Analysis
- user interaction
yes - max time kernel
129s - max time network
204s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
24/08/2026, 02:05
General
- Target music-converter.exe
- Size 643KB
- Sample260824-chw55ack5x
- SHA256 aa8c2b8bdb93e3736d96b37b4fb03465c3505aec25a0437d9272f947f92cae2c
Score
7/10
Malware Config
Signatures
- Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Looks up external IP address via web service 1 TTPs 6 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory 5 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 5 IoCs
- Executes dropped EXE 4 IoCs
- Loads dropped DLL 19 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 16 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 4 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 11 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 2 IoCs
- Gathers system information 1 TTPs 2 IoCs
Runs systeminfo.exe.
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 12 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
- Suspicious use of WriteProcessMemory 33 IoCs
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
- cURL User-Agent 4 IoCs
Uses User-Agent string associated with cURL utility.
Processes
-
C:\Users\Admin\AppData\Local\Temp\music-converter.exe"C:\Users\Admin\AppData\Local\Temp\music-converter.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\curl.execurl -X POST -H "X-Parse-Application-Id: q5jvWMLK5VAn0zVjMVPFSnZYPpbCj2JEAiBpahAC" -H "Content-Type: application/json" -d "{\"event\":\"OpenInstallationPackage\",\"os\":\"win\",\"name\":\"MuConvert All-in-One Music Converter\",\"version\":\"3.3.22\",\"language\":\"en\"}" https://parse.tunefab.com/parse/classes/OmcEvent2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\curl.execurl -X POST -H "X-Parse-Application-Id: q5jvWMLK5VAn0zVjMVPFSnZYPpbCj2JEAiBpahAC" -H "Content-Type: application/json" -d "{\"event\":\"FirstOpenInstallationPackage\",\"os\":\"win\",\"name\":\"MuConvert All-in-One Music Converter\",\"version\":\"3.3.22\",\"language\":\"en\"}" https://parse.tunefab.com/parse/classes/OmcEvent2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\curl.execurl -X POST -H "X-Parse-Application-Id: q5jvWMLK5VAn0zVjMVPFSnZYPpbCj2JEAiBpahAC" -H "Content-Type: application/json" -d "{\"event\":\"StartInstall\",\"os\":\"win\",\"name\":\"MuConvert All-in-One Music Converter\",\"version\":\"3.3.22\",\"language\":\"en\"}" https://parse.tunefab.com/parse/classes/OmcEvent2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Program Files\MuConvert All-in-One Music Converter\vc_redist.x64.exe"C:\Program Files\MuConvert All-in-One Music Converter\vc_redist.x64.exe" /quiet2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{EA949111-F004-4476-A638-8819CF7F9046}\.cr\vc_redist.x64.exe"C:\Windows\Temp\{EA949111-F004-4476-A638-8819CF7F9046}\.cr\vc_redist.x64.exe" -burn.clean.room="C:\Program Files\MuConvert All-in-One Music Converter\vc_redist.x64.exe" -burn.filehandle.attached=580 -burn.filehandle.self=588 /quiet3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{FA443E39-D674-454B-BA4E-CE228F7B9C64}\.be\VC_redist.x64.exe"C:\Windows\Temp\{FA443E39-D674-454B-BA4E-CE228F7B9C64}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{FA2DB835-A7F5-490A-9457-2E86C9161635} {F4466040-55D8-4179-BB6B-B99AE46DE405} 29804⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={1de5e707-82da-4db6-b810-5d140cc4cbb3} -burn.filehandle.self=1028 -burn.embedded BurnPipe.{1BDDB5CD-BFB1-4ACC-86B5-1A5C3A4B5660} {C0405494-2C98-436E-B73F-40DDE8EF0C2A} 60165⤵
-
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=556 -burn.filehandle.self=576 -uninstall -quiet -burn.related.upgrade -burn.ancestors={1de5e707-82da-4db6-b810-5d140cc4cbb3} -burn.filehandle.self=1028 -burn.embedded BurnPipe.{1BDDB5CD-BFB1-4ACC-86B5-1A5C3A4B5660} {C0405494-2C98-436E-B73F-40DDE8EF0C2A} 60166⤵
-
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{83897432-4BE6-493F-A7E2-F06954626947} {790F4D80-3F58-4BC8-8103-42AAFFA387D5} 26207⤵
-
-
-
-
-
-
-
C:\Windows\SysWOW64\curl.execurl -X POST -H "X-Parse-Application-Id: q5jvWMLK5VAn0zVjMVPFSnZYPpbCj2JEAiBpahAC" -H "Content-Type: application/json" -d "{\"event\":\"InstallSuccess\",\"os\":\"win\",\"name\":\"MuConvert All-in-One Music Converter\",\"version\":\"3.3.22\",\"language\":\"en\"}" https://parse.tunefab.com/parse/classes/OmcEvent2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\System32\explorer.exe" https://muconvert.com/music-converter/installation/2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\MuConvert All-in-One Music Converter\MuConvert All-in-One Music Converter.exe"C:\Program Files\MuConvert All-in-One Music Converter\MuConvert All-in-One Music Converter.exe" --install-lang-code=10331⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\reg.exeC:\Windows\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\reg.exeC:\Windows\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "chcp 65001 | systeminfo"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650013⤵
-
-
C:\Windows\system32\systeminfo.exesysteminfo3⤵
- Gathers system information
