Analysis
- user interaction
yes - max time kernel
353s - max time network
323s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
08/09/2026, 15:26
General
- Target https://www.mediafire.com/file/qw64u59hveszppz/OmniaEnterprise9s3.32.20.7z/file
- Sample260908-svjcssgd56
Score
10/10
Malware Config
Signatures
- Modifies firewall policy service 3 TTPs 8 IoCs
- Event Triggered Execution: Image File Execution Options Injection 1 TTPs 6 IoCs
- Modifies Windows Firewall 2 TTPs 8 IoCs
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 15 IoCs
- Loads dropped DLL 32 IoCs
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory 20 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 24 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 22 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 2 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- NSIS installer 2 IoCs
- Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Kills process with taskkill 2 IoCs
- Modifies Internet Explorer settings 1 TTPs 8 IoCs
- Modifies data under HKEY_USERS 8 IoCs
- Modifies registry class 64 IoCs
- Runs .reg file with regedit 1 IoCs
- Runs net.exe
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: EnumeratesProcesses 24 IoCs
- Suspicious behavior: GetForegroundWindowSpam 3 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 24 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 38 IoCs
- Suspicious use of SetWindowsHookEx 19 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.mediafire.com/file/qw64u59hveszppz/OmniaEnterprise9s3.32.20.7z/file1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffe3bf5c188,0x7ffe3bf5c194,0x7ffe3bf5c1a02⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1984,i,845564772142448913,7931646361887048093,524288 --field-trial-handle=1888,i,7436988206990420323,1026153449402125121,262144 --variations-seed-version --mojo-platform-channel-handle=2464 /prefetch:32⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1900,i,12537642092714628441,1025044074565016476,262144 --field-trial-handle=1888,i,7436988206990420323,1026153449402125121,262144 --variations-seed-version --mojo-platform-channel-handle=2392 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2516,i,13355445169285237323,12841559707230320542,524288 --field-trial-handle=1888,i,7436988206990420323,1026153449402125121,262144 --variations-seed-version --mojo-platform-channel-handle=2536 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,14076584008874646328,13286558011385923854,2097152 --field-trial-handle=1888,i,7436988206990420323,1026153449402125121,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,528589220228446616,11689995945038715562,2097152 --field-trial-handle=1888,i,7436988206990420323,1026153449402125121,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4256,i,12344078219323519553,11750594439530155602,2097152 --field-trial-handle=1888,i,7436988206990420323,1026153449402125121,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4268,i,11587137344320791371,5631730413451813942,2097152 --field-trial-handle=1888,i,7436988206990420323,1026153449402125121,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3596,i,16197468462046986241,8886928894563692180,2097152 --field-trial-handle=1888,i,7436988206990420323,1026153449402125121,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5264,i,11434504752906117391,456336131560644698,2097152 --field-trial-handle=1888,i,7436988206990420323,1026153449402125121,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5504,i,9841301318073213761,6786663218549411074,524288 --field-trial-handle=1888,i,7436988206990420323,1026153449402125121,262144 --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5560,i,3588030372669079555,3690094947042657792,524288 --field-trial-handle=1888,i,7436988206990420323,1026153449402125121,262144 --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5592,i,6207595000086574857,4268075896722323860,2097152 --field-trial-handle=1888,i,7436988206990420323,1026153449402125121,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6316,i,4511239294302887153,12058989907337295378,2097152 --field-trial-handle=1888,i,7436988206990420323,1026153449402125121,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6640,i,781743255675390527,11784350325365804171,2097152 --field-trial-handle=1888,i,7436988206990420323,1026153449402125121,262144 --variations-seed-version --mojo-platform-channel-handle=6668 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6368,i,10628041727343702444,10745490493629853314,524288 --field-trial-handle=1888,i,7436988206990420323,1026153449402125121,262144 --variations-seed-version --mojo-platform-channel-handle=6648 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7260,i,3740704293970642076,16402241219127566771,524288 --field-trial-handle=1888,i,7436988206990420323,1026153449402125121,262144 --variations-seed-version --mojo-platform-channel-handle=7272 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7260,i,3740704293970642076,16402241219127566771,524288 --field-trial-handle=1888,i,7436988206990420323,1026153449402125121,262144 --variations-seed-version --mojo-platform-channel-handle=7272 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=7424,i,13415797618746833931,10107378082488326133,2097152 --field-trial-handle=1888,i,7436988206990420323,1026153449402125121,262144 --variations-seed-version --mojo-platform-channel-handle=7448 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8132,i,2043944372112542774,6212718542093420693,524288 --field-trial-handle=1888,i,7436988206990420323,1026153449402125121,262144 --variations-seed-version --mojo-platform-channel-handle=7460 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5172,i,15690678465360881827,16003720171700662829,2097152 --field-trial-handle=1888,i,7436988206990420323,1026153449402125121,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=8128,i,13742409468773759532,2549630383906943355,2097152 --field-trial-handle=1888,i,7436988206990420323,1026153449402125121,262144 --variations-seed-version --mojo-platform-channel-handle=6680 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6740,i,12888629407074700735,15503458245491071662,2097152 --field-trial-handle=1888,i,7436988206990420323,1026153449402125121,262144 --variations-seed-version --mojo-platform-channel-handle=6568 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=5348,i,714006935979238270,106061186150686163,2097152 --field-trial-handle=1888,i,7436988206990420323,1026153449402125121,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=5184,i,9348537420236676126,16370161839566227348,2097152 --field-trial-handle=1888,i,7436988206990420323,1026153449402125121,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7948,i,4505520679556976943,5338371287603866863,2097152 --field-trial-handle=1888,i,7436988206990420323,1026153449402125121,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=6116,i,10861575681175161034,8608948649475247049,2097152 --field-trial-handle=1888,i,7436988206990420323,1026153449402125121,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5356,i,1588034311767331708,16039092654784349243,524288 --field-trial-handle=1888,i,7436988206990420323,1026153449402125121,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3816,i,17742848105335239850,9783421665630876225,524288 --field-trial-handle=1888,i,7436988206990420323,1026153449402125121,262144 --variations-seed-version --mojo-platform-channel-handle=560 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5232,i,2341737743888883743,11068111786314015273,524288 --field-trial-handle=1888,i,7436988206990420323,1026153449402125121,262144 --variations-seed-version --mojo-platform-channel-handle=7864 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=5160,i,12656156492305203371,17147792129300132058,2097152 --field-trial-handle=1888,i,7436988206990420323,1026153449402125121,262144 --variations-seed-version --mojo-platform-channel-handle=7892 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8016,i,14680250128187947512,10764252078062332278,524288 --field-trial-handle=1888,i,7436988206990420323,1026153449402125121,262144 --variations-seed-version --mojo-platform-channel-handle=8056 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=2996,i,283057394901822316,5919749448039387438,2097152 --field-trial-handle=1888,i,7436988206990420323,1026153449402125121,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7060,i,1925834465428490229,7131806245017536365,524288 --field-trial-handle=1888,i,7436988206990420323,1026153449402125121,262144 --variations-seed-version --mojo-platform-channel-handle=7568 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=6872,i,15009653652976672448,15632481257219463743,2097152 --field-trial-handle=1888,i,7436988206990420323,1026153449402125121,262144 --variations-seed-version --mojo-platform-channel-handle=6860 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=7648,i,14605808196865846554,302333041629894280,2097152 --field-trial-handle=1888,i,7436988206990420323,1026153449402125121,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=5720,i,13856492990719308142,4459991263867447885,2097152 --field-trial-handle=1888,i,7436988206990420323,1026153449402125121,262144 --variations-seed-version --mojo-platform-channel-handle=7936 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=7952,i,15175048777766025017,12564884577760867832,2097152 --field-trial-handle=1888,i,7436988206990420323,1026153449402125121,262144 --variations-seed-version --mojo-platform-channel-handle=8320 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8544,i,15489608400910051943,408003207390022593,524288 --field-trial-handle=1888,i,7436988206990420323,1026153449402125121,262144 --variations-seed-version --mojo-platform-channel-handle=8508 /prefetch:82⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6512,i,6140710488017522935,6072166764111745243,524288 --field-trial-handle=1888,i,7436988206990420323,1026153449402125121,262144 --variations-seed-version --mojo-platform-channel-handle=8628 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=8844,i,17963261467205381341,7910408404271975444,262144 --field-trial-handle=1888,i,7436988206990420323,1026153449402125121,262144 --variations-seed-version --mojo-platform-channel-handle=8836 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\OmniaEnterprise9s3.32.20\" -spe -an -ai#7zMap22706:108:7zEvent83611⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\OmniaEnterprise9s3.32.20\OmniaE9s_patch_3.32.20\" -spe -an -ai#7zMap28207:156:7zEvent87431⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\Downloads\OmniaEnterprise9s3.32.20\OmniaE9s_installer_3.32.20.exe"C:\Users\Admin\Downloads\OmniaEnterprise9s3.32.20\OmniaE9s_installer_3.32.20.