Analysis
- user interaction
yes - max time kernel
660s - max time network
664s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
21/08/2026, 04:33
General
- Target https://cdn.discordapp.com/attachments/1535062763687125173/1539987873728565278/Rebooted.zip?ex=6a88f9b8&is=6a87a838&hm=269e1069360802d3f6d164788bda03272da7cca5c680c8898143b9574240bd32&
- Sample260821-e6rxesgm8s
Score
8/10
Malware Config
Signatures
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Using powershell.exe command.
- Downloads MZ/PE file 1 IoCs
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 64 IoCs
- Loads dropped DLL 64 IoCs
- Adds Run key to start application 2 TTPs 3 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops desktop.ini file(s) 2 IoCs
- Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory 64 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 16 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 4 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 12 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 4 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Delays execution with timeout.exe 3 IoCs
- Enumerates system info in registry 2 TTPs 12 IoCs
- Modifies data under HKEY_USERS 47 IoCs
- Modifies registry class 64 IoCs
- Opens file in notepad (likely ransom note) 2 IoCs
- Runs net.exe
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 4 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 44 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 48 IoCs
- Suspicious use of SetWindowsHookEx 9 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.discordapp.com/attachments/1535062763687125173/1539987873728565278/Rebooted.zip?ex=6a88f9b8&is=6a87a838&hm=269e1069360802d3f6d164788bda03272da7cca5c680c8898143b9574240bd32&1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2d8,0x7fffba66c188,0x7fffba66c194,0x7fffba66c1a02⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1572,i,5714274253767267145,7257021451124420322,262144 --field-trial-handle=2352,i,5931320595015528836,7957293976624975483,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1832,i,2716755141968679439,10100300285512190371,524288 --field-trial-handle=2352,i,5931320595015528836,7957293976624975483,262144 --variations-seed-version --mojo-platform-channel-handle=2388 /prefetch:112⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2380,i,11662367228667319134,3534233308289071265,524288 --field-trial-handle=2352,i,5931320595015528836,7957293976624975483,262144 --variations-seed-version --mojo-platform-channel-handle=3424 /prefetch:132⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3304,i,10773214751210674705,3984437149732711307,2097152 --field-trial-handle=2352,i,5931320595015528836,7957293976624975483,262144 --variations-seed-version --mojo-platform-channel-handle=3408 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3376,i,9643821144350991989,5599824786149493255,2097152 --field-trial-handle=2352,i,5931320595015528836,7957293976624975483,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4280,i,12917662825569836926,11972546631039263005,2097152 --field-trial-handle=2352,i,5931320595015528836,7957293976624975483,262144 --variations-seed-version --mojo-platform-channel-handle=4388 /prefetch:92⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4268,i,3276920247741911508,13358922961923008974,2097152 --field-trial-handle=2352,i,5931320595015528836,7957293976624975483,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5304,i,10946567034877473601,11267639229508233168,524288 --field-trial-handle=2352,i,5931320595015528836,7957293976624975483,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5292,i,16683546067714850125,9085372766902797427,524288 --field-trial-handle=2352,i,5931320595015528836,7957293976624975483,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5708,i,12152560367253962366,14285895937331159439,524288 --field-trial-handle=2352,i,5931320595015528836,7957293976624975483,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5864,i,10293823170127116979,18355489176513994184,2097152 --field-trial-handle=2352,i,5931320595015528836,7957293976624975483,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6628,i,5676183483271333241,7827233635348067378,524288 --field-trial-handle=2352,i,5931320595015528836,7957293976624975483,262144 --variations-seed-version --mojo-platform-channel-handle=6752 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6724,i,13466319484883708444,1321822498145943787,524288 --field-trial-handle=2352,i,5931320595015528836,7957293976624975483,262144 --variations-seed-version --mojo-platform-channel-handle=6740 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6628,i,5676183483271333241,7827233635348067378,524288 --field-trial-handle=2352,i,5931320595015528836,7957293976624975483,262144 --variations-seed-version --mojo-platform-channel-handle=6752 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window2⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2d4,0x7fffba66c188,0x7fffba66c194,0x7fffba66c1a03⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1792,i,8669887262409974293,5832816648682661211,524288 --field-trial-handle=2316,i,10133301064242354427,16751327726348849455,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:113⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2468,i,3187018589045548778,4541037359236861910,524288 --field-trial-handle=2316,i,10133301064242354427,16751327726348849455,262144 --variations-seed-version --mojo-platform-channel-handle=3380 /prefetch:133⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1624,i,7714037737228266036,15889988594546953296,262144 --field-trial-handle=2316,i,10133301064242354427,16751327726348849455,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:23⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4432,i,15011199861960844394,9566370704152881063,524288 --field-trial-handle=2316,i,10133301064242354427,16751327726348849455,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4432,i,15011199861960844394,9566370704152881063,524288 --field-trial-handle=2316,i,10133301064242354427,16751327726348849455,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4452,i,8318193835590331986,12859481233139111453,524288 --field-trial-handle=2316,i,10133301064242354427,16751327726348849455,262144 --variations-seed-version --mojo-platform-channel-handle=4580 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4872,i,15775895830144166286,5851478748288594931,524288 --field-trial-handle=2316,i,10133301064242354427,16751327726348849455,262144 --variations-seed-version --mojo-platform-channel-handle=4728 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4624,i,8244220884401458400,12089036854884111367,524288 --field-trial-handle=2316,i,10133301064242354427,16751327726348849455,262144 --variations-seed-version --mojo-platform-channel-handle=5024 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4728,i,2526516418659704264,5006312420472275961,524288 --field-trial-handle=2316,i,10133301064242354427,16751327726348849455,262144 --variations-seed-version --mojo-platform-channel-handle=4740 