Analysis
- user interaction
yes - max time kernel
1192s - max time network
1163s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
27/08/2026, 07:56
General
- Target http://google.com
- Sample260827-js1pmazvbv
Score
8/10
Malware Config
Signatures
- Downloads MZ/PE file 2 IoCs
- Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 12 IoCs
- Loads dropped DLL 35 IoCs
- Adds Run key to start application 2 TTPs 3 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory 52 IoCs
- Probable phishing domain 1 TTPs 2 IoCs
- Drops file in Windows directory 17 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 15 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 9 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 24 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies data under HKEY_USERS 16 IoCs
- Modifies registry class 64 IoCs
- Suspicious behavior: EnumeratesProcesses 14 IoCs
- Suspicious behavior: LoadsDriver 4 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 42 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 32 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://google.com1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x28c,0x7ff9a697c188,0x7ff9a697c194,0x7ff9a697c1a02⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1980,i,17140194957285019026,2557885464443439659,524288 --field-trial-handle=2796,i,11416033694671828995,4538129415609030060,262144 --variations-seed-version --mojo-platform-channel-handle=2824 /prefetch:32⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1764,i,5631024272442084474,3656029478859689758,262144 --field-trial-handle=2796,i,11416033694671828995,4538129415609030060,262144 --variations-seed-version --mojo-platform-channel-handle=2792 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2352,i,4758726562397040720,9200328644186728859,524288 --field-trial-handle=2796,i,11416033694671828995,4538129415609030060,262144 --variations-seed-version --mojo-platform-channel-handle=3076 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3488,i,12678933934367950571,17920161822266937495,2097152 --field-trial-handle=2796,i,11416033694671828995,4538129415609030060,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3496,i,756930373542883813,10863399422629432767,2097152 --field-trial-handle=2796,i,11416033694671828995,4538129415609030060,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4200,i,3352952701982249923,2546093670745960273,2097152 --field-trial-handle=2796,i,11416033694671828995,4538129415609030060,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4224,i,6906449382342401558,10055173510557539870,2097152 --field-trial-handle=2796,i,11416033694671828995,4538129415609030060,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3912,i,4902168737045735529,12925119620425446787,2097152 --field-trial-handle=2796,i,11416033694671828995,4538129415609030060,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5308,i,3205711271000250514,15605797722088253059,524288 --field-trial-handle=2796,i,11416033694671828995,4538129415609030060,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5304,i,1014938566760228151,13527685328132195324,524288 --field-trial-handle=2796,i,11416033694671828995,4538129415609030060,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6056,i,11037134759019329784,430701647444651064,524288 --field-trial-handle=2796,i,11416033694671828995,4538129415609030060,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6056,i,11037134759019329784,430701647444651064,524288 --field-trial-handle=2796,i,11416033694671828995,4538129415609030060,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6252,i,13656705984219549152,13020555992047177632,2097152 --field-trial-handle=2796,i,11416033694671828995,4538129415609030060,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3460,i,12440598199547573,1594960931824155977,524288 --field-trial-handle=2796,i,11416033694671828995,4538129415609030060,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=4596,i,4854114206651090390,12186172761886247967,2097152 --field-trial-handle=2796,i,11416033694671828995,4538129415609030060,262144 --variations-seed-version --mojo-platform-channel-handle=1756 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6796,i,15691955382470311427,6996168637836915090,2097152 --field-trial-handle=2796,i,11416033694671828995,4538129415609030060,262144 --variations-seed-version --mojo-platform-channel-handle=4540 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6528,i,17113171761056483956,1298814282178486259,524288 --field-trial-handle=2796,i,11416033694671828995,4538129415609030060,262144 --variations-seed-version --mojo-platform-channel-handle=560 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4476,i,15383259839186384540,6871931159696111044,524288 --field-trial-handle=2796,i,11416033694671828995,4538129415609030060,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3560,i,16656103516745691470,10861296768364134748,524288 --field-trial-handle=2796,i,11416033694671828995,4538129415609030060,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4500,i,10846342914472918437,7757281821527737891,524288 --field-trial-handle=2796,i,11416033694671828995,4538129415609030060,262144 --variations-seed-version --mojo-platform-channel-handle=6752 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=756,i,12056649441329486548,1711929573234034208,524288 --field-trial-handle=2796,i,11416033694671828995,4538129415609030060,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3624,i,11476746226536409999,4856829033205882155,262144 --field-trial-handle=2796,i,11416033694671828995,4538129415609030060,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3604,i,1833508327777507900,1535856434858060988,524288 --field-trial-handle=2796,i,11416033694671828995,4538129415609030060,262144 --variations-seed-version --mojo-platform-channel-handle=5668 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7004,i,427716516074574382,12212489020773562354,524288 --field-trial-handle=2796,i,11416033694671828995,4538129415609030060,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5416,i,3795920293722977084,10634991864281351440,524288 --field-trial-handle=2796,i,11416033694671828995,4538129415609030060,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4036,i,17465851175280181655,14957987355172475608,524288 --field-trial-handle=2796,i,11416033694671828995,4538129415609030060,262144 --variations-seed-version --mojo-platform-channel-handle=7016 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3636,i,1244242085507316903,17824682176561520876,524288 --field-trial-handle=2796,i,11416033694671828995,4538129415609030060,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=5828,i,749864102308932131,9469168972614549100,2097152 --field-trial-handle=2796,i,11416033694671828995,4538129415609030060,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=4512,i,9093099164045269542,17394535963460594475,2097152 --field-trial-handle=2796,i,11416033694671828995,4538129415609030060,262144 --variations-seed-version --mojo-platform-channel-handle=4052 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=7180,i,4345549800850393775,17515819117456156548,2097152 --field-trial-handle=2796,i,11416033694671828995,4538129415609030060,262144 --variations-seed-version --mojo-platform-channel-handle=7196 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=5308,i,3441144060685404970,845379780393584590,2097152 --field-trial-handle=2796,i,11416033694671828995,4538129415609030060,262144 --variations-seed-version --mojo-platform-channel-handle=7176 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=4572,i,18285929645414720618,8191237094136311107,2097152 --field-trial-handle=2796,i,11416033694671828995,4538129415609030060,262144 --variations-seed-version --mojo-platform-channel-handle=7364 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=5480,i,2207551182598947374,3764010016057825130,2097152 --field-trial-handle=2796,i,11416033694671828995,4538129415609030060,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=7648,i,2805795265730372373,2685547273314974191,2097152 --field-trial-handle=2796,i,11416033694671828995,4538129415609030060,262144 --variations-seed-version --mojo-platform-channel-handle=7672 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=7048,i,2680541368881557910,3603062140990496809,2097152 --field-trial-handle=2796,i,11416033694671828995,4538129415609030060,262144 --variations-seed-version --mojo-platform-channel-handle=7480 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=7492,i,2149406654937629190,1233661385141637121,2097152 --field-trial-handle=2796,i,11416033694671828995,4538129415609030060,262144 --variations-seed-version --mojo-platform-channel-handle=7876 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=7852,i,12773719403434961908,17310073639655458698,2097152 --field-trial-handle=2796,i,11416033694671828995,4538129415609030060,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=6968,i,18015941558812770209,3618583761735054753,2097152 --field-trial-handle=2796,i,11416033694671828995,4538129415609030060,262144 --variations-seed-version --mojo-platform-channel-handle=8020 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5636,i,13733506263343047786,6512615915180536038,524288 --field-trial-handle=2796,i,11416033694671828995,4538129415609030060,262144 --variations-seed-version --mojo-platform-channel-handle=8140 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=7048,i,7657776673510435162,14326231825292220393,2097152 --field-trial-handle=2796,i,11416033694671828995,4538129415609030060,262144 --variations-seed-version --mojo-platform-channel-handle=8068 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8180,i,13306288554595679802,15693093541407405506,524288 --field-trial-handle=2796,i,11416033694671828995,4538129415609030060,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:82⤵
-
-
C:\Users\Admin\Downloads\VC_redist.x64.exe"C:\Users\Admin\Downloads\VC_redist.x64.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\Temp\{56FA1136-537C-4C35-BF22-E14D470E8284}\.cr\VC_redist.x64.exe"C:\Windows\Temp\{56FA1136-537C-4C35-BF22-E14D470E8284}\.cr\VC_redist.x64.exe" -burn.clean.room="C:\Users\Admin\Downloads\VC_redist.x64.exe" -burn.filehandle.attached=584 -burn.filehandle.self=7203⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
-
C:\Windows\Temp\{EFD317ED-6ED7-48E7-A8DC-260196EAD759}\.be\VC_redist.x64.exe"C:\Windows\Temp\{EFD317ED-6ED7-48E7-A8DC-260196EAD759}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{80DEC996-3BB1-4372-BD76-EDA2A98463A3} {A4663871-42BF-45DD-9AA8-B11FB31D82A0} 42084⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={0e3bb569-69d6-4c34-bff9-c2f81db5e5f0} -burn.filehandle.self=1072 -burn.embedded BurnPipe.{313AF94D-0B82-4499-BFDC-C69FB3483C75} {BE544634-E14A-484B-A84A-3F092964AF8B} 15965⤵
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=488 -burn.filehandle.self=564 -uninstall -quiet -burn.related.upgrade -burn.ancestors={0e3bb569-69d6-4c34-bff9-c2f81db5e5f0} -burn.filehandle.self=1072 -burn.embedded BurnPipe.{313AF94D-0B82-4499-BFDC-C69FB3483C75} {BE544634-E14A-484B-A84A-3F092964AF8B} 15966⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{9BD8733A-C263-48F4-9053-9AF6EDDA507B} {06FEAAAC-758E-4B9E-B2B2-463D65B46882} 44327⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