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "chcp 65001 | systeminfo | findstr ;"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650013⤵
-
-
C:\Windows\system32\systeminfo.exesysteminfo3⤵
- Gathers system information
-
-
C:\Windows\system32\findstr.exefindstr ;3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "chcp 65001 | wmic ComputerSystem get TotalPhysicalMemory"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650013⤵
-
-
C:\Windows\System32\Wbem\WMIC.exewmic ComputerSystem get TotalPhysicalMemory3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "chcp 65001 | wmic memorychip get Capacity"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650013⤵
-
-
C:\Windows\System32\Wbem\WMIC.exewmic memorychip get Capacity3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "ver"2⤵
- Executes a command shell one-liner
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "chcp 65001 | reg query "HKCU\Software\MuConvert All-in-One Music Converter" /V "google_form" | findstr /ri "google_form""2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\chcp.comchcp 650013⤵
-
-
C:\Windows\system32\reg.exereg query "HKCU\Software\MuConvert All-in-One Music Converter" /V "google_form"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /ri "google_form"3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "chcp 65001 | reg query "HKEY_CURRENT_USER\Software\MuConvert All-in-One Music Converter" "2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\chcp.comchcp 650013⤵
-
-
C:\Windows\system32\reg.exereg query "HKEY_CURRENT_USER\Software\MuConvert All-in-One Music Converter"3⤵
-
-
-
C:\Program Files\MuConvert All-in-One Music Converter\MuConvert All-in-One Music Converter.exe"C:\Program Files\MuConvert All-in-One Music Converter\MuConvert All-in-One Music Converter.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\MuConvert All-in-One Music Converter" --gpu-preferences=UAAAAAAAAADgAgAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=disabled --mojo-platform-channel-handle=1764 --field-trial-handle=1724,i,6421899670758063894,4844145255383311299,131072 --disable-features=CrossOriginOpenerPolicy,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:22⤵
-
-
C:\Program Files\MuConvert All-in-One Music Converter\MuConvert All-in-One Music Converter.exe"C:\Program Files\MuConvert All-in-One Music Converter\MuConvert All-in-One Music Converter.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --ignore-certificate-errors --ignore-certificate-errors --user-data-dir="C:\Users\Admin\AppData\Roaming\MuConvert All-in-One Music Converter" --mojo-platform-channel-handle=1940 --field-trial-handle=1724,i,6421899670758063894,4844145255383311299,131072 --disable-features=CrossOriginOpenerPolicy,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:82⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "chcp 65001 | reg query "HKCU\Software\MuConvert All-in-One Music Converter" /V "Installer Path" | findstr /ri "Installer Path""2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\chcp.comchcp 650013⤵
-
-
C:\Windows\system32\reg.exereg query "HKCU\Software\MuConvert All-in-One Music Converter" /V "Installer Path"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /ri "Installer Path"3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "chcp 65001 | reg add "HKCU\Software\MuConvert All-in-One Music Converter" /V "Installer Path" /t REG_SZ /d "C:\ProgramData\MuConvert All-in-One Music Converter\ww" /f"2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\chcp.comchcp 650013⤵
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\MuConvert All-in-One Music Converter" /V "Installer Path" /t REG_SZ /d "C:\ProgramData\MuConvert All-in-One Music Converter\ww" /f3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "chcp 65001 | reg add "HKCU\Software\MuConvert All-in-One Music Converter" /V "Output Path" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\MuConvert All-in-One Music Converter\File" /f"2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\chcp.comchcp 650013⤵
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\MuConvert All-in-One Music Converter" /V "Output Path" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\MuConvert All-in-One Music Converter\File" /f3⤵
-
-
-
C:\Program Files\MuConvert All-in-One Music Converter\MuConvert All-in-One Music Converter.exe"C:\Program Files\MuConvert All-in-One Music Converter\MuConvert All-in-One Music Converter.exe" "C:\Program Files\MuConvert All-in-One Music Converter\resources\app.asar\node_modules\read-browser\forkLeveldb.js" C:\Users\Admin\AppData\Local\Temp\tmp_local\leveldb "{\"fingerPrint\":{\"levelKeys\":[\"_https://muconvert.de\u0000\u0001fingerPrint\",\"_https://muconvert.com\u0000\u0001fingerPrint\",\"_https://www.tunefab.com\u0000\u0001fingerPrint\",\"_https://muconvert.jp\u0000\u0001fingerPrint\",\"_https://www.amusicsoft.com\u0000\u0001fingerPrint\",\"_https://www.tunefab.com.br\u0000\u0001fingerPrint\",\"_https://www.tunefab.ru\u0000\u0001fingerPrint\"]},\"fpVersion\":{\"levelKeys\":[\"_https://muconvert.de\u0000\u0001fpVersion\",\"_https://muconvert.com\u0000\u0001fpVersion\",\"_https://www.tunefab.com\u0000\u0001fpVersion\",\"_https://muconvert.jp\u0000\u0001fpVersion\",\"_https://www.amusicsoft.com\u0000\u0001fpVersion\",\"_https://www.tunefab.com.br\u0000\u0001fpVersion\",\"_https://www.tunefab.ru\u0000\u0001fpVersion\"]},\"_ga\":{\"levelKeys\":[\"_https://muconvert.de\u0000\u0001_ga\",\"_https://muconvert.com\u0000\u0001_ga\",\"_https://www.tunefab.com\u0000\u0001_ga\",\"_https://muconvert.jp\u0000\u0001_ga\",\"_https://www.amusicsoft.com\u0000\u0001_ga\",\"_https://www.tunefab.com.br\u0000\u0001_ga\",\"_https://www.tunefab.ru\u0000\u0001_ga\"]},\"_gid\":{\"levelKeys\":[\"_https://muconvert.de\u0000\u0001_gid\",\"_https://muconvert.com\u0000\u0001_gid\",\"_https://www.tunefab.com\u0000\u0001_gid\",\"_https://muconvert.jp\u0000\u0001_gid\",\"_https://www.amusicsoft.com\u0000\u0001_gid\",\"_https://www.tunefab.com.br\u0000\u0001_gid\",\"_https://www.tunefab.ru\u0000\u0001_gid\"]}}"2⤵
-
-
C:\Program Files\MuConvert All-in-One Music Converter\MuConvert All-in-One Music Converter.exe"C:\Program Files\MuConvert All-in-One Music Converter\MuConvert All-in-One Music Converter.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\MuConvert All-in-One Music Converter" --app-path="C:\Program Files\MuConvert All-in-One Music Converter\resources\app.asar" --no-sandbox --no-zygote --no-sandbox --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2956 --field-trial-handle=1724,i,6421899670758063894,4844145255383311299,131072 --disable-features=CrossOriginOpenerPolicy,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:12⤵
-
C:\Program Files\MuConvert All-in-One Music Converter\resources\app.asar.unpacked\node_modules\vpdl\exe\vpdl.exe"C:\Program Files\MuConvert All-in-One Music Converter\resources\app.asar.unpacked\node_modules\vpdl\exe\vpdl.exe" --version http://version 1ac301eecfe0a1253fe2d185488a2c443⤵
-
C:\Program Files\MuConvert All-in-One Music Converter\resources\app.asar.unpacked\node_modules\vpdl\exe\vpdl.exe"C:\Program Files\MuConvert All-in-One Music Converter\resources\app.asar.unpacked\node_modules\vpdl\exe\vpdl.exe" --version http://version 1ac301eecfe0a1253fe2d185488a2c444⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"5⤵
- Executes a command shell one-liner
-
-
-
-
C:\Program Files\MuConvert All-in-One Music Converter\resources\app.asar.unpacked\node_modules\pssh\exe\psshReslover\psshReslover.exe"C:\Program Files\MuConvert All-in-One Music Converter\resources\app.asar.unpacked\node_modules\pssh\exe\psshReslover\psshReslover.exe" --version http://version 1ac301eecfe0a1253fe2d185488a2c443⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic csproduct get uuid3⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic csproduct get IdentifyingNumber3⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic baseboard get SerialNumber3⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic csproduct get uuid3⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic csproduct get IdentifyingNumber3⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic baseboard get SerialNumber3⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic csproduct get uuid3⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic csproduct get IdentifyingNumber3⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic baseboard get SerialNumber3⤵
-
-
C:\Users\Admin\AppData\Roaming\MuConvert All-in-One Music Converter\vpdl\vpdl.exe.downloading"C:\Users\Admin\AppData\Roaming\MuConvert All-in-One Music Converter\vpdl\vpdl.exe.downloading" --version http://version 1ac301eecfe0a1253fe2d185488a2c443⤵
-
C:\Users\Admin\AppData\Roaming\MuConvert All-in-One Music Converter\vpdl\vpdl.exe.downloading"C:\Users\Admin\AppData\Roaming\MuConvert All-in-One Music Converter\vpdl\vpdl.exe.downloading" --version http://version 1ac301eecfe0a1253fe2d185488a2c444⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"5⤵
- Executes a command shell one-liner
-
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "chcp 65001 | WMIC PATH Win32_Battery Get EstimatedRunTime"2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\chcp.comchcp 650013⤵
-
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PATH Win32_Battery Get EstimatedRunTime3⤵
-
-
-
C:\Program Files\MuConvert All-in-One Music Converter\MuConvert All-in-One Music Converter.exe"C:\Program Files\MuConvert All-in-One Music Converter\MuConvert All-in-One Music Converter.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\MuConvert All-in-One Music Converter" --app-path="C:\Program Files\MuConvert All-in-One Music Converter\resources\app.asar" --no-sandbox --no-zygote --enable-blink-features --disable-blink-features --no-sandbox --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3084 --field-trial-handle=1724,i,6421899670758063894,4844145255383311299,131072 --disable-features=CrossOriginOpenerPolicy,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:12⤵
-
-