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4576,i,5640644871491784102,8877834200952532302,524288 --field-trial-handle=2316,i,10133301064242354427,16751327726348849455,262144 --variations-seed-version --mojo-platform-channel-handle=4564 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5184,i,10012005653193168208,7952762612258985631,524288 --field-trial-handle=2316,i,10133301064242354427,16751327726348849455,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5388,i,11338154359963939620,10820969019414836823,524288 --field-trial-handle=2316,i,10133301064242354427,16751327726348849455,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4772,i,18270807801895248057,14832640939744830412,524288 --field-trial-handle=2316,i,10133301064242354427,16751327726348849455,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4768,i,13677247698399272380,12880332054479958189,524288 --field-trial-handle=2316,i,10133301064242354427,16751327726348849455,262144 --variations-seed-version --mojo-platform-channel-handle=4760 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4560,i,1187640706236096358,6043046351909603759,524288 --field-trial-handle=2316,i,10133301064242354427,16751327726348849455,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5388,i,6973393945366661952,9995645690232782492,2097152 --field-trial-handle=2316,i,10133301064242354427,16751327726348849455,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=4768,i,3545985580127329147,10182515738480832272,2097152 --field-trial-handle=2316,i,10133301064242354427,16751327726348849455,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5176,i,7330393244604674833,5264582518477711432,524288 --field-trial-handle=2316,i,10133301064242354427,16751327726348849455,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5652,i,2747349167234488548,16746133994421932217,524288 --field-trial-handle=2316,i,10133301064242354427,16751327726348849455,262144 --variations-seed-version --mojo-platform-channel-handle=5712 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6004,i,16631691664642621799,18137677882984652415,524288 --field-trial-handle=2316,i,10133301064242354427,16751327726348849455,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6864,i,8092316913527746634,16967696263101591348,2097152 --field-trial-handle=2316,i,10133301064242354427,16751327726348849455,262144 --variations-seed-version --mojo-platform-channel-handle=6824 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7164,i,2459280011633716175,9808312497259038622,2097152 --field-trial-handle=2316,i,10133301064242354427,16751327726348849455,262144 --variations-seed-version --mojo-platform-channel-handle=6928 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6668,i,240003983207899530,5985343091278119298,524288 --field-trial-handle=2316,i,10133301064242354427,16751327726348849455,262144 --variations-seed-version --mojo-platform-channel-handle=6652 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=7304,i,286259171634471109,17817792254450912593,2097152 --field-trial-handle=2316,i,10133301064242354427,16751327726348849455,262144 --variations-seed-version --mojo-platform-channel-handle=7328 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=7432,i,17926810471700539837,14888254740798528996,2097152 --field-trial-handle=2316,i,10133301064242354427,16751327726348849455,262144 --variations-seed-version --mojo-platform-channel-handle=7468 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=7592,i,4577403010264348280,5016883598590887617,2097152 --field-trial-handle=2316,i,10133301064242354427,16751327726348849455,262144 --variations-seed-version --mojo-platform-channel-handle=7608 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7760,i,3348331326319955719,16164653298486228143,524288 --field-trial-handle=2316,i,10133301064242354427,16751327726348849455,262144 --variations-seed-version --mojo-platform-channel-handle=7816 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7292,i,8757100043157102980,12995162230046510290,524288 --field-trial-handle=2316,i,10133301064242354427,16751327726348849455,262144 --variations-seed-version --mojo-platform-channel-handle=7796 /prefetch:123⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=7488,i,6387394596723856199,11417890664683177566,2097152 --field-trial-handle=2316,i,10133301064242354427,16751327726348849455,262144 --variations-seed-version --mojo-platform-channel-handle=7548 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=7456,i,4663901148201896506,898168300352376526,2097152 --field-trial-handle=2316,i,10133301064242354427,16751327726348849455,262144 --variations-seed-version --mojo-platform-channel-handle=7700 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=7464,i,7282381860399708944,3525420878736530146,2097152 --field-trial-handle=2316,i,10133301064242354427,16751327726348849455,262144 --variations-seed-version --mojo-platform-channel-handle=8144 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7388,i,5754851094686189327,10428343194568562611,524288 --field-trial-handle=2316,i,10133301064242354427,16751327726348849455,262144 --variations-seed-version --mojo-platform-channel-handle=8008 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=7384,i,164655223044204476,6348259581328902738,2097152 --field-trial-handle=2316,i,10133301064242354427,16751327726348849455,262144 --variations-seed-version --mojo-platform-channel-handle=8028 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=7664,i,11400955949606232982,15396315956118580855,2097152 --field-trial-handle=2316,i,10133301064242354427,16751327726348849455,262144 --variations-seed-version --mojo-platform-channel-handle=7656 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=7468,i,17217352296214845081,1596130670232817964,2097152 --field-trial-handle=2316,i,10133301064242354427,16751327726348849455,262144 --variations-seed-version --mojo-platform-channel-handle=7344 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=8212,i,2134777185486738068,12962042073694147882,2097152 --field-trial-handle=2316,i,10133301064242354427,16751327726348849455,262144 --variations-seed-version --mojo-platform-channel-handle=8232 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7540,i,7651151240983815378,8222356696276723236,262144 --field-trial-handle=2316,i,10133301064242354427,16751327726348849455,262144 --variations-seed-version --mojo-platform-channel-handle=7680 /prefetch:103⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8368,i,9783472754438565319,12783806328574292264,524288 --field-trial-handle=2316,i,10133301064242354427,16751327726348849455,262144 --variations-seed-version --mojo-platform-channel-handle=8424 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=4692,i,11467016541978301782,17754216762644125180,2097152 --field-trial-handle=2316,i,10133301064242354427,16751327726348849455,262144 --variations-seed-version --mojo-platform-channel-handle=4160 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3336,i,5717006594007709240,12162679833528706364,524288 --field-trial-handle=2316,i,10133301064242354427,16751327726348849455,262144 --variations-seed-version --mojo-platform-channel-handle=7608 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=8376,i,16869822493101125667,13575923227631896314,2097152 --field-trial-handle=2316,i,10133301064242354427,16751327726348849455,262144 --variations-seed-version --mojo-platform-channel-handle=8476 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8564,i,13554128290673040962,2319659568885564980,524288 --field-trial-handle=2316,i,10133301064242354427,16751327726348849455,262144 --variations-seed-version --mojo-platform-channel-handle=7668 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=4696,i,1789800105998607582,1825748028856448261,2097152 --field-trial-handle=2316,i,10133301064242354427,16751327726348849455,262144 --variations-seed-version --mojo-platform-channel-handle=8892 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=4236,i,10356832546675026499,12758274598921901561,2097152 --field-trial-handle=2316,i,10133301064242354427,16751327726348849455,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9072,i,6591790974002387806,2130909885382000863,524288 --field-trial-handle=2316,i,10133301064242354427,16751327726348849455,262144 --variations-seed-version --mojo-platform-channel-handle=4868 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=5900,i,8114224957132773046,14408534720548168468,2097152 --field-trial-handle=2316,i,10133301064242354427,16751327726348849455,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,1612961334884267604,3197501788902916678,524288 --field-trial-handle=2316,i,10133301064242354427,16751327726348849455,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,5344038936054342985,7997706693141535952,524288 --field-trial-handle=2316,i,10133301064242354427,16751327726348849455,262144 --variations-seed-version --mojo-platform-channel-handle=9008 /prefetch:143⤵
-
-
C:\Users\Admin\Downloads\dxwebsetup.exe"C:\Users\Admin\Downloads\dxwebsetup.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exe d3dx9_24_x64.inf5⤵
- Executes dropped EXE
- Drops file in System32 directory
-
-
C:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exe d3dx9_25_x64.inf5⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exe d3dx9_26_x64.inf5⤵
- Executes dropped EXE
- Drops file in System32 directory
-
-
C:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exe d3dx9_27_x64.inf5⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exe d3dx9_28_x64.inf5⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exe d3dx9_29_x64.inf5⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exe XACT_x64.inf5⤵
- Executes dropped EXE
- Drops file in System32 directory
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_0.dll5⤵
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exe d3dx9_30_x64.inf5⤵
- Executes dropped EXE
- Drops file in System32 directory
-
-
C:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exe XACT2_1_x64.inf5⤵
- Executes dropped EXE
- Drops file in System32 directory
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_1.dll5⤵
- Loads dropped DLL
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exe xinput1_1_x64.inf, Install_Driver5⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exe XACT2_2_x64.inf5⤵
- Executes dropped EXE
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_2.dll5⤵
- Loads dropped DLL
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exe xinput1_2_x64.inf, Install_Driver5⤵
- Executes dropped EXE
- Drops file in System32 directory
-
-
C:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exe XACT2_3_x64.inf5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_3.dll5⤵
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exe d3dx9_31_x64.inf5⤵
- Executes dropped EXE
- Drops file in System32 directory
-
-
C:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exe XACT2_4_x64.inf5⤵
- Executes dropped EXE
- Drops file in System32 directory
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_4.dll5⤵
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exe d3dx9_32_x64.inf5⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exe d3dx10_00_x64.inf5⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exe XACT2_5_x64.inf5⤵
- Executes dropped EXE
- Drops file in System32 directory
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_5.dll5⤵
- Loads dropped DLL
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exe XACT2_6_x64.inf5⤵
- Executes dropped EXE
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_6.dll5⤵
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exe d3dx9_33_x64.inf5⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exe d3dx10_33_x64.inf5⤵
- Executes dropped EXE
- Drops file in System32 directory
-
-
C:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exe XACT2_7_x64.inf5⤵
- Executes dropped EXE
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_7.dll5⤵
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exe xinput1_3_x64.inf, Install_Driver5⤵
- Executes dropped EXE
- Drops file in System32 directory
-
-
C:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exe d3dx9_34_x64.inf5⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exe d3dx10_34_x64.inf5⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exe XACT2_8_x64.inf5⤵
- Executes dropped EXE
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_8.dll5⤵
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exe d3dx9_35_x64.inf5⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exe d3dx10_35_x64.inf5⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exe XACT2_9_x64.inf5⤵
- Executes dropped EXE
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_9.dll5⤵
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exe d3dx9_36_x64.inf5⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exe d3dx10_36_x64.inf5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
-
C:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exe X3DAudio1_2_x64.inf5⤵
- Executes dropped EXE
- Drops file in System32 directory
-
-
C:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exe XACT2_10_x64.inf5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_10.dll5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exe D3DX9_37_x64.inf5⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exe d3dx10_37_x64.inf5⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exe X3DAudio1_3_x64.inf5⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exe XACT3_0_x64.inf5⤵
- Executes dropped EXE
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_0.dll5⤵
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exe XAudio2_0_x64.inf5⤵
- Executes dropped EXE
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_0.dll5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exe D3DX9_38_x64.inf5⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exe d3dx10_38_x64.inf5⤵
- Executes dropped EXE
- Drops file in System32 directory
-
-
C:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exe X3DAudio1_4_x64.inf5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
-
C:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exe XACT3_1_x64.inf5⤵
- Executes dropped EXE
