Analysis
- user interaction
yes - max time kernel
1755s - max time network
1744s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
19/10/2026, 15:59
Errors
Reason
Machine shutdown
General
- Target http://rewind11
- Sample261019-te53asds7v
Score
10/10
Malware Config
Signatures
- Family: KillMBR
KillMBR is a trojan that attempts to overwrite the Master Boot Record.
- Detects KillMBR 1 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 3 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Event Triggered Execution: Image File Execution Options Injection 1 TTPs 5 IoCs
- Possible privilege escalation attempt 15 IoCs
- Checks computer location settings 2 TTPs 9 IoCs
Looks up country code configured in the registry, likely geofence.
- Creates new service(s) 2 TTPs
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 61 IoCs
- Loads dropped DLL 64 IoCs
- Modifies file permissions 1 TTPs 15 IoCs
- Modifies system executable filetype association 2 TTPs 1 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Stops running service(s) 4 TTPs
- Adds Run key to start application 2 TTPs 2 IoCs
- Badlisted process makes network request 3 IoCs
Network request originating from process or tool commonly abused by malware.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs
Using powershell.exe command.
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Drops desktop.ini file(s) 1 IoCs
- Enumerates connected drives 3 TTPs 52 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Installs/modifies Browser Helper Object 2 TTPs 4 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- ConfuserEx .NET packer 1 IoCs
Detects ConfuserEx .NET packer.
- Drops file in System32 directory 11 IoCs
- UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 21 IoCs
- Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 12 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 53 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 5 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Inno Setup is an open-source installation builder for Windows applications. 32 IoCs
Inno Setup installer
- NSIS installer 2 IoCs
- Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 14 IoCs
Processor information is often read in order to detect sandboxing environments.
- Delays execution with timeout.exe 3 IoCs
- Enumerates system info in registry 2 TTPs 17 IoCs
- Kills process with taskkill 5 IoCs
- Modifies Control Panel 19 IoCs
- Modifies Internet Explorer settings 1 TTPs 17 IoCs
- Modifies data under HKEY_USERS 64 IoCs
- Modifies registry class 64 IoCs
- Modifies system certificate store 2 TTPs 10 IoCs
- Opens file in notepad (likely ransom note) 1 IoCs
- Runs .reg file with regedit 6 IoCs
- Runs net.exe
- Suspicious behavior: AddClipboardFormatListener 4 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 6 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 64 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 64 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
- Views/modifies file attributes 1 TTPs 2 IoCs
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://rewind111⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x20c,0x248,0x7ffb0e76c188,0x7ffb0e76c194,0x7ffb0e76c1a02⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1780,i,6116314826396638743,9161223757583366504,524288 --field-trial-handle=2168,i,10059407045289864349,12031554681064621745,262144 --variations-seed-version --mojo-platform-channel-handle=2204 /prefetch:32⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,7220422014912995153,8553165788246400449,262144 --field-trial-handle=2168,i,10059407045289864349,12031554681064621745,262144 --variations-seed-version --mojo-platform-channel-handle=2164 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2384,i,5145404941756633507,4676274248106441660,524288 --field-trial-handle=2168,i,10059407045289864349,12031554681064621745,262144 --variations-seed-version --mojo-platform-channel-handle=3028 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,8328492026659966345,10237163250113659540,2097152 --field-trial-handle=2168,i,10059407045289864349,12031554681064621745,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,14450736358904388145,10911865503747010388,2097152 --field-trial-handle=2168,i,10059407045289864349,12031554681064621745,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4168,i,13418587476006663870,2778410449138566259,2097152 --field-trial-handle=2168,i,10059407045289864349,12031554681064621745,262144 --variations-seed-version --mojo-platform-channel-handle=4172 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4240,i,4330818492379595455,7540598462911847779,2097152 --field-trial-handle=2168,i,10059407045289864349,12031554681064621745,262144 --variations-seed-version --mojo-platform-channel-handle=4184 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5056,i,9416991057159104208,13966603858591570148,2097152 --field-trial-handle=2168,i,10059407045289864349,12031554681064621745,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3460,i,15505518732432984059,14973094583035012191,524288 --field-trial-handle=2168,i,10059407045289864349,12031554681064621745,262144 --variations-seed-version --mojo-platform-channel-handle=3720 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3956,i,11562285078964085283,15749744827974275829,524288 --field-trial-handle=2168,i,10059407045289864349,12031554681064621745,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5836,i,9077479555710171549,2833175493381053922,524288 --field-trial-handle=2168,i,10059407045289864349,12031554681064621745,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5836,i,9077479555710171549,2833175493381053922,524288 --field-trial-handle=2168,i,10059407045289864349,12031554681064621745,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5896,i,1469262509624196954,11538431602450986329,2097152 --field-trial-handle=2168,i,10059407045289864349,12031554681064621745,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6336,i,15417374174803542026,4222366760360522157,524288 --field-trial-handle=2168,i,10059407045289864349,12031554681064621745,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5164,i,3885202451074612528,2185563174341150957,2097152 --field-trial-handle=2168,i,10059407045289864349,12031554681064621745,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=4464,i,5720204693471818463,4419029763092710883,2097152 --field-trial-handle=2168,i,10059407045289864349,12031554681064621745,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6332,i,8963444399597426727,5909761356626261493,2097152 --field-trial-handle=2168,i,10059407045289864349,12031554681064621745,262144 --variations-seed-version --mojo-platform-channel-handle=6664 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6836,i,10811774626690344583,4497091929528039255,2097152 --field-trial-handle=2168,i,10059407045289864349,12031554681064621745,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=564,i,1071255420087669308,17941450847606922652,524288 --field-trial-handle=2168,i,10059407045289864349,12031554681064621745,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3440,i,1290455480771510247,18262110130733015723,524288 --field-trial-handle=2168,i,10059407045289864349,12031554681064621745,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4524,i,6827976981343694896,7932180922299071821,524288 --field-trial-handle=2168,i,10059407045289864349,12031554681064621745,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=4388,i,13438026333328501044,11104580473725084474,2097152 --field-trial-handle=2168,i,10059407045289864349,12031554681064621745,262144 --variations-seed-version --mojo-platform-channel-handle=3396 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7024,i,12632060634299247569,5025621314132515956,2097152 --field-trial-handle=2168,i,10059407045289864349,12031554681064621745,262144 --variations-seed-version --mojo-platform-channel-handle=4572 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6968,i,11823685481425289319,1880078301070455758,524288 --field-trial-handle=2168,i,10059407045289864349,12031554681064621745,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5320,i,5315713438334556620,6526705442788402694,524288 --field-trial-handle=2168,i,10059407045289864349,12031554681064621745,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=5272,i,11218545142224487107,4347954872229117900,2097152 --field-trial-handle=2168,i,10059407045289864349,12031554681064621745,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=6996,i,8352803286052352914,6322907143170288935,2097152 --field-trial-handle=2168,i,10059407045289864349,12031554681064621745,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7368,i,11188851498413226649,9148745838598292108,262144 --field-trial-handle=2168,i,10059407045289864349,12031554681064621745,262144 --variations-seed-version --mojo-platform-channel-handle=7364 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3680,i,993777603472908229,12179409438346363295,524288 --field-trial-handle=2168,i,10059407045289864349,12031554681064621745,262144 --variations-seed-version --mojo-platform-channel-handle=4868 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Rewind11\" -spe -an -ai#7zMap16899:78:7zEvent255751⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\NOTEPAD.EXE"C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Rewind11\Rewind11src\RUN_ME.bat1⤵
- Opens file in notepad (likely ransom note)
-
C:\Users\Admin\Downloads\Rewind11\Rewind11src\Installers\AuthUX-setup-x64.exe"C:\Users\Admin\Downloads\Rewind11\Rewind11src\Installers\AuthUX-setup-x64.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Downloads\Rewind11\Rewind11src\Installers\OpenGlassSetup.Signed.exe"C:\Users\Admin\Downloads\Rewind11\Rewind11src\Installers\OpenGlassSetup.Signed.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\is-7PG06JJ6ZG.tmp\OpenGlassSetup.Signed.tmp"C:\Users\Admin\AppData\Local\Temp\is-7PG06JJ6ZG.tmp\OpenGlassSetup.Signed.tmp" /SL5="$1502B4,2395526,893952,C:\Users\Admin\Downloads\Rewind11\Rewind11src\Installers\OpenGlassSetup.Signed.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\icacls.exe"C:\Windows\system32\icacls.exe" "C:\Program Files\OpenGlass" /inheritance:r /grant:r *S-1-5-18:(OI)(CI)F *S-1-5-32-544:(OI)(CI)F *S-1-5-32-545:(OI)(CI)RX *S-1-5-90-0:(OI)(CI)RX3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\icacls.exe"C:\Windows\system32\icacls.exe" "C:\Program Files\OpenGlass\OpenGlassHost.exe" /inheritance:r /grant:r *S-1-5-18:F *S-1-5-32-544:D3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\icacls.exe"C:\Windows\system32\icacls.exe" "C:\Program Files\OpenGlass\symbols" /inheritance:r /grant:r *S-1-5-18:(OI)(CI)F *S-1-5-32-544:(OI)(CI)F *S-1-5-32-545:(OI)(CI)R *S-1-5-90-0:(OI)(CI)RWD3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\sc.exe"C:\Windows\system32\sc.exe" delete OpenGlassHost3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exe"C:\Windows\system32\sc.exe" create OpenGlassHost binPath= "C:\Program Files\OpenGlass\OpenGlassHost.exe" displayName= "OpenGlass Host Service" start= auto type= own3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exe"C:\Windows\system32\sc.exe" description OpenGlassHost "This service injects DLL into DWM for you and also maintains that user settings are correctly loaded."3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exe"C:\Windows\system32\sc.exe" start OpenGlassHost3⤵
- Launches sc.exe
-
-
-
C:\Program Files\OpenGlass\OpenGlassHost.exe"C:\Program Files\OpenGlass\OpenGlassHost.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\Downloads\Rewind11\Rewind11src\Installers\OpenWithEx-setup-x64.exe"C:\Users\Admin\Downloads\Rewind11\Rewind11src\Installers\OpenWithEx-setup-x64.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Downloads\Rewind11\Rewind11src\Installers\reshacker_setup.exe"C:\Users\Admin\Downloads\Rewind11\Rewind11src\Installers\reshacker_setup.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\is-OR4GE.tmp\reshacker_setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-OR4GE.tmp\reshacker_setup.tmp" /SL5="$1501CE,3527991,870400,C:\Users\Admin\Downloads\Rewind11\Rewind11src\Installers\reshacker_setup.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files (x86)\Resource Hacker\ReadMe.txt3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Resource Hacker\ResourceHacker.exe"C:\Program Files (x86)\Resource Hacker\ResourceHacker.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
-
-
-
C:\Windows\System32\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\Rewind11\Rewind11src\Installers\SecureUxTheme_x64.msi"1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Event Triggered Execution: Image File Execution Options Injection
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding FC1C4C1D9B4508592F48ED7E0158A726 C2⤵
- Loads dropped DLL
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
-
C:\Users\Admin\Downloads\Rewind11\Rewind11src\Installers\WinaeroTweaker-1.65.0.0-setup.exe"C:\Users\Admin\Downloads\Rewind11\Rewind11src\Installers\WinaeroTweaker-1.65.0.0-setup.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\is-BIEC8.tmp\WinaeroTweaker-1.65.0.0-setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-BIEC8.tmp\WinaeroTweaker-1.65.0.0-setup.tmp" /SL5="$A0168,5221241,832000,C:\Users\Admin\Downloads\Rewind11\Rewind11src\Installers\WinaeroTweaker-1.65.0.0-setup.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im winaerotweaker.exe /f3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im winaerotweaker.exe /f4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im winaerotweakerhelper.exe /f3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im winaerotweakerhelper.exe /f4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
-
-
-
-
C:\Users\Admin\Downloads\Rewind11\Rewind11src\Installers\ClassicPrograms\ClassicStickyNotes2\ClassicStickyNotes-2.0-setup.exe"C:\Users\Admin\Downloads\Rewind11\Rewind11src\Installers\ClassicPrograms\ClassicStickyNotes2\ClassicStickyNotes-2.0-setup.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\is-KEBUT.tmp\ClassicStickyNotes-2.0-setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-KEBUT.tmp\ClassicStickyNotes-2.0-setup.tmp" /SL5="$D0168,1499604,191488,C:\Users\Admin\Downloads\Rewind11\Rewind11src\Installers\ClassicPrograms\ClassicStickyNotes2\ClassicStickyNotes-2.0-setup.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Program Files\Classic Sticky Notes\StikyNot.exe"C:\Program Files\Classic Sticky Notes\StikyNot.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