C:\Program Files\MuConvert All-in-One Music Converter\MuConvert All-in-One Music Converter.exe"C:\Program Files\MuConvert All-in-One Music Converter\MuConvert All-in-One Music Converter.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\MuConvert All-in-One Music Converter" --app-path="C:\Program Files\MuConvert All-in-One Music Converter\resources\app.asar" --no-sandbox --no-zygote --enable-blink-features --disable-blink-features --no-sandbox --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=1384 --field-trial-handle=1724,i,6421899670758063894,4844145255383311299,131072 --disable-features=CrossOriginOpenerPolicy,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:12⤵
-
-
C:\Program Files\MuConvert All-in-One Music Converter\MuConvert All-in-One Music Converter.exe"C:\Program Files\MuConvert All-in-One Music Converter\MuConvert All-in-One Music Converter.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\MuConvert All-in-One Music Converter" --app-path="C:\Program Files\MuConvert All-in-One Music Converter\resources\app.asar" --enable-sandbox --enable-blink-features --disable-blink-features --no-sandbox --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3064 --field-trial-handle=1724,i,6421899670758063894,4844145255383311299,131072 --disable-features=CrossOriginOpenerPolicy,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:12⤵
-
-
C:\Program Files\MuConvert All-in-One Music Converter\MuConvert All-in-One Music Converter.exe"C:\Program Files\MuConvert All-in-One Music Converter\MuConvert All-in-One Music Converter.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\MuConvert All-in-One Music Converter" --app-path="C:\Program Files\MuConvert All-in-One Music Converter\resources\app.asar" --enable-sandbox --enable-blink-features --disable-blink-features --no-sandbox --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1336 --field-trial-handle=1724,i,6421899670758063894,4844145255383311299,131072 --disable-features=CrossOriginOpenerPolicy,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:12⤵
-
-
C:\Program Files\MuConvert All-in-One Music Converter\MuConvert All-in-One Music Converter.exe"C:\Program Files\MuConvert All-in-One Music Converter\MuConvert All-in-One Music Converter.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\MuConvert All-in-One Music Converter" --app-path="C:\Program Files\MuConvert All-in-One Music Converter\resources\app.asar" --enable-sandbox --enable-blink-features --disable-blink-features --no-sandbox --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=3164 --field-trial-handle=1724,i,6421899670758063894,4844145255383311299,131072 --disable-features=CrossOriginOpenerPolicy,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:12⤵
-
-
C:\Program Files\MuConvert All-in-One Music Converter\MuConvert All-in-One Music Converter.exe"C:\Program Files\MuConvert All-in-One Music Converter\MuConvert All-in-One Music Converter.exe" --type=utility --utility-sub-type=media.mojom.CdmServiceBroker --lang=en-US --service-sandbox-type=cdm --no-sandbox --ignore-certificate-errors --ignore-certificate-errors --user-data-dir="C:\Users\Admin\AppData\Roaming\MuConvert All-in-One Music Converter" --mojo-platform-channel-handle=3368 --field-trial-handle=1724,i,6421899670758063894,4844145255383311299,131072 --disable-features=CrossOriginOpenerPolicy,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:82⤵
-
-
C:\Program Files\MuConvert All-in-One Music Converter\MuConvert All-in-One Music Converter.exe"C:\Program Files\MuConvert All-in-One Music Converter\MuConvert All-in-One Music Converter.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\MuConvert All-in-One Music Converter" --app-path="C:\Program Files\MuConvert All-in-One Music Converter\resources\app.asar" --no-sandbox --no-zygote --no-sandbox --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=3328 --field-trial-handle=1724,i,6421899670758063894,4844145255383311299,131072 --disable-features=CrossOriginOpenerPolicy,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:12⤵
-
C:\Program Files\MuConvert All-in-One Music Converter\resources\app.asar.unpacked\node_modules\vpdl\exe\vpdl.exe"C:\Program Files\MuConvert All-in-One Music Converter\resources\app.asar.unpacked\node_modules\vpdl\exe\vpdl.exe" --version http://version 1ac301eecfe0a1253fe2d185488a2c443⤵
-
C:\Program Files\MuConvert All-in-One Music Converter\resources\app.asar.unpacked\node_modules\vpdl\exe\vpdl.exe"C:\Program Files\MuConvert All-in-One Music Converter\resources\app.asar.unpacked\node_modules\vpdl\exe\vpdl.exe" --version http://version 1ac301eecfe0a1253fe2d185488a2c444⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"5⤵
- Executes a command shell one-liner
-
-
-
-
C:\Program Files\MuConvert All-in-One Music Converter\resources\app.asar.unpacked\node_modules\pssh\exe\psshReslover\psshReslover.exe"C:\Program Files\MuConvert All-in-One Music Converter\resources\app.asar.unpacked\node_modules\pssh\exe\psshReslover\psshReslover.exe" --version http://version 1ac301eecfe0a1253fe2d185488a2c443⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic csproduct get uuid3⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic csproduct get IdentifyingNumber3⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic baseboard get SerialNumber3⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic csproduct get uuid3⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic csproduct get IdentifyingNumber3⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic baseboard get SerialNumber3⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic csproduct get uuid3⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic csproduct get IdentifyingNumber3⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic baseboard get SerialNumber3⤵