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_1.dll5⤵
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exe XAudio2_1_x64.inf5⤵
- Executes dropped EXE
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_1.dll5⤵
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exe D3DX9_39_x64.inf5⤵
- Executes dropped EXE
- Drops file in System32 directory
-
-
C:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exe d3dx10_39_x64.inf5⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exe XACT3_2_x64.inf5⤵
- Executes dropped EXE
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_2.dll5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exe XAudio2_2_x64.inf5⤵
- Executes dropped EXE
- Drops file in System32 directory
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_2.dll5⤵
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exe X3DAudio1_5_x64.inf5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
-
C:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exe XACT3_3_x64.inf5⤵
- Executes dropped EXE
- Drops file in System32 directory
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_3.dll5⤵
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exe XAudio2_3_x64.inf5⤵
- Executes dropped EXE
- Drops file in System32 directory
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_3.dll5⤵
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exe D3DX9_40_x64.inf5⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exe d3dx10_40_x64.inf5⤵
- Executes dropped EXE
- Drops file in System32 directory
-
-
C:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exe X3DAudio1_6_x64.inf5⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exe XACT3_4_x64.inf5⤵
- Executes dropped EXE
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_4.dll5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exe XAudio2_4_x64.inf5⤵
- Executes dropped EXE
- Drops file in System32 directory
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_4.dll5⤵
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exe D3DX9_41_x64.inf5⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exe d3dx10_41_x64.inf5⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exe D3DX9_42_x64.inf5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
-
C:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exe d3dx10_42_x64.inf5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
-
C:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exe d3dx11_42_x64.inf5⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exe d3dcsx_42_x64.inf5⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exe D3DCompiler_42_x64.inf5⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exe XACT3_5_x64.inf5⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_5.dll5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exe XAudio2_5_x64.inf5⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_5.dll5⤵
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exe X3DAudio1_7_x64.inf5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exe XACT3_6_x64.inf5⤵
- Drops file in System32 directory
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_6.dll5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exe XAudio2_6_x64.inf5⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_6.dll5⤵
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exe D3DX9_43_x64.inf5⤵
- Drops file in System32 directory
- Drops file in Windows directory
-
-
C:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exe d3dx10_43_x64.inf5⤵
- Drops file in System32 directory
-
-
C:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exe d3dx11_43_x64.inf5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exe d3dcsx_43_x64.inf5⤵
- Drops file in Windows directory
-
-
C:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exe D3DCompiler_43_x64.inf5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exe XACT3_7_x64.inf5⤵
- Drops file in Windows directory
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_7.dll5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXFC75.tmp\infinst.exe XAudio2_7_x64.inf5⤵
- Drops file in Windows directory
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_7.dll5⤵
- Modifies registry class
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,9352295849691015507,9068133177720750278,524288 --field-trial-handle=2316,i,10133301064242354427,16751327726348849455,262144 --variations-seed-version --mojo-platform-channel-handle=8396 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2b4,0x7fffba66c188,0x7fffba66c194,0x7fffba66c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1564,i,10323961964189727249,14541349952182893989,262144 --field-trial-handle=2156,i,5727039572418643087,15041102471973000,262144 --variations-seed-version --mojo-platform-channel-handle=2044 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1856,i,996232899475085972,8679099307795804515,524288 --field-trial-handle=2156,i,5727039572418643087,15041102471973000,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2672,i,13937713137165792299,321090041800749574,524288 --field-trial-handle=2156,i,5727039572418643087,15041102471973000,262144 --variations-seed-version --mojo-platform-channel-handle=2572 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4300,i,8277808610679068898,1844043652033214372,524288 --field-trial-handle=2156,i,5727039572418643087,15041102471973000,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4300,i,8277808610679068898,1844043652033214372,524288 --field-trial-handle=2156,i,5727039572418643087,15041102471973000,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4936,i,18157857149351239427,6195465357847218252,2097152 --field-trial-handle=2156,i,5727039572418643087,15041102471973000,262144 --variations-seed-version --mojo-platform-channel-handle=4952 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4900,i,10092030427785197181,6945176576759133439,524288 --field-trial-handle=2156,i,5727039572418643087,15041102471973000,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5200,i,10913435819910571326,17856938744458761546,524288 --field-trial-handle=2156,i,5727039572418643087,15041102471973000,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5700,i,4154330921669978583,2951639056926099772,2097152 --field-trial-handle=2156,i,5727039572418643087,15041102471973000,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,6235662567440709027,10696195880316700934,524288 --field-trial-handle=2156,i,5727039572418643087,15041102471973000,262144 --variations-seed-version --mojo-platform-channel-handle=600 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,11373898477093470681,8134041122463130468,524288 --field-trial-handle=2156,i,5727039572418643087,15041102471973000,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,17636300314922999852,5531392899766932323,524288 --field-trial-handle=2156,i,5727039572418643087,15041102471973000,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5452,i,2550219291048979388,17574410282395192005,524288 --field-trial-handle=2156,i,5727039572418643087,15041102471973000,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5956,i,17571231502796525054,5551610487869719378,524288 --field-trial-handle=2156,i,5727039572418643087,15041102471973000,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5984,i,14458120953245243480,6833337867786630073,524288 --field-trial-handle=2156,i,5727039572418643087,15041102471973000,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4784,i,16806872277407697263,17813918396611160447,524288 --field-trial-handle=2156,i,5727039572418643087,15041102471973000,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5916,i,6620721599875186567,9746770547976671142,262144 --field-trial-handle=2156,i,5727039572418643087,15041102471973000,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:104⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,14150506425614425500,13574637145867299260,524288 --field-trial-handle=2156,i,5727039572418643087,15041102471973000,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,13153529791318307500,13315956659376613992,524288 --field-trial-handle=2156,i,5727039572418643087,15041102471973000,262144 --variations-seed-version --mojo-platform-channel-handle=2408 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5384,i,754221268130241950,11635399869272821309,524288 --field-trial-handle=2156,i,5727039572418643087,15041102471973000,262144 --variations-seed-version --mojo-platform-channel-handle=2992 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4144,i,7215172336793799967,3480409315328886770,524288 --field-trial-handle=2156,i,5727039572418643087,15041102471973000,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3836,i,5853664515238481138,11882887866232383313,524288 --field-trial-handle=2156,i,5727039572418643087,15041102471973000,262144 --variations-seed-version --mojo-platform-channel-handle=3184 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2120,i,8246868489256422527,7397048741872655796,524288 --field-trial-handle=2156,i,5727039572418643087,15041102471973000,262144 --variations-seed-version --mojo-platform-channel-handle=2108 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3640,i,6362734973221540987,3898141817893854146,524288 --field-trial-handle=2156,i,5727039572418643087,15041102471973000,262144 --variations-seed-version --mojo-platform-channel-handle=4144 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5556,i,13291813723314110883,8084310039899562258,524288 --field-trial-handle=2156,i,5727039572418643087,15041102471973000,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3848,i,10083777031866066882,4291367129770716973,524288 --field-trial-handle=2156,i,5727039572418643087,15041102471973000,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3848,i,9292679603336357462,16620537471592559963,524288 --field-trial-handle=2156,i,5727039572418643087,15041102471973000,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2140,i,1578612063161356341,8500391248485872153,524288 --field-trial-handle=2156,i,5727039572418643087,15041102471973000,262144 --variations-seed-version --mojo-platform-channel-handle=4064 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,6200769631908791505,17093646902881428759,524288 --field-trial-handle=2156,i,5727039572418643087,15041102471973000,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\Rebooted\Rebooted\LAUNCHER.bat" "1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Desktop\Rebooted\Rebooted\REBOOTEDSPOOFER.exe"REBOOTEDSPOOFER.exe"2⤵
-
-
C:\Windows\system32\timeout.exetimeout /t 22⤵
- Delays execution with timeout.exe
-
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\gemini-code-1787286975930.bat" "1⤵
- Executes a command shell one-liner
-
C:\Windows\system32\net.exenet session2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 session3⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Invoke-WebRequest -Uri 'https://www.python.org/ftp/python/3.14.7/python-3.14.7-amd64.exe' -OutFile 'C:\Users\Admin\AppData\Local\Temp\python_installer.exe'"2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Downloads MZ/PE file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\python_installer.exeC:\Users\Admin\AppData\Local\Temp\python_installer.exe /quiet InstallAllUsers=1 PrependPath=1 Include_pip=12⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\Temp\{8FE4C058-AB3C-45DA-AE74-131459011417}\.cr\python_installer.exe"C:\Windows\Temp\{8FE4C058-AB3C-45DA-AE74-131459011417}\.cr\python_installer.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\python_installer.exe" -burn.filehandle.attached=752 -burn.filehandle.self=756 /quiet InstallAllUsers=1 PrependPath=1 Include_pip=13⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Windows\Temp\{DB944ED3-347B-4B01-8DC6-D9101C69B5F7}\.be\python-3.14.7-amd64.exe"C:\Windows\Temp\{DB944ED3-347B-4B01-8DC6-D9101C69B5F7}\.be\python-3.14.7-amd64.exe" -q -burn.elevated BurnPipe.{3A68BE0A-40A4-4947-8606-F7B820F888AC} {D2327315-78F7-4ECF-AF5E-32C2F9004B01} 80124⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:21⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\Rebooted\Rebooted\LAUNCHER.bat" "1⤵
- Executes a command shell one-liner
-
C:\Users\Admin\Desktop\Rebooted\Rebooted\REBOOTEDSPOOFER.exe"REBOOTEDSPOOFER.exe"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\timeout.exetimeout /t 22⤵
- Delays execution with timeout.exe
-
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe" "C:\Users\Admin\Desktop\Rebooted\Rebooted\LAUNCHER.ps1"1⤵
- Opens file in notepad (likely ransom note)
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe" "C:\Users\Admin\Desktop\Rebooted\Rebooted\LAUNCHER.ps1"1⤵
- Opens file in notepad (likely ransom note)
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "-file" " C:\Users\Admin\Desktop\Rebooted\Rebooted\LAUNCHER.ps1 "1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 893AD3879B31317F6C852D10FDE10C8C2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Python314\python.exe"C:\Program Files\Python314\python.exe" -I -m ensurepip -U --default-pip3⤵
- Drops file in Program Files directory
-
C:\Program Files\Python314\python.exe"C:\Program Files\Python314\python.exe" -I -W ignore::DeprecationWarning -c " import runpy import sys sys.path = ['C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpqdd21452\\pip-26.2.1-py3-none-any.whl'] + sys.path sys.argv[1:] = ['install', '--no-cache-dir', '--no-index', '--find-links', 'C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpqdd21452', '--upgrade', 'pip'] runpy.run_module(\"pip\", run_name=\"__main__\", alter_sys=True) "4⤵
- Drops file in Program Files directory
-
-
-
-