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\system32\netsh.exe" advfirewall firewall add rule name="Omnia Enterprise 9s App" dir=in action=allow program="C:\Program Files\OmniaE9s\OmniaE9sApp.exe" enable=yes2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\system32\netsh.exe" advfirewall firewall add rule name="Omnia Enterprise 9s Svc" dir=in action=allow program="C:\Program Files\OmniaE9s\OmniaE9sSvc.exe" enable=yes2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\CodeMeter_OmniaE9s\CodeMeterRuntime64.msi" /passive2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\SysWOW64\regedit.exe"C:\Windows\regedit.exe" /s "C:\Users\Admin\AppData\Local\Temp\NfRemote.reg"2⤵
- System Location Discovery: System Language Discovery
- Runs .reg file with regedit
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\system32\netsh.exe" advfirewall firewall add rule name="NfRemote" dir=in action=allow program="C:\Users\Admin\AppData\Local\NfRemote\NfRemote.exe" enable=yes2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\NfRemote.exe"C:\Users\Admin\AppData\Local\Temp\NfRemote.exe" install="C:\Users\Admin\AppData\Local\NfRemote" silent2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Modifies firewall policy service
- Event Triggered Execution: Image File Execution Options Injection
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
-
-
C:\Windows\Installer\MSIC7E5.tmp"C:\Windows\Installer\MSIC7E5.tmp" /t2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\Installer\MSIC834.tmp"C:\Windows\Installer\MSIC834.tmp" /t2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 9E3C9D73A42C64A22448E1888538598A2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding F5F004CADA6D5DD5C912348B4D8671212⤵
- Loads dropped DLL
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding AFD88F2C5A381BDAAC9760483D64B073 E Global\MSI00002⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\net.exe"C:\Windows\system32\net.exe" stop CodeMeter.exe /Y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop CodeMeter.exe /Y4⤵
-
-
-
C:\Windows\SysWOW64\netsh.exe"netsh" advfirewall firewall delete rule name="CodeMeter Runtime Server"3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
- System Time Discovery
-
-
C:\Windows\SysWOW64\netsh.exe"netsh" advfirewall firewall delete rule name="CmWebAdminFWEx1"3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exe"netsh" advfirewall firewall delete rule name="CodeMeterFWEx1"3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\net.exe"C:\Windows\system32\net.exe" start CodeMeter.exe /Y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start CodeMeter.exe /Y4⤵
-
-
-
-
C:\Windows\syswow64\MsiExec.exe"C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\CodeMeter\Runtime\bin\WibuCmTrigger32.dll"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
C:\Windows\System32\MsiExec.exe"C:\Windows\System32\MsiExec.exe" /Y "C:\Program Files\WIBU-SYSTEMS\System\WibuShellExt64.dll"2⤵
- Loads dropped DLL
- Modifies registry class
-
-
C:\Windows\System32\MsiExec.exe"C:\Windows\System32\MsiExec.exe" /Y "C:\Program Files\CodeMeter\Runtime\bin\WibuCmTrigger64.dll"2⤵
- Loads dropped DLL
- Modifies registry class
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 24E4F5253AD66D61914598F03A2E3292 E Global\MSI00002⤵
- Loads dropped DLL
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\CodeMeter\Runtime\bin\CmWebAdmin.exe"C:\Program Files\CodeMeter\Runtime\bin\CmWebAdmin.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
-
C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeter.exe"C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeter.exe"1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5816 -s 9922⤵
- Program crash
-
-