-
-
C:\Users\Admin\AppData\Roaming\MuConvert All-in-One Music Converter\pssh\psshReslover_tmp\psshReslover.exe"C:\Users\Admin\AppData\Roaming\MuConvert All-in-One Music Converter\pssh\psshReslover_tmp\psshReslover.exe" --version http://version 1ac301eecfe0a1253fe2d185488a2c443⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://muconvert.com/music-converter/2⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://muconvert.com/spotify-music-converter/buy/win/?is_from_aio=12⤵
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://muconvert.com/music-converter/installation/2⤵
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ffb4be5c188,0x7ffb4be5c194,0x7ffb4be5c1a03⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1812,i,14276784594606665552,10134975335220816171,524288 --field-trial-handle=2692,i,15285777000774317855,16158550607035356296,262144 --variations-seed-version --mojo-platform-channel-handle=2720 /prefetch:113⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1520,i,6975889846370820813,17888714007061455349,262144 --field-trial-handle=2692,i,15285777000774317855,16158550607035356296,262144 --variations-seed-version --mojo-platform-channel-handle=2680 /prefetch:23⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2220,i,5848541702044369315,15600380237693971454,524288 --field-trial-handle=2692,i,15285777000774317855,16158550607035356296,262144 --variations-seed-version --mojo-platform-channel-handle=2728 /prefetch:133⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3680,i,17904029586776503990,17304518807657509502,2097152 --field-trial-handle=2692,i,15285777000774317855,16158550607035356296,262144 --variations-seed-version --mojo-platform-channel-handle=3732 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3676,i,13523746941670053494,13910657388853095261,2097152 --field-trial-handle=2692,i,15285777000774317855,16158550607035356296,262144 --variations-seed-version --mojo-platform-channel-handle=3728 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4080,i,11265865383232805121,11930295868344771465,2097152 --field-trial-handle=2692,i,15285777000774317855,16158550607035356296,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:93⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4072,i,17058055421186474752,8676398138242416395,2097152 --field-trial-handle=2692,i,15285777000774317855,16158550607035356296,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5096,i,13509700443842324765,8664989805878668564,524288 --field-trial-handle=2692,i,15285777000774317855,16158550607035356296,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5308,i,4000400992481223651,14129661167185520129,524288 --field-trial-handle=2692,i,15285777000774317855,16158550607035356296,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5320,i,4736083369426104893,18186493224666475800,524288 --field-trial-handle=2692,i,15285777000774317855,16158550607035356296,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5844,i,14142261232389195090,9712163691481397409,2097152 --field-trial-handle=2692,i,15285777000774317855,16158550607035356296,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:13⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:21⤵
-
C:\ProgramData\Package Cache\{1de5e707-82da-4db6-b810-5d140cc4cbb3}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{1de5e707-82da-4db6-b810-5d140cc4cbb3}\VC_redist.x64.exe" /burn.runonce1⤵
-
C:\ProgramData\Package Cache\{1de5e707-82da-4db6-b810-5d140cc4cbb3}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{1de5e707-82da-4db6-b810-5d140cc4cbb3}\VC_redist.x64.exe" /quiet /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823220744.log"2⤵
-
C:\ProgramData\Package Cache\{1de5e707-82da-4db6-b810-5d140cc4cbb3}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{1de5e707-82da-4db6-b810-5d140cc4cbb3}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{1de5e707-82da-4db6-b810-5d140cc4cbb3}\VC_redist.x64.exe" -burn.filehandle.attached=556 -burn.filehandle.self=576 /quiet /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823220744.log"3⤵
-
C:\ProgramData\Package Cache\{1de5e707-82da-4db6-b810-5d140cc4cbb3}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{1de5e707-82da-4db6-b810-5d140cc4cbb3}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{3D568E91-8A6B-459C-9794-76B1A9187137} {FCF03994-F1D9-45EA-B8C4-3E2AB365B155} 62884⤵
-
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={1de5e707-82da-4db6-b810-5d140cc4cbb3} -burn.filehandle.self=1012 -burn.embedded BurnPipe.{9784B8E0-8889-4C2E-B524-4D0C465E655E} {54101DB3-1E91-4DFB-9887-93E2EEEA9A14} 70165⤵
-
