrn
Electro 14.dmptrn
Hip Hop 13.dmptrn
Hip Hop 20.dmptrn
Old School 09.dmptrn
Industrial 03.dmptrn
World Groove 02.dmptrn
World Groove 04.dmptrn
World Groove 05.dmptrn
World Groove 06.dmptrn
World Groove 07.dmptrn
World Groove 08.dmptrn
World Groove 09.dmptrn
World Groove 11.dmptrn
World Groove 24.dmptrn
World Groove 26.dmptrn
World Groove 27.dmptrn
World Groove 28.dmptrn
World Groove 29.dmptrn
World Groove 30.dmptrn
World Groove 31.dmptrn
World Groove 32.dmptrn
World Groove 33.dmptrn
World Groove 34.dmptrn
World Groove 35.dmptrn
World Groove 36.dmptrn
HQ_Ramp.wav
HQ_SmoothInvSaw_Dist.wav
GM Drums.txt
Flat (centered).fnv
Flat (top).fnv
Default ADSR.fnv
No attack.fnv
Short burst.fnv
Shortest attack.fnv
Default.fnv
Immediate.fnv
Modulation - increasing.fnv
bg_fltenv.tga
morph_page_bkg.tga
Pan - default.fnv
Pitch arpeggiato 2.fnv
Pitch arpeggiato.fnv
Porta - basic.fnv
Porta - curved.fnv
Short decay.fnv
Strings.fnv
1 bar triangle.fnv
Little randomness (centered).fnv
Little randomness (top).fnv
Waveshaper - default.fnv
Waveshaper - harsh.fnv
Waveshaper - limiter.fnv
Moog-Pulse2.wav
Cuprum.ttf
FrancoisOne.ttf
dsp_ippv2.dll
Native Instruments TRAKTOR KONTROL F1.flmapping
Fruity Parametric EQ 2.png
Upgrade Fire to Signature Bundle.png
Upgrade Fruity to All Plugins Edition.png
Upgrade Fruity to FL Studio + ALL Plugins Bundle.png
Page2.scr
Page3.scr
Page4.scr
Page5.scr
Page7.scr
Page8.scr
Example.scr
Palette.scr
ja.moe
test-midi.exe
ILWASAPI2ASIO.dll
flcloud.messages
MicrosoftEdgeUpdate.log
40381828-3226-417c-8949-9d714e8c3b73.tmp
BookmarkMergedSurfaceOrdering
BrowsingTopicsState
f_000005
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
data_1
CURRENT
MANIFEST-000001
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
TransportSecurity
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
the-real-index
the-real-index~RFe58e9ce.TMP
the-real-index
the-real-index
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
www.bing[2].xml
www.bing[2].xml
www.bing[2].xml
www.bing[2].xml
__PSScriptPolicyTest_wdw02a4b.ypv.ps1
ILSetup.dll
InstallOptions.dll
UserMgr.dll
ioA.ini
ioAllUsersPage.ini
ioAllUsersPage.ini
ioFLMobileAd.ini
ioGoToWebPage_Online.ini
ioSpecial.ini
ioSpecial.ini
ioSpecial.ini
ioSpecial.ini
nsExec.dll
settings.dat
the-real-index
the-real-index~RFe641cef.TMP
Network Persistent State
Network Persistent State~RFe641dba.TMP
Preferences
Preferences
Preferences~RFe6401e5.TMP
MANIFEST-000001
data_0
data_2
data_3
Local State
Local State
Local State
Local State
Local State~RFe63b4de.TMP
a0c634d6-c0c6-4e65-8ed5-81e3f99483be.tmp
5d696d521de238c3.customDestinations-ms
5d696d521de238c3.customDestinations-ms
HQ_RoundSaw.wav
HQ_Saw.wav
HQ_Sine_Dist.wav
HQ_SmoothInvSaw.wav
HQ_SmoothInvSaw_2.wav
SHP_Additive.wav
SHP_Additive_2.wav
SHP_BungList.wav
SHP_BungList_2.wav
SHP_BungList_3.wav
SHP_BungList_4.wav
SHP_BungList_5.wav
SHP_BungList_6.wav