C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeter.exe"C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeter.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 5816 -ip 58161⤵
-
C:\Users\Admin\Downloads\OmniaEnterprise9s3.32.20\OmniaE9s_patch_3.32.20\OmniaE9sApp.exe"C:\Users\Admin\Downloads\OmniaEnterprise9s3.32.20\OmniaE9s_patch_3.32.20\OmniaE9sApp.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\Downloads\OmniaEnterprise9s3.32.20\OmniaE9s_patch_3.32.20\OmniaE9sSvc.exe"C:\Users\Admin\Downloads\OmniaEnterprise9s3.32.20\OmniaE9s_patch_3.32.20\OmniaE9sSvc.exe"1⤵
- Executes dropped EXE
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe" C:\Program Files\OmniaE9s\OmniaE9s Shortcuts1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\OmniaE9s\OmniaE9sApp.exe"C:\Program Files\OmniaE9s\OmniaE9sApp.exe" config2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
-
-
C:\Program Files\OmniaE9s\OmniaE9sApp.exe"C:\Program Files\OmniaE9s\OmniaE9sApp.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Program Files\OmniaE9s\OmniaE9sApp.exe"C:\Program Files\OmniaE9s\OmniaE9sApp.exe" config2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\OmniaE9s\OmniaE9s Shortcuts\OmniaE9s_patch_3.32.20\OmniaE9sApp.exe"C:\Program Files\OmniaE9s\OmniaE9s Shortcuts\OmniaE9s_patch_3.32.20\OmniaE9sApp.exe"2⤵
- Executes dropped EXE
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe" C:\Program Files\OmniaE9s\OmniaE9s Shortcuts1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\OmniaE9s\Uninstall.exe"C:\Program Files\OmniaE9s\Uninstall.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe"C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe" _?=C:\Program Files\OmniaE9s\3⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im OmniaE9sApp.exe"4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im OmniaE9sSvc.exe"4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\system32\netsh.exe" advfirewall firewall delete rule name="Omnia Enterprise 9s App" program="C:\Program Files\OmniaE9s\OmniaE9sApp.exe"4⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\system32\netsh.exe" advfirewall firewall delete rule name="Omnia Enterprise 9s Svc" program="C:\Program Files\OmniaE9s\OmniaE9sSvc.exe"4⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Create or Modify System Process
2Windows Service
2Event Triggered Execution
3Component Object Model Hijacking
1Image File Execution Options Injection
1Netsh Helper DLL
1Privilege Escalation
Create or Modify System Process
2Windows Service
2Event Triggered Execution
3Component Object Model Hijacking
1Image File Execution Options Injection
1Netsh Helper DLL
1Defense Evasion
Impair Defenses
2Disable or Modify System Firewall
2Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
e5ac3f0.rbs
e5ac3f2.rbs
CodeMeterCC.exe
OmniaE9sApp.exe
OmniaE9sSvc.exe
blocklist
settings.dat
settings.dat
settings.dat
settings.dat
BookmarkMergedSurfaceOrdering
f_00010c
the-real-index
the-real-index~RFe599292.TMP
SiteList-Enterprise.json
Edge Profile.ico
data_1
MANIFEST-000001
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Sdch Dictionaries~RFe592e3a.TMP
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
the-real-index
the-real-index
the-real-index~RFe58d906.TMP
the-real-index
the-real-index
index.txt
the-real-index
the-real-index~RFe59621b.TMP
the-real-index
sync_diagnostic.log
OperationConfig
OperationConfig~RFe594905.TMP
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter~RFe58e923.TMP
a9c6d432-292f-426c-9784-23678c981e3a.tmp
49ba9edd-9a38-484d-b310-16493039df5d.tmp
5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
NfRemote.exe
Debug_2026-09-08.log.txt
