Analysis
- geolocation tags
- user interaction
yes - max time kernel
667s - max time network
703s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
17/10/2026, 10:30
General
- Target https://download2332.mediafire.com/7wle4oy112rgV_1Y_bfmFm8yEfxlMck9OXymWldsI9iF5G_gn0-EA1C9IMH7ImfTABE-ByKY7N91Hk_PIZLcZhGnXLi2dxhvXf9wQTQ887YWmAWSAn_tpjhpE9DDJzueuRosTkll5NnliTAmz6KEQCOje6PeaB5CsulXufdSdk5-/j0c9twno04emf9j/FL26.rar
- Sample261017-mkbbjsdz5w
Malware Config
Extracted
-
ps1
-
exe.dropper
https://www.win-rar.com/fileadmin/winrar-versions/downloader/versions.xml
Extracted
-
ps1
-
exe.dropper
https://www.win-rar.com/fileadmin/winrar-versions/winrar/winrar-x64-723.exe
Signatures
- Badlisted process makes network request 3 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs
Run Powershell and hide display window.
- Downloads MZ/PE file 3 IoCs
- Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 53 IoCs
- Loads dropped DLL 64 IoCs
- Modifies system executable filetype association 2 TTPs 4 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 3 IoCs
- Drops desktop.ini file(s) 4 IoCs
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Network Share Discovery 1 TTPs
Attempt to gather information on host network.
- Checks system information in the registry 2 TTPs 10 IoCs
System information is often read in order to detect sandboxing environments.
- Drops file in System32 directory 51 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 10 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 24 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 31 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 29 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Inno Setup is an open-source installation builder for Windows applications. 4 IoCs
Inno Setup installer
- Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 11 IoCs
- Modifies data under HKEY_USERS 9 IoCs
- Modifies registry class 64 IoCs
- Runs .reg file with regedit 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 2 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 24 IoCs
- Suspicious use of SetWindowsHookEx 14 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- System policy modification 1 TTPs 4 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://download2332.mediafire.com/7wle4oy112rgV_1Y_bfmFm8yEfxlMck9OXymWldsI9iF5G_gn0-EA1C9IMH7ImfTABE-ByKY7N91Hk_PIZLcZhGnXLi2dxhvXf9wQTQ887YWmAWSAn_tpjhpE9DDJzueuRosTkll5NnliTAmz6KEQCOje6PeaB5CsulXufdSdk5-/j0c9twno04emf9j/FL26.rar1⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ffe0b1cc188,0x7ffe0b1cc194,0x7ffe0b1cc1a02⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1872,i,10723051941175962794,11041309978541606689,524288 --field-trial-handle=2152,i,14625385401832277438,16420054298525603447,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:112⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1532,i,15529019121369549353,16914344269129777205,262144 --field-trial-handle=2152,i,14625385401832277438,16420054298525603447,262144 --variations-seed-version --mojo-platform-channel-handle=2140 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2428,i,4178081619226618772,14460674805512372608,524288 --field-trial-handle=2152,i,14625385401832277438,16420054298525603447,262144 --variations-seed-version --mojo-platform-channel-handle=2740 /prefetch:132⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3544,i,9406531143754077404,16551404145464118193,2097152 --field-trial-handle=2152,i,14625385401832277438,16420054298525603447,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3548,i,9621943078026308434,17949447517650347253,2097152 --field-trial-handle=2152,i,14625385401832277438,16420054298525603447,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4268,i,18052036204267623323,13662300869405724697,2097152 --field-trial-handle=2152,i,14625385401832277438,16420054298525603447,262144 --variations-seed-version --mojo-platform-channel-handle=4788 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4292,i,2485850154423117082,1597883262153279259,2097152 --field-trial-handle=2152,i,14625385401832277438,16420054298525603447,262144 --variations-seed-version --mojo-platform-channel-handle=4792 /prefetch:92⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5344,i,15665860841041532007,16576759867445970604,524288 --field-trial-handle=2152,i,14625385401832277438,16420054298525603447,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5336,i,15542478342926372347,17676960624305072661,524288 --field-trial-handle=2152,i,14625385401832277438,16420054298525603447,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5956,i,418494916500214129,14114487400465450464,2097152 --field-trial-handle=2152,i,14625385401832277438,16420054298525603447,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5492,i,8889605750330040677,6840143703174446435,524288 --field-trial-handle=2152,i,14625385401832277438,16420054298525603447,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5228,i,15779839409393328842,14579774921877561809,524288 --field-trial-handle=2152,i,14625385401832277438,16420054298525603447,262144 --variations-seed-version --mojo-platform-channel-handle=6664 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5228,i,15779839409393328842,14579774921877561809,524288 --field-trial-handle=2152,i,14625385401832277438,16420054298525603447,262144 --variations-seed-version --mojo-platform-channel-handle=6664 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=7312,i,6432818838121106981,2342975331879951939,2097152 --field-trial-handle=2152,i,14625385401832277438,16420054298525603447,262144 --variations-seed-version --mojo-platform-channel-handle=7324 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6648,i,15254013286852197768,412273733534262940,524288 --field-trial-handle=2152,i,14625385401832277438,16420054298525603447,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5188,i,4504992267586471072,844264543364097841,524288 --field-trial-handle=2152,i,14625385401832277438,16420054298525603447,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5208,i,563988033020469839,15658790710262581963,524288 --field-trial-handle=2152,i,14625385401832277438,16420054298525603447,262144 --variations-seed-version --mojo-platform-channel-handle=7260 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6000,i,11057188389347927651,17841712205815145653,524288 --field-trial-handle=2152,i,14625385401832277438,16420054298525603447,262144 --variations-seed-version --mojo-platform-channel-handle=6760 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5212,i,2858339489604307562,10312596317825865973,524288 --field-trial-handle=2152,i,14625385401832277438,16420054298525603447,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5604,i,14141551773809761134,3672129978669082493,262144 --field-trial-handle=2152,i,14625385401832277438,16420054298525603447,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6068,i,4785598104332788780,11270412341782445187,2097152 --field-trial-handle=2152,i,14625385401832277438,16420054298525603447,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7188,i,6506232637941938163,4890183777302090311,2097152 --field-trial-handle=2152,i,14625385401832277438,16420054298525603447,262144 --variations-seed-version --mojo-platform-channel-handle=7016 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6064,i,12303521634176353705,9321815483319084104,2097152 --field-trial-handle=2152,i,14625385401832277438,16420054298525603447,262144 --variations-seed-version --mojo-platform-channel-handle=6944 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=3624,i,3344022591628790054,11322675711995978976,2097152 --field-trial-handle=2152,i,14625385401832277438,16420054298525603447,262144 --variations-seed-version --mojo-platform-channel-handle=7476 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6164,i,4113659120533573687,8161250992327955152,2097152 --field-trial-handle=2152,i,14625385401832277438,16420054298525603447,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=5696,i,11014420534747482096,8445500776402518049,2097152 --field-trial-handle=2152,i,14625385401832277438,16420054298525603447,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=5600,i,5883223838104185905,17924121954060508522,2097152 --field-trial-handle=2152,i,14625385401832277438,16420054298525603447,262144 --variations-seed-version --mojo-platform-channel-handle=2408 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6140,i,17634930405657700539,13744749167419052586,524288 --field-trial-handle=2152,i,14625385401832277438,16420054298525603447,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:142⤵
-
-
C:\Users\Admin\Downloads\WinRAR-723.exe"C:\Users\Admin\Downloads\WinRAR-723.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command "try { $WebClient = New-Object System.Net.WebClient; $WebClient.DownloadFile('https://www.win-rar.com/fileadmin/winrar-versions/downloader/versions.xml', 'C:\Users\Admin\AppData\Local\Temp\wrtmp\versions.xml'); Write-Host 'SUCCESS' -NoNewline; exit 0 } catch { if ($_.Exception -is [System.Net.WebException]) { Write-Host $_.Exception.Response.StatusCode.value__ -NoNewline; exit 1 } else { Write-Host $_.Exception.Message -NoNewline; exit 2 } }"3⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command "try { $WebClient = New-Object System.Net.WebClient; $WebClient.DownloadFile('https://www.win-rar.com/fileadmin/winrar-versions/winrar/winrar-x64-723.exe', 'C:\Users\Admin\AppData\Local\Temp\wrtmp\wrarinstaller.exe'); Write-Host 'SUCCESS' -NoNewline; exit 0 } catch { if ($_.Exception -is [System.Net.WebException]) { Write-Host $_.Exception.Response.StatusCode.value__ -NoNewline; exit 1 } else { Write-Host $_.Exception.Message -NoNewline; exit 2 } }"3⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Downloads MZ/PE file