-
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=4476,i,13862223136667182008,16893916845518271792,2097152 --field-trial-handle=2796,i,11416033694671828995,4538129415609030060,262144 --variations-seed-version --mojo-platform-channel-handle=7608 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=8052,i,16243028796328620281,3707343305272970346,2097152 --field-trial-handle=2796,i,11416033694671828995,4538129415609030060,262144 --variations-seed-version --mojo-platform-channel-handle=7560 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=4484,i,16652781617304746945,5459031348863609612,2097152 --field-trial-handle=2796,i,11416033694671828995,4538129415609030060,262144 --variations-seed-version --mojo-platform-channel-handle=6968 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=7608,i,4280499585565279684,7379247515192425368,2097152 --field-trial-handle=2796,i,11416033694671828995,4538129415609030060,262144 --variations-seed-version --mojo-platform-channel-handle=7220 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=7820,i,4807374409520185977,14461047987240476988,2097152 --field-trial-handle=2796,i,11416033694671828995,4538129415609030060,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=8460,i,17750669330058420969,5868365601447329764,2097152 --field-trial-handle=2796,i,11416033694671828995,4538129415609030060,262144 --variations-seed-version --mojo-platform-channel-handle=8044 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=8112,i,294224549253700187,10731521219765815327,2097152 --field-trial-handle=2796,i,11416033694671828995,4538129415609030060,262144 --variations-seed-version --mojo-platform-channel-handle=8472 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9192,i,9084703440042505337,5364688819926281698,524288 --field-trial-handle=2796,i,11416033694671828995,4538129415609030060,262144 --variations-seed-version --mojo-platform-channel-handle=9008 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --always-read-main-dll --metrics-shmem-handle=8164,i,11423143242838847910,786420703045299435,2097152 --field-trial-handle=2796,i,11416033694671828995,4538129415609030060,262144 --variations-seed-version --mojo-platform-channel-handle=8724 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --always-read-main-dll --metrics-shmem-handle=8708,i,5448741589651109794,4225530209769813565,2097152 --field-trial-handle=2796,i,11416033694671828995,4538129415609030060,262144 --variations-seed-version --mojo-platform-channel-handle=8660 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --always-read-main-dll --metrics-shmem-handle=8836,i,849989004600698710,12167766386048793644,2097152 --field-trial-handle=2796,i,11416033694671828995,4538129415609030060,262144 --variations-seed-version --mojo-platform-channel-handle=8672 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --always-read-main-dll --metrics-shmem-handle=9524,i,3267934761081336995,10532673988178644545,2097152 --field-trial-handle=2796,i,11416033694671828995,4538129415609030060,262144 --variations-seed-version --mojo-platform-channel-handle=9536 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7772,i,6830691826588311917,5513189069144306043,524288 --field-trial-handle=2796,i,11416033694671828995,4538129415609030060,262144 --variations-seed-version --mojo-platform-channel-handle=6664 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --always-read-main-dll --metrics-shmem-handle=8484,i,7391951833759507530,14559298588975673503,2097152 --field-trial-handle=2796,i,11416033694671828995,4538129415609030060,262144 --variations-seed-version --mojo-platform-channel-handle=6676 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --always-read-main-dll --metrics-shmem-handle=9860,i,10029086214625369340,16476005555379181000,2097152 --field-trial-handle=2796,i,11416033694671828995,4538129415609030060,262144 --variations-seed-version --mojo-platform-channel-handle=9808 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --always-read-main-dll --metrics-shmem-handle=10024,i,18132890798150217694,12226859693440676222,2097152 --field-trial-handle=2796,i,11416033694671828995,4538129415609030060,262144 --variations-seed-version --mojo-platform-channel-handle=9816 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --always-read-main-dll --metrics-shmem-handle=9868,i,10475375723869607318,12015205184289131300,2097152 --field-trial-handle=2796,i,11416033694671828995,4538129415609030060,262144 --variations-seed-version --mojo-platform-channel-handle=9860 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --always-read-main-dll --metrics-shmem-handle=10228,i,9115049664981531114,11905749397087723926,2097152 --field-trial-handle=2796,i,11416033694671828995,4538129415609030060,262144 --variations-seed-version --mojo-platform-channel-handle=6700 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --always-read-main-dll --metrics-shmem-handle=9984,i,14626119845568182580,5553199180950622020,2097152 --field-trial-handle=2796,i,11416033694671828995,4538129415609030060,262144 --variations-seed-version --mojo-platform-channel-handle=9316 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --always-read-main-dll --metrics-shmem-handle=6664,i,7440697107267346664,15017962819842034098,2097152 --field-trial-handle=2796,i,11416033694671828995,4538129415609030060,262144 --variations-seed-version --mojo-platform-channel-handle=8584 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --always-read-main-dll --metrics-shmem-handle=10580,i,3209001537103638083,8868325562107562892,2097152 --field-trial-handle=2796,i,11416033694671828995,4538129415609030060,262144 --variations-seed-version --mojo-platform-channel-handle=10480 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=10520,i,1118713036816175362,17009944181988417454,524288 --field-trial-handle=2796,i,11416033694671828995,4538129415609030060,262144 --variations-seed-version --mojo-platform-channel-handle=10524 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --always-read-main-dll --metrics-shmem-handle=9864,i,2065430065344745793,9915676628030933452,2097152 --field-trial-handle=2796,i,11416033694671828995,4538129415609030060,262144 --variations-seed-version --mojo-platform-channel-handle=8700 /prefetch:12⤵
-
-
C:\Users\Admin\Downloads\NDP481-DevPack-ENU.exe"C:\Users\Admin\Downloads\NDP481-DevPack-ENU.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\Temp\{BF979E1F-1B0E-43BB-8363-685E352CE34C}\.cr\NDP481-DevPack-ENU.exe"C:\Windows\Temp\{BF979E1F-1B0E-43BB-8363-685E352CE34C}\.cr\NDP481-DevPack-ENU.exe" -burn.clean.room="C:\Users\Admin\Downloads\NDP481-DevPack-ENU.exe" -burn.filehandle.attached=688 -burn.filehandle.self=6963⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --always-read-main-dll --metrics-shmem-handle=9792,i,16941604203220048688,6150939114243749726,2097152 --field-trial-handle=2796,i,11416033694671828995,4538129415609030060,262144 --variations-seed-version --mojo-platform-channel-handle=9516 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:21⤵