Debug_2026-09-08.log.txt
Startup_2026-09-08.log.txt
modern-header.bmp
nsExec.dll
System.dll
dumplog.dll
Un_A.exe
OmniaE9s_patch_3.32.20.zip
MSIC7E5.tmp
MSIC834.tmp
MSICB91.tmp
MSICFEA.tmp
MSID058.tmp
MSID0B7.tmp
Icon_SC_CMCC1.A961A077_4BD0_4C98_86BC_EE4A98CE550D.exe
Icon_cmu32_cmd.A961A077_4BD0_4C98_86BC_EE4A98CE550D.exe
WibuCmNET.resources.dll
WibuCmNET.resources.dll
WibuCmNET.resources.dll
WibuCmNET.resources.dll
WibuCmNET.resources.dll
WibuCmNET.dll
policy.4.0.WibuCmNET.dll
policy.4.1.WibuCmNET.dll
policy.4.10.WibuCmNET.dll
policy.4.20.WibuCmNET.dll
policy.4.30.WibuCmNET.dll
policy.4.40.WibuCmNET.dll
policy.4.50.WibuCmNET.dll
policy.5.0.WibuCmNET.dll
policy.5.10.WibuCmNET.dll
policy.5.20.WibuCmNET.dll
policy.5.21.WibuCmNET.dll
policy.5.22.WibuCmNET.dll
policy.6.0.WibuCmNET.dll
policy.6.10.WibuCmNET.dll
policy.6.20.WibuCmNET.dll
policy.6.30.WibuCmNET.dll
policy.6.40.WibuCmNET.dll
policy.6.50.WibuCmNET.dll
policy.6.60.WibuCmNET.dll
policy.6.70.WibuCmNET.dll
policy.6.80.WibuCmNET.dll
policy.6.81.WibuCmNET.dll
policy.6.90.WibuCmNET.dll
policy.7.0.WibuCmNET.dll
WibuCmNET.resources.dll
WibuCmNET.resources.dll
WibuCmNET.resources.dll
WibuCmNET.resources.dll
WibuCmNET.resources.dll
WibuCmNET.resources.dll
WibuCmNET.resources.dll
WibuCmNET.resources.dll
WibuCmNET.resources.dll
WibuCmNET.resources.dll
WibuCmNET.resources.dll
WibuCmNET.dll
policy.2.0.WibuCmNET.dll
policy.2.1.WibuCmNET.dll
policy.2.10.WibuCmNET.dll
policy.2.20.WibuCmNET.dll
policy.3.0.WibuCmNET.dll
policy.3.20.WibuCmNET.dll
policy.3.30.WibuCmNET.dll
policy.3.31.WibuCmNET.dll
policy.3.32.WibuCmNET.dll
policy.3.33.WibuCmNET.dll
policy.4.0.WibuCmNET.dll
policy.4.1.WibuCmNET.dll
policy.4.10.WibuCmNET.dll
policy.4.20.WibuCmNET.dll
policy.4.30.WibuCmNET.dll
policy.4.40.WibuCmNET.dll
policy.4.50.WibuCmNET.dll
policy.5.0.WibuCmNET.dll
policy.5.10.WibuCmNET.dll
policy.5.20.WibuCmNET.dll
policy.5.21.WibuCmNET.dll
policy.5.22.WibuCmNET.dll
policy.6.0.WibuCmNET.dll
policy.6.10.WibuCmNET.dll
policy.6.20.WibuCmNET.dll
policy.6.30.WibuCmNET.dll
policy.6.40.WibuCmNET.dll
memory/3996-4231-0x0000000000400000-0x0000000000F8D000-memory.dmp
memory/3996-4025-0x0000000000400000-0x0000000000F8D000-memory.dmp
memory/4288-3275-0x000001DE77480000-0x000001DE7748C000-memory.dmp
memory/4288-3212-0x000001DE772B0000-0x000001DE772B8000-memory.dmp
memory/4288-3129-0x000001DE77160000-0x000001DE77168000-memory.dmp
memory/4288-3132-0x000001DE77170000-0x000001DE77178000-memory.dmp
memory/4288-3314-0x000001DE77620000-0x000001DE7762C000-memory.dmp
memory/4288-3311-0x000001DE77610000-0x000001DE7761C000-memory.dmp
memory/4288-3308-0x000001DE77530000-0x000001DE7753E000-memory.dmp
memory/4288-3121-0x000001DE77140000-0x000001DE77148000-memory.dmp
memory/4288-3305-0x000001DE77520000-0x000001DE7752C000-memory.dmp
memory/4288-3116-0x000001DE77130000-0x000001DE77138000-memory.dmp
memory/4288-3302-0x000001DE77510000-0x000001DE7751E000-memory.dmp
memory/4288-3113-0x000001DE77120000-0x000001DE77128000-memory.dmp
memory/4288-3299-0x000001DE77500000-0x000001DE7750E000-memory.dmp
memory/4288-3108-0x000001DE77110000-0x000001DE77118000-memory.dmp
memory/4288-3296-0x000001DE774F0000-0x000001DE774FE000-memory.dmp
memory/4288-3105-0x000001DE77100000-0x000001DE77108000-memory.dmp
memory/4288-3293-0x000001DE774E0000-0x000001DE774EE000-memory.dmp
memory/4288-3100-0x000001DE770F0000-0x000001DE770F8000-memory.dmp
memory/4288-3290-0x000001DE774D0000-0x000001DE774DE000-memory.dmp
memory/4288-3097-0x000001DE770E0000-0x000001DE770E8000-memory.dmp
memory/4288-3287-0x000001DE774C0000-0x000001DE774CC000-memory.dmp
memory/4288-3092-0x000001DE770D0000-0x000001DE770D8000-memory.dmp