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -noninteractive -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File .\script.ps1 C:\Users\Admin\AppData\Local\Temp\wrtmp\wrarinstaller.exe C:\Users\Admin\AppData\Local\Temp\wrtmp\downloadedCertificate.txt -FFFeatureOff3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\wrtmp\wrarinstaller.exe"C:\Users\Admin\AppData\Local\Temp\wrtmp\wrarinstaller.exe" -s1 -d"C:\Program Files\WinRAR"3⤵
- Executes dropped EXE
-
C:\Program Files\WinRAR\uninstall.exe"C:\Program Files\WinRAR\uninstall.exe" /setup4⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
-
C:\Program Files\WinRAR\RarExtInstaller.exe"C:\Program Files\WinRAR\RarExtInstaller.exe" -install5⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
-
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command "try { $headers = @{'User-Agent'='MyApp/1.0 (Windows NT 10.0; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Edg/128.0.0.0'; 'Content-Type'='application/json'}; $body = @{ payload = @{ website = 'b2afcf08-4ca2-48e4-a206-1e275ef84749'; hostname = 'test'; screen = '1920x1080'; language = 'en-US'; title = 'tracking'; url = '/track'; referrer = '/tracker'; name = 'finished installation'; data = @{ Language='en'; SetupType='Easy Setup' } }; type = 'event' } | ConvertTo-Json -Depth 6 -Compress; $null = Invoke-RestMethod -Method POST -Uri 'https://umami.win-rar.com/api/send' -Headers $headers -Body $body; Write-Host 'SUCCESS' -NoNewline; exit 0 } catch { if ($_.Exception -and $_.Exception.Response -and $_.Exception.Response.StatusCode.value__) { Write-Host $_.Exception.Response.StatusCode.value__ -NoNewline; exit 1 } else { Write-Host $_.Exception.Message -NoNewline; exit 2 } }"3⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe" "C:\Program Files\WinRAR\WinRAR.exe"3⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3784,i,8619245802333534788,15712972278791407041,524288 --field-trial-handle=2152,i,14625385401832277438,16420054298525603447,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7800,i,1350228417479978589,270356116481934404,524288 --field-trial-handle=2152,i,14625385401832277438,16420054298525603447,262144 --variations-seed-version --mojo-platform-channel-handle=7796 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7960,i,6156047176965099414,15497889079181296892,524288 --field-trial-handle=2152,i,14625385401832277438,16420054298525603447,262144 --variations-seed-version --mojo-platform-channel-handle=7972 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5804,i,8859680730304925115,2902030127043692425,524288 --field-trial-handle=2152,i,14625385401832277438,16420054298525603447,262144 --variations-seed-version --mojo-platform-channel-handle=8120 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8216,i,7301340055591294554,10529318141713683419,524288 --field-trial-handle=2152,i,14625385401832277438,16420054298525603447,262144 --variations-seed-version --mojo-platform-channel-handle=8180 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6268,i,1755391502135070985,12774760852311916251,524288 --field-trial-handle=2152,i,14625385401832277438,16420054298525603447,262144 --variations-seed-version --mojo-platform-channel-handle=6840 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files\WinRAR\RarExtInstaller.exe"C:\Program Files\WinRAR\RarExtInstaller.exe" /install /local1⤵
- Executes dropped EXE
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\WinRAR\WinRAR.exe"C:\Program Files\WinRAR\WinRAR.exe"2⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Program Files\WinRAR\RarExtInstaller.exe"C:\Program Files\WinRAR\RarExtInstaller.exe" -install3⤵
- Executes dropped EXE
-
-
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\WinRAR\WinRAR.exe"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\Admin\Downloads\FL26.rar"2⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Users\Admin\AppData\Local\Temp\Rar$EXb7144.43900.rartemp\FL26\flstudio_win64_26.1.0.5530.exe"C:\Users\Admin\AppData\Local\Temp\Rar$EXb7144.43900.rartemp\FL26\flstudio_win64_26.1.0.5530.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsk7BEF.tmp\tempfile.ps1"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsk7BEF.tmp\tempfile.ps1"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsk7BEF.tmp\tempfile.ps1"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsk7BEF.tmp\tempfile.ps1"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsk7BEF.tmp\tempfile.ps1"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsk7BEF.tmp\tempfile.ps1"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsk7BEF.tmp\tempfile.ps1"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebView2RuntimeInstallerX64.exe"C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebView2RuntimeInstallerX64.exe" /silent /install4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\Microsoft\Temp\EU9A26.tmp\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\Temp\EU9A26.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20WebView2%20Runtime&needsadmin=Prefers"5⤵
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc6⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver6⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.241.13\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.241.13\MicrosoftEdgeUpdateComRegisterShell64.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.241.13\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.241.13\MicrosoftEdgeUpdateComRegisterShell64.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.241.13\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.241.13\MicrosoftEdgeUpdateComRegisterShell64.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4yNDEuMTMiIHNoZWxsX3ZlcnNpb249IjEuMy4yNDEuMTMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7Mzg5NkVCNTctQUM0Qi00QjgyLUE5QTctMjVGMTMzRThFMkFDfSIgdXNlcmlkPSJ7NkE4RURBMzQtOEY5Qy00N0M3LThFQTAtNjREQTU5MTRFRDBDfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins1QkU3NzlGNC05REM4LTQzOUMtQTc0OC1EMzEzRkFDRkJEQUN9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iMTYiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4yNjEwMC4xNzQyIiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iMTkxIiBpc193aXA9IjAiIGlzX2luX2xvY2tkb3duX21vZGU9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSJEQURZIiBwcm9kdWN0X25hbWU9IkRhZHkgc3VwZXIgcG93ZXJmdWwgUEMiLz48ZXhwIGV0YWc9IiZxdW90O3M4RmFudndmTWNkNjZnN0xWMlBlYVNSN1dVT3YwbHVGNGh2aWlyVG9rK009JnF1b3Q7Ii8-PGFwcCBhcHBpZD0ie0YzQzRGRTAwLUVGRDUtNDAzQi05NTY5LTM5OEEyMEYxQkE0QX0iIHZlcnNpb249IjEuMy4xOTUuNjUiIG5leHR2ZXJzaW9uPSIxLjMuMjQxLjEzIiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIj48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxMDAzNTQxNzAwNiIgaW5zdGFsbF90aW1lX21zPSI3OTEiLz48L2FwcD48L3JlcXVlc3Q-6⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20WebView2%20Runtime&needsadmin=Prefers" /installsource offline /sessionid "{3896EB57-AC4B-4B82-A9A7-25F133E8E2AC}" /silent /offlinedir "{677C5317-0779-4AF1-90F3-3266D3D2DA8B}"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\SYSTEM32\regsvr32.exeregsvr32.exe /s "C:\Program Files\Image-Line\FL Studio ASIO\ILWASAPI2ASIO_x64.dll"4⤵
-
-
C:\Program Files\Image-Line\FL Studio 2026\System\Installers\FL Cloud Plugins Installer.exe"C:\Program Files\Image-Line\FL Studio 2026\System\Installers\FL Cloud Plugins Installer.exe" /verysilent4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\is-SZX0XN1403.tmp\FL Cloud Plugins Installer.tmp"C:\Users\Admin\AppData\Local\Temp\is-SZX0XN1403.tmp\FL Cloud Plugins Installer.tmp" /SL5="$90308,29875417,893952,C:\Program Files\Image-Line\FL Studio 2026\System\Installers\FL Cloud Plugins Installer.exe" /verysilent5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\is-Y78ZLXMVFB.tmp\VC_redist.x64.exe"C:\Users\Admin\AppData\Local\Temp\is-Y78ZLXMVFB.tmp\VC_redist.x64.exe" /quiet /norestart /repair6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\Temp\{BFF5CF28-2910-43C1-BB33-EC42154EF04B}\.cr\VC_redist.x64.exe"C:\Windows\Temp\{BFF5CF28-2910-43C1-BB33-EC42154EF04B}\.cr\VC_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-Y78ZLXMVFB.tmp\VC_redist.x64.exe" -burn.filehandle.attached=596 -burn.filehandle.self=696 /quiet /norestart /repair7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\Temp\{5A4A8BFC-E070-440B-87BA-7C1CB4376E8D}\.be\VC_redist.x64.exe"C:\Windows\Temp\{5A4A8BFC-E070-440B-87BA-7C1CB4376E8D}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{DEEB219E-B5F1-42D0-B2D1-2E14CF239EBA} {E61F1E6D-45B3-41BC-8F9B-C4ACDEBD7C93} 64528⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
-
-
-
-
C:\Windows\regedit.exe"regedit.exe" "C:\Users\Admin\AppData\Local\Temp\Rar$DIb7144.29017.rartemp\FL Studio 26.1.reg"3⤵
- Runs .reg file with regedit
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- System policy modification
-