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe" /burn.runonce1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260827090337.log"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe" -burn.filehandle.attached=520 -burn.filehandle.self=540 /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260827090337.log"3⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
-
C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{F8D71039-E9FF-484B-9A54-CD14C92E558D} {44FAFE64-EA9E-4FB2-8CEB-62AE5FFACECA} 32604⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\VC_redist.x64\" -ad -an -ai#7zMap22667:88:7zEvent274871⤵
- Suspicious use of FindShellTrayWindow
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1992 -prefsLen 27099 -prefMapHandle 1996 -prefMapSize 270279 -ipcHandle 2084 -initialChannelId {5aa7fb7b-9fb4-4dbf-847b-e160939dbfa1} -parentPid 3120 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3120" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu3⤵
- Loads dropped DLL
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2460 -prefsLen 27135 -prefMapHandle 2464 -prefMapSize 270279 -ipcHandle 2472 -initialChannelId {c738777c-22c4-4791-bebc-ae9d5f0472fe} -parentPid 3120 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3120" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket3⤵
- Loads dropped DLL
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3652 -prefsLen 27276 -prefMapHandle 3656 -prefMapSize 270279 -jsInitHandle 3660 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3668 -initialChannelId {648f5e55-b30d-431b-96b9-73c6b5ca1127} -parentPid 3120 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3120" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab3⤵
- Loads dropped DLL
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3852 -prefsLen 27276 -prefMapHandle 3856 -prefMapSize 270279 -ipcHandle 3932 -initialChannelId {314b6540-9e0a-4115-bd24-8e9214c92018} -parentPid 3120 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3120" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd3⤵
- Loads dropped DLL
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4416 -prefsLen 34775 -prefMapHandle 4420 -prefMapSize 270279 -jsInitHandle 4424 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4432 -initialChannelId {b22155ee-0d93-44eb-b330-688939bb9475} -parentPid 3120 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3120" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab3⤵
- Loads dropped DLL
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4800 -prefsLen 34931 -prefMapHandle 4804 -prefMapSize 270279 -ipcHandle 4812 -initialChannelId {a842ed89-6e1c-4a0a-aa8b-244d54df4272} -parentPid 3120 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3120" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility3⤵
- Loads dropped DLL
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5100 -prefsLen 32952 -prefMapHandle 5092 -prefMapSize 270279 -jsInitHandle 5088 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5200 -initialChannelId {c062cfbf-061a-4487-8c25-e3aae06884b6} -parentPid 3120 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3120" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab3⤵
- Loads dropped DLL
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5340 -prefsLen 32952 -prefMapHandle 5344 -prefMapSize 270279 -jsInitHandle 5348 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5356 -initialChannelId {7a0cf9d3-c9b8-4747-9cbc-040fa37a2dc3} -parentPid 3120 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3120" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab3⤵
- Loads dropped DLL
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5308 -prefsLen 32952 -prefMapHandle 5304 -prefMapSize 270279 -jsInitHandle 5300 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1396 -initialChannelId {4b18123b-2bbb-4121-b365-ecb33b3af83b} -parentPid 3120 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3120" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab3⤵