memory/4288-3284-0x000001DE774B0000-0x000001DE774BC000-memory.dmp
memory/4288-3281-0x000001DE774A0000-0x000001DE774AC000-memory.dmp
memory/4288-3278-0x000001DE77490000-0x000001DE7749C000-memory.dmp
memory/4288-3137-0x000001DE77180000-0x000001DE77188000-memory.dmp
memory/4288-3272-0x000001DE77470000-0x000001DE77480000-memory.dmp
memory/4288-3269-0x000001DE77340000-0x000001DE7734E000-memory.dmp
memory/4288-3266-0x000001DE77330000-0x000001DE7733E000-memory.dmp
memory/4288-3263-0x000001DE77320000-0x000001DE7732E000-memory.dmp
memory/4288-3260-0x000001DE77310000-0x000001DE7731E000-memory.dmp
memory/4288-3257-0x000001DE77300000-0x000001DE7730E000-memory.dmp
memory/4288-3254-0x000001DE772F0000-0x000001DE772FE000-memory.dmp
memory/4288-3251-0x000001DE77540000-0x000001DE77606000-memory.dmp
memory/4288-3248-0x000001DE77350000-0x000001DE773A6000-memory.dmp
memory/4288-3245-0x000001DE773B0000-0x000001DE77466000-memory.dmp
memory/4288-3224-0x000001DE772E0000-0x000001DE772E8000-memory.dmp
memory/4288-3220-0x000001DE772D0000-0x000001DE772D8000-memory.dmp
memory/4288-3216-0x000001DE772C0000-0x000001DE772C8000-memory.dmp
memory/4288-3124-0x000001DE77150000-0x000001DE77158000-memory.dmp
memory/4288-3208-0x000001DE772A0000-0x000001DE772A8000-memory.dmp
memory/4288-3204-0x000001DE77290000-0x000001DE77298000-memory.dmp
memory/4288-3200-0x000001DE77280000-0x000001DE77288000-memory.dmp
memory/4288-3196-0x000001DE77270000-0x000001DE77278000-memory.dmp
memory/4288-3193-0x000001DE77260000-0x000001DE77268000-memory.dmp
memory/4288-3188-0x000001DE77250000-0x000001DE77258000-memory.dmp
memory/4288-3185-0x000001DE77240000-0x000001DE77248000-memory.dmp
memory/4288-3180-0x000001DE77230000-0x000001DE77238000-memory.dmp
memory/4288-3177-0x000001DE77220000-0x000001DE77228000-memory.dmp
memory/4288-3172-0x000001DE77210000-0x000001DE77218000-memory.dmp
memory/4288-3169-0x000001DE77200000-0x000001DE77208000-memory.dmp
memory/4288-3164-0x000001DE771F0000-0x000001DE771F8000-memory.dmp
memory/4288-3161-0x000001DE771E0000-0x000001DE771E8000-memory.dmp
memory/4288-3156-0x000001DE771D0000-0x000001DE771D8000-memory.dmp
memory/4288-3153-0x000001DE771C0000-0x000001DE771C8000-memory.dmp
memory/4288-3089-0x000001DE770C0000-0x000001DE770C8000-memory.dmp
memory/4288-3084-0x000001DE770B0000-0x000001DE770B8000-memory.dmp
memory/4288-3081-0x000001DE770A0000-0x000001DE770A8000-memory.dmp
memory/4288-3073-0x000001DE77080000-0x000001DE77088000-memory.dmp
memory/4288-3076-0x000001DE77090000-0x000001DE77098000-memory.dmp
memory/4288-3068-0x000001DE77070000-0x000001DE77078000-memory.dmp
memory/4288-3065-0x000001DE77060000-0x000001DE77068000-memory.dmp
memory/4288-3060-0x000001DE77050000-0x000001DE77058000-memory.dmp
memory/4288-3056-0x000001DE77040000-0x000001DE77048000-memory.dmp
memory/4288-3052-0x000001DE77030000-0x000001DE77038000-memory.dmp
memory/4288-3145-0x000001DE771A0000-0x000001DE771A8000-memory.dmp
memory/4288-3048-0x000001DE77020000-0x000001DE77028000-memory.dmp
memory/4288-3040-0x000001DE77000000-0x000001DE77008000-memory.dmp
memory/4288-3140-0x000001DE77190000-0x000001DE77198000-memory.dmp
memory/4288-3024-0x000001DE76FC0000-0x000001DE76FC8000-memory.dmp
memory/4288-3044-0x000001DE77010000-0x000001DE77018000-memory.dmp
memory/4288-3036-0x000001DE76FF0000-0x000001DE76FF8000-memory.dmp
memory/4288-3032-0x000001DE76FE0000-0x000001DE76FE8000-memory.dmp
memory/4288-3148-0x000001DE771B0000-0x000001DE771B8000-memory.dmp
memory/4288-3028-0x000001DE76FD0000-0x000001DE76FD8000-memory.dmp
memory/4896-4067-0x00007FF6B9BB0000-0x00007FF6BC5A6000-memory.dmp
memory/5972-4066-0x00007FF7B0770000-0x00007FF7B3166000-memory.dmp