C:\Windows\SysWOW64\wermgr.exe"C:\Windows\system32\wermgr.exe" "-outproc" "0" "880" "856" "828" "844" "0" "0" "0" "0" "0" "0" "0" "0"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4yNDEuMTMiIHNoZWxsX3ZlcnNpb249IjEuMy4yNDEuMTMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7Mzg5NkVCNTctQUM0Qi00QjgyLUE5QTctMjVGMTMzRThFMkFDfSIgdXNlcmlkPSJ7NkE4RURBMzQtOEY5Qy00N0M3LThFQTAtNjREQTU5MTRFRDBDfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7NjI0Q0Y1QzEtREUzOC00N0ZBLUIxMUEtRkU3OEQ0QTZGQzlGfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjE2IiBkaXNrX3R5cGU9IjIiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMjYxMDAuMTc0MiIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjE5MSIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iREFEWSIgcHJvZHVjdF9uYW1lPSJEYWR5IHN1cGVyIHBvd2VyZnVsIFBDIi8-PGV4cCBldGFnPSImcXVvdDtzOEZhbnZ3Zk1jZDY2ZzdMVjJQZWFTUjdXVU92MGx1RjRodmlpclRvaytNPSZxdW90OyIvPjxhcHAgYXBwaWQ9Ins4QTY5RDM0NS1ENTY0LTQ2M2MtQUZGMS1BNjlEOUU1MzBGOTZ9IiB2ZXJzaW9uPSIxNDAuMC43MzM5LjgxIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIzNSIgaW5zdGFsbGRhdGV0aW1lPSIxNzg5MTc0MzAyIiBvb2JlX2luc3RhbGxfdGltZT0iMTM0MzM2NDY2NDI0ODQwMDAwIj48ZXZlbnQgZXZlbnR0eXBlPSIzMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iODYwNjU5NDMiIHN5c3RlbV91cHRpbWVfdGlja3M9IjEwMDQwNjI0OTY1Ii8-PC9hcHA-PC9yZXF1ZXN0Pg2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{CBC71BE9-1B9D-4FEE-A296-D03C8AEEA296}\MicrosoftEdgeWebview_X64_149.0.4022.80.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{CBC71BE9-1B9D-4FEE-A296-D03C8AEEA296}\MicrosoftEdgeWebview_X64_149.0.4022.80.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level2⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{CBC71BE9-1B9D-4FEE-A296-D03C8AEEA296}\EDGEMITMP_D76D0.tmp\setup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{CBC71BE9-1B9D-4FEE-A296-D03C8AEEA296}\EDGEMITMP_D76D0.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{CBC71BE9-1B9D-4FEE-A296-D03C8AEEA296}\MicrosoftEdgeWebview_X64_149.0.4022.80.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level3⤵
- Executes dropped EXE
- Drops file in Windows directory
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4yNDEuMTMiIHNoZWxsX3ZlcnNpb249IjEuMy4yNDEuMTMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7Mzg5NkVCNTctQUM0Qi00QjgyLUE5QTctMjVGMTMzRThFMkFDfSIgdXNlcmlkPSJ7NkE4RURBMzQtOEY5Qy00N0M3LThFQTAtNjREQTU5MTRFRDBDfSIgaW5zdGFsbHNvdXJjZT0ib2ZmbGluZSIgcmVxdWVzdGlkPSJ7QjJFNjgxNkQtMjdBOC00NEU5LUIyNzUtRDFGMEJGNzQwNTEyfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjE2IiBkaXNrX3R5cGU9IjIiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMjYxMDAuMTc0MiIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjE5MSIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iREFEWSIgcHJvZHVjdF9uYW1lPSJEYWR5IHN1cGVyIHBvd2VyZnVsIFBDIi8-PGV4cCBldGFnPSImcXVvdDtIaHZISVdwVU5aVE1uVjJWVDFsZTNmNVlKUTlPU29URDZNeEhEbEE4OVBnPSZxdW90OyIvPjxhcHAgYXBwaWQ9IntGMzAxNzIyNi1GRTJBLTQyOTUtOEJERi0wMEMzQTlBN0U0QzV9IiB2ZXJzaW9uPSIiIG5leHR2ZXJzaW9uPSIxNDkuMC40MDIyLjgwIiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIiBleHBlcmltZW50cz0iY29uc2VudD1mYWxzZSIgaW5zdGFsbGFnZT0iMzUiPjx1cGRhdGVjaGVjay8-PGV2ZW50IGV2ZW50dHlwZT0iOSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTAwNDcwOTc3OTgiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI1IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxMDA0NzM1ODczNCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjEwMDYwMDQzMTg4IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTAwODAwNjQxODEiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIxOTY3NTciIHN5c3RlbV91cHRpbWVfdGlja3M9IjEwNDIyNjMzMzkxIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiBkb3dubG9hZGVkPSIxOTU3OTg4NjQiIHRvdGFsPSIxOTU3OTg4NjQiIHBhY2thZ2VfY2FjaGVfcmVzdWx0PSIxIiBpbnN0YWxsX3RpbWVfbXM9IjM0MjQ3Ii8-PC9hcHA-PC9yZXF1ZXN0Pg2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:21⤵
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\ProgramData\Package Cache\{c649ede4-f16a-4486-a117-dcc2f2a35165}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{c649ede4-f16a-4486-a117-dcc2f2a35165}\VC_redist.x64.exe" /burn.runonce1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{c649ede4-f16a-4486-a117-dcc2f2a35165}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{c649ede4-f16a-4486-a117-dcc2f2a35165}\VC_redist.x64.exe" /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20261017063953.log"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{c649ede4-f16a-4486-a117-dcc2f2a35165}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{c649ede4-f16a-4486-a117-dcc2f2a35165}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{c649ede4-f16a-4486-a117-dcc2f2a35165}\VC_redist.x64.exe" -burn.filehandle.attached=564 -burn.filehandle.self=580 /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20261017063953.log"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{c649ede4-f16a-4486-a117-dcc2f2a35165}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{c649ede4-f16a-4486-a117-dcc2f2a35165}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{67943A5E-0333-4489-9525-5A0A745B0E95} {47AC70C2-9B18-411C-AE25-CCA4CC1955B7} 36444⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={c649ede4-f16a-4486-a117-dcc2f2a35165} -burn.filehandle.self=1016 -burn.embedded BurnPipe.{47A990CA-9C34-4C6D-944E-36F4DC9CF04C} {6EBDA3EA-2439-4352-B65F-485D0EAD10AF} 68445⤵
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=564 -burn.filehandle.self=580 -uninstall -quiet -burn.related.upgrade -burn.ancestors={c649ede4-f16a-4486-a117-dcc2f2a35165} -burn.filehandle.self=1016 -burn.embedded BurnPipe.{47A990CA-9C34-4C6D-944E-36F4DC9CF04C} {6EBDA3EA-2439-4352-B65F-485D0EAD10AF} 68446⤵
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{942F09BD-4F5B-4315-85F5-79A8CB835CDD} {2D6BDFDE-35D2-4559-BD3E-A12E774E4978} 70607⤵
- System Location Discovery: System Language Discovery
-
-
-
-
-
-
-
C:\Program Files\Image-Line\FL Studio 2026\FL64.exe"C:\Program Files\Image-Line\FL Studio 2026\FL64.exe"1⤵
- Downloads MZ/PE file
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\149.0.4022.80\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\149.0.4022.80\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=FL64.exe --webview-exe-version=26.1.0.5530 --user-data-dir="C:\Users\Admin\AppData\Roaming\Image-Line\Edge\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --mojo-named-platform-channel-pipe=6372.6780.5234715134832590733 /pfhostedapp:0d3697efbf92f3c76bc1f34703223dfd9cb03b2c2⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- System policy modification
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\149.0.4022.80\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\149.0.4022.80\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\Image-Line\Edge\EBWebView /prefetch:4 /pfhostedapp:0d3697efbf92f3c76bc1f34703223dfd9cb03b2c --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\Image-Line\Edge\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=149.0.7827.156 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\149.0.4022.80\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=149.0.4022.80 --initial-client-data=0x17c,0x180,0x184,0x158,0x1b8,0x7ffdf4dc9c38,0x7ffdf4dc9c44,0x7ffdf4dc9c503⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\149.0.4022.80\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\149.0.4022.80\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\Image-Line\Edge\EBWebView" --webview-exe-name=FL64.exe --webview-exe-version=26.1.0.5530 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --startup-read-main-dll --metrics-shmem-handle=1792,i,3146457208526354856,4525758631323944954,524288 --field-trial-handle=2000,i,63968489106519446,17640166251797764766,262144 --variations-seed-version --pseudonymization-salt-handle=2004,i,14349068273698407342,15692114675515160807,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2160 /prefetch:11 /pfhostedapp:0d3697efbf92f3c76bc1f34703223dfd9cb03b2c3⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\149.0.4022.80\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\149.0.4022.80\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\Image-Line\Edge\EBWebView" --webview-exe-name=FL64.exe --webview-exe-version=26.1.0.5530 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --startup-read-main-dll --metrics-shmem-handle=1552,i,15290610470292967148,11013669919790276236,262144 --field-trial-handle=2000,i,63968489106519446,17640166251797764766,262144 --variations-seed-version --pseudonymization-salt-handle=2004,i,14349068273698407342,15692114675515160807,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1992 /prefetch:2 /pfhostedapp:0d3697efbf92f3c76bc1f34703223dfd9cb03b2c3⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\149.0.4022.80\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\149.0.4022.80\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\Image-Line\Edge\EBWebView" --webview-exe-name=FL64.exe --webview-exe-version=26.1.0.5530 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --startup-read-main-dll --metrics-shmem-handle=2492,i,3395602070489748330,3642042612284320781,524288 --field-trial-handle=2000,i,63968489106519446,17640166251797764766,262144 --variations-seed-version --pseudonymization-salt-handle=2004,i,14349068273698407342,15692114675515160807,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2632 /prefetch:13 /pfhostedapp:0d3697efbf92f3c76bc1f34703223dfd9cb03b2c3⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\149.0.4022.80\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\149.0.4022.80\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\Image-Line\Edge\EBWebView" --webview-exe-name=FL64.exe --webview-exe-version=26.1.0.5530 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--expose-gc --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --ssd-no-pressure-read-main-dll --metrics-shmem-handle=3636,i,1002931359288596854,6131614745424739426,2097152 --field-trial-handle=2000,i,63968489106519446,17640166251797764766,262144 --variations-seed-version --pseudonymization-salt-handle=2004,i,14349068273698407342,15692114675515160807,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3736 /pfhostedapp:0d3697efbf92f3c76bc1f34703223dfd9cb03b2c /prefetch:13⤵