- Loads dropped DLL
- Checks processor information in registry
-
-
-
C:\Users\Admin\Downloads\VC_redist.x64.exe"C:\Users\Admin\Downloads\VC_redist.x64.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\Temp\{077BD906-6FE3-4B02-B289-CC122016A900}\.cr\VC_redist.x64.exe"C:\Windows\Temp\{077BD906-6FE3-4B02-B289-CC122016A900}\.cr\VC_redist.x64.exe" -burn.clean.room="C:\Users\Admin\Downloads\VC_redist.x64.exe" -burn.filehandle.attached=556 -burn.filehandle.self=6922⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
-
C:\Windows\Temp\{A0ED3A75-E939-44F2-9D05-53E6E857D67A}\.be\VC_redist.x64.exe"C:\Windows\Temp\{A0ED3A75-E939-44F2-9D05-53E6E857D67A}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{A76AC3F3-FA5C-439D-9B2E-FBE8845CE89D} {45776691-B12D-41FE-85B7-A94083961C5C} 67083⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\VC_redist.x64\" -ad -an -ai#7zMap15441:88:7zEvent182481⤵
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
e5e788e.rbs
e5e789a.rbs
e5e78a1.rbs
e5e78b0.rbs
e5e78b4.rbs
e5e78b5.rbf
e5e78b6.rbf
e5e78b7.rbf
e5e78b8.rbf
e5e78b9.rbf
e5e78ba.rbf
e5e78bb.rbf
e5e78bc.rbf
e5e78bd.rbf
e5e78be.rbf
e5e78bf.rbf
e5e78c0.rbf
e5e78c1.rbf
e5e78c2.rbf
e5e78c5.rbs
e5e78c7.rbf
e5e78ca.rbf
e5e78cb.rbf
e5e78cc.rbf
e5e78cd.rbf
e5e78ce.rbf
e5e78cf.rbf
e5e78d0.rbf
e5e78d1.rbf
state.rsm
blocklist
CrashpadMetrics-active.pma
settings.dat
settings.dat
LOG.old
LOG.old
LOG.old
BookmarkMergedSurfaceOrdering
f_0000a8
f_0000a9
f_0000aa
f_0000ad
f_0000ae
f_0000af
f_0000b0
f_0000b2
f_0000b4
f_0000b6
f_0000b8
f_0000bb
f_0000bc
f_0000bd
f_0000be
f_0000bf
f_0000c2
f_0000c3
f_0000c4
f_0000c5
f_0000c6
f_0000c8
f_0000cb
f_0000cc
f_0000d1
f_0000d9
f_0000e1
f_0000e7
f_0000ee
f_0000ef
f_0000f0
f_0000f1
f_0000f2
f_0000f4
f_0000f6
f_0000f7
f_0000f8
f_0000fe
f_00010f
f_00012e
f_000138
f_000162
f_00018a
f_0001a1
00691dfa6b24d64b_0
02e41caad904e7fc_0
049ce322c48355cd_0
0b4b8762beb4eb8b_0
0c4a1eb1a2961aef_0
0d870d2f777375a0_0
0e6f435c4604914e_0
0f54957f594985c3_0
11104fe27cea1141_0
1a1686b54dbad744_0
1bc866f48325ad5b_0
1f1c4bba1674fa36_0
20ff6f048024802c_0
23a99b22b30ff532_0
283ac5054c175e55_0
293e60791f0a2b52_0
29ac3d5c0e9e00ac_0
29cc897241c2fb59_0
29fef8150c3e845e_0
2d40663f2583876f_0
2ed183d46af5954b_0
2f4680e8f8f8a14f_0
2f65003196a27bed_0
30d402df118bbd51_0
30f9fe35a22956f9_0
33ca4c796610002b_0
34752e2d1753963c_0
3874ebefa0c7aeb3_0
395af9039f15e196_0
39a5e623cac641bd_0
3a117163e2be7c8c_0
3c7e56a16f19a9d8_0
3d2d353aea0ebd2a_0
435c28d9cd412a91_0
4b819f1e1528ade3_0
4ccfc79731feb27f_0
51c003cd405a5673_0
5419e86514e02389_0
5483ee6c9e829040_0
5a53f6a2eca06b5c_0
5a7fb0fb2d3c1c15_0
5dd016d767bf505a_0
6048c53dd280a81c_0
61a0b4d20ae0e222_0
690ccc8eea086670_0
69dd773dac28b474_0
69f91929ca3415c8_0
6a54d8c7c9bb4cad_0
6a922a4fb7ca9575_0
6c53d31eaa2cce26_0
6c7ddd4a187d7745_0
6d1b6c821e5413e7_0
6fdd4e4d142743d0_0
76e61c1c89c5ebe1_0
7853c5422f7aa119_0
78b99223269c8493_0
7a6268d420b60dbf_0
7d6189b66755de2b_0
8370f32e56b70429_0
89e32bc39c403ec4_0
8a7d343f91ebe8a8_0
8baa13f7b32fb253_0
92aa708729096273_0
976a3649ed264c1f_0
9820ef3cdc166065_0
9c3949ae1729aba5_0
9c5cd2ae8787ec91_0
9cafecb54c45618b_0
9dc2c94216db55a9_0
9dfa7f798b9b53ba_0
9e820ba8a7bcce09_0
a0e874a56c694b12_0
a2509c30c6083168_0
a2c2b7678606fb5f_0
a392e7077bf25147_0
a4d78697d978ffb1_0
a5dbf24ad19a2bf1_0
a7723cd3edfef78e_0
a8c76e48bcca7936_0
abb0b29c5e6831bc_0
aea7846c19d82fbf_0
af3fcfd7fc74a113_0
b4d37676c7b35f5a_0
b5901ac71d8cfbee_0
b827c624dbf27111_0
bad0f5187f20cb50_0
bc3ce50e37d0cec8_0
bf9a77945d755a20_0
c0b72fa81f98dcf1_0
c4d5ae27b76737ab_0
c69e33723c33ed39_0