-
-
-
C:\Program Files\Classic Sticky Notes\StikyNot.exe"C:\Program Files\Classic Sticky Notes\StikyNot.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\Downloads\Rewind11\Rewind11src\Installers\ClassicPrograms\ClassicPaint\ClassicPaint-1.1-setup.exe"C:\Users\Admin\Downloads\Rewind11\Rewind11src\Installers\ClassicPrograms\ClassicPaint\ClassicPaint-1.1-setup.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\is-GPMN3.tmp\ClassicPaint-1.1-setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-GPMN3.tmp\ClassicPaint-1.1-setup.tmp" /SL5="$C0314,3888726,886784,C:\Users\Admin\Downloads\Rewind11\Rewind11src\Installers\ClassicPrograms\ClassicPaint\ClassicPaint-1.1-setup.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
-
C:\Program Files\Classic Paint\mspaint1.exe"C:\Program Files\Classic Paint\mspaint1.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService1⤵
-
C:\Users\Admin\Downloads\Rewind11\Rewind11src\Installers\ClassicPrograms\DesktopGadgetsInstaller\DesktopGadgetsRevived-2.0.exe"C:\Users\Admin\Downloads\Rewind11\Rewind11src\Installers\ClassicPrograms\DesktopGadgetsInstaller\DesktopGadgetsRevived-2.0.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\is-U5GDQ.tmp\DesktopGadgetsRevived-2.0.tmp"C:\Users\Admin\AppData\Local\Temp\is-U5GDQ.tmp\DesktopGadgetsRevived-2.0.tmp" /SL5="$A0240,4382259,184320,C:\Users\Admin\Downloads\Rewind11\Rewind11src\Installers\ClassicPrograms\DesktopGadgetsInstaller\DesktopGadgetsRevived-2.0.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\Windows Sidebar\sbdrop.dll"3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\Windows Sidebar\wlsrvc.dll"3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\Windows Sidebar\sbdrop.dll"3⤵
- Loads dropped DLL
-
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\Windows Sidebar\wlsrvc.dll"3⤵
- Loads dropped DLL
-
-
C:\Program Files (x86)\Windows Sidebar\sidebar.exe"C:\Program Files (x86)\Windows Sidebar\sidebar.exe" /RegServer3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
C:\Program Files\Windows Sidebar\sidebar.exe"C:\Program Files\Windows Sidebar\sidebar.exe" /RegServer3⤵
- Executes dropped EXE
-
-
C:\Windows\system32\attrib.exe"C:\Windows\system32\attrib.exe" "C:\Program Files\Windows Sidebar" -s -h3⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\attrib.exe"C:\Windows\system32\attrib.exe" "C:\Program Files (x86)\Windows Sidebar" -s -h3⤵
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add HKCR\Windows.gadget /v FriendlyTypeName /t REG_EXPAND_SZ /d @"%ProgramFiles%\Windows Sidebar\sbdrop.dll",-100 /f3⤵
-
-
C:\Program Files\Windows Sidebar\sidebar.exe"C:\Program Files\Windows Sidebar\sidebar.exe" /autoRun3⤵
- Executes dropped EXE
-
-
C:\Program Files\Windows Sidebar\sidebar.exe"C:\Program Files\Windows Sidebar\sidebar.exe" /showGadgets3⤵
- Executes dropped EXE
-
-
-
C:\Program Files\Windows Sidebar\sidebar.exe"C:\Program Files\Windows Sidebar\sidebar.exe" /autoRun1⤵
- Executes dropped EXE
-
C:\Users\Admin\Downloads\Rewind11\Rewind11src\Installers\ClassicPrograms\notepad\notepad-1.0-setup.exe"C:\Users\Admin\Downloads\Rewind11\Rewind11src\Installers\ClassicPrograms\notepad\notepad-1.0-setup.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\is-O5PI0.tmp\notepad-1.0-setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-O5PI0.tmp\notepad-1.0-setup.tmp" /SL5="$18029A,1162210,868352,C:\Users\Admin\Downloads\Rewind11\Rewind11src\Installers\ClassicPrograms\notepad\notepad-1.0-setup.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\Downloads\Rewind11\Rewind11src\Installers\ClassicPrograms\oldcalcWin11Win10\OldClassicCalc-2.0-setup.exe"C:\Users\Admin\Downloads\Rewind11\Rewind11src\Installers\ClassicPrograms\oldcalcWin11Win10\OldClassicCalc-2.0-setup.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\is-0D3BL.tmp\OldClassicCalc-2.0-setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-0D3BL.tmp\OldClassicCalc-2.0-setup.tmp" /SL5="$2201F0,816846,204800,C:\Users\Admin\Downloads\Rewind11\Rewind11src\Installers\ClassicPrograms\oldcalcWin11Win10\OldClassicCalc-2.0-setup.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\Downloads\Rewind11\Rewind11src\Installers\ClassicPrograms\tm_cfg_win8_win10\tm_cfg_win8-win10.exe"C:\Users\Admin\Downloads\Rewind11\Rewind11src\Installers\ClassicPrograms\tm_cfg_win8_win10\tm_cfg_win8-win10.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\is-AODJP.tmp\tm_cfg_win8-win10.tmp"C:\Users\Admin\AppData\Local\Temp\is-AODJP.tmp\tm_cfg_win8-win10.tmp" /SL5="$2401F0,815998,201728,C:\Users\Admin\Downloads\Rewind11\Rewind11src\Installers\ClassicPrograms\tm_cfg_win8_win10\tm_cfg_win8-win10.exe"2⤵
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\Downloads\Rewind11\Rewind11src\Installers\ClassicPrograms\Windows7Games\Windows 7 Games for Windows 11, 10 and 8-4.2-setup.exe"C:\Users\Admin\Downloads\Rewind11\Rewind11src\Installers\ClassicPrograms\Windows7Games\Windows 7 Games for Windows 11, 10 and 8-4.2-setup.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\is-2RK5K.tmp\Windows 7 Games for Windows 11, 10 and 8-4.2-setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-2RK5K.tmp\Windows 7 Games for Windows 11, 10 and 8-4.2-setup.tmp" /SL5="$F0348,86993915,851968,C:\Users\Admin\Downloads\Rewind11\Rewind11src\Installers\ClassicPrograms\Windows7Games\Windows 7 Games for Windows 11, 10 and 8-4.2-setup.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
C:\Users\Admin\Downloads\Rewind11\Rewind11src\Installers\ClassicPrograms\wordpad\wordpad-2.0-setup.exe"C:\Users\Admin\Downloads\Rewind11\Rewind11src\Installers\ClassicPrograms\wordpad\wordpad-2.0-setup.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\is-3HG01.tmp\wordpad-2.0-setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-3HG01.tmp\wordpad-2.0-setup.tmp" /SL5="$110348,2054031,863744,C:\Users\Admin\Downloads\Rewind11\Rewind11src\Installers\ClassicPrograms\wordpad\wordpad-2.0-setup.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
C:\Users\Admin\Downloads\Rewind11\Rewind11src\Installers\ClassicPrograms\Aurora\aurora_x64_64bit.exe"C:\Users\Admin\Downloads\Rewind11\Rewind11src\Installers\ClassicPrograms\Aurora\aurora_x64_64bit.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\Downloads\Rewind11\Rewind11src\KIT\11to7source\Explorer7\ex7forw8.exe"C:\Users\Admin\Downloads\Rewind11\Rewind11src\KIT\11to7source\Explorer7\ex7forw8.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\regedit.exe"regedit.exe" "C:\Users\Admin\Downloads\Rewind11\Rewind11src\KIT\11to7source\Explorer7\Import Me.reg"1⤵
- Modifies registry class
- Runs .reg file with regedit
-