- Executes dropped EXE
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004E4 0x00000000000004F01⤵
-
C:\Windows\system32\werfault.exewerfault.exe /h /shared Global\a9b307725a354ba6a4e0022a3dc5791a /t 2548 /p 63721⤵
-
C:\Program Files\Image-Line\FL Studio 2026\FL64.exe"C:\Program Files\Image-Line\FL Studio 2026\FL64.exe"1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\149.0.4022.80\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\149.0.4022.80\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=FL64.exe --webview-exe-version=26.1.0.5530 --user-data-dir="C:\Users\Admin\AppData\Roaming\Image-Line\Edge\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --mojo-named-platform-channel-pipe=1948.6444.14129001057885331877 /pfhostedapp:0d3697efbf92f3c76bc1f34703223dfd9cb03b2c2⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- System policy modification
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\149.0.4022.80\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\149.0.4022.80\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\Image-Line\Edge\EBWebView /prefetch:4 /pfhostedapp:0d3697efbf92f3c76bc1f34703223dfd9cb03b2c --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\Image-Line\Edge\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=149.0.7827.156 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\149.0.4022.80\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=149.0.4022.80 --initial-client-data=0x17c,0x180,0x184,0x158,0x1b8,0x7ffdf4dc9c38,0x7ffdf4dc9c44,0x7ffdf4dc9c503⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\149.0.4022.80\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\149.0.4022.80\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\Image-Line\Edge\EBWebView" --webview-exe-name=FL64.exe --webview-exe-version=26.1.0.5530 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --startup-read-main-dll --metrics-shmem-handle=1712,i,5859312587264430708,6537167654936840826,524288 --field-trial-handle=1900,i,12136348285771877780,1171006002796191910,262144 --variations-seed-version --pseudonymization-salt-handle=1904,i,6017848792617300512,8305942959451939593,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2016 /prefetch:11 /pfhostedapp:0d3697efbf92f3c76bc1f34703223dfd9cb03b2c3⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\149.0.4022.80\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\149.0.4022.80\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\Image-Line\Edge\EBWebView" --webview-exe-name=FL64.exe --webview-exe-version=26.1.0.5530 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --startup-read-main-dll --metrics-shmem-handle=1524,i,17545665650934824504,2137851208655811698,262144 --field-trial-handle=1900,i,12136348285771877780,1171006002796191910,262144 --variations-seed-version --pseudonymization-salt-handle=1904,i,6017848792617300512,8305942959451939593,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1896 /prefetch:2 /pfhostedapp:0d3697efbf92f3c76bc1f34703223dfd9cb03b2c3⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\149.0.4022.80\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\149.0.4022.80\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\Image-Line\Edge\EBWebView" --webview-exe-name=FL64.exe --webview-exe-version=26.1.0.5530 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --startup-read-main-dll --metrics-shmem-handle=2516,i,12364973288064179242,440041153371455204,524288 --field-trial-handle=1900,i,12136348285771877780,1171006002796191910,262144 --variations-seed-version --pseudonymization-salt-handle=1904,i,6017848792617300512,8305942959451939593,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2544 /prefetch:13 /pfhostedapp:0d3697efbf92f3c76bc1f34703223dfd9cb03b2c3⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\149.0.4022.80\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\149.0.4022.80\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\Image-Line\Edge\EBWebView" --webview-exe-name=FL64.exe --webview-exe-version=26.1.0.5530 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--expose-gc --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --ssd-no-pressure-read-main-dll --metrics-shmem-handle=3444,i,11476600293133010102,7279757101598161644,2097152 --field-trial-handle=1900,i,12136348285771877780,1171006002796191910,262144 --variations-seed-version --pseudonymization-salt-handle=1904,i,6017848792617300512,8305942959451939593,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3868 /pfhostedapp:0d3697efbf92f3c76bc1f34703223dfd9cb03b2c /prefetch:13⤵
- Executes dropped EXE
-
-
-
C:\Program Files\Image-Line\FL Studio 2026\System\Tools\Plugin Manager\PluginManager.exe"C:\Program Files\Image-Line\FL Studio 2026\System\Tools\Plugin Manager\PluginManager.exe" -flpath "C:\Program Files\Image-Line\FL Studio 2026\" -flcaption "FL Studio 2026" -deepscan2⤵
- Executes dropped EXE
-
C:\Program Files\Image-Line\FL Studio 2026\System\Tools\Bridge\64bit\ilbridge.exe"C:\Program Files\Image-Line\FL Studio 2026\System\Tools\Plugin Manager\..\Bridge\64bit\ilbridge.exe" -wrapper -address "{E89DE746-AE02-41AF-80AA-37CF6967C5CF}1" -processid 60563⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SendNotifyMessage
-
-
C:\Program Files\Image-Line\FL Studio 2026\System\Tools\Bridge\64bit\ilbridge.exe"C:\Program Files\Image-Line\FL Studio 2026\System\Tools\Plugin Manager\..\Bridge\64bit\ilbridge.exe" -wrapper -address "{CB878D83-BD59-4FCD-A61A-D2D12F0739E9}2" -processid 60563⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SendNotifyMessage
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵
-
C:\Program Files\Image-Line\FL Studio 2026\FL64.exe"C:\Program Files\Image-Line\FL Studio 2026\FL64.exe"1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\149.0.4022.80\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\149.0.4022.80\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=FL64.exe --webview-exe-version=26.1.0.5530 --user-data-dir="C:\Users\Admin\AppData\Roaming\Image-Line\Edge\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --mojo-named-platform-channel-pipe=1604.7244.14440566019411428125 /pfhostedapp:0d3697efbf92f3c76bc1f34703223dfd9cb03b2c2⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Enumerates system info in registry
- System policy modification
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\149.0.4022.80\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\149.0.4022.80\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\Image-Line\Edge\EBWebView /prefetch:4 /pfhostedapp:0d3697efbf92f3c76bc1f34703223dfd9cb03b2c --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\Image-Line\Edge\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=149.0.7827.156 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\149.0.4022.80\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=149.0.4022.80 --initial-client-data=0x17c,0x180,0x184,0x158,0x1bc,0x7ffdf4dc9c38,0x7ffdf4dc9c44,0x7ffdf4dc9c503⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\149.0.4022.80\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\149.0.4022.80\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\Image-Line\Edge\EBWebView" --webview-exe-name=FL64.exe --webview-exe-version=26.1.0.5530 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --startup-read-main-dll --metrics-shmem-handle=1852,i,12626052033504200799,3221771416241067157,524288 --field-trial-handle=1776,i,6900096475376056294,3467395600123712003,262144 --variations-seed-version --pseudonymization-salt-handle=1784,i,10447869693704209655,1062240471668290595,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=1976 /prefetch:11 /pfhostedapp:0d3697efbf92f3c76bc1f34703223dfd9cb03b2c3⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\149.0.4022.80\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\149.0.4022.80\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\Image-Line\Edge\EBWebView" --webview-exe-name=FL64.exe --webview-exe-version=26.1.0.5530 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --startup-read-main-dll --metrics-shmem-handle=1572,i,12340215087697398918,8152950752956100860,262144 --field-trial-handle=1776,i,6900096475376056294,3467395600123712003,262144 --variations-seed-version --pseudonymization-salt-handle=1784,i,10447869693704209655,1062240471668290595,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1780 /prefetch:2 /pfhostedapp:0d3697efbf92f3c76bc1f34703223dfd9cb03b2c3⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\149.0.4022.80\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\149.0.4022.80\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\Image-Line\Edge\EBWebView" --webview-exe-name=FL64.exe --webview-exe-version=26.1.0.5530 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --startup-read-main-dll --metrics-shmem-handle=2500,i,1794077318798577662,9007818586876300392,524288 --field-trial-handle=1776,i,6900096475376056294,3467395600123712003,262144 --variations-seed-version --pseudonymization-salt-handle=1784,i,10447869693704209655,1062240471668290595,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2452 /prefetch:13 /pfhostedapp:0d3697efbf92f3c76bc1f34703223dfd9cb03b2c3⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\149.0.4022.80\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\149.0.4022.80\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\Image-Line\Edge\EBWebView" --webview-exe-name=FL64.exe --webview-exe-version=26.1.0.5530 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--expose-gc --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --ssd-no-pressure-read-main-dll --metrics-shmem-handle=3612,i,1776039804896095923,90780147948680452,2097152 --field-trial-handle=1776,i,6900096475376056294,3467395600123712003,262144 --variations-seed-version --pseudonymization-salt-handle=1784,i,10447869693704209655,1062240471668290595,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3724 /pfhostedapp:0d3697efbf92f3c76bc1f34703223dfd9cb03b2c /prefetch:13⤵