SHP_BungList_7.wav
SHP_BungList_8.wav
SHP_BungList_9.wav
SHP_Detuned Saw.wav
SHP_Harmonics.wav
SHP_Moog.wav
SHP_Noise Bass.wav
SHP_Noise.wav
SHP_Overtone.wav
SHP_Overtone_2.wav
SHP_Ramp Saw.wav
SHP_Rand.wav
SHP_Rand_2.wav
SHP_Rough Square.wav
SHP_Rough Step.wav
SHP_Rough Step_2.wav
SHP_Saw+Sine.wav
SHP_Sawing Synth.wav
SHP_Synth.wav
SHP_Thin Pulse.wav
SHP_Thin.wav
SHP_Vowel A.wav
SHP_Vowel U.wav
SHP_Wire Scan.wav
SHP_Wooble Synth.wav
Bassline.fst
Changing bass.fst
DX7.fst
Death ray.fst
Droplets.fst
Fat cheese 2.fst
Fat cheese.fst
Hard bass.fst
JrBass.fst
Log drum.fst
Moog bass.fst
Moogish.fst
Moralog.fst
Nasty.fst
Noisy bass 2.fst
Noisy bass.fst
Phat bass.fst
Pilch bass.fst
Porta bass.fst
Pure bass 2.fst
Pure bass 3.fst
Pure bass 4.fst
Pure bass 5.fst
Pure bass 6.fst
Pure bass 7.fst
Pure bass 8.fst
Pure bass.fst
Square bass 2.fst
Square bass.fst
Supa bass.fst
Synth bass 10.fst
Synth bass 2.fst
Synth bass 3.fst
Synth bass 4.fst
Synth bass 5.fst
Synth bass 6.fst
Synth bass 7.fst
Synth bass 8.fst
Synth bass 9.fst
Synth bass.fst
Weird bass.fst
Bell.fst
Clap.fst
Closed hat.fst
Hihat.fst
Kick 2.fst
Kick 3.fst
Kick 4.fst
Kick 5.fst
Kick.fst
Open hat.fst
Snare 2.fst
Snare.fst
Snarekick 2.fst
Snarekick.fst
Pluck (fat).fst
Pluck.fst
Accordeon 2.fst
Analog dreamz.fst
Clean.fst
Detuned.fst
Dixie.fst
Intregue.fst
Laser.fst
Pilch tech lead.fst
Rave lead.fst
Raw.fst
SciFi 2.fst
SciFi 3.fst
SciFi 4.fst
SciFi 5.fst
SciFi 6.fst
SciFi 7.fst
SciFi 8.fst
SciFi.fst
Short 10.fst
Short 11.fst
Short 2.fst
Short 3.fst
Short 4.fst
Short 5.fst
Short 6.fst
Short 7 (fat).fst
Short 7.fst
Short 8.fst
Short 9.fst
Short square 2.fst
Short square.fst
Short.fst
Trance lead.fst
Accordeon.fst
BP string.fst
Brass 2.fst
Brass 3.fst
Brass 4.fst
Brass 5.fst
Brass 6.fst
Brass.fst
Cheap trumpet.fst
Flute.fst
HQ_Brass 2 (fat).fst
HQ_Brass 2.fst
HQ_Brass.fst
Long string (major).fst
Long string.fst
Notched string 2.fst
Notched string 3.fst
Notched string.fst
Odd brass.fst
Organ 2.fst
Organ 3 (fat).fst
Organ 3 (major).fst
Organ 3.fst
Organ 4.fst
Organ 5.fst
Organ 6.fst
Organ.fst
Smooth string 2 (fat).fst
Smooth string 2.fst
Smooth string.fst
String (fat).fst
String 10.fst
String 11.fst
String 2.fst
String 3.fst
String 4.fst
String 5.fst
String 6.fst
String 7.fst
String 8.fst
String 9.fst
String.fst
Pilch tech pad.fst
Quiet.fst
Slice.fst
Smooth synth.fst
Voodoo.fst
Windy.fst
Chip 2.fst
Chip 3.fst
Chip 4.fst
Chip.fst
Glitchy.fst
Hoover.fst
Mad KB.fst
Outer space hooter.fst
Roswel Landing.fst
Warped.fst
Wip.fst
Arp King.fst
Arpeggio 10.fst
Arpeggio 2.fst
Arpeggio 3.fst
Arpeggio 4.fst
Arpeggio 5.fst
Arpeggio 6.fst
Arpeggio 7.fst
Arpeggio 8.fst
Arpeggio 9.fst
Arpeggio.fst
Stutt arp.fst
Analogous phattus.fst
Caesar.fst
Chime synth.fst
Square 2.fst
Square.fst
Warble 2.fst
Warble.fst
zzzzap.fst
5th Chord.flgsynth
Arctic Melody.flgsynth
Basic.flgsynth
Classy.flgsynth
Crisp Detune.flgsynth