C:\Users\Admin\AppData\Local\Package Cache\{97b6de30-6082-48d1-9bb4-9f43296531a4}\python-3.14.7-amd64.exe"C:\Users\Admin\AppData\Local\Package Cache\{97b6de30-6082-48d1-9bb4-9f43296531a4}\python-3.14.7-amd64.exe" /burn.runonce1⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Package Cache\{97b6de30-6082-48d1-9bb4-9f43296531a4}\python-3.14.7-amd64.exe"C:\Users\Admin\AppData\Local\Package Cache\{97b6de30-6082-48d1-9bb4-9f43296531a4}\python-3.14.7-amd64.exe" /quiet /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Python 3.14.7 (64-bit)_20260821054034.log" InstallAllUsers=1 PrependPath=1 Include_pip=12⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Package Cache\{97b6de30-6082-48d1-9bb4-9f43296531a4}\python-3.14.7-amd64.exe"C:\Users\Admin\AppData\Local\Package Cache\{97b6de30-6082-48d1-9bb4-9f43296531a4}\python-3.14.7-amd64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Package Cache\{97b6de30-6082-48d1-9bb4-9f43296531a4}\python-3.14.7-amd64.exe" -burn.filehandle.attached=560 -burn.filehandle.self=580 /quiet /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Python 3.14.7 (64-bit)_20260821054034.log" InstallAllUsers=1 PrependPath=1 Include_pip=13⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Package Cache\{97b6de30-6082-48d1-9bb4-9f43296531a4}\python-3.14.7-amd64.exe"C:\Users\Admin\AppData\Local\Package Cache\{97b6de30-6082-48d1-9bb4-9f43296531a4}\python-3.14.7-amd64.exe" -q -burn.elevated BurnPipe.{E4D344F9-7EB0-454D-ABAE-6534A4A16F9F} {B57E5F48-15C0-4D42-B3A9-C30B014E2C72} 90004⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\Rebooted\Rebooted\LAUNCHER.bat" "1⤵
- Executes a command shell one-liner
-
C:\Users\Admin\Desktop\Rebooted\Rebooted\REBOOTEDSPOOFER.exe"REBOOTEDSPOOFER.exe"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\timeout.exetimeout /t 22⤵
- Delays execution with timeout.exe
-
-
C:\Windows\py.exe"C:\Windows\py.exe" "C:\Users\Admin\Desktop\Rebooted\Rebooted\keyauth_emulator.py"2⤵
- System Location Discovery: System Language Discovery
-
C:\Program Files\Python314\python.exe"C:\Program Files\Python314\python.exe" "C:\Users\Admin\Desktop\Rebooted\Rebooted\keyauth_emulator.py"3⤵
-
-
-
C:\Users\Admin\Desktop\Rebooted\Rebooted\REBOOTEDSPOOFER.exe"C:\Users\Admin\Desktop\Rebooted\Rebooted\REBOOTEDSPOOFER.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of SendNotifyMessage
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7fffc7abc728,0x7fffc7abc734,0x7fffc7abc7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1884,i,4100101017835422788,11120957120188121056,524288 --field-trial-handle=1984,i,9316964696248947733,12800263734989948879,262144 --variations-seed-version --mojo-platform-channel-handle=2012 /prefetch:112⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1624,i,1832967846408726530,1019875208166344920,262144 --field-trial-handle=1984,i,9316964696248947733,12800263734989948879,262144 --variations-seed-version --mojo-platform-channel-handle=1980 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2308,i,8892265321888601426,12932503023416382602,524288 --field-trial-handle=1984,i,9316964696248947733,12800263734989948879,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:132⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3224,i,2349916431965001184,11520670521313428887,2097152 --field-trial-handle=1984,i,9316964696248947733,12800263734989948879,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3240,i,6802153962395700559,14538572708168171402,2097152 --field-trial-handle=1984,i,9316964696248947733,12800263734989948879,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4664,i,8402088942839510208,7211665981903707800,2097152 --field-trial-handle=1984,i,9316964696248947733,12800263734989948879,262144 --variations-seed-version --mojo-platform-channel-handle=4696 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4876,i,13404061721942278763,270332182981181504,524288 --field-trial-handle=1984,i,9316964696248947733,12800263734989948879,262144 --variations-seed-version --mojo-platform-channel-handle=4880 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5036,i,13924616803600923403,4694678662143793893,524288 --field-trial-handle=1984,i,9316964696248947733,12800263734989948879,262144 --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5208,i,4408327000444454804,11359668473699687996,524288 --field-trial-handle=1984,i,9316964696248947733,12800263734989948879,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5276,i,10847101909957599193,14201219493397134910,2097152 --field-trial-handle=1984,i,9316964696248947733,12800263734989948879,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5596,i,18146526468829838741,1257223047033319305,524288 --field-trial-handle=1984,i,9316964696248947733,12800263734989948879,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5696,i,15347032559319192218,5387003704739325528,2097152 --field-trial-handle=1984,i,9316964696248947733,12800263734989948879,262144 --variations-seed-version --mojo-platform-channel-handle=5708 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5728,i,14740001354743143489,11910672085181751815,2097152 --field-trial-handle=1984,i,9316964696248947733,12800263734989948879,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5984,i,4195430571525417142,9974840611375771165,2097152 --field-trial-handle=1984,i,9316964696248947733,12800263734989948879,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5792,i,14299868846845746786,16571371454102306087,524288 --field-trial-handle=1984,i,9316964696248947733,12800263734989948879,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5784,i,16789335596416303857,1565688760314084002,2097152 --field-trial-handle=1984,i,9316964696248947733,12800263734989948879,262144 --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6120,i,11210416508430410708,15673302497602696141,2097152 --field-trial-handle=1984,i,9316964696248947733,12800263734989948879,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6160,i,6297410163600698903,17722930331990055940,524288 --field-trial-handle=1984,i,9316964696248947733,12800263734989948879,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6048,i,11007565798440634728,4451825754284162613,2097152 --field-trial-handle=1984,i,9316964696248947733,12800263734989948879,262144 --variations-seed-version --mojo-platform-channel-handle=2868 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5596,i,15032598248241574169,5532660011959303782,2097152 --field-trial-handle=1984,i,9316964696248947733,12800263734989948879,262144 --variations-seed-version --mojo-platform-channel-handle=4992 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6148,i,16135609697427491394,711784662592549618,2097152 --field-trial-handle=1984,i,9316964696248947733,12800263734989948879,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6296,i,7989389695326988726,14945934066890177862,2097152 --field-trial-handle=1984,i,9316964696248947733,12800263734989948879,262144 --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5984,i,7717683254422829972,13175110741053668725,524288 --field-trial-handle=1984,i,9316964696248947733,12800263734989948879,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=3556,i,10974051873113848439,17118975366433152544,2097152 --field-trial-handle=1984,i,9316964696248947733,12800263734989948879,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=4912,i,10695905942410360935,7234263606557013788,2097152 --field-trial-handle=1984,i,9316964696248947733,12800263734989948879,262144 --variations-seed-version --mojo-platform-channel-handle=4792 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=5260,i,15748958008325949034,6867040132555212921,2097152 --field-trial-handle=1984,i,9316964696248947733,12800263734989948879,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:92⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=6612,i,12857359914778860408,16416509702129200838,2097152 --field-trial-handle=1984,i,9316964696248947733,12800263734989948879,262144 --variations-seed-version --mojo-platform-channel-handle=6624 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵
- Modifies data under HKEY_USERS
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵
-
C:\Windows\py.exe"C:\Windows\py.exe" "C:\Users\Admin\Desktop\Rebooted\Rebooted\keyauth_emulator.py"1⤵
- System Location Discovery: System Language Discovery
-
C:\Program Files\Python314\python.exe"C:\Program Files\Python314\python.exe" "C:\Users\Admin\Desktop\Rebooted\Rebooted\keyauth_emulator.py"2⤵
-
-
C:\Users\Admin\Desktop\Rebooted\Rebooted\REBOOTEDSPOOFER.exe"C:\Users\Admin\Desktop\Rebooted\Rebooted\REBOOTEDSPOOFER.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SDRSVC1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
e5ff0d4.rbs
e5ff0d9.rbs
e5ff0de.rbs
e5ff0e3.rbs
e5ff0e8.rbs
e5ff0ec.rbs
e5ff0f0.rbs
e5ff0f4.rbs
e5ff0f8.rbs
e5ff0fd.rbs
e5ff102.rbs
e5ff107.rbs
e5ff10b.rbs
e5ff10e.rbs
e5ff111.rbs
e5ff114.rbs
e5ff117.rbs
__init__.py
__main__.py
pip.exe
python.exe
f_000006
the-real-index
messages.json
craw_background.js
Network Persistent State
TransportSecurity
Preferences
Preferences
Secure Preferences
the-real-index
the-real-index
data_0
data_2
data_3
Local State
Local State
Local State
blocklist
settings.dat
settings.dat
settings.dat
settings.dat
3decb2d2-ab47-4963-8444-1311faca7a1a.tmp
LOG.old
BookmarkMergedSurfaceOrdering
BrowsingTopicsSiteData
BrowsingTopicsState
data_0
data_1
data_3
f_00006b
f_00006d
f_00006e
f_00006f
f_000070
f_000073
f_000076
f_000079
f_000083
f_00008c
f_000091
f_00009e
f_0000b5
f_0000b8
f_0000b9
f_0000ba
f_0000bb
f_0000bc
f_0000be
f_0000bf
f_0000c1
f_0000da
temp-index
the-real-index
the-real-index
the-real-index
the-real-index~RFe59e47a.TMP
data_1
SiteList-Enterprise.json
Edge Profile.ico
LOG
000003.log
LOG
ExtensionActivityEdge
History
000003.log
MANIFEST-000001
LOG
667a89d4-e52f-47d5-9f73-ea5ce7ee38d5.tmp
Cookies
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Reporting and NEL
SCT Auditing Pending Reports
Sdch Dictionaries
Sdch Dictionaries
TransportSecurity
TransportSecurity
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
623cd082b6202da0_0
the-real-index
the-real-index~RFe5b056b.TMP
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index~RFe5b40ed.TMP
index.txt
index.txt
index.txt
LOG
the-real-index
the-real-index~RFe5ac1ab.TMP
LOG
000003.log
LOG
sync_diagnostic.log
sync_diagnostic.log
CURRENT
MANIFEST-000001
Web Data
favorites_diagnostic.log
000003.log
LOG
000003.log
LOG
dd712dc1-2a62-454f-81cb-22d23dd580e9.tmp
data_1
Last Browser
Last Version
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter~RFe5aed6e.TMP
data_1
Variations
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
first_party_sets.db
AUG2009_D3DCompiler_42_x64.inf
AUG2009_D3DCompiler_42_x86.inf
AUG2009_XACT_x64.inf
AUG2009_XACT_x86.inf
AUG2009_XAudio_x64.inf
AUG2009_XAudio_x86.inf
AUG2009_d3dcsx_42_x64.inf
AUG2009_d3dcsx_42_x86.inf
AUG2009_d3dx10_42_x64.inf
AUG2009_d3dx10_42_x86.inf
AUG2009_d3dx11_42_x64.inf
AUG2009_d3dx11_42_x86.inf
AUG2009_d3dx9_42_x64.inf
AUG2009_d3dx9_42_x86.inf
Aug2008_XACT_x64.inf
Aug2008_XACT_x86.inf
Aug2008_XAudio_x64.inf
Aug2008_XAudio_x86.inf
Aug2008_d3dx10_39_x64.inf
Aug2008_d3dx10_39_x86.inf
Aug2008_d3dx9_39_x64.inf
Aug2008_d3dx9_39_x86.inf
D3DCompiler_37.dll
D3DCompiler_38.dll
D3DCompiler_39.dll
D3DCompiler_40.dll
D3DCompiler_41.dll
D3DCompiler_42.dll
D3DCompiler_43.dll
FEB2010_X3DAudio_x64.inf
FEB2010_X3DAudio_x86.inf
FEB2010_XACT_x64.inf
FEB2010_XACT_x86.inf
FEB2010_XAudio_x64.inf
FEB2010_XAudio_x86.inf
JUN2010_D3DCompiler_43_x64.inf
JUN2010_D3DCompiler_43_x86.inf
JUN2010_XACT_x64.inf
JUN2010_XACT_x86.inf
JUN2010_XAudio_x64.inf
JUN2010_XAudio_x86.inf
JUN2010_d3dcsx_43_x64.inf
JUN2010_d3dcsx_43_x86.inf
JUN2010_d3dx10_43_x64.inf
JUN2010_d3dx10_43_x86.inf
JUN2010_d3dx11_43_x64.inf
JUN2010_d3dx11_43_x86.inf
JUN2010_d3dx9_43_x64.inf
JUN2010_d3dx9_43_x86.inf
Jun2008_X3DAudio_x64.inf
Jun2008_X3DAudio_x86.inf
Jun2008_XACT_x64.inf
Jun2008_XACT_x86.inf
Jun2008_XAudio_x64.inf
Jun2008_XAudio_x86.inf
Jun2008_d3dx10_38_x64.inf
Jun2008_d3dx10_38_x86.inf
Jun2008_d3dx9_38_x64.inf
Jun2008_d3dx9_38_x86.inf
Mar2008_X3DAudio_x64.inf
Mar2008_X3DAudio_x86.inf
Mar2008_XACT_x64.inf
Mar2008_XACT_x86.inf
Mar2008_XAudio_x64.inf
Mar2008_XAudio_x86.inf
Mar2008_d3dx10_37_x64.inf
Mar2008_d3dx10_37_x86.inf
Mar2008_d3dx9_37_x64.inf
Mar2008_d3dx9_37_x86.inf
Mar2009_X3DAudio_x64.inf
Mar2009_X3DAudio_x86.inf
Mar2009_XACT_x64.inf
Mar2009_XACT_x86.inf
Mar2009_XAudio_x64.inf
Mar2009_XAudio_x86.inf
Mar2009_d3dx10_41_x64.inf
Mar2009_d3dx10_41_x86.inf
Mar2009_d3dx9_41_x64.inf
Mar2009_d3dx9_41_x86.inf
Nov2008_X3DAudio_x64.inf
Nov2008_X3DAudio_x86.inf
Nov2008_XACT_x64.inf
Nov2008_XACT_x86.inf
Nov2008_XAudio_x64.inf
Nov2008_XAudio_x86.inf
Nov2008_d3dx10_40_x64.inf
Nov2008_d3dx10_40_x86.inf
Nov2008_d3dx9_40_x64.inf
Nov2008_d3dx9_40_x86.inf
X3DAudio1_3.dll
X3DAudio1_4.dll
X3DAudio1_5.dll
X3DAudio1_6.dll
X3DAudio1_7.dll
XAPOFX1_0.dll
XAPOFX1_1.dll
XAPOFX1_2.dll
XAPOFX1_3.dll
XAPOFX1_3.dll
XAPOFX1_4.dll
XAPOFX1_5.dll
XAudio2_0.dll
XAudio2_1.dll
XAudio2_2.dll
XAudio2_3.dll
XAudio2_4.dll
XAudio2_5.dll
XAudio2_6.dll
XAudio2_7.dll
apr2005_d3dx9_25_x64.inf
apr2005_d3dx9_25_x86.inf
apr2006_d3dx9_30_x64.inf
apr2006_d3dx9_30_x86.inf
apr2006_mdx1_x86.inf
apr2006_xact_x64.inf
apr2006_xact_x86.inf
apr2006_xinput_x64.inf
apr2006_xinput_x86.inf
apr2007_d3dx10_33_x64.inf
apr2007_d3dx10_33_x86.inf
apr2007_d3dx9_33_x64.inf
apr2007_d3dx9_33_x86.inf
apr2007_xact_x64.inf
apr2007_xact_x86.inf
apr2007_xinput_x64.inf
apr2007_xinput_x86.inf
aug2005_d3dx9_27_x64.inf
aug2005_d3dx9_27_x86.inf
aug2006_xact_x64.inf
aug2006_xact_x86.inf
aug2006_xinput_x64.inf
aug2006_xinput_x86.inf
aug2007_d3dx10_35_x64.inf
aug2007_d3dx10_35_x86.inf
aug2007_d3dx9_35_x64.inf
aug2007_d3dx9_35_x86.inf
aug2007_xact_x64.inf
aug2007_xact_x86.inf
d3dcompiler_33.dll
d3dcompiler_34.dll
d3dcompiler_35.dll
d3dcompiler_36.dll
d3dcsx_42.dll
d3dcsx_43.dll
d3dx10.dll
d3dx10_33.dll
d3dx10_34.dll
d3dx10_35.dll
d3dx10_36.dll
d3dx10_37.dll
d3dx10_38.dll
d3dx10_39.dll
d3dx10_40.dll
d3dx10_41.dll
d3dx10_42.dll
d3dx10_43.dll
d3dx11_42.dll
d3dx11_43.dll
d3dx9_24.dll
d3dx9_25.dll
d3dx9_26.dll
d3dx9_27.dll
d3dx9_28.dll
d3dx9_29.dll
d3dx9_30.dll
d3dx9_31.dll
d3dx9_32.dll
d3dx9_33.dll
d3dx9_34.dll
d3dx9_35.dll
d3dx9_36.dll
d3dx9_37.dll
d3dx9_38.dll
d3dx9_39.dll
d3dx9_40.dll
d3dx9_41.dll
d3dx9_42.dll
d3dx9_43.dll
dec2005_d3dx9_28_x64.inf
dec2005_d3dx9_28_x86.inf
dec2006_d3dx10_00_x64.inf
dec2006_d3dx10_00_x86.inf
dec2006_d3dx9_32_x64.inf
dec2006_d3dx9_32_x86.inf
dec2006_xact_x64.inf
dec2006_xact_x86.inf
dxupdate.inf
feb2006_d3dx9_29_x64.inf
feb2006_d3dx9_29_x86.inf
feb2006_xact_x64.inf
feb2006_xact_x86.inf
feb2007_xact_x64.inf
feb2007_xact_x86.inf
infinst.exe
infinst.exe
infinst.exe
infinst.exe
infinst.exe
infinst.exe
infinst.exe
infinst.exe
infinst.exe