-
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
3Change Default File Association
1Component Object Model Hijacking
1Image File Execution Options Injection
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
3Change Default File Association
1Component Object Model Hijacking
1Image File Execution Options Injection
1Discovery
Browser Information Discovery
1Debugger Evasion
1Network Share Discovery
1Peripheral Device Discovery
2Query Registry
7System Information Discovery
7System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
2Internet Connection Discovery
1System Time Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
e60cba6.rbs
e60cbb2.rbs
e60cbb9.rbs
e60cbc8.rbs
msedge_7z.data
MicrosoftEdgeUpdate.exe
FL Studio VSTi (Multi).dll
FL Studio VSTi.dll
FL Cloud Plugins.exe
Ookay - Thief.flp
Env filter - default.fnv
Env filter - flat.fnv
Corridors.nfo
IMP Evnt - Medium Chamber.wv
IMP double_dulcintar_pz.wv
IMP montclair_church_a_03_far.wv
CB DnB Riser.wav
Chorus - Hum 1 (Right).wav
Lead Vocal (consolidated).wav
Amount Too - Amount Too.wav
Fl Demo Type Beat 3_2025-10-07 18-09-10_DEX PRESET 2_2.wav
Fl Demo Type Beat 3_2025-10-07 18-41-10_DEX PRESET 2_2.wav
Fl Demo Type Beat 3_2025-10-07 18-54-09_DEX PRESET 2_2.wav
Fl Demo Type Beat 3_2025-10-07 19-07-15_DEX PRESET 2_3.wav
Fl Demo Type Beat 3_2025-10-07 21-45-03_DEX PRESET 2_2.wav
Fl Demo Type Beat 3_2025-10-07 21-55-37_DEX PRESET 2_2.wav
FLS_Aah yea 001 - Part_6.wav
FLS_Alright 001 - Part_4.wav
RD_Hat_6.wav
GMMidTom1_01.wav
IMP forest_occluded.wv
Attack Timbale 01.wv
Attack Timbale 03.wv
Attack Shaker 09.wv
Attack Shaker 10.wv
HouseGen Shaker 07.wv
Power Shaker 03.wv
Monster Kick 004.nfo
Groove Bias.nfo
snare 3 v9 rr1.wav
snare 4 v8 rr1.wav
Rock.nfo
Thrower.nfo
909 Clap.wav
DNC Clap 1.wav
FPC Wack.wav
RD Gui 1.wav
RD Tamb 1.wav
Industrial Snare 2.wav
909 Tom.wav
Titey Tom.wav
Core Synths.ini
Melodic Techno.ini
Olbaid Compendium.ini
DNC_Clap.wav
DNC_Crash.wav
FPC_RideBell_F_010.wav
FPC_Tamb_B04.wav
HIP_Kick_2.wav
FLS_ct6_tak.wav
RD_Hat_7.wav
RD_Snare_9.wav
RD_Tom_5.wav
FLS_Aah yea 001.wav
FLS_Alright 001.wav
Riser Noise.wv
Riser Vocal.wv
FX Big Reverse.wav
SFX Cym Crash.wav
SFX Cym Noisy.wav
SFX Noise Punch.wav
SFX Splash Noiz.wav
SFX Thunder Sheet.wav
SHP_Ramp.wav
Reeverb 2.fst
Full Reset.fst
0 - Note Formula Default.fst
6 - and add some randomness to the velocity.fst
Jayce Lewis Direct.fst
Jayce Lewis Mix.fst
Jayce Lewis Overhead.fst
Jayce Lewis Direct multi out.fst
Jayce Lewis Mix multi out.fst
Jayce Lewis Overhead multi out.fst
Diego TE.gmsynth
Diego TE.gmsynth
Loop timestretching (2 bars).fst
Bass Wire.flms
Keys Classic Saw.flms
Keys Organ.flms
Keys Super Saw.flms
Keys Talking Synth.flms
Lead Yay.flms
Mx Keys.flms
Mx Pad.flms
Mx Synth.flms
BAS Elec Bass NUC.mrp
BAS PseudoSync MC.mrp
KBD Dynamic Suitcase FG.mrp
KBD Pianorhodes NUC.mrp
KBD Slow Leslie FG.mrp
LED Synthish FG.mrp
LED Voyager Detuned FG.mrp
PAD Analog Sweep FG.mrp
PAD Juno MC.mrp
PAD Keepin it Simple FG.mrp
PAD Mello FG.mrp
PAD Morphine FG.mrp
PAD Serene FG.mrp
PAD Spectropolice FG.mrp
PAD Syncer FG.mrp
PAD Unnamed.mrp
PAD WaterGlass FG.mrp
SFX Bad Dream FG.mrp
SFX HammerHead (Hold) FG.mrp
STR Elec Guitar NUC.mrp
SYN Bend it Like FG.mrp
SYN Eastern Bowed FG.mrp
FG Chomper.fst
FG Classico Bass.fst
FG Just Add Distortion.fst
FG Lo-Fi Avenger.fst
FG Micro-Mini.fst
FG Spaced TB.fst
FG Squarer.fst
FG Storm Bass.fst
FG Taurus.fst
FG WhipLash.fst
FG Four Bits.fst
FG Jupiter Brass.fst
FG Massive Pulse.fst
FG The Epic.fst
FG Angry Analog.fst
FG BuzzSaw.fst
FG Fury of V.fst
FG I am Monster.fst
FG Plain Stab.fst
FG Pro-52.fst
FG Use for D&B.fst
MC Stab Low.fst
FG A Loud Whisper.fst
FG Aflac.fst
FG Almost a Violin.fst
FG MS-20 2.fst
FG No Limit.fst
FG Steel Guitar.fst
FG Trancer's Pluck.fst
FG Tropical Island.fst
Insects ToTc.tbio
Musical ToTc.tbio
WindTunnel ToTc.tbio
Almost lead.tbio
Blunt ToTc.tbio
DeepReso.tbio
Plastic ToTc.tbio
Stumpy FG.tbio
Thin but Deep ToTc.tbio
Twice Bitten ToTc.tbio
Voyager ToTc.tbio
8SEQ On Display ToTc.tbio
ATM Suspense ToTc.tbio
BAS Africana ToTc.tbio
BAS Attitude ToTc.tbio
BAS BioHazard ToTc.tbio
BAS Fab-Filter ToTc.tbio
BAS Fat Solids ToTc.tbio
BAS Squeeze Harder ToTc.tbio
KBD TarnceArp ToTc.tbio
LED PW Gurgle ToTc.tbio
LED Scrape ToTc.tbio
PAD Swipe ToTc.tbio
SFX ResoSyn ToTc.tbio
SYN I'm A Monster ToTc.tbio
SYN Play Chords ToTc.tbio
SYN Rough Edge ToTc.tbio
SYN Stab-Synth ToTc.tbio
Default.tbio
12 Bit Sine ToTc.tbio
Breather ToTc.tbio
Dirty Keys ToTc.tbio
Fairy Tale ToTc.tbio
Final Organ ToTc.tbio
Organ Toned Down ToTc.tbio
Plastic Keys ToTc.tbio
Plucked.tbio
Simple HighPass ToTc.tbio
Another TB ToTc.tbio
CREAM ToTc.tbio
Chaos.tbio
Custom Saw ToTc.tbio
Deep & Wide ToTc.tbio
Emulator Brass ToTc.tbio
FMAlog ToTc.tbio
KutThroat ToTc.tbio
New Breed ToTc.tbio
Psycho ToTc.tbio
Virus ToTc.tbio
All Saws ToTc.tbio
Anti-Warm ToTc.tbio
Drama Automatic ToTc.tbio
FM Warmth ToTc.tbio
Harsh Digital ToTc.tbio
Kristalis ToTc.tbio
Lite Aliasing ToTc.tbio
Myst ToTc.tbio
Spectralis ToTc.tbio
Triton ToTc.tbio
Mechanical Spoon ToTc.tbio
Burn Unit ToTc.tbio
Nitrous ToTc.tbio
SuperSweep ToTc.tbio
Alien Wind ToTc.tbio
DeepThroat ToTc.tbio
SubWoofer Bomb ToTc.tbio
Synth Ah ToTc.tbio
WindTunnel ToTc.tbio
Interlude ToTc.tbio
Mixture ToTc.tbio
On The ETAC ToTc.tbio
Radiation ToTc.tbio
Rapture II ToTc.tbio
Recycled ToTc.tbio
Saturated Fats ToTc.tbio
Space Balls ToTc.tbio
Sweeping Notion ToTc.tbio
Toxitar ToTc.tbio
Epic ToTc.tbio
RezoSequence ToTc.tbio
Tribes ToTc.tbio
BAS Xenos FM 3.tbio
DRM Snare 1.tbio
KBD Pipe Organ.tbio
SYN Harp.tbio
BAS Electric NUC.tbio
KEY Hammond Organ NUC.tbio
KEY Trick Piano NUC.tbio
SEQ Momentum NUC.tbio
SYN FMorgan NUC.tbio
1 1 3 2.fsc
1 2 3 (filter).fsc
1 2 3 3.fsc
1 2 3.fsc
1 3 2 (cropped).fsc
1- 2 3.fsc
13- 2.fsc
3 2 1 (porta).fsc
Default.fsc
Oxygene.fsc
Simple.fsc
Trance 2.fsc
Trance 3.fsc
Trance 4.fsc
Trance 5.fsc
Trance 6.fsc
Trance 7.fsc
Trance.fsc
Default.fsc
fpc_6-8_groove_10.mid
fpc_6-8_groove_16.mid
fpc_shufflegroove_14.mid
fpc_shufflegroove_29.mid
707kit_16.mid
fpc_percussion_18.mid
fpc_conga_02.mid
fpc_rockgroove2_004.mid
fpc_rockgroove7_39.mid
fpc_rockgroove7_52.mid
fpc_rockgroove_11.mid
fpc_rockgroove_14.mid
fpc_rockgroove_24.mid
fpc_triphop_20.mid
16_boogaloo.fsc
16_ragged.fsc
Default.fsc
Maj7.fsc
Major.fsc
aug.fsc
m7.fsc
m9.fsc
mb5.fsc
minor.fsc
sus2.fsc
sus4.fsc
Major (Ionian).fsc
Major Bebop.fsc
Major Bulgarian.fsc
Major Hexatonic.fsc
Major Pentatonic.fsc
Major Persian.fsc
Major Polymode.fsc
Minor Harmonic.fsc
Minor Hungarian.fsc
Minor Melodic.fsc
Minor Natural (Aeolian).fsc
Minor Neapolitan.fsc
Minor Pentatonic.fsc
Minor Polymode.fsc
Minor Romanian.fsc
Other Arabic.fsc
Other Bebop Dominant.fsc
Other Blues Nonatonic.fsc
Other Blues.fsc
Other Diminished.fsc
Other Dorian.fsc
Other Eastern.fsc
Other Egyptian.fsc
Other Enigmatic.fsc
Other Hirajoshi.fsc
Other Iwato.fsc
Other Japanese Insen.fsc
Other Locrian Super.fsc
Other Locrian.fsc
Other Lydian.fsc
Other Mixolydian.fsc
Other Neapolitan.fsc
Other Phrygian Dominant.fsc
Other Phrygian.fsc
Other Piongio.fsc
Other Prometheus.fsc
Other Whole Tone.fsc
Env filter - asymmetry.fnv
Env filter - small knee.fnv
AudioLoggerTrack.fst
Fruity.nfo
VST.nfo
VST3.nfo
MiniSynthTrack.fst
Emphasis.fst
Hyper Chorus.fst
Low Lifter.fst
Transmitter.fst
VFX Script.fst
Fruity Slicer 2.fst
VFX Script.nfo
VFX Script.png
Effects.nfo
Emphasis.nfo
Emphasis.png
Emphasizer.fst
Emphasizer.nfo
Emphasizer.png
FL Studio Mobile Rack FX.fst
FL Studio Mobile Rack FX.nfo
FL Studio Mobile Rack FX.png
Frequency Splitter.fst
Fruity Delay 3.fst
Fruity Filter.fst
Fruity HTML NoteBook.fst
Fruity Peak Controller.fst
Fruity X-Y-Z Controller.fst
Hardcore.fst
Hyper Chorus.nfo
Hyper Chorus.png
Low Lifter.nfo
Low Lifter.png
LuxeVerb.fst
LuxeVerb.nfo
LuxeVerb.png
Maximus.fst
Multiband Delay.fst
Multiband Delay.nfo
Multiband Delay.png
Pitch Shifter.fst
Pitch Shifter.nfo
Pitch Shifter.png
Spreader.fst
Spreader.nfo
Spreader.png
Transmitter.nfo
Transmitter.png
Transporter.fst
Transporter.nfo
Transporter.png
Tuner.fst
Vintage Chorus.fst
Vintage Chorus.nfo
Vintage Chorus.png
Vintage Phaser.fst
Vintage Phaser.nfo
Vintage Phaser.png
Generators.nfo
Audio Clip.fst
Automation Clip.fst
BassDrum.fst
Drumaxx.fst
FL Studio Mobile Rack.fst
FL Studio Mobile Rack.nfo
FL Studio Mobile Rack.png
FL Studio Mobile.fst
FPC.fst
Fruity Slicer 2.nfo
Fruity Slicer 2.png
Harmor.fst
Kepler Exo.fst
Patcher.nfo
Patcher.png
Sampler.fst
Sytrus.fst
Transistor Bass.fst
VFX Color Mapper.fst
VFX Color Mapper.nfo
VFX Color Mapper.png
VFX Envelope.fst
VFX Envelope.nfo
VFX Envelope.png
VFX Key Mapper.fst
VFX Key Mapper.nfo
VFX Key Mapper.png
VFX Keyboard Splitter.fst
VFX Keyboard Splitter.nfo
VFX Keyboard Splitter.png
VFX Level Scaler.fst
VFX Level Scaler.nfo
VFX Level Scaler.png
VFX Sequencer.fst
VFX Sequencer.nfo
VFX Sequencer.png
Installed.nfo
Distructor.fst
Distructor.nfo
Distructor.png
Fruity Blood Overdrive.fst
Fruity Blood Overdrive.nfo
Fruity Blood Overdrive.png
Fruity Fast Dist.fst
Fruity Fast Dist.nfo
Fruity Fast Dist.png
Fruity Soft Clipper.fst
Fruity Soft Clipper.nfo
Fruity Soft Clipper.png
Fruity Squeeze.fst