Deep Talk.flgsynth
Electro Frog.flgsynth
Electro Octaves.flgsynth
Fifth Jazz.flgsynth
Fifth Pikes 1.flgsynth
Fifth Pikes 2.flgsynth
Fluctuate.flgsynth
Moonlight.flgsynth
Phase Drops.flgsynth
Pluck.flgsynth
Psy Filter.flgsynth
Seq 8th Notes TE.flgsynth
Seq Goblins TE.flgsynth
Seq Octave Pulse N.flgsynth
Seq Pulsar N.flgsynth
Seq Pulsate TE.flgsynth
Seq Rapid Fire TE.flgsynth
Seq Space swamp TE.flgsynth
Short Clean.flgsynth
Sine Pluck.flgsynth
Smooth Chord.flgsynth
Swell.flgsynth
Synth Trance Chord 1.flgsynth
Synth Trance Plucks TE.flgsynth
Synth Tripped Out TE.flgsynth
Synth Unstable Square TE.flgsynth
Synth Upfront Chord TE.flgsynth
Synth Wormhole TE.flgsynth
Phat.flms
Pump.flms
Soft.flms
Tight.flms
Tone.flms
Tromb.flms
Tube.flms
Science.flms
oscdata.dat
24.2.1.ini
zh.moe
fr.moe
zh.moe
device_Fire.py
Arturia MiniLab 3.ini
Default news.rss
Versions.xml
7z2602-x64.exe:Zone.Identifier
Image-Line.FL.Studio.Producer.Edition.25.1.6.4997.x64.All.Plugins.Edition.rar:Zone.Identifier
Unconfirmed 489839.crdownload
e638267.msi
license.rtf
thm.wxl
thm.xml
wixstdba.dll
logo.png
VC_redist.x64.exe
memory/680-59612-0x0000000000430000-0x000000000079B000-memory.dmp
memory/680-59771-0x0000000000430000-0x000000000079B000-memory.dmp
memory/1000-59768-0x0000000000CB0000-0x0000000000D27000-memory.dmp
memory/1036-1183-0x00000272747F0000-0x00000272748F0000-memory.dmp
memory/1036-1212-0x0000027276DD0000-0x0000027276DF0000-memory.dmp
memory/1036-1213-0x00000272767E0000-0x0000027276800000-memory.dmp
memory/1860-1017-0x000001D8AD5A0000-0x000001D8AD5C0000-memory.dmp
memory/1860-1016-0x000001D8ADB90000-0x000001D8ADBB0000-memory.dmp
memory/1860-993-0x000001D89B7A0000-0x000001D89B8A0000-memory.dmp
memory/1860-987-0x000001D89B8E0000-0x000001D89B9E0000-memory.dmp
memory/2260-622-0x0000022663640000-0x0000022663740000-memory.dmp
memory/2260-650-0x0000022675A40000-0x0000022675A60000-memory.dmp
memory/2260-651-0x0000022675550000-0x0000022675570000-memory.dmp
memory/2260-627-0x0000022663290000-0x0000022663390000-memory.dmp
memory/2464-57190-0x000002062CA10000-0x000002062CB5F000-memory.dmp
memory/2468-57225-0x000001EEAE260000-0x000001EEAE3AF000-memory.dmp
memory/2708-60838-0x00007FFCCCD70000-0x00007FFCCCD71000-memory.dmp
memory/2708-62408-0x000002614E640000-0x000002614E6DE000-memory.dmp
memory/3020-57139-0x00000257F5540000-0x00000257F568F000-memory.dmp
memory/3384-59536-0x0000000000260000-0x000000000033D000-memory.dmp
memory/3384-59611-0x0000000000260000-0x000000000033D000-memory.dmp
memory/3384-59772-0x0000000000260000-0x000000000033D000-memory.dmp
memory/3612-57434-0x00000000735A0000-0x00000000737C7000-memory.dmp
memory/3612-57443-0x0000000000D90000-0x0000000000DC5000-memory.dmp
memory/3612-57413-0x0000000000D90000-0x0000000000DC5000-memory.dmp
memory/3612-57414-0x00000000735A0000-0x00000000737C7000-memory.dmp
memory/3832-57173-0x00000161BDD50000-0x00000161BDE9F000-memory.dmp