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=556 -burn.filehandle.self=576 -uninstall -quiet -burn.related.upgrade -burn.ancestors={1de5e707-82da-4db6-b810-5d140cc4cbb3} -burn.filehandle.self=1012 -burn.embedded BurnPipe.{9784B8E0-8889-4C2E-B524-4D0C465E655E} {54101DB3-1E91-4DFB-9887-93E2EEEA9A14} 70166⤵
-
-
-
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2cc,0x7ffb4be5c188,0x7ffb4be5c194,0x7ffb4be5c1a02⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1540,i,5174784392302049828,11012493626820315338,262144 --field-trial-handle=2500,i,3380104290377797170,2609801324918204869,262144 --variations-seed-version --mojo-platform-channel-handle=2496 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1704,i,1032663638779120752,6371446944692678151,524288 --field-trial-handle=2500,i,3380104290377797170,2609801324918204869,262144 --variations-seed-version --mojo-platform-channel-handle=2528 /prefetch:112⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2260,i,1471977219081258569,18229714123999464229,524288 --field-trial-handle=2500,i,3380104290377797170,2609801324918204869,262144 --variations-seed-version --mojo-platform-channel-handle=2940 /prefetch:132⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=4756,i,16176386311335114533,3808178939482373242,2097152 --field-trial-handle=2500,i,3380104290377797170,2609801324918204869,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=4760,i,5234840774605423738,11401882940587163696,2097152 --field-trial-handle=2500,i,3380104290377797170,2609801324918204869,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5060,i,3834775909058722488,8381137151765830952,524288 --field-trial-handle=2500,i,3380104290377797170,2609801324918204869,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5068,i,3137361663228439216,12293444884666333768,524288 --field-trial-handle=2500,i,3380104290377797170,2609801324918204869,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5808,i,6859978163076750515,8303121696239492591,524288 --field-trial-handle=2500,i,3380104290377797170,2609801324918204869,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window2⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ffb4be5c188,0x7ffb4be5c194,0x7ffb4be5c1a03⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1800,i,4308333737236402931,14542004303369144509,524288 --field-trial-handle=2212,i,16304814890555181218,9928277682290036106,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:113⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1524,i,9014669691446456216,10756723945191346352,262144 --field-trial-handle=2212,i,16304814890555181218,9928277682290036106,262144 --variations-seed-version --mojo-platform-channel-handle=2208 /prefetch:23⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2552,i,5867948980088493880,10889770234239101119,524288 --field-trial-handle=2212,i,16304814890555181218,9928277682290036106,262144 --variations-seed-version --mojo-platform-channel-handle=3016 /prefetch:133⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4324,i,12476513319741836434,6417893592858090739,524288 --field-trial-handle=2212,i,16304814890555181218,9928277682290036106,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4324,i,12476513319741836434,6417893592858090739,524288 --field-trial-handle=2212,i,16304814890555181218,9928277682290036106,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4440,i,13118184763053327312,13512467586899763557,524288 --field-trial-handle=2212,i,16304814890555181218,9928277682290036106,262144 --variations-seed-version --mojo-platform-channel-handle=4420 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4732,i,4577862857476202611,12339373171460515984,524288 --field-trial-handle=2212,i,16304814890555181218,9928277682290036106,262144 --variations-seed-version --mojo-platform-channel-handle=4780 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4736,i,8392335223073961548,4465847889037001250,524288 --field-trial-handle=2212,i,16304814890555181218,9928277682290036106,262144 --variations-seed-version --mojo-platform-channel-handle=4796 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4100,i,15034968252189604773,8149591115662879566,524288 --field-trial-handle=2212,i,16304814890555181218,9928277682290036106,262144 --variations-seed-version --mojo-platform-channel-handle=4804 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4932,i,17241746737978142976,3928991791459872202,524288 --field-trial-handle=2212,i,16304814890555181218,9928277682290036106,262144 --variations-seed-version --mojo-platform-channel-handle=4936 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4832,i,15487306210749620442,426519208788849069,2097152 --field-trial-handle=2212,i,16304814890555181218,9928277682290036106,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=4904,i,17151712954665095420,11163672124398279049,2097152 --field-trial-handle=2212,i,16304814890555181218,9928277682290036106,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5556,i,311360439662663845,3443365378988137934,524288 --field-trial-handle=2212,i,16304814890555181218,9928277682290036106,262144 --variations-seed-version --mojo-platform-channel-handle=5620 