Fruity Squeeze.nfo
Fruity Squeeze.png
Fruity WaveShaper.fst
Fruity WaveShaper.nfo
Fruity WaveShaper.png
Hardcore.nfo
Hardcore.png
Control Surface.fst
Control Surface.nfo
Control Surface.png
Fruity Formula Controller.fst
Fruity Formula Controller.nfo
Fruity Formula Controller.png
Fruity Peak Controller.nfo
Fruity Peak Controller.png
Fruity X-Y Controller.fst
Fruity X-Y Controller.nfo
Fruity X-Y Controller.png
Fruity X-Y-Z Controller.nfo
Fruity X-Y-Z Controller.png
Fruity Compressor.fst
Fruity Compressor.nfo
Fruity Compressor.png
Fruity Limiter.fst
Fruity Limiter.nfo
Fruity Limiter.png
Fruity Multiband Compressor.fst
Fruity Multiband Compressor.nfo
Fruity Multiband Compressor.png
Maximus.nfo
Maximus.png
Soundgoodizer.fst
Soundgoodizer.nfo
Soundgoodizer.png
Transient Processor.fst
Transient Processor.nfo
Transient Processor.png
Fruity Filter.nfo
Fruity Filter.png
Fruity Love Philter.fst
Fruity Love Philter.nfo
Fruity Love Philter.png
Fruity LSD.fst
Fruity LSD.nfo
Fruity LSD.png
EQUO.fst
EQUO.nfo
EQUO.png
Effector.fst
Effector.nfo
Effector.png
Frequency Splitter.nfo
Frequency Splitter.png
Fruity Balance.fst
Fruity Balance.nfo
Fruity Balance.png
Fruity PanOMatic.fst
Fruity PanOMatic.nfo
Fruity PanOMatic.png
Fruity Parametric EQ 2.fst
Fruity Parametric EQ 2.nfo
Fruity Parametric EQ.fst
Fruity Parametric EQ.nfo
Fruity Parametric EQ.png
Fruity Send.fst
Fruity Send.nfo
Fruity Send.png
Fruity Stereo Enhancer.fst
Fruity Stereo Enhancer.nfo
Fruity Stereo Enhancer.png
Fruity Stereo Shaper.fst
Fruity Stereo Shaper.nfo
Fruity Stereo Shaper.png
Fruity Chorus.fst
Fruity Chorus.nfo
Fruity Chorus.png
Fruity Flanger.fst
Fruity Flanger.nfo
Fruity Flanger.png
Fruity Flangus.fst
Fruity Flangus.nfo
Fruity Flangus.png
Fruity Phaser.fst
Fruity Phaser.nfo
Fruity Phaser.png
Gross Beat.fst
Gross Beat.nfo
Gross Beat.png
Frequency Shifter.fst
Frequency Shifter.nfo
Frequency Shifter.png
Fruity Convolver.fst
Fruity Convolver.nfo
Fruity Convolver.png
Fruity Delay 2.fst
Fruity Delay 2.nfo
Fruity Delay 2.png
Fruity Delay 3.nfo
Fruity Delay 3.png
Fruity Delay Bank.fst
Fruity Delay Bank.nfo
Fruity Delay Bank.png
Fruity Reeverb 2.fst
Fruity Reeverb 2.nfo
Fruity Reeverb 2.png
Edison.fst
Edison.nfo
Edison.png
Fruity Big Clock.fst
Fruity Big Clock.nfo
Fruity Big Clock.png
Fruity HTML NoteBook.nfo
Fruity HTML NoteBook.png
Fruity NoteBook 2.fst
Fruity NoteBook 2.nfo
Fruity NoteBook 2.png
Fruity NoteBook.fst
Fruity NoteBook.nfo
Fruity NoteBook.png
Fruity Scratcher.fst
Fruity Scratcher.nfo
Fruity Scratcher.png
Fruity Spectroman.fst
Fruity Spectroman.nfo
Fruity Spectroman.png
Fruity dB Meter.fst
Fruity dB Meter.nfo
Fruity dB Meter.png
Newtime.fst
Newtime.nfo
Newtime.png
Patcher.fst
Razer Chroma.fst
Razer Chroma.nfo
Razer Chroma.png
Tuner.nfo
Tuner.png
Wave Candy.fst
Wave Candy.nfo
Wave Candy.png
ZGameEditor Visualizer.fst
ZGameEditor Visualizer.nfo
ZGameEditor Visualizer.png
Fruity Vocoder.fst
Fruity Vocoder.nfo
Fruity Vocoder.png
Newtone.fst
Newtone.nfo
Newtone.png
Pitcher.fst
Pitcher.nfo
Pitcher.png
Vocodex.fst
Vocodex.nfo
Vocodex.png
BooBass.fst
BooBass.nfo
BooBass.png
Transistor Bass.nfo
Transistor Bass.png
Fruity Envelope Controller.fst
Fruity Envelope Controller.nfo
Fruity Envelope Controller.png
Fruity Keyboard Controller.fst
Fruity Keyboard Controller.nfo
Fruity Keyboard Controller.png
BassDrum.nfo
BassDrum.png
Drumaxx.nfo
Drumaxx.png
Drumpad.fst
Drumpad.nfo
Drumpad.png
FPC.nfo
FPC.png
Fruit Kick.fst
Fruit Kick.nfo
Fruit Kick.png
Fruity DrumSynth Live.fst
Fruity DrumSynth Live.nfo
Fruity DrumSynth Live.png
Fruity Slicer.fst
Fruity Slicer.nfo
Fruity Slicer.png
Ogun.fst
Ogun.nfo
Ogun.png
Sampler.nfo
Sampler.png
Slicex.fst
Slicex.nfo
Slicex.png
Plucked!.fst
Plucked!.nfo
Plucked!.png
Sakura.fst
Sakura.nfo
Sakura.png
FL Keys.fst
FL Keys.nfo
FL Keys.png
Dashboard.fst
Dashboard.nfo
Dashboard.png
MIDI Out.fst
MIDI Out.nfo
MIDI Out.png
ReWired.fst
ReWired.nfo
ReWired.png
DirectWave.fst
DirectWave.nfo
DirectWave.png
FL Studio Mobile.nfo
FLEX.fst
FLEX.nfo
FLEX.png
Morphine.fst
Morphine.nfo
Morphine.png
SoundFont Player.fst
SoundFont Player.nfo
SoundFont Player.png
3x Osc.fst
3x Osc.nfo
3x Osc.png
Autogun.fst
Autogun.nfo
Autogun.png
BeepMap.fst
BeepMap.nfo
BeepMap.png
Fruity DX10.fst
Fruity DX10.nfo
Fruity DX10.png
Fruity Granulizer.fst
Fruity Granulizer.nfo
Fruity Granulizer.png
GMS.fst
GMS.nfo
GMS.png
Harmless.fst
Harmless.nfo
Harmless.png
Harmor.nfo
Harmor.png
Kepler Exo.nfo
Kepler Exo.png
Kepler.fst
Kepler.nfo
Kepler.png
MiniSynth.fst
MiniSynth.nfo
MiniSynth.png
PoiZone.fst
PoiZone.nfo
PoiZone.png
Sawer.fst
Sawer.nfo
Sawer.png
SimSynth.fst
SimSynth.nfo
SimSynth.png
Sytrus.nfo
Sytrus.png
Toxic Biohazard.fst
Toxic Biohazard.nfo
Toxic Biohazard.png
Fruity Dance.fst
Fruity Dance.nfo
Fruity Dance.png
Fruity Video Player.fst
Fruity Video Player.nfo
Fruity Video Player.png
Fruity Voltage Controller.fst
Fruity Voltage Controller.nfo
Fruity Voltage Controller.png
Layer.fst
Layer.nfo
Layer.png
Patcher.fst
Wave Traveller.fst
Wave Traveller.nfo
Wave Traveller.png
Fruity Parametric EQ 2.png
FL Studio Mobile.png
Installed.nfo
Speech.speech
Empty.flp
Empty.nfo
FL64.exe
Editions_FL__fruity.png
Editions_FL_producer_1.png
Editions_FL_signature.png
Rounded Rectangle.ilcontrol
IMP Cabinet Model A.wv
IMP Cabinet Model B.wv
IMP Cabinet Model C.wv
IMP Cabinet Model D.wv
IMP Cabinet Model E.wv
IMP Cabinet Model F.wv
IMP Cabinet Model G.wv
IMP Cabinet Model H.wv
IMP Cabinet Model I.wv
IMP Cabinet Model J.wv
IMP Cabinet Model K.wv
IMP Cabinet Model L.wv
IMP Cabinet Model M.wv
IMP Cabinet Model N.wv
IMP Cabinet Model O.wv
IMP Cabinet Model P.wv
IMP Cabinet Model Q.wv
IMP Cabinet Model R.wv
IMP Cabinet Model S.wv
IMP Cabinet Model T.wv
Plugin.nfo
Blur - alt.fnv
Blur - default.fnv
Blur - narrow.fnv
Blur - pulse.fnv
EQ - default.fnv
Furnace.bmp
Plugin.nfo
GM Drums.txt
EQ - 15Hz - 18kHz cut.fnv
EQ - 40Hz cut.fnv
EQ - key points.fnv
Spectral mask - default.fnv
12dB steps.bmp
Charcoal.bmp
Deeper furnace.bmp
Glacier.bmp
Temperature.bmp
The Matrix.bmp
Fruity NoteBook_Info.rtf
Spectrum.bmp
Fruity Parametric EQ 2_Info.rtf
Fruity Stereo Shaper_Info.rtf
Default.fnv
Pedal_chorus.tga
MPC 2.groovepat
BG2.tga
Flat (centered).fnv
Flat (top).fnv
Bright.fst
Car horn.fst
Chip.fst
Elderly.fst
Ensemble.fst
Flanged pulse.fst
Flanged saw.fst
Gargling.fst
Growling.fst
Harsh.fst
Machine 2.fst
Machine.fst
Organ.fst
PWM.fst
Panner.fst
Phased 2.fst
Phased.fst
Power.fst
Pulse.fst
Robot saw.fst
Saw.fst
Scythe.fst
Supersaw.fst
Tube.fst
Weird.fst
Brain.zgeMesh
Car.zgeMesh
Drone.zgeMesh
Hero.zgeMesh
Heroine.zgeMesh
Skull.zgeMesh
World map.zgeMesh
Youlean Retro Road.zgeproj
Cuprum.ttf
FrancoisOne.ttf
Youlean Peak Shapes.zgeproj
Youlean Waveform.zgeproj
SG.dat
default.tga
EQ.bmp
Dance Crash 04.dmpatch
Dance Hat 15.dmpatch
Dance Hat 18.dmpatch
Electro Hat Cl 07.dmpatch
Clap 05.dmpatch
Clap 07.dmpatch
Electro Perc 06.dmpatch
Electro Perc 07.dmpatch
Muted Drum 01.dmpatch
Muted Drum 02.dmpatch
Snap 02.dmpatch
Break Beat 08.dmptrn
Break Beat 11.dmptrn
Break Beat 15.dmptrn
Break Beat 16.dmptrn
Electro 01.dmptrn
Electro 03.dmptrn
Electro 12.dmptrn
Electro 15.dmptrn
Funk 02.dmptrn
Funk 03.dmptrn
Funk 04.dmptrn
Funk 05.dmptrn
Funk 06.dmptrn
Funk 07.dmptrn
Funk 08.dmptrn
Funk 09.dmptrn
Funk 10.dmptrn
Hip Hop 14.dmptrn
Hip Hop 16.dmptrn
Hip Hop 17.dmptrn
Hip Hop 18.dmptrn
Hip Hop 19.dmptrn
Hip Hop 22.dmptrn
Old School 01.dmptrn
Old School 02.dmptrn
Old School 03.dmptrn
Old School 04.dmptrn
Old School 05.dmptrn
Old School 06.dmptrn
Old School 07.dmptrn
Old School 08.dmptrn
Old School 10.dmptrn
RNB 09.dmptrn
Industrial 05.dmptrn
Africana 01.dmptrn
Africana 02.dmptrn
Africana 03.dmptrn
World Groove 03.dmptrn
World Groove 12.dmptrn
World Groove 25.dmptrn
Rock 11.dmptrn
HQ_RoundSaw.wav
HQ_Saw.wav
HQ_Sine_Dist.wav
HQ_SmoothInvSaw.wav
HQ_SmoothInvSaw_2.wav
HQ_SmoothInvSaw_Dist.wav
SHP_Additive.wav
SHP_Additive_2.wav
SHP_BungList.wav
SHP_BungList_2.wav
SHP_BungList_3.wav
SHP_BungList_4.wav
SHP_BungList_5.wav
SHP_BungList_6.wav
SHP_BungList_7.wav
SHP_BungList_8.wav
SHP_BungList_9.wav
SHP_Detuned Saw.wav
SHP_Harmonics.wav
SHP_Moog.wav
SHP_Noise Bass.wav
SHP_Noise.wav
SHP_Overtone.wav
SHP_Overtone_2.wav
SHP_Ramp Saw.wav
SHP_Rand.wav
SHP_Rand_2.wav
SHP_Rough Square.wav
SHP_Rough Step.wav
SHP_Rough Step_2.wav
SHP_Saw+Sine.wav
SHP_Sawing Synth.wav
SHP_Synth.wav
SHP_Thin Pulse.wav
SHP_Thin.wav
SHP_Vowel A.wav
SHP_Vowel U.wav
SHP_Wire Scan.wav
SHP_Wooble Synth.wav
STR Ensemble.sf2
Bassline.fst
Changing bass.fst
DX7.fst
Death ray.fst
Droplets.fst
Fat cheese 2.fst
Fat cheese.fst
Hard bass.fst
JrBass.fst
Log drum.fst
Moog bass.fst
Moogish.fst
Moralog.fst
Nasty.fst
Noisy bass 2.fst
Noisy bass.fst
Phat bass.fst
Pilch bass.fst
Porta bass.fst
Pure bass 2.fst
Pure bass 3.fst
Pure bass 4.fst
Pure bass 5.fst
Pure bass 6.fst
Pure bass 7.fst
Pure bass 8.fst
Pure bass.fst
Square bass 2.fst
Square bass.fst
Supa bass.fst
Synth bass 10.fst
Synth bass 2.fst
Synth bass 3.fst
Synth bass 4.fst
Synth bass 5.fst
Synth bass 6.fst
Synth bass 7.fst
Synth bass 8.fst
Synth bass 9.fst
Synth bass.fst
Weird bass.fst
Bell.fst
Clap.fst
Closed hat.fst
Hihat.fst
Kick 2.fst
Kick 3.fst
Kick 4.fst
Kick 5.fst
Kick.fst
Open hat.fst
Snare 2.fst
Snare.fst
Snarekick 2.fst
Snarekick.fst
Pluck (fat).fst
Pluck.fst
Accordeon 2.fst
Analog dreamz.fst
Clean.fst
Detuned.fst
Dixie.fst
Intregue.fst
Laser.fst
Pilch tech lead.fst
Rave lead.fst
Raw.fst
SciFi 2.fst
SciFi 3.fst
SciFi 4.fst
SciFi 5.fst
SciFi 6.fst
SciFi 7.fst
SciFi 8.fst
SciFi.fst
Short 10.fst
Short 11.fst
Short 2.fst
Short 3.fst
Short 4.fst
Short 5.fst
Short 6.fst
Short 7 (fat).fst
Short 7.fst
Short 8.fst
Short 9.fst
Short square 2.fst