memory/3896-57206-0x000001E4F4800000-0x000001E4F48B3000-memory.dmp
memory/3896-57208-0x000001E4F4240000-0x000001E4F438F000-memory.dmp
memory/4208-794-0x000001A872B80000-0x000001A872C80000-memory.dmp
memory/4208-806-0x000001A8722F0000-0x000001A8723F0000-memory.dmp
memory/4208-799-0x000001A872690000-0x000001A872790000-memory.dmp
memory/4208-825-0x000001A874860000-0x000001A874880000-memory.dmp
memory/4208-829-0x000001A874780000-0x000001A8747A0000-memory.dmp
memory/4208-880-0x000001A976D80000-0x000001A976E80000-memory.dmp
memory/4528-60840-0x00007FFCCCD70000-0x00007FFCCCD71000-memory.dmp
memory/4528-62409-0x000002393AD40000-0x000002393ADDE000-memory.dmp
memory/4716-59529-0x0000000005E90000-0x0000000005EFF000-memory.dmp
memory/5280-59767-0x0000000000CB0000-0x0000000000D27000-memory.dmp
memory/5520-62231-0x00000000099C0000-0x0000000009A08000-memory.dmp
memory/5520-62239-0x0000000003750000-0x0000000005D6F000-memory.dmp
memory/5520-62895-0x0000000053B40000-0x0000000053D4E000-memory.dmp
memory/5520-62295-0x00000000532D0000-0x0000000053796000-memory.dmp
memory/5520-62147-0x00000000104C0000-0x0000000011ED0000-memory.dmp
memory/5520-62227-0x0000000014AA0000-0x0000000014DD8000-memory.dmp
memory/5520-62294-0x00000000537A0000-0x0000000053B3D000-memory.dmp
memory/5520-62293-0x0000000053B40000-0x0000000053D4E000-memory.dmp
memory/5520-60020-0x00007FFCCDC30000-0x00007FFCCDC32000-memory.dmp
memory/5520-63035-0x0000000053D50000-0x0000000057CF4000-memory.dmp
memory/5520-62389-0x0000000053D50000-0x0000000057CF4000-memory.dmp
memory/5520-62894-0x0000000003750000-0x0000000005D6F000-memory.dmp
memory/5520-60021-0x0000000053D50000-0x0000000057CF4000-memory.dmp
memory/5520-60024-0x0000000009A40000-0x0000000009AD2000-memory.dmp
memory/5520-62641-0x00000000537A0000-0x0000000053B3D000-memory.dmp
memory/5520-62640-0x0000000053B40000-0x0000000053D4E000-memory.dmp
memory/5520-62642-0x00000000532D0000-0x0000000053796000-memory.dmp
memory/5520-62639-0x0000000003750000-0x0000000005D6F000-memory.dmp
memory/5540-57122-0x0000025959EA0000-0x0000025959FEF000-memory.dmp
memory/5540-57118-0x000002595A0F0000-0x000002595A0F6000-memory.dmp
memory/5540-57117-0x000002595A0E0000-0x000002595A0E8000-memory.dmp
memory/5540-57116-0x000002595A580000-0x000002595A59A000-memory.dmp
memory/5540-57119-0x000002595A5A0000-0x000002595A5AA000-memory.dmp
memory/5540-57115-0x000002595A0D0000-0x000002595A0DA000-memory.dmp
memory/5540-57114-0x000002595A560000-0x000002595A57C000-memory.dmp
memory/5540-57113-0x0000025959B10000-0x0000025959B1A000-memory.dmp
memory/5540-57112-0x000002595A010000-0x000002595A0C3000-memory.dmp
memory/5540-57111-0x0000025959FF0000-0x000002595A00C000-memory.dmp
memory/5540-57098-0x0000025959A90000-0x0000025959AB2000-memory.dmp
memory/5556-57156-0x000001C5338C0000-0x000001C533A0F000-memory.dmp
memory/5816-59765-0x0000000000CB0000-0x0000000000D27000-memory.dmp