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5552,i,13226383916487546489,11072812916722895188,524288 --field-trial-handle=2212,i,16304814890555181218,9928277682290036106,262144 --variations-seed-version --mojo-platform-channel-handle=5640 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6108,i,14030272479100519608,8827015785994930005,2097152 --field-trial-handle=2212,i,16304814890555181218,9928277682290036106,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window3⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x290,0x7ffb4be5c188,0x7ffb4be5c194,0x7ffb4be5c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1932,i,2610946611034736542,17704775940857666809,262144 --field-trial-handle=2448,i,4798868753232945014,15972177870152318678,262144 --variations-seed-version --mojo-platform-channel-handle=2452 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2060,i,7885200094125587474,12044819587951367685,524288 --field-trial-handle=2448,i,4798868753232945014,15972177870152318678,262144 --variations-seed-version --mojo-platform-channel-handle=2504 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2592,i,14011500277783988500,4231073070834751727,524288 --field-trial-handle=2448,i,4798868753232945014,15972177870152318678,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4348,i,4548471039941951971,9609817680244493854,524288 --field-trial-handle=2448,i,4798868753232945014,15972177870152318678,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4348,i,4548471039941951971,9609817680244493854,524288 --field-trial-handle=2448,i,4798868753232945014,15972177870152318678,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Discovery
Browser Information Discovery
1Peripheral Device Discovery
1Query Registry
3System Information Discovery
4System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1System Time Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
e5bcd92.rbs
e5bcd9e.rbs
e5bcda2.rbs
e5bcda8.rbs
e5bcdb7.rbs
e5bcdbb.rbs
MuConvert All-in-One Music Converter.lnk
F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx
F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val
blocklist
settings.dat
settings.dat
settings.dat
settings.dat
settings.dat
6d489850-6d4b-42ea-8ce9-4bc406df1e81.tmp
BookmarkMergedSurfaceOrdering
the-real-index
the-real-index
the-real-index
data_1
839db385-5871-49b3-aaff-a556242d5ba2.tmp
Edge Profile.ico
MANIFEST-000001
000003.log
Network Persistent State
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
TransportSecurity
d6da7d0c-f5ec-4429-952d-83a3272fedce.tmp
Preferences
Preferences
Preferences
Preferences
Secure Preferences
sync_diagnostic.log
aa6ad5c7-50f5-4686-9968-95bd6468fece.tmp
Local State
Local State
Local State
Local State
Local State
Local State
Local State
d2753b7f-66b1-4e7a-bec9-2449c6dc1f4d.tmp
e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
metadata.json
settings.json
11a7f277-802f-4819-b263-1b54ca21a07b.tmp.node
1d76bf80-3f59-4d40-b20a-ca916c2e22fb.tmp
56ff6801-e7f3-4292-8ba9-c632b280b609.tmp.node
VCRUNTIME140.dll
_ctypes.pyd
base_library.zip
python310.dll
d5331e49-7950-4ea8-9d53-882da2c03943.tmp.node
DownloaderRegisterDll.dll
LICENSE.electron.txt
LICENSE.txt
LICENSES.chromium.html
MuConvert All-in-One Music Converter.exe.sig
verified_contents.json
avdevice-60.dll
avfilter-9.dll
avformat-60.dll
avutil-58.dll
postproc-57.dll
swresample-4.dll
swscale-7.dll
widevinecdm.dll
manifest.fingerprint
manifest.json
alglib1.dll
audible_byte#4-4_0_10000x1362345_0.rt
audible_byte#4-4_1_10000x1362345_0.rt
audible_byte#4-4_2_10000x1362345_0.rt
audible_byte#4-4_3_10000x1362345_0.rt
chrome_100_percent.pak
chrome_200_percent.pak
d3dcompiler_47.dll
ffmpeg.dll
icudtl.dat
id3.exe
alglib0.dll
alglib1.dll
audible_byte#4-4_0_10000x526100_0.rtc
audible_byte#4-4_1_10000x526742_0.rtc
audible_byte#4-4_2_10000x527064_0.rtc
audible_byte#4-4_3_10000x526706_0.rtc
id3.exe
language.json
libEGL.dll
libGLESv2.dll
libcrypto-1_1-x64.dll
libcrypto-1_1.dll
libssl-1_1-x64.dll
af.pak
am.pak
ar.pak
bg.pak
bn.pak
ca.pak
cs.pak
da.pak
de.pak
el.pak
en-GB.pak
en-US.pak
es-419.pak
es.pak
et.pak
fa.pak
fi.pak
fil.pak
fr.pak
gu.pak
he.pak
hi.pak
hr.pak
hu.pak
id.pak
it.pak
ja.pak
kn.pak
ko.pak
lt.pak
lv.pak
ml.pak
mr.pak
ms.pak
nb.pak
nl.pak
pl.pak
pt-BR.pak
pt-PT.pak
ro.pak
ru.pak
sk.pak
sl.pak
sr.pak
sv.pak
sw.pak
ta.pak
te.pak
th.pak
tr.pak
uk.pak
ur.pak
vi.pak
zh-CN.pak
zh-TW.pak
manifest.json
msvcr120.dll
msvcrt.dll
resources.pak
app-update.yml
pssh.json
156a17333e77a3c504018cae5ada8c3b
2bfe9d72a4aae8f06a31025b7536be80
_ARC4.pyd
_Salsa20.pyd
_chacha20.pyd
_pkcs1_decode.pyd
_raw_aes.pyd
_raw_aesni.pyd
_raw_arc2.pyd
_raw_blowfish.pyd
_raw_cast.pyd
_raw_cbc.pyd
_raw_cfb.pyd
_raw_ctr.pyd
_raw_des.pyd
_raw_des3.pyd
_raw_ecb.pyd
_raw_eksblowfish.pyd
_raw_ocb.pyd
_raw_ofb.pyd
_BLAKE2b.pyd
_BLAKE2s.pyd
_MD2.pyd
_MD4.pyd
_MD5.pyd
_RIPEMD160.pyd
_SHA1.pyd
_SHA224.pyd
_SHA256.pyd
_SHA384.pyd
_SHA512.pyd
_ghash_clmul.pyd
_ghash_portable.pyd
_keccak.pyd
_poly1305.pyd
_modexp.pyd
_scrypt.pyd
_ec_ws.pyd
_ed25519.pyd
_ed448.pyd
_x25519.pyd
_cpuid_c.pyd
_strxor.pyd
VCRUNTIME140.dll
_bz2.pyd
_cffi_backend.cp37-win_amd64.pyd
_ctypes.pyd
_decimal.pyd