Short square.fst
Short.fst
Trance lead.fst
Accordeon.fst
BP string.fst
Brass 2.fst
Brass 3.fst
Brass 4.fst
Brass 5.fst
Brass 6.fst
Brass.fst
Cheap trumpet.fst
Flute.fst
HQ_Brass 2 (fat).fst
HQ_Brass 2.fst
HQ_Brass.fst
Long string (major).fst
Long string.fst
Notched string 2.fst
Notched string 3.fst
Notched string.fst
Odd brass.fst
Organ 2.fst
Organ 3 (fat).fst
Organ 3 (major).fst
Organ 3.fst
Organ 4.fst
Organ 5.fst
Organ 6.fst
Organ.fst
Smooth string 2 (fat).fst
Smooth string 2.fst
Smooth string.fst
String (fat).fst
String 10.fst
String 11.fst
String 2.fst
String 3.fst
String 4.fst
String 5.fst
String 6.fst
String 7.fst
String 8.fst
String 9.fst
String.fst
Pilch tech pad.fst
Quiet.fst
Slice.fst
Smooth synth.fst
Voodoo.fst
Windy.fst
Chip 2.fst
Chip 3.fst
Chip 4.fst
Chip.fst
Glitchy.fst
Hoover.fst
Mad KB.fst
Outer space hooter.fst
Roswel Landing.fst
Warped.fst
Wip.fst
Arp King.fst
Arpeggio 10.fst
Arpeggio 2.fst
Arpeggio 3.fst
Arpeggio 4.fst
Arpeggio 5.fst
Arpeggio 6.fst
Arpeggio 7.fst
Arpeggio 8.fst
Arpeggio 9.fst
Arpeggio.fst
Stutt arp.fst
Analogous phattus.fst
Caesar.fst
Chime synth.fst
Square 2.fst
Square.fst
Warble 2.fst
Warble.fst
zzzzap.fst
Seq 8thotes.flgsynth
Seq Goblins.flgsynth
Seq Octave Pulse.flgsynth
Seq Pulsar.flgsynth
Seq Pulsate.flgsynth
Seq Rapid Fire.flgsynth
Seq Space swamp.flgsynth
Synth 5th Chord TE.flgsynth
Synth Arctic Melody TE.flgsynth
Synth Basic.flgsynth
Synth Classy TE.flgsynth
Synth Crisp Detune TE.flgsynth
Synth Deep Talk N.flgsynth
Synth Electro Frog TE.flgsynth
Synth Electro Octaves TE.flgsynth
Synth Fifth Jazz N.flgsynth
Synth Fifth Pikes 1 TE.flgsynth
Synth Fifth Pikes 2 TE.flgsynth
Synth Fluctuate N.flgsynth
Synth Moonlight TE.flgsynth
Synth Phase Drops N.flgsynth
Synth Pluck.flgsynth
Synth Psy Filter TE.flgsynth
Synth Short Clean TE.flgsynth
Synth Sine Pluck TE.flgsynth
Synth Smooth Chord TE.flgsynth
Synth Swell TE.flgsynth
Trance Chord 1.flgsynth
Trance Plucks.flgsynth
Tripped Out.flgsynth
Unstable Square.flgsynth
Upfront Chord.flgsynth
Wormhole.flgsynth
Phat.flms
Pump.flms
Soft.flms
Tight.flms
Tone.flms
Tromb.flms
Tube.flms
Science.flms
Default ADSR.fnv
No attack.fnv
Short burst.fnv
Shortest attack.fnv
Default.fnv
Immediate.fnv
Modulation - increasing.fnv
Waveshaper - default.fnv
Waveshaper - harsh.fnv
Waveshaper - limiter.fnv
EQ.bmp
Res.fnv
Vol.fnv
Rand - uniform.fnv
Fruity Wrapper_Info.rtf
Pitch arpeggiato 2.fnv
Pitch arpeggiato.fnv
Short decay.fnv
Strings.fnv
Ambiance.bmp
Climbing.bmp
Default.bmp
Liquid.bmp
Rippled.bmp
Voice.bmp
Warp.bmp
Little randomness (centered).fnv
Little randomness (top).fnv
Harmor.rtf
1.fst
Filter 2 resonance mask.fnv
Phaser shape.fnv
Timbre 2 harmonic level.fnv
bg_filter.tga
oscdata.dat
mod_page_bkg.tga
Porta - basic.fnv
Porta - curved.fnv
1 bar triangle.fnv
Bin shape - hat.fnv
Bin shape - tent.fnv
0.txt
1.txt
2.txt
3.txt
4.txt
5.txt
6.txt
7.txt
8.txt
9.txt
Default.dat
Default_C.dat
1.fnv
2.fnv
3.fnv
4.fnv
5.fnv
6.fnv
7.fnv
8.fnv
Info.rtf
Ogun_Info.rtf
Patcher_Info.rtf
LFO.fnv
Speed.fnv
Speed - basic scratching.fnv
Vol - ADSR.fnv
Vol - decay only.fnv
Vol - sustaining.fnv
Default.dat
Arp - 1 1 2 3.fnv
Arp - 1 2 1 3.fnv
Arp - 2 notes M.fnv
Arp - big chaos.fnv
Arp - blade runner.fnv
Arp - classic down.fnv
Arp - classic up-down.fnv
Arp - classic up.fnv
Arp - double and hold.fnv
Arp - gated up.fnv
Arp - held up.fnv
Arp - little chaos.fnv
Arp - pattern 1.fnv
Arp - pattern 2.fnv
Arp - pattern 3.fnv
Arp - pattern 4.fnv
Arp - pattern 5.fnv
Arp - pattern 6.fnv
Gate - basic 10.fnv
Gate - basic 11.fnv
Gate - basic 12.fnv
Gate - basic 13.fnv
Gate - basic 14.fnv
Gate - basic 15.fnv
Gate - basic 16.fnv
Gate - basic 17.fnv
Gate - basic 2.fnv
Gate - basic 3.fnv
Gate - basic 4.fnv
Gate - basic 5.fnv
Gate - basic 6.fnv
Gate - basic 7.fnv
Gate - basic 8.fnv
Gate - basic 9.fnv
Gate - basic switch.fnv
Gate - basic.fnv
Gate - pulse.fnv
Pitch smooth arpeggiato.fnv
Smoothing for FX.fnv
Pitch vibrato.fnv
Filter cutoff - key compensation.fnv
Pitch - constant sub-oscillator.fnv
Plucked - default damp key mapping.fnv
Waveshaper - degrade.fnv
Waveshaper - fuzz.fnv
Waveshaper - soft sat.fnv
bg_seq.tga
MS20-Square.wav
Moog-Pulse1.wav
Plugin.nfo
Wasp XT_Info.rtf
Wasp XT_x64.dll
04b03_COMP_MAT-Regular.ttf
American-Captain.ttf
Antaris.ttf
Barlow-Medium.ttf
Chosence-Bold.ttf
Chosence-Regular.ttf
OFL.txt
OFL.txt
Italianno-Regular.ttf
JosefinSans-SemiBold.ttf
Khand-Light.ttf
Oswald-Light.ttf
PT_Sans-Narrow-Web-Regular.ttf
PT_Sans-Web-Regular.ttf
Revalia-Regular.ttf
LICENSE.txt
Share-Regular.ttf
Ubuntu-R.ttf
UbuntuCondensed-Regular.ttf
ornamentsFont.ttf
dsp_ippv2.dll
Settings.nfo
Akai APC40.flmapping
Native Instruments MASCHINE.flmapping
Vel curve 1.env
(none).png
Fruity Fast LP.png
Fruity Phase Inverter.png
Upgrade Fire to FL Studio + ALL Plugins Bundle.png
Upgrade Fire to Producer Edition.png
Upgrade Fruity Fire to All Plugins Edition.png
Page1.scr
Page2.scr
Page3.scr
Page1.scr
Page6.scr
Page2.scr
Page3.scr
Page4.scr
Page5.scr
Page7.scr
Page8.scr
Example.scr
Palette.scr
FL Cloud Plugins Installer.exe
es.moe
WebView2Loader.dll
fldiagnostic.exe
test-lily.exe
PluginManager.exe
ILWASAPI2ASIO.dll
Rar.txt
RarExtInstaller.exe
RarExtPackage.msix
Uninstall.exe
WhatsNew.txt
WinRAR.chm
WinRAR.exe
flcloud.messages
flcloud.messages
flcloud.messages
MicrosoftEdgeUpdate.log
vc_runtimeMinimum_x64.msi
8EC9B1D0ABBD7F98B401D425828828CE_D96A4C3B75E862E237A6B89F58F74354
C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
8EC9B1D0ABBD7F98B401D425828828CE_D96A4C3B75E862E237A6B89F58F74354
C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
0d8dbc6e-fbef-4dd6-b9e0-7fffcad3c189.tmp
12c9a03c-cd15-43d5-abe4-2811bfb453d6.tmp
1458c5ac-6126-4c00-8577-138219346c4c.tmp
1be4b723-c657-4915-8125-0c50d221879e.tmp
4377a5da-4315-444f-a82b-17c9b730f43c.tmp
4d93367b-4f30-4c73-a562-58a99216d2b8.tmp
5b4f72f4-caae-44a2-b888-060e45c2a65b.tmp
7582b870-7f44-4333-9ce8-afaaa9b7def1.tmp
849ef547-3289-4109-8991-54ea9559b86c.tmp
860bb026-9ddc-400e-9672-5fc7afefa3af.tmp
ce5c5aaa-ad66-4d5f-afee-64cd08d5783b.tmp
settings.dat
settings.dat
152772b8-9896-4c3a-b0bc-b9a6eb948798.tmp
1d2c2131-2c94-4440-bd64-3d7064ed2516.tmp
69906583-f637-47d2-b11d-33b9b6c6ff8b.tmp
93650bd4-2bc8-4904-8fd6-7a767c8f6616.tmp
963b972c-51a0-4fd9-afe4-9e34dd49c250.tmp
97a53985-efed-4d2f-8111-9e1d4d008977.tmp
9ecd4b9c-ebb2-43b5-a9ab-5b7ef7337b47.tmp
LOG
LOG.old
LOG.old
f_00005c
f_00005d
f_00005e
f_00005f
f_000060
f_000061
f_000062
f_000063
f_000064
f_000065
f_000066
f_000068
f_000069
f_00006a
f_00006c
f_00006d
f_00006e
f_000070
f_000071
f_000072
f_000073
f_000074
f_00007d
f_000085
f_00008c
f_00008f
f_000090
f_000091
temp-index
the-real-index
fdbf8176-3ae7-40e9-bd3b-6631b7a62ee1.tmp
1aafbd13-f2ec-4d26-83f3-e89c39255fcd.tmp
465cdb1a-c520-4036-a6e3-05df0b263be2.tmp
8bf8426b-7968-4c94-91f8-23b7ca3ff533.tmp
94068e23-0d1d-4088-867b-c530f6092bb8.tmp
d8da0cbd-a019-4bc6-a3d6-de002e4edfce.tmp
e140d91c-b451-4e42-bbc9-e194006f4d04.tmp
f0520109-ebde-4dc5-b769-3252aa1bf936.tmp
temp-index
index.txt.tmp
temp-index
the-real-index
CURRENT
sync_diagnostic.log
sync_diagnostic.log
MANIFEST-000001
c65a02a0-cdb8-4533-b4b8-cc302bd8fd14.tmp
ea2080cf-db17-45d4-a48b-7799aebe0068.tmp
b14f3c45-c138-438e-af74-6edff8e4e7c6.tmp
bb138b10-c1f8-4cac-b92c-68a73c802cba.tmp
7ba8c8ed-cb1c-4fee-8a99-68688447644c.tmp
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
FLEngine_x64.dll
FL Studio 26.1.reg
FL64 (scaled).exe
FL64.exe
FLEngine_x64.dll
engine_x64.dll
__PSScriptPolicyTest_a43d30w1.03o.psm1
VC_redist.x64.exe
Banner.dll
Header.bmp
InstallOptionsEx.dll
MINIMAL.bmp
MultiLanguage.ini
MultiLanguage.ini
MultiLanguage.ini
MultiLanguage.ini
MultiLanguage.ini
SetupType.ini
SetupType.ini
SetupType.ini
SetupType.ini
System.dll
ioSpecial.ini
ioSpecial.ini
ioSpecial.ini
ioSpecial.ini
nsArray.dll
nsExec.dll
nsProcessW.dll
nsisXML.dll
ILSetup.dll
InstallOptions.dll
System.dll
UAC.dll
UserMgr.dll
ioA.ini
ioAllUsersPage.ini
ioAllUsersPage.ini
ioFLMobileAd.ini
ioGoToWebPage_Online.ini
ioSpecial.ini
ioSpecial.ini
ioSpecial.ini
ioSpecial.ini
ioXPWarning.ini
modern-wizard.bmp
nsExec.dll
downloadedCertificate.txt
script.ps1
versions.xml
wrarinstaller.exe
settings.dat
settings.dat
settings.dat
48743825-9c4c-4faa-8a9f-34252b916fc1.tmp
55645282-2f37-45db-ae24-fdaa56461bc0.tmp
693db995-21da-4d97-847e-0cd6d1748073.tmp
f_00002d
temp-index
temp-index
temp-index
the-real-index
data_0
data_1
data_2
data_3
8d6f63d4-7d8a-4bb6-9499-f5bdf0ac2b66.tmp
Network Persistent State
f1726a2a-4e27-4888-9f75-60d3ccba0997.tmp
f4a36e83-b7ba-45ee-8d67-2a1b828d3169.tmp
Preferences
d5ab0eb7-4ed8-442b-a26e-215a327daa18.tmp
e4cfc72b-dea4-4859-9424-3432b9cb4fac.tmp
fd701563-e161-4735-a6b7-0939f438e765.tmp
Edge-Local-State-Tmp-6bd02f69-601a-4696-be3f-c0190b814eb8.tmp
Edge-Local-State-Tmp-9c42ffbe-0603-489a-aef7-3a3493a92416.tmp
Edge-Local-State-Tmp-ad4402ef-4643-4a41-8360-b569c559665c.tmp
Edge-Local-State-Tmp-c992f9c8-aa3f-4b5a-9d9f-5a123d77a9bd.tmp
Edge-Local-State-Tmp-dda5259b-f7b8-4a1e-9b70-b698efd596f6.tmp
Edge-Local-State-Tmp-e3544259-00c8-44b6-b349-c1a034cd174e.tmp
Edge-Local-State-Tmp-fe7710d6-4746-440e-b953-fc09e5bb95f4.tmp
Local State
zh.moe
fr.moe
zh.moe
it.moe
genres.lstj
Control Surface.nfo
Distructor.nfo
EQUO.nfo
Edison.nfo
Effector.nfo
Emphasis.nfo
Emphasizer.nfo
FL Studio Mobile Rack FX.nfo
Frequency Shifter.nfo
Frequency Splitter.nfo
Fruity 7 Band EQ.nfo
Fruity Balance.nfo
Fruity Bass Boost.nfo
Fruity Big Clock.nfo
Fruity Blood Overdrive.nfo
Fruity Center.nfo
Fruity Chorus.nfo
Fruity Compressor.nfo
Fruity Convolver.nfo
Fruity Delay 2.nfo
Fruity Delay 3.nfo
Fruity Delay Bank.nfo
Fruity Delay.nfo
Fruity Fast Dist.nfo
Fruity Fast LP.nfo