C:\Users\Admin\Downloads\Rewind11\Rewind11src\KIT\11to7source\Explorer7\ex7forw8.exe"C:\Users\Admin\Downloads\Rewind11\Rewind11src\KIT\11to7source\Explorer7\ex7forw8.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\Rewind11\Rewind11src\KIT\11to7source\ALT+TAB\get-win7-alttab.bat" "1⤵
- Executes a command shell one-liner
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\Rewind11\Rewind11src\KIT\11to7source\ALT+TAB\get-win7-alttab.bat" "1⤵
- Executes a command shell one-liner
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\Rewind11\Rewind11src\KIT\11to7source\ALT+TAB\get-win7-alttab.bat" "1⤵
- Executes a command shell one-liner
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\Rewind11\Rewind11src\KIT\11to7source\Fonts\RestoreWin7-CMD.bat" "1⤵
- Executes a command shell one-liner
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference='Stop';$paths=@(($env:LOCALAPPDATA+'\Packages\Microsoft.WindowsTerminal_8wekyb3d8bbwe\LocalState\settings.json'),($env:LOCALAPPDATA+'\Packages\Microsoft.WindowsTerminalPreview_8wekyb3d8bbwe\LocalState\settings.json'),($env:LOCALAPPDATA+'\Microsoft\Windows Terminal\settings.json'));$path=$null;foreach($p in $paths){if(Test-Path -LiteralPath $p){$path=$p;break}};if(-not $path){Write-Host 'Could not find Windows Terminal settings.json.';Write-Host 'Open Windows Terminal once so it creates its settings, then run this file again.';exit 1};Write-Host ('Using: '+$path);$backup=$path+'.win7-backup';Copy-Item -LiteralPath $path -Destination $backup -Force;Write-Host ('Backup saved: '+$backup);$raw=Get-Content -LiteralPath $path -Raw;$re=[regex]'(\x22(?:\\.|[^\x22\\])*\x22)|/\*[\s\S]*?\*/|//[^\r\n]*';$clean=$re.Replace($raw,{param($m) if($m.Groups[1].Success){$m.Value}else{''}});$obj=ConvertFrom-Json -InputObject $clean;if(-not $obj.profiles){Add-Member -InputObject $obj -NotePropertyName profiles -NotePropertyValue ([pscustomobject]@{}) -Force};if(-not $obj.profiles.defaults){Add-Member -InputObject $obj.profiles -NotePropertyName defaults -NotePropertyValue ([pscustomobject]@{}) -Force};$d=$obj.profiles.defaults;$font=[pscustomobject]@{face='Consolas';size=12};Add-Member -InputObject $d -NotePropertyName font -NotePropertyValue $font -Force;Add-Member -InputObject $d -NotePropertyName colorScheme -NotePropertyValue 'Vintage' -Force;Add-Member -InputObject $d -NotePropertyName cursorShape -NotePropertyValue 'vintage' -Force;Add-Member -InputObject $d -NotePropertyName antialiasingMode -NotePropertyValue 'aliased' -Force;Add-Member -InputObject $d -NotePropertyName padding -NotePropertyValue '0' -Force;Add-Member -InputObject $d -NotePropertyName useAcrylic -NotePropertyValue $false -Force;Add-Member -InputObject $obj -NotePropertyName alwaysShowTabs -NotePropertyValue $false -Force;Add-Member -InputObject $obj -NotePropertyName showTabsInTitlebar -NotePropertyValue $false -Force;$out=ConvertTo-Json -InputObject $obj -Depth 32;[IO.File]::WriteAllText($path,$out,(New-Object System.Text.UTF8Encoding($false)));Write-Host '';Write-Host 'Done! Fully close and reopen Windows Terminal to see the changes.';"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"1⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\Rewind11\Rewind11src\KIT\11to7source\Fonts\RestoreWin7-CMD.bat" "1⤵
- Executes a command shell one-liner
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference='Stop';$paths=@(($env:LOCALAPPDATA+'\Packages\Microsoft.WindowsTerminal_8wekyb3d8bbwe\LocalState\settings.json'),($env:LOCALAPPDATA+'\Packages\Microsoft.WindowsTerminalPreview_8wekyb3d8bbwe\LocalState\settings.json'),($env:LOCALAPPDATA+'\Microsoft\Windows Terminal\settings.json'));$path=$null;foreach($p in $paths){if(Test-Path -LiteralPath $p){$path=$p;break}};if(-not $path){Write-Host 'Could not find Windows Terminal settings.json.';Write-Host 'Open Windows Terminal once so it creates its settings, then run this file again.';exit 1};Write-Host ('Using: '+$path);$backup=$path+'.win7-backup';Copy-Item -LiteralPath $path -Destination $backup -Force;Write-Host ('Backup saved: '+$backup);$raw=Get-Content -LiteralPath $path -Raw;$re=[regex]'(\x22(?:\\.|[^\x22\\])*\x22)|/\*[\s\S]*?\*/|//[^\r\n]*';$clean=$re.Replace($raw,{param($m) if($m.Groups[1].Success){$m.Value}else{''}});$obj=ConvertFrom-Json -InputObject $clean;if(-not $obj.profiles){Add-Member -InputObject $obj -NotePropertyName profiles -NotePropertyValue ([pscustomobject]@{}) -Force};if(-not $obj.profiles.defaults){Add-Member -InputObject $obj.profiles -NotePropertyName defaults -NotePropertyValue ([pscustomobject]@{}) -Force};$d=$obj.profiles.defaults;$font=[pscustomobject]@{face='Consolas';size=12};Add-Member -InputObject $d -NotePropertyName font -NotePropertyValue $font -Force;Add-Member -InputObject $d -NotePropertyName colorScheme -NotePropertyValue 'Vintage' -Force;Add-Member -InputObject $d -NotePropertyName cursorShape -NotePropertyValue 'vintage' -Force;Add-Member -InputObject $d -NotePropertyName antialiasingMode -NotePropertyValue 'aliased' -Force;Add-Member -InputObject $d -NotePropertyName padding -NotePropertyValue '0' -Force;Add-Member -InputObject $d -NotePropertyName useAcrylic -NotePropertyValue $false -Force;Add-Member -InputObject $obj -NotePropertyName alwaysShowTabs -NotePropertyValue $false -Force;Add-Member -InputObject $obj -NotePropertyName showTabsInTitlebar -NotePropertyValue $false -Force;$out=ConvertTo-Json -InputObject $obj -Depth 32;[IO.File]::WriteAllText($path,$out,(New-Object System.Text.UTF8Encoding($false)));Write-Host '';Write-Host 'Done! Fully close and reopen Windows Terminal to see the changes.';"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\Rewind11\Rewind11src\KIT\11to7source\Fonts\RestoreWin7-Fonts.bat" "1⤵
- Executes a command shell one-liner
-
C:\Windows\system32\net.exenet session2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 session3⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\Downloads\Rewind11\Rewind11src\KIT\11to7source\Fonts\RestoreWin7-Fonts.ps1"2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in Windows directory
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" export "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts" C:\Users\Admin\Downloads\Rewind11\Rewind11src\KIT\11to7source\Fonts\Backup_20261019_171130\Fonts.reg /y3⤵
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" export "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes" C:\Users\Admin\Downloads\Rewind11\Rewind11src\KIT\11to7source\Fonts\Backup_20261019_171130\FontSubstitutes.reg /y3⤵
-
-