_hashlib.pyd
_lzma.pyd
_multiprocessing.pyd
_queue.pyd
_socket.pyd
_ssl.pyd
api-ms-win-core-console-l1-1-0.dll
api-ms-win-core-datetime-l1-1-0.dll
api-ms-win-core-debug-l1-1-0.dll
api-ms-win-core-errorhandling-l1-1-0.dll
api-ms-win-core-file-l1-1-0.dll
api-ms-win-core-file-l1-2-0.dll
api-ms-win-core-file-l2-1-0.dll
api-ms-win-core-handle-l1-1-0.dll
api-ms-win-core-heap-l1-1-0.dll
api-ms-win-core-interlocked-l1-1-0.dll
api-ms-win-core-libraryloader-l1-1-0.dll
api-ms-win-core-localization-l1-2-0.dll
api-ms-win-core-memory-l1-1-0.dll
api-ms-win-core-namedpipe-l1-1-0.dll
api-ms-win-core-processenvironment-l1-1-0.dll
api-ms-win-core-processthreads-l1-1-0.dll
api-ms-win-core-processthreads-l1-1-1.dll
api-ms-win-core-profile-l1-1-0.dll
api-ms-win-core-rtlsupport-l1-1-0.dll
api-ms-win-core-string-l1-1-0.dll
api-ms-win-core-synch-l1-1-0.dll
api-ms-win-core-synch-l1-2-0.dll
api-ms-win-core-sysinfo-l1-1-0.dll
api-ms-win-core-timezone-l1-1-0.dll
api-ms-win-core-util-l1-1-0.dll
api-ms-win-crt-conio-l1-1-0.dll
api-ms-win-crt-convert-l1-1-0.dll
api-ms-win-crt-environment-l1-1-0.dll
api-ms-win-crt-filesystem-l1-1-0.dll
api-ms-win-crt-heap-l1-1-0.dll
api-ms-win-crt-locale-l1-1-0.dll
api-ms-win-crt-math-l1-1-0.dll
api-ms-win-crt-process-l1-1-0.dll
api-ms-win-crt-runtime-l1-1-0.dll
api-ms-win-crt-stdio-l1-1-0.dll
api-ms-win-crt-string-l1-1-0.dll
api-ms-win-crt-time-l1-1-0.dll
api-ms-win-crt-utility-l1-1-0.dll
base_library.zip
_brotli.cp37-win_amd64.pyd
cacert.pem
md.cp37-win_amd64.pyd
md__mypyc.cp37-win_amd64.pyd
_message.cp37-win_amd64.pyd
certs.pem
INSTALLER
LICENSE
METADATA
RECORD
WHEEL
top_level.txt
libcrypto-1_1.dll
libssl-1_1.dll
mp4decrypt.exe
psshReslover.exe
pyexpat.pyd
python37.dll
select.pyd
tinyaes.cp37-win_amd64.pyd
ucrtbase.dll
unicodedata.pyd
INSTALLER
LICENSE.txt
METADATA
RECORD
WHEEL
entry_points.txt
index.js
package.json
postinstall.js
settings.json
vpdl
vpdl.exe
vpdl.json
index.js
package.json
rsbuild.config.ts
elevate.exe
wvconf.json
snapshot_blob.bin
tageditor.exe
v8_context_snapshot.bin
vc_redist.x64.exe
vcruntime140.dll
vcruntime140_1.dll
vk_swiftshader.dll
vk_swiftshader_icd.json
vulkan-1.dll
LICENSE
manifest.json
widevinecdm.dll
widevinecdm.dll.sig
widevinecdm.dll.lib
widevinecdm.dll.sig
INetC.dll
LangDLL.dll
StdUtils.dll
System.dll
UAC.dll
WinShell.dll
nsDialogs.dll
nsExec.dll
nsProcess.dll
nsis7z.dll
content_new.js
CURRENT
LOG
MANIFEST-000002
default.exc
the-real-index
the-real-index
CURRENT
6e06b217-cdaf-4bbd-b908-579cfc758ecc.tmp
Network Persistent State
Network Persistent State
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity~RFe5c1d34.TMP
Preferences
converted.json
MANIFEST-000001
config.json
config.json
main.log
main.log
main.log
main.log
widevine-win.zip
pssh.zip
_SHA224.pyd
e5bcd9f.msi
license.rtf
thm.wxl
thm.xml
vc_redist.x64.exe
logo.png
wixstdba.dll
memory/2188-3378-0x0000000000190000-0x0000000000207000-memory.dmp
memory/2620-3381-0x0000000000190000-0x0000000000207000-memory.dmp
memory/3196-48-0x0000028514810000-0x0000028514811000-memory.dmp
memory/3196-59-0x0000028514810000-0x0000028514811000-memory.dmp
memory/3196-58-0x0000028514810000-0x0000028514811000-memory.dmp
memory/3196-57-0x0000028514810000-0x0000028514811000-memory.dmp
memory/3196-56-0x0000028514810000-0x0000028514811000-memory.dmp
memory/3196-55-0x0000028514810000-0x0000028514811000-memory.dmp
memory/3196-54-0x0000028514810000-0x0000028514811000-memory.dmp
memory/3196-50-0x0000028514810000-0x0000028514811000-memory.dmp
memory/3368-1502-0x00000225E1490000-0x00000225E1491000-memory.dmp
memory/3368-1496-0x00000225E1490000-0x00000225E1491000-memory.dmp
memory/3368-1505-0x00000225E1490000-0x00000225E1491000-memory.dmp
memory/3368-1501-0x00000225E1490000-0x00000225E1491000-memory.dmp
memory/3368-1503-0x00000225E1490000-0x00000225E1491000-memory.dmp
memory/3368-1494-0x00000225E1490000-0x00000225E1491000-memory.dmp
memory/3368-1504-0x00000225E1490000-0x00000225E1491000-memory.dmp
memory/3476-3430-0x00007FF737D70000-0x00007FF737D9D000-memory.dmp
memory/4364-3009-0x00007FFB4A260000-0x00007FFB4A6C5000-memory.dmp
memory/4364-2906-0x00007FFB4A260000-0x00007FFB4A6C5000-memory.dmp
memory/4936-3385-0x0000000000190000-0x0000000000207000-memory.dmp
memory/4964-3407-0x000000006B280000-0x000000006B327000-memory.dmp
memory/5236-3380-0x0000000000190000-0x0000000000207000-memory.dmp
memory/6512-2654-0x000000006B280000-0x000000006B327000-memory.dmp
memory/6540-2821-0x00007FFB64EF0000-0x00007FFB64F98000-memory.dmp
memory/6540-2730-0x00007FFB1E4F0000-0x00007FFB23A43000-memory.dmp
memory/6540-2717-0x00007FFB3EB30000-0x00007FFB3FC81000-memory.dmp
memory/6540-2716-0x00007FFB3FC90000-0x00007FFB40EDA000-memory.dmp
memory/6540-2715-0x00007FFB48F10000-0x00007FFB48F9E000-memory.dmp
memory/6668-3383-0x0000000000190000-0x0000000000207000-memory.dmp
memory/6720-2418-0x00007FFB46280000-0x00007FFB466E5000-memory.dmp
memory/6720-2439-0x00007FFB46280000-0x00007FFB466E5000-memory.dmp
memory/6812-3431-0x00007FF737D70000-0x00007FF737D9D000-memory.dmp
memory/6812-4276-0x00007FF737D70000-0x00007FF737D9D000-memory.dmp
memory/7028-2419-0x000000006B280000-0x000000006B327000-memory.dmp