Fruity Filter.nfo
Fruity Flanger.nfo
Fruity Flangus.nfo
Fruity Formula Controller.nfo
Fruity Free Filter.nfo
Fruity HTML NoteBook.nfo
Fruity LSD.nfo
Fruity Limiter.nfo
Fruity Love Philter.nfo
Fruity Multiband Compressor.nfo
Fruity Mute 2.nfo
Fruity NoteBook 2.nfo
Fruity NoteBook.nfo
Fruity PanOMatic.nfo
Fruity Parametric EQ 2.nfo
Fruity Parametric EQ.nfo
Fruity Peak Controller.nfo
Fruity Phase Inverter.nfo
Fruity Phaser.nfo
Fruity Reeverb 2.nfo
Fruity Reeverb.nfo
Fruity Scratcher.nfo
Fruity Send.nfo
Fruity Soft Clipper.nfo
Fruity Spectroman.nfo
Fruity Squeeze.nfo
Fruity Stereo Enhancer.nfo
Fruity Stereo Shaper.nfo
Fruity Vocoder.nfo
Fruity WaveShaper.nfo
Fruity Wrapper.nfo
Fruity X-Y Controller.nfo
Fruity X-Y-Z Controller.nfo
Fruity dB Meter.nfo
Gross Beat.nfo
Hardcore.nfo
Hyper Chorus.nfo
Low Lifter.nfo
Luxeverb.nfo
Maximus.nfo
Multiband Delay.nfo
Newtime.nfo
Newtone.nfo
Patcher.nfo
Pitch Shifter.nfo
Pitcher.nfo
Razer Chroma.nfo
Soundgoodizer.nfo
Spreader.nfo
Transient Processor.nfo
Transmitter.nfo
Transporter.nfo
Tuner.nfo
VFX Color Mapper.nfo
VFX Envelope.nfo
VFX Key Mapper.nfo
VFX Keyboard Splitter.nfo
VFX Level Scaler.nfo
VFX Script.nfo
VFX Sequencer.nfo
Vintage Chorus.nfo
Vintage Phaser.nfo
Vocodex.nfo
Wave Candy.nfo
ZGameEditor Visualizer.nfo
3x Osc.nfo
Autogun.nfo
BassDrum.nfo
BeepMap.nfo
BooBass.nfo
Dashboard.nfo
DirectWave.nfo
Drumaxx.nfo
Drumpad.nfo
FL Keys.nfo
FL Slayer.nfo
FL Studio Mobile Rack.nfo
FL Studio Mobile.nfo
FLEX.nfo
FPC.nfo
Fruit Kick.nfo
Fruity DX10.nfo
Fruity Dance.nfo
Fruity DrumSynth Live.nfo
Fruity Envelope Controller.nfo
Fruity Granulizer.nfo
Fruity Keyboard Controller.nfo
Fruity Slicer 2.nfo
Fruity Slicer.nfo
Fruity Video Player.nfo
Fruity Voltage Controller.nfo
Fruity Wrapper.nfo
GMS.nfo
Harmless.nfo
Harmor.nfo
Kepler Exo.nfo
Kepler.nfo
MIDI Out.nfo
Minisynth.nfo
Morphine.nfo
Ogun.nfo
Patcher.nfo
Plucked!.nfo
PoiZone.nfo
ReWired.nfo
Sakura.nfo
Sawer.nfo
SimSynth.nfo
Slicex.nfo
Soundfont Player.nfo
Sytrus.nfo
Toxic Biohazard.nfo
Transistor Bass.nfo
Wave Traveller.nfo
FL Studio VSTi (multi).nfo
FL Studio VSTi.nfo
device_Fire.py
harmonicScales.py
ArturiaCrossKeyboardKLEss3.py
ArturiaVCOL.py
Displays.py
Icons.py
KLEss3Buttons.py
KLEss3Connexion.py
KLEss3Dispatch.py
KLEss3Display.py
KLEss3Navigation.py
KLEss3Pages.py
KLEss3Plugin.py
KLEss3Process.py
KLEss3Return.py
LedIds.py
MachineState.py
Patch.py
device_KLEss3.py
Arturia KeyLab Essential.ini
ArturiaCrossKeyboardEss.py
ArturiaVCOL.py
KeyLab Essential FL Studio User Guide V1 (3).pdf
KeyLabEssDispatch.py
KeyLabEssDisplay.py
KeyLabEssNavigation.py
KeyLabEssPages.py
KeyLabEssPlugin.py
KeyLabEssProcess.py
KeyLabEssReturn.py
device_Forward CCs Port 10 KEYLAB Ess.py
device_KeyLabEss.py
ArturiaCrossKeyboardKLmk2.py
ArturiaVCOL.py
KeyLab mkII FL Studio Overlay.jpg
KeyLab mkII FL Studio User Guide V1 (5).pdf
KeyLabmk2Dispatch.py
KeyLabmk2Display.py
KeyLabmk2Navigation.py
KeyLabmk2Pages.py
KeyLabmk2Plugin.py
KeyLabmk2Process.py
KeyLabmk2Return.py
KeyLabmk2SeqParam.py
device_Forward CCs Port 10 KEYLAB MKII.py
device_KeyLabmkII.py
ArturiaCrossKeyboardKL3.py
ArturiaVCOL.py
IntegrationPatchId.py
KL3Buttons.py
KL3Connexion.py
KL3Dispatch.py
KL3Display.py
KL3Navigation.py
KL3Pages.py
KL3Plugin.py
KL3Process.py
KL3Return.py
KL3SeqParam.py
KeyLab_mk3__1_0__2024_08_27__FL_Studio__DAW_User_Guide.pdf
LedId.py
ParamId.py
ScreenId.py
device_KL3.py
device_KeyLab mk3 MIDI.py
images_sub_enums.py
ArturiaVCOL.py
MiniLab37Connexion.py
MiniLab37Dispatch.py
MiniLab37Display.py
MiniLab37Navigation.py
MiniLab37Pages.py
MiniLab37Plugin.py
MiniLab37Process.py
MiniLab37Return.py
device_MiniLab37 MIDI.py
device_MiniLab37.py
ArturiaVCOL.py
MiniLab3Connexion.py
MiniLab3Dispatch.py
MiniLab3Display.py
MiniLab3Navigation.py
MiniLab3Pages.py
MiniLab3Plugin.py
MiniLab3Process.py
MiniLab3Return.py
device_MiniLab3.py
Auto saved.ncp
FL26.rar.crdownload
WinRAR-723.exe
e2c5d568-7994-4ae4-b30e-c0f45cb70bd1.tmp
logo.png
VC_redist.x64.exe
BootstrapperApplicationData.xml
license.rtf
thm.wxl
thm.xml
wixstdba.dll
memory/1300-60324-0x00007FFE270C0000-0x00007FFE270C1000-memory.dmp
memory/1576-61633-0x0000000000F70000-0x0000000001584000-memory.dmp
memory/1604-62872-0x0000000070470000-0x000000007067D000-memory.dmp
memory/1604-62829-0x0000000070470000-0x000000007067D000-memory.dmp
memory/1604-62875-0x000000006F7B0000-0x000000006FBD5000-memory.dmp
memory/1604-62888-0x000000006F7B0000-0x000000006FBD5000-memory.dmp
memory/1604-62790-0x0000000004B90000-0x0000000004BD8000-memory.dmp
memory/1604-62832-0x000000006F7B0000-0x000000006FBD5000-memory.dmp
memory/1604-62873-0x00000000700D0000-0x000000007046E000-memory.dmp
memory/1604-62831-0x000000006FBE0000-0x00000000700C2000-memory.dmp
memory/1604-62874-0x000000006FBE0000-0x00000000700C2000-memory.dmp
memory/1604-62743-0x0000000007150000-0x00000000071E2000-memory.dmp
memory/1604-62830-0x00000000700D0000-0x000000007046E000-memory.dmp
memory/1948-61373-0x0000000070680000-0x00000000723B7000-memory.dmp
memory/1948-61565-0x00000000700D0000-0x000000007046E000-memory.dmp
memory/1948-61568-0x0000000070680000-0x00000000723B7000-memory.dmp
memory/1948-62637-0x0000000070470000-0x000000007067D000-memory.dmp
memory/1948-62649-0x0000000070470000-0x000000007067D000-memory.dmp
memory/1948-61564-0x0000000070470000-0x000000007067D000-memory.dmp
memory/1948-61562-0x0000000004CD0000-0x0000000004D18000-memory.dmp
memory/1948-61857-0x00000000700D0000-0x000000007046E000-memory.dmp
memory/1948-61847-0x0000000070470000-0x000000007067D000-memory.dmp
memory/1948-61374-0x0000000008140000-0x00000000081D2000-memory.dmp
memory/2848-922-0x0000000004490000-0x00000000044B3000-memory.dmp
memory/2848-852-0x0000000002580000-0x00000000025A3000-memory.dmp
memory/3112-60367-0x00007FFE270C0000-0x00007FFE270C1000-memory.dmp
memory/4620-1934-0x0000000006C10000-0x0000000006C5C000-memory.dmp
memory/4620-1932-0x0000000006210000-0x000000000656B000-memory.dmp
memory/5052-59973-0x00000000001E0000-0x0000000000257000-memory.dmp
memory/5264-59781-0x0000000000FD0000-0x000000000141B000-memory.dmp
memory/5264-59983-0x0000000000FD0000-0x000000000141B000-memory.dmp
memory/5432-716-0x00000000069A0000-0x00000000069BE000-memory.dmp
memory/5432-672-0x0000000005C60000-0x00000000062AA000-memory.dmp
memory/5432-670-0x00000000034F0000-0x0000000003526000-memory.dmp
memory/5432-674-0x00000000063A0000-0x0000000006406000-memory.dmp
memory/5432-675-0x0000000006410000-0x0000000006476000-memory.dmp
memory/5432-678-0x0000000006580000-0x00000000068DB000-memory.dmp
memory/5432-768-0x0000000006EF0000-0x0000000006F0A000-memory.dmp
memory/5432-720-0x0000000006A00000-0x0000000006A4C000-memory.dmp
memory/5432-767-0x0000000008000000-0x000000000867C000-memory.dmp
memory/5432-673-0x0000000005BB0000-0x0000000005BD2000-memory.dmp
memory/5688-59780-0x0000000000200000-0x00000000002E9000-memory.dmp
memory/5688-59984-0x0000000000200000-0x00000000002E9000-memory.dmp
memory/5688-59698-0x0000000000200000-0x00000000002E9000-memory.dmp
memory/6056-62636-0x0000000000090000-0x0000000000793000-memory.dmp
memory/6056-62627-0x0000000000090000-0x0000000000793000-memory.dmp
memory/6056-62629-0x00000000700D0000-0x000000007046E000-memory.dmp
memory/6056-62628-0x0000000070470000-0x000000007067D000-memory.dmp
memory/6180-59691-0x0000000005E20000-0x0000000005E8F000-memory.dmp
memory/6252-1979-0x000000006F590000-0x000000006F5DC000-memory.dmp
memory/6252-1966-0x0000000005DC0000-0x000000000611B000-memory.dmp
memory/6252-1978-0x0000000007530000-0x0000000007566000-memory.dmp
memory/6252-1980-0x000000006F740000-0x000000006FA9B000-memory.dmp
memory/6252-1985-0x0000000007570000-0x0000000007613000-memory.dmp
memory/6252-1983-0x00000000074F0000-0x0000000007510000-memory.dmp
memory/6252-1996-0x0000000007750000-0x000000000775A000-memory.dmp
memory/6252-1998-0x00000000079F0000-0x0000000007A86000-memory.dmp
memory/6252-2000-0x0000000006160000-0x0000000006171000-memory.dmp
memory/6252-2006-0x0000000007950000-0x0000000007972000-memory.dmp
memory/6252-2007-0x0000000008DB0000-0x000000000936A000-memory.dmp
memory/6372-60518-0x0000000008C80000-0x0000000008CC8000-memory.dmp
memory/6372-60568-0x0000000070470000-0x000000007067D000-memory.dmp
memory/6372-60874-0x0000000070470000-0x000000007067D000-memory.dmp
memory/6372-61240-0x00000000700D0000-0x000000007046E000-memory.dmp
memory/6372-61325-0x0000000070680000-0x00000000723B7000-memory.dmp
memory/6372-60585-0x0000000070680000-0x00000000723B7000-memory.dmp
memory/6372-61239-0x0000000070470000-0x000000007067D000-memory.dmp
memory/6372-60569-0x00000000700D0000-0x000000007046E000-memory.dmp
memory/6372-60251-0x00000000066D0000-0x0000000006762000-memory.dmp
memory/6372-60249-0x00007FFE28750000-0x00007FFE28752000-memory.dmp
memory/6372-60248-0x0000000070680000-0x00000000723B7000-memory.dmp
memory/6492-58044-0x000001C8F4E50000-0x000001C8F4E72000-memory.dmp
memory/6492-58049-0x000001C8F4EC0000-0x000001C8F4EDE000-memory.dmp
memory/6492-58050-0x000001C8F5110000-0x000001C8F51C2000-memory.dmp
memory/6492-58051-0x000001C8F4E20000-0x000001C8F4E2A000-memory.dmp
memory/6512-59976-0x00000000001E0000-0x0000000000257000-memory.dmp
memory/6644-58372-0x0000000000AB0000-0x0000000000AE5000-memory.dmp
memory/6644-58373-0x00000000737E0000-0x0000000073A23000-memory.dmp
memory/6644-58398-0x0000000000AB0000-0x0000000000AE5000-memory.dmp
memory/6792-2124-0x0000000008F10000-0x000000000943C000-memory.dmp
memory/6792-2119-0x0000000007EB0000-0x0000000008072000-memory.dmp
memory/7060-59975-0x00000000001E0000-0x0000000000257000-memory.dmp
memory/7092-61616-0x0000000070680000-0x00000000723B7000-memory.dmp
memory/7092-61624-0x0000000000F70000-0x0000000001584000-memory.dmp