c6aa8e61aaa87dc0_0
c796a9a28320e412_0
cb5c9d39a8c4bcf9_0
cbde122905d43173_0
cc25a4c9b17d453b_0
d79e0a2891fc014a_0
dc7b47f23bfbb5eb_0
e0513585c34859ad_0
e2ec9d1138bca871_0
e2f483455f0de9e3_0
e4db5f1336425d50_0
e7f5fc6df2f02125_0
e93bf8a6b9ea2225_0
e9c7e700cc3e33cf_0
eae8ac79bdb269e6_0
ebd82afa15a0aaf8_0
f17e77031873dab7_0
f18bfaddbc8bc49a_0
f2da324e75bcf663_0
f47798777502ae62_0
f4aeffbce202bf58_0
f7ad3f637d1e5b60_0
fac04c66d8725008_0
fc15564f196d27a8_0
fcb044140ef57d42_0
ffa52ba239421c84_0
fff83739132565d2_0
temp-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index~RFe58a63e.TMP
SiteList-Enterprise.json
Edge Profile.ico
000003.log
CURRENT
LOG
MANIFEST-000001
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
4f2277ea2139c475_0
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
623cd082b6202da0_0
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
f40c9eef63ff087e_0
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index~RFe5dabd3.TMP
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index~RFe5dabd3.TMP
0ee5e2ae7c65b717_0
0ee5e2ae7c65b717_1
2c53cde658823a94_0
2c53cde658823a94_1
2d1fd6ec13179694_0
2d1fd6ec13179694_1
36e767b36e764605_0
36e767b36e764605_1
3742e809c03a504e_0
3742e809c03a504e_1
388a2c78de7cf98f_0
388a2c78de7cf98f_1
56dda95837f739c9_0
56dda95837f739c9_1
590640047f2ba5f0_0
590640047f2ba5f0_1
5a5d3e4b80e58225_0
5a5d3e4b80e58225_1
6a1ac6c7a19d2072_0
6a1ac6c7a19d2072_1
72515b9cd8332adb_0
72515b9cd8332adb_1
787debb6026fb350_0
787debb6026fb350_1
832c668c42a3c48a_0
832c668c42a3c48a_1
87c2d2383cabd8fd_0
87c2d2383cabd8fd_1
9574902bf57da1b6_0
9574902bf57da1b6_1
a5760a89fa5064d3_0
a5760a89fa5064d3_1
aa57973c1e26ae3d_0
aa57973c1e26ae3d_1
ab317b2503a74d4f_0
ab317b2503a74d4f_1
b70fb308826c65bb_0
b70fb308826c65bb_1
c22bdee357892973_0
c22bdee357892973_1
cd97c1762cb6ab60_0
cd97c1762cb6ab60_1
d3170240b49d1bf5_0
d3170240b49d1bf5_1
d84561beb18c6b12_0
d84561beb18c6b12_1
e3c5699b5189de47_0
e3c5699b5189de47_1
e6c0a08c45e55298_0
e6c0a08c45e55298_1
e794b234d9d933f6_0
e794b234d9d933f6_1
e7dedc7674095d3f_0
e7dedc7674095d3f_1
e89f1d7bae7296fa_0
e89f1d7bae7296fa_1
e93565d7ace72b06_0
e93565d7ace72b06_1
f2c7b252c34aec4a_0
f2c7b252c34aec4a_1
f48ae2aa85e0111c_0
f48ae2aa85e0111c_1
fbe4acf434e3a37b_0
fbe4acf434e3a37b_1
the-real-index
the-real-index
the-real-index~RFe581539.TMP
index.txt
index.txt
index.txt
index.txt
index.txt
index.txt.tmp
index.txt.tmp
index.txt.tmp
ba23d8ecda68de77_0
ba23d8ecda68de77_1
the-real-index
the-real-index~RFe586bf4.TMP
36f6b881e258413e_0
ee1cdf8c43e022d7_0
the-real-index
the-real-index
sync_diagnostic.log
OperationConfig
OperationConfig~RFe58e6e0.TMP
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter~RFe584e4a.TMP
33381541-b122-4576-9f1e-adbf25e7a93d.tmp
5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
dd_vcredist_amd64_20260827090337_000_vcRuntimeMinimum_x64.log
dd_vcredist_amd64_20260827090337_001_vcRuntimeAdditional_x64.log
data.safe.tmp
data.safe.tmp
events
6d9ee076-c7ed-4ded-afac-295123081eca
a37c5fa9-1dbe-4b09-99a5-da88f6a0fd97
bcf2be1f-9694-496d-8e02-77336ef41ee5
c747b83d-8896-4c58-b945-91aed7aea520
cb74c10b-ecef-416f-943d-a572a4912fa4
fdf52fa2-c91b-4541-8d70-bb011449a9ca
prefs-1.js
VC_redist.x64.exe.crdownload
u1
u17
u2
wixstdba.dll
VC_redist.x64.exe
thm.wxl
thm.wxl
thm.wxl
thm.wxl
thm.wxl
thm.wxl
thm.wxl
thm.wxl
thm.wxl
thm.wxl
thm.wxl
thm.wxl
thm.wxl
logo.png
wixstdba.dll
cab2C04DDC374BD96EB5C8EB8208F2C7C92
cab5046A8AB272BF37297BB7928664C9503
vcRuntimeAdditional_x64
vcRuntimeMinimum_x64
memory/2364-2953-0x0000000000600000-0x0000000000677000-memory.dmp
memory/4432-2955-0x0000000000600000-0x0000000000677000-memory.dmp
memory/5132-2956-0x0000000000600000-0x0000000000677000-memory.dmp