infinst.exe
infinst.exe
infinst.exe
infinst.exe
infinst.exe
infinst.exe
infinst.exe
infinst.exe
infinst.exe
infinst.exe
jun2005_d3dx9_26_x64.inf
jun2005_d3dx9_26_x86.inf
jun2006_xact_x64.inf
jun2006_xact_x86.inf
jun2007_d3dx10_34_x64.inf
jun2007_d3dx10_34_x86.inf
jun2007_d3dx9_34_x64.inf
jun2007_d3dx9_34_x86.inf
jun2007_xact_x64.inf
jun2007_xact_x86.inf
mdx_1.0.2902.0_x86.inf
microsoft.directx.direct3dx.dll
microsoft.directx.direct3dx.dll
microsoft.directx.direct3dx.xml
microsoft.directx.direct3dx.xml
nov2007_d3dx10_36_x64.inf
nov2007_d3dx10_36_x86.inf
nov2007_d3dx9_36_x64.inf
nov2007_d3dx9_36_x86.inf
nov2007_x3daudio_x64.inf
nov2007_x3daudio_x86.inf
nov2007_xact_x64.inf
nov2007_xact_x86.inf
oct2006_d3dx9_31_x64.inf
oct2006_d3dx9_31_x86.inf
oct2006_xact_x64.inf
oct2006_xact_x86.inf
x3daudio1_0.dll
x3daudio1_1.dll
x3daudio1_2.dll
x3daudio1_2.dll
x3daudio1_2.dll
xactengine2_0.dll
xactengine2_1.dll
xactengine2_10.dll
xactengine2_2.dll
xactengine2_3.dll
xactengine2_4.dll
xactengine2_5.dll
xactengine2_6.dll
xactengine2_7.dll
xactengine2_8.dll
xactengine2_9.dll
xactengine3_0.dll
xactengine3_1.dll
xactengine3_2.dll
xactengine3_3.dll
xactengine3_4.dll
xactengine3_5.dll
xactengine3_6.dll
xactengine3_7.dll
xinput1_1.dll
xinput1_2.dll
xinput1_3.dll
DXI7F2A.tmp
dxupdate.cif
dxupdate.dll
cv_debug.log
ecb8838b-251c-44f0-96cb-1d0f84a6c47a.tmp
content_new.js
messages.json
default.exc
dxwebsetup.exe.crdownload
DirectX.log
e5ff0e0.msi
e5ff0ed.msi
DirectX.log
DirectX.log
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
LICENSE
Other
PythonBA.dll
SideBar.png
python-3.14.7-amd64.exe
pip_AllUsers
Microsoft.DirectX.AudioVideoPlayback.dll
__AssemblyInfo__.ini
Microsoft.DirectX.Diagnostics.dll
Microsoft.DirectX.Direct3DX.dll
__AssemblyInfo__.ini
Microsoft.DirectX.Direct3DX.dll
__AssemblyInfo__.ini
Microsoft.DirectX.Direct3DX.dll
__AssemblyInfo__.ini
Microsoft.DirectX.Direct3DX.dll
__AssemblyInfo__.ini
Microsoft.DirectX.Direct3DX.dll
__AssemblyInfo__.ini
Microsoft.DirectX.Direct3DX.dll
__AssemblyInfo__.ini
Microsoft.DirectX.Direct3DX.dll
__AssemblyInfo__.ini
Microsoft.DirectX.Direct3DX.dll
__AssemblyInfo__.ini
Microsoft.DirectX.Direct3D.dll
__AssemblyInfo__.ini
Microsoft.DirectX.DirectDraw.dll
__AssemblyInfo__.ini
Microsoft.DirectX.DirectInput.dll
__AssemblyInfo__.ini
Microsoft.DirectX.DirectPlay.dll
__AssemblyInfo__.ini
Microsoft.DirectX.DirectSound.dll
__AssemblyInfo__.ini
Microsoft.DirectX.dll
__AssemblyInfo__.ini
dxupdate.cab
Apr2006_xinput_x86.cab
Apr2006_xinput_x64.cab
Aug2006_xinput_x86.cab
Aug2006_xinput_x64.cab
Dec2006_d3dx10_00_x86.cab
Dec2006_d3dx10_00_x64.cab
Apr2007_xinput_x86.cab
Apr2007_xinput_x64.cab
Feb2005_d3dx9_24_x86.cab
Apr2005_d3dx9_25_x86.cab
Jun2005_d3dx9_26_x86.cab
Aug2005_d3dx9_27_x86.cab
Dec2005_d3dx9_28_x86.cab
Feb2006_d3dx9_29_x86.cab
Apr2006_d3dx9_30_x86.cab
Oct2006_d3dx9_31_x86.cab
Dec2006_d3dx9_32_x86.cab
Apr2007_d3dx9_33_x86.cab
Apr2007_d3dx10_33_x86.cab
Jun2007_d3dx9_34_x86.cab
Jun2007_d3dx10_34_x86.cab
Aug2007_d3dx9_35_x86.cab
Aug2007_d3dx10_35_x86.cab
Nov2007_d3dx9_36_x86.cab
Nov2007_d3dx10_36_x86.cab
Mar2008_d3dx9_37_x86.cab
Mar2008_d3dx10_37_x86.cab
Jun2008_d3dx9_38_x86.cab
Jun2008_d3dx10_38_x86.cab
Aug2008_d3dx9_39_x86.cab
Aug2008_d3dx10_39_x86.cab
Nov2008_d3dx9_40_x86.cab
Nov2008_d3dx10_40_x86.cab
Mar2009_d3dx9_41_x86.cab
Mar2009_d3dx10_41_x86.cab
Aug2009_d3dx9_42_x86.cab
Aug2009_d3dx10_42_x86.cab
Aug2009_d3dx11_42_x86.cab
Aug2009_d3dcsx_42_x86.cab
Aug2009_D3DCompiler_42_x86.cab
Jun2010_d3dx9_43_x86.cab
Jun2010_d3dx10_43_x86.cab
Jun2010_d3dx11_43_x86.cab
Jun2010_d3dcsx_43_x86.cab
Jun2010_D3DCompiler_43_x86.cab
Feb2005_d3dx9_24_x64.cab
Apr2005_d3dx9_25_x64.cab
Jun2005_d3dx9_26_x64.cab
Aug2005_d3dx9_27_x64.cab
Dec2005_d3dx9_28_x64.cab
Feb2006_d3dx9_29_x64.cab
Feb2006_xact_x86.cab
Feb2006_xact_x64.cab
Apr2006_d3dx9_30_x64.cab
Apr2006_xact_x86.cab
Apr2006_xact_x64.cab
Jun2006_xact_x86.cab
Jun2006_xact_x64.cab
Aug2006_xact_x86.cab
Aug2006_xact_x64.cab
Oct2006_d3dx9_31_x64.cab
Oct2006_xact_x86.cab
Oct2006_xact_x64.cab
Dec2006_d3dx9_32_x64.cab
Dec2006_xact_x86.cab
Dec2006_xact_x64.cab
Feb2007_xact_x86.cab
Feb2007_xact_x64.cab
Apr2007_d3dx9_33_x64.cab
Apr2007_d3dx10_33_x64.cab
Apr2007_xact_x86.cab
Apr2007_xact_x64.cab
Jun2007_d3dx9_34_x64.cab
Jun2007_d3dx10_34_x64.cab
Jun2007_xact_x86.cab
Jun2007_xact_x64.cab
Aug2007_d3dx9_35_x64.cab
Aug2007_d3dx10_35_x64.cab
Aug2007_xact_x86.cab
Aug2007_xact_x64.cab
Nov2007_d3dx9_36_x64.cab
Nov2007_d3dx10_36_x64.cab
Nov2007_x3daudio_x86.cab
Nov2007_x3daudio_x64.cab
Nov2007_xact_x86.cab
Nov2007_xact_x64.cab
Mar2008_d3dx9_37_x64.cab
Mar2008_d3dx10_37_x64.cab
Mar2008_x3daudio_x86.cab
Mar2008_x3daudio_x64.cab
Mar2008_xact_x86.cab
Mar2008_xact_x64.cab
Mar2008_xaudio_x86.cab
Mar2008_xaudio_x64.cab
Jun2008_d3dx9_38_x64.cab
Jun2008_d3dx10_38_x64.cab
Jun2008_x3daudio_x86.cab
Jun2008_x3daudio_x64.cab
Jun2008_xact_x86.cab
Jun2008_xact_x64.cab
Jun2008_xaudio_x86.cab
Jun2008_xaudio_x64.cab
Aug2008_d3dx9_39_x64.cab
Aug2008_d3dx10_39_x64.cab
Aug2008_xact_x86.cab
Aug2008_xact_x64.cab
Aug2008_xaudio_x86.cab
Aug2008_xaudio_x64.cab
Nov2008_x3daudio_x86.cab
Nov2008_x3daudio_x64.cab
Nov2008_xact_x86.cab
Nov2008_xact_x64.cab
Nov2008_xaudio_x86.cab
Nov2008_xaudio_x64.cab
Nov2008_d3dx9_40_x64.cab
Nov2008_d3dx10_40_x64.cab
Mar2009_d3dx9_41_x64.cab
Mar2009_d3dx10_41_x64.cab
Mar2009_x3daudio_x86.cab
Mar2009_x3daudio_x64.cab
Mar2009_xact_x86.cab
Mar2009_xact_x64.cab
Mar2009_xaudio_x86.cab
Mar2009_xaudio_x64.cab
Aug2009_d3dx9_42_x64.cab
Aug2009_d3dx10_42_x64.cab
Aug2009_d3dx11_42_x64.cab
Aug2009_d3dcsx_42_x64.cab
Aug2009_D3DCompiler_42_x64.cab
Aug2009_xact_x86.cab
Aug2009_xact_x64.cab
Aug2009_xaudio_x86.cab
Aug2009_xaudio_x64.cab
Feb2010_x3daudio_x86.cab
Feb2010_x3daudio_x64.cab
Feb2010_xact_x86.cab
Feb2010_xact_x64.cab
Feb2010_xaudio_x86.cab
Feb2010_xaudio_x64.cab
Jun2010_d3dx9_43_x64.cab
Jun2010_d3dx10_43_x64.cab
Jun2010_d3dx11_43_x64.cab
Jun2010_d3dcsx_43_x64.cab
Jun2010_D3DCompiler_43_x64.cab
Jun2010_xact_x86.cab
Jun2010_xact_x64.cab
Jun2010_xaudio_x86.cab
Jun2010_xaudio_x64.cab
MDX_1.0.2902.0_x86.cab
MDX_1.0.2903.0_x86.cab
MDX_1.0.2904.0_x86.cab
MDX_1.0.2905.0_x86.cab
MDX_1.0.2906.0_x86.cab
MDX_1.0.2907.0_x86.cab
MDX_1.0.2908.0_x86.cab
MDX_1.0.2909.0_x86.cab
MDX_1.0.2910.0_x86.cab
Apr2006_MDX1_x86.cab
memory/1868-30816-0x0000000140000000-0x0000000144C60000-memory.dmp
memory/3400-3079-0x0000020A44800000-0x0000020A44822000-memory.dmp
memory/3516-20458-0x0000000002340000-0x00000000023A9000-memory.dmp
memory/4064-19382-0x00000000020C0000-0x0000000002124000-memory.dmp
memory/5052-30067-0x0000000140000000-0x0000000144C60000-memory.dmp
memory/5224-19622-0x0000000001FB0000-0x0000000002016000-memory.dmp
memory/5972-30129-0x0000000140000000-0x0000000144C60000-memory.dmp
memory/8320-24073-0x00000000021A0000-0x00000000021A1000-memory.dmp
memory/8320-24059-0x0000000002190000-0x0000000002191000-memory.dmp
memory/8320-24055-0x0000000140000000-0x0000000144C60000-memory.dmp
memory/8320-24053-0x00007FFFDC050000-0x00007FFFDC052000-memory.dmp
memory/8320-24054-0x00007FFFDC060000-0x00007FFFDC062000-memory.dmp
memory/8928-20163-0x0000000001F70000-0x0000000001FD9000-memory.dmp