C:\Windows\system32\takeown.exe"C:\Windows\system32\takeown.exe" /F C:\Windows\Fonts\segoeui.ttf /A3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\icacls.exe"C:\Windows\system32\icacls.exe" C:\Windows\Fonts\segoeui.ttf /grant *S-1-5-32-544:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\takeown.exe"C:\Windows\system32\takeown.exe" /F C:\Windows\Fonts\segoeuib.ttf /A3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\icacls.exe"C:\Windows\system32\icacls.exe" C:\Windows\Fonts\segoeuib.ttf /grant *S-1-5-32-544:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\takeown.exe"C:\Windows\system32\takeown.exe" /F C:\Windows\Fonts\segoeuii.ttf /A3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\icacls.exe"C:\Windows\system32\icacls.exe" C:\Windows\Fonts\segoeuii.ttf /grant *S-1-5-32-544:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\takeown.exe"C:\Windows\system32\takeown.exe" /F C:\Windows\Fonts\segoeuiz.ttf /A3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\icacls.exe"C:\Windows\system32\icacls.exe" C:\Windows\Fonts\segoeuiz.ttf /grant *S-1-5-32-544:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\takeown.exe"C:\Windows\system32\takeown.exe" /F C:\Windows\Fonts\segoeuil.ttf /A3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\icacls.exe"C:\Windows\system32\icacls.exe" C:\Windows\Fonts\segoeuil.ttf /grant *S-1-5-32-544:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\takeown.exe"C:\Windows\system32\takeown.exe" /F C:\Windows\Fonts\seguisb.ttf /A3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\icacls.exe"C:\Windows\system32\icacls.exe" C:\Windows\Fonts\seguisb.ttf /grant *S-1-5-32-544:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
-
C:\Users\Admin\Downloads\Rewind11\Rewind11src\KIT\11to7source\OldNewExplorer\OldNewExplorerCfg.exe"C:\Users\Admin\Downloads\Rewind11\Rewind11src\KIT\11to7source\OldNewExplorer\OldNewExplorerCfg.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\Downloads\Rewind11\Rewind11src\KIT\11to7source\OldNewExplorer\OldNewExplorer64.dll"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\regsvr32.exe/s "C:\Users\Admin\Downloads\Rewind11\Rewind11src\KIT\11to7source\OldNewExplorer\OldNewExplorer64.dll"3⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\Downloads\Rewind11\Rewind11src\KIT\11to7source\OldNewExplorer\OldNewExplorer32.dll"2⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- System Location Discovery: System Language Discovery
-
-
C:\Program Files\ClassicTaskmgr\tm.exe"C:\Program Files\ClassicTaskmgr\tm.exe" "C:\Windows\system32\taskmgr.exe" /41⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SendNotifyMessage
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"2⤵
- Boot or Logon Autostart Execution: Active Setup
- Loads dropped DLL
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Downloads\Rewind11\Rewind11src\KIT\Firefox\firefox_ie9.exe"C:\Users\Admin\Downloads\Rewind11\Rewind11src\KIT\Firefox\firefox_ie9.exe"3⤵
- Executes dropped EXE
-
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe" "C:\Users\Admin\Downloads\Rewind11\Rewind11src\KIT\Firefox\Setup-Firefox.ps1"3⤵
- Loads dropped DLL
-
-
C:\Users\Admin\Downloads\Rewind11\Rewind11src\KIT\Firefox\Firefox Setup 115.37.0esr.exe"C:\Users\Admin\Downloads\Rewind11\Rewind11src\KIT\Firefox\Firefox Setup 115.37.0esr.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\7zS4F2881D6\setup.exe.\setup.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\Mozilla Firefox\AccessibleMarshal.dll"5⤵
- Loads dropped DLL
-
-
C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe"C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice_tmp.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice_tmp.exe" install6⤵
- Executes dropped EXE
-
-
-
C:\Program Files\Mozilla Firefox\default-browser-agent.exe"C:\Program Files\Mozilla Firefox\default-browser-agent.exe" register-task 308046B0AF4A39CB5⤵
- Executes dropped EXE
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --backgroundtask install5⤵
- Executes dropped EXE
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --backgroundtask install6⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Modifies Control Panel
-
-
-
-
-
C:\Users\Admin\Downloads\Rewind11\Rewind11src\KIT\Firefox\firefox_ie9.exe"C:\Users\Admin\Downloads\Rewind11\Rewind11src\KIT\Firefox\firefox_ie9.exe"3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\Downloads\Rewind11\Rewind11src\KIT\NetTray\NetworkIndicator.exe"C:\Users\Admin\Downloads\Rewind11\Rewind11src\KIT\NetTray\NetworkIndicator.exe"3⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\Rewind11\Rewind11src\KIT\OneDrive\disable-remove-onedrive.bat" "3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\net.exenet session4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 session5⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im OneDrive.exe4⤵
- Kills process with taskkill
-
-
C:\Windows\system32\timeout.exetimeout /t 2 /nobreak4⤵
- Delays execution with timeout.exe
-
-
C:\Windows\system32\Robocopy.exerobocopy "C:\Users\Admin\OneDrive\Desktop" "C:\Users\Admin\Desktop" /E /XJ /NFL /NDL /NJH /NJS /NC /NS /NP4⤵
-
-
C:\Windows\system32\Robocopy.exerobocopy "C:\Users\Admin\OneDrive\Documents" "C:\Users\Admin\Documents" /E /XJ /NFL /NDL /NJH /NJS /NC /NS /NP4⤵
-
-
C:\Windows\system32\Robocopy.exerobocopy "C:\Users\Admin\OneDrive\Pictures" "C:\Users\Admin\Pictures" /E /XJ /NFL /NDL /NJH /NJS /NC /NS /NP4⤵
-
-
C:\Windows\system32\Robocopy.exerobocopy "C:\Users\Admin\OneDrive\Music" "C:\Users\Admin\Music" /E /XJ /NFL /NDL /NJH /NJS /NC /NS /NP4⤵
-
-
C:\Windows\system32\Robocopy.exerobocopy "C:\Users\Admin\OneDrive\Videos" "C:\Users\Admin\Videos" /E /XJ /NFL /NDL /NJH /NJS /NC /NS /NP4⤵
-
-
C:\Windows\system32\Robocopy.exerobocopy "C:\Users\Admin\OneDrive\Downloads" "C:\Users\Admin\Downloads" /E /XJ /NFL /NDL /NJH /NJS /NC /NS /NP4⤵
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v "Desktop" /t REG_EXPAND_SZ /d "%USERPROFILE%\Desktop" /f4⤵
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v "{754AC886-DF64-4CBA-86B5-F7FBF4FBCEF5}" /t REG_EXPAND_SZ /d "%USERPROFILE%\Desktop" /f4⤵
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v "Personal" /t REG_EXPAND_SZ /d "%USERPROFILE%\Documents" /f4⤵
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v "{F42EE2D3-909F-4907-8871-4C22FC0BF756}" /t REG_EXPAND_SZ /d "%USERPROFILE%\Documents" /f4⤵
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v "My Pictures" /t REG_EXPAND_SZ /d "%USERPROFILE%\Pictures" /f4⤵
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v "{0DDD015D-B06C-45D5-8C4C-F59713854639}" /t REG_EXPAND_SZ /d "%USERPROFILE%\Pictures" /f4⤵
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v "My Music" /t REG_EXPAND_SZ /d "%USERPROFILE%\Music" /f4⤵
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v "{A0C69A99-21C8-4671-8703-7934162FCF1D}" /t REG_EXPAND_SZ /d "%USERPROFILE%\Music" /f4⤵
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v "My Video" /t REG_EXPAND_SZ /d "%USERPROFILE%\Videos" /f4⤵
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v "{35286A68-3C57-41A1-BBB1-0EAE73D76C95}" /t REG_EXPAND_SZ /d "%USERPROFILE%\Videos" /f4⤵
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v "{374DE290-123F-4565-9164-39C4925E467B}" /t REG_EXPAND_SZ /d "%USERPROFILE%\Downloads" /f4⤵
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\OneDrive" /v "KFMBlockOptIn" /t REG_DWORD /d 1 /f4⤵
-
-
C:\Windows\SysWOW64\OneDriveSetup.exe"C:\Windows\SysWOW64\OneDriveSetup.exe" /uninstall4⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\OneDriveSetup.exe"C:\Windows\SysWOW64\OneDriveSetup.exe" C:\Windows\SysWOW64\OneDriveSetup.exe /uninstall /permachine /childprocess /silent /enableOMCTelemetry /enableExtractCabV2 /cusid:S-1-5-21-939655444-3071939294-1401108526-10005⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\OneDriveSetup.exeC:\Windows\SysWOW64\OneDriveSetup.exe /uninstall /peruser /childprocess /enableOMCTelemetry /enableExtractCabV25⤵
- Modifies system executable filetype association
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe"C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe" /uninstall6⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
-
-
C:\Windows\system32\timeout.exetimeout /t 3 /nobreak4⤵
- Delays execution with timeout.exe
-
-
C:\Windows\system32\reg.exereg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v OneDrive /f4⤵
-
-
C:\Windows\system32\reg.exereg add "HKCR\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}" /v "System.IsPinnedToNameSpaceTree" /t REG_DWORD /d 0 /f4⤵
-
-
C:\Windows\system32\reg.exereg add "HKCR\Wow6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}" /v "System.IsPinnedToNameSpaceTree" /t REG_DWORD /d 0 /f4⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe4⤵
- Kills process with taskkill
-
-
C:\Windows\explorer.exeexplorer.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\Rewind11\Rewind11src\KIT\Patches\ExplorerPatchv1.4\FavoritesPatch.bat" "5⤵
- Executes a command shell one-liner
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\Downloads\Rewind11\Rewind11src\KIT\Patches\ExplorerPatchv1.4\FavoritesPatch.ps1"6⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe6⤵
- Kills process with taskkill
-
-
C:\Windows\explorer.exeexplorer.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\themecpl.dll,OpenThemeAction C:\Users\Admin\Downloads\Rewind11\Rewind11src\KIT\11to7source\Theme\Aero11_Seven_Shiny.theme7⤵
- Modifies Control Panel
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\Rewind11\Rewind11src\KIT\ClassicControlPanel\install-classic-cpl.bat" "7⤵
- Executes a command shell one-liner
-
C:\Windows\system32\net.exenet session8⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 session9⤵
-
-
-
-
C:\Windows.7\KIT\Explorer7\ex7forw8.exe"C:\Windows.7\KIT\Explorer7\ex7forw8.exe"7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\regedit.exe"regedit.exe" "C:\Windows.7\KIT\WindowsRegistry\src\Add Windows Logoff Sound to Control Panel.reg"7⤵
- Runs .reg file with regedit
-
-
C:\Windows\regedit.exe"regedit.exe" "C:\Windows.7\KIT\WindowsRegistry\src\Add Windows Logon Sounds to Control Panel.reg"7⤵
- Runs .reg file with regedit
-
-
C:\Windows\regedit.exe"regedit.exe" "C:\Windows.7\KIT\WindowsRegistry\src\oglbasic.reg"7⤵
- Runs .reg file with regedit
-
-
C:\Windows\regedit.exe"regedit.exe" "C:\Windows.7\KIT\WindowsRegistry\src\oglfull.reg"7⤵
- Runs .reg file with regedit
-
-
C:\Windows\regedit.exe"regedit.exe" "C:\Windows.7\KIT\WindowsRegistry\src\Add System Exit Sound to Control Panel.reg"7⤵
- Runs .reg file with regedit
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\SaveLock.htm7⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument C:\Users\Admin\Desktop\SaveLock.htm8⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x244,0x7ffb0e76c188,0x7ffb0e76c194,0x7ffb0e76c1a09⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1940,i,4555820969921986622,7912178173415772123,524288 --field-trial-handle=2260,i,8014019674152842647,15040507860069207232,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:39⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1688,i,8938378896206974069,15262292461151208526,262144 --field-trial-handle=2260,i,8014019674152842647,15040507860069207232,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:29⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1996,i,16033010035092819926,15017758581921433001,524288 --field-trial-handle=2260,i,8014019674152842647,15040507860069207232,262144 --variations-seed-version --mojo-platform-channel-handle=2792 /prefetch:89⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3520,i,5930901330038598700,9998902208628874332,2097152 --field-trial-handle=2260,i,8014019674152842647,15040507860069207232,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:19⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3524,i,9470139376554346557,17739717496425595086,2097152 --field-trial-handle=2260,i,8014019674152842647,15040507860069207232,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:19⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4284,i,16294196548401941039,9419474172961141756,2097152 --field-trial-handle=2260,i,8014019674152842647,15040507860069207232,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:19⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4880,i,11423558037654488388,11815527648676427779,524288 --field-trial-handle=2260,i,8014019674152842647,15040507860069207232,262144 --variations-seed-version --mojo-platform-channel-handle=4888 /prefetch:89⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5192,i,3435649784772627272,13931542758159331046,524288 --field-trial-handle=2260,i,8014019674152842647,15040507860069207232,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:89⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window9⤵
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffb0e76c188,0x7ffb0e76c194,0x7ffb0e76c1a010⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1968,i,15933858126756164725,3064691948025199465,524288 --field-trial-handle=2288,i,13043017107037628605,5392508663380832319,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:310⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1744,i,15476476993085452283,5195843938856733902,262144 --field-trial-handle=2288,i,13043017107037628605,5392508663380832319,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:210⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2592,i,14175413181855495730,9149428227619690260,524288 --field-trial-handle=2288,i,13043017107037628605,5392508663380832319,262144 --variations-seed-version --mojo-platform-channel-handle=2796 /prefetch:810⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4508,i,17050143736053880280,14573995316773405996,524288 --field-trial-handle=2288,i,13043017107037628605,5392508663380832319,262144 --variations-seed-version --mojo-platform-channel-handle=4540 /prefetch:810⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4508,i,17050143736053880280,14573995316773405996,524288 --field-trial-handle=2288,i,13043017107037628605,5392508663380832319,262144 --variations-seed-version --mojo-platform-channel-handle=4540 /prefetch:810⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4748,i,2202469319103944420,1481496706324025452,524288 --field-trial-handle=2288,i,13043017107037628605,5392508663380832319,262144 --variations-seed-version --mojo-platform-channel-handle=4720 /prefetch:810⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4908,i,10041163599631501049,9711933227119319397,524288 --field-trial-handle=2288,i,13043017107037628605,5392508663380832319,262144 --variations-seed-version --mojo-platform-channel-handle=4736 /prefetch:810⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4728,i,5775446692423885048,3378854835279546083,524288 --field-trial-handle=2288,i,13043017107037628605,5392508663380832319,262144 --variations-seed-version --mojo-platform-channel-handle=4764 /prefetch:810⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4952,i,585716070397552031,13121980404946117349,524288 --field-trial-handle=2288,i,13043017107037628605,5392508663380832319,262144 --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:810⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5040,i,14783121972165459283,3049934526628915869,524288 --field-trial-handle=2288,i,13043017107037628605,5392508663380832319,262144 --variations-seed-version --mojo-platform-channel-handle=4876 /prefetch:810⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5052,i,7509506629168473314,3868289922613046452,524288 --field-trial-handle=2288,i,13043017107037628605,5392508663380832319,262144 --variations-seed-version --mojo-platform-channel-handle=4892 /prefetch:810⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5224,i,929167906116565232,8197268584144515267,524288 --field-trial-handle=2288,i,13043017107037628605,5392508663380832319,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:810⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5172,i,2103738177501856262,17136510662199290914,524288 --field-trial-handle=2288,i,13043017107037628605,5392508663380832319,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:810⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5160,i,3007662298817556119,4489068941182973628,524288 --field-trial-handle=2288,i,13043017107037628605,5392508663380832319,262144 --variations-seed-version --mojo-platform-channel-handle=4544 /prefetch:810⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5148,i,18122298416899025168,11913646592997131911,524288 --field-trial-handle=2288,i,13043017107037628605,5392508663380832319,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:810⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5292,i,10106723819365399540,5513702372524958355,524288 --field-trial-handle=2288,i,13043017107037628605,5392508663380832319,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:810⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5172,i,15934961809105528093,9313695574703485091,524288 --field-trial-handle=2288,i,13043017107037628605,5392508663380832319,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:810⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5292,i,10184451271252569560,13798427615387631595,262144 --field-trial-handle=2288,i,13043017107037628605,5392508663380832319,262144 --variations-seed-version --mojo-platform-channel-handle=4692 /prefetch:810⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4848,i,8102330237637548155,13772120058402833056,524288 --field-trial-handle=2288,i,13043017107037628605,5392508663380832319,262144 --variations-seed-version --mojo-platform-channel-handle=4776 /prefetch:810⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3992,i,7399928605678767257,11356216809299775810,524288 --field-trial-handle=2288,i,13043017107037628605,5392508663380832319,262144 --variations-seed-version --mojo-platform-channel-handle=3948 /prefetch:810⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4220,i,9458775314804252950,3289590735451307857,524288 --field-trial-handle=2288,i,13043017107037628605,5392508663380832319,262144 --variations-seed-version --mojo-platform-channel-handle=4132 /prefetch:810⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3952,i,717021790416776082,2182497632242960602,524288 --field-trial-handle=2288,i,13043017107037628605,5392508663380832319,262144 --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:810⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5036,i,2040238998191507960,2036065418399801205,524288 --field-trial-handle=2288,i,13043017107037628605,5392508663380832319,262144 --variations-seed-version --mojo-platform-channel-handle=4056 /prefetch:810⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4744,i,16066112161875185022,8508501350713085377,524288 --field-trial-handle=2288,i,13043017107037628605,5392508663380832319,262144 --variations-seed-version --mojo-platform-channel-handle=4044 /prefetch:810⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5096,i,18345346011950772841,1542214462153723023,524288 --field-trial-handle=2288,i,13043017107037628605,5392508663380832319,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:810⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2440,i,15720349809775202861,15361149612412562875,524288 --field-trial-handle=2288,i,13043017107037628605,5392508663380832319,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:810⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5348,i,13777291469468576252,1855075131259701397,524288 --field-trial-handle=2288,i,13043017107037628605,5392508663380832319,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:810⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5096,i,13169696832965776680,11025027733525281000,524288 --field-trial-handle=2288,i,13043017107037628605,5392508663380832319,262144 --variations-seed-version --mojo-platform-channel-handle=1308 /prefetch:810⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3788,i,12351997915520746054,6882823377136426486,524288 --field-trial-handle=2288,i,13043017107037628605,5392508663380832319,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:810⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3856,i,11488131358451865980,5803295501391209719,524288 --field-trial-handle=2288,i,13043017107037628605,5392508663380832319,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:810⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5040,i,14724823931057298737,12319340457983297326,524288 --field-trial-handle=2288,i,13043017107037628605,5392508663380832319,262144 --variations-seed-version --mojo-platform-channel-handle=4884 /prefetch:810⤵
-
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\SaveLock.htm7⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"7⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffb0111c728,0x7ffb0111c734,0x7ffb0111c7408⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1740,i,13216592886770537450,13677184310425339181,262144 --field-trial-handle=2016,i,2741985985343463898,8938635044144086853,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2012 /prefetch:28⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2188,i,4452055472574497768,2352797798085820999,524288 --field-trial-handle=2016,i,2741985985343463898,8938635044144086853,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2196 /prefetch:38⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2428,i,9719902696875256420,2112567621114005432,524288 --field-trial-handle=2016,i,2741985985343463898,8938635044144086853,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2440 /prefetch:88⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3296,i,5018914509335203141,6377598212646083304,2097152 --field-trial-handle=2016,i,2741985985343463898,8938635044144086853,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3304 /prefetch:18⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3384,i,10471606129729517305,11244409369962604,2097152 --field-trial-handle=2016,i,2741985985343463898,8938635044144086853,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3432 /prefetch:18⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4556,i,10190221470981161441,12581786675102990132,2097152 --field-trial-handle=2016,i,2741985985343463898,8938635044144086853,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4552 /prefetch:18⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4764,i,462876266400621069,14982179379772480430,524288 --field-trial-handle=2016,i,2741985985343463898,8938635044144086853,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4748 /prefetch:88⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5144,i,9985524181315574338,7090860407278572287,524288 --field-trial-handle=2016,i,2741985985343463898,8938635044144086853,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5148 /prefetch:88⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5500,i,10514583573129963828,8336367881175586739,524288 --field-trial-handle=2016,i,2741985985343463898,8938635044144086853,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5512 /prefetch:88⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5568,i,4304033422247954557,1118883228487527813,524288 --field-trial-handle=2016,i,2741985985343463898,8938635044144086853,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5144 /prefetch:88⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5144,i,2358912308889111618,8737464084418006850,524288 --field-trial-handle=2016,i,2741985985343463898,8938635044144086853,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5532 /prefetch:88⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5184,i,13437393283677269389,9266658455523854021,2097152 --field-trial-handle=2016,i,2741985985343463898,8938635044144086853,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5620 /prefetch:18⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5768,i,7431049676043995798,12911793694213748980,2097152 --field-trial-handle=2016,i,2741985985343463898,8938635044144086853,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4892 /prefetch:28⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6200,i,18241558218591056989,9615412091510638138,2097152 --field-trial-handle=2016,i,2741985985343463898,8938635044144086853,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5524 /prefetch:18⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=3616,i,7107068348519803956,12412369612991435197,2097152 --field-trial-handle=2016,i,2741985985343463898,8938635044144086853,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3580 /prefetch:18⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3508,i,17237202307765852389,10644297662760641631,524288 --field-trial-handle=2016,i,2741985985343463898,8938635044144086853,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3496 /prefetch:88⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=3592,i,2695139432257297996,6006648033538356172,524288 --field-trial-handle=2016,i,2741985985343463898,8938635044144086853,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3548 /prefetch:88⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6192,i,9145798785493989994,829684792915633770,2097152 --field-trial-handle=2016,i,2741985985343463898,8938635044144086853,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3648 /prefetch:18⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6104,i,16115280842306143052,16965873588034215358,524288 --field-trial-handle=2016,i,2741985985343463898,8938635044144086853,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5908 /prefetch:88⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6108,i,4275335188296975628,5046042148537036160,524288 --field-trial-handle=2016,i,2741985985343463898,8938635044144086853,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5904 /prefetch:88⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6112,i,1252387088589119665,11974331910175771163,524288 --field-trial-handle=2016,i,2741985985343463898,8938635044144086853,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6024 /prefetch:88⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6424,i,2438064313185546687,16616162089029533332,2097152 --field-trial-handle=2016,i,2741985985343463898,8938635044144086853,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6180 /prefetch:18⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=1220,i,4345057489126506621,13894887163140860116,2097152 --field-trial-handle=2016,i,2741985985343463898,8938635044144086853,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=868 /prefetch:18⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=6612,i,9700467453010027347,3838019766178420453,2097152 --field-trial-handle=2016,i,2741985985343463898,8938635044144086853,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6648 /prefetch:18⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=6540,i,10889122128930290823,10316755073633772755,2097152 --field-trial-handle=2016,i,2741985985343463898,8938635044144086853,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6476 /prefetch:18⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=6488,i,9404294542350271103,4474215989894795161,2097152 --field-trial-handle=2016,i,2741985985343463898,8938635044144086853,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6560 /prefetch:18⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6756,i,5218131999856966297,3723509141626258804,262144 --field-trial-handle=2016,i,2741985985343463898,8938635044144086853,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6652 /prefetch:88⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=6812,i,14804885244765402449,10730020450648527085,2097152 --field-trial-handle=2016,i,2741985985343463898,8938635044144086853,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6632 /prefetch:18⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=6856,i,15125557692436177224,6694998022498124432,2097152 --field-trial-handle=2016,i,2741985985343463898,8938635044144086853,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6868 /prefetch:18⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=7012,i,17125813418897995611,1634523562575307410,2097152 --field-trial-handle=2016,i,2741985985343463898,8938635044144086853,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6648 /prefetch:18⤵
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"7⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffb0111c728,0x7ffb0111c734,0x7ffb0111c7408⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1824,i,15321640379160785624,1780141857522495584,262144 --field-trial-handle=1968,i,14320471090249589796,9944714972427602563,262144 --variations-seed-version=20261019-010044.269000-production --mojo-platform-channel-handle=1964 /prefetch:28⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2260,i,1237755012212816757,15671819809804258791,524288 --field-trial-handle=1968,i,14320471090249589796,9944714972427602563,262144 --variations-seed-version=20261019-010044.269000-production --mojo-platform-channel-handle=2264 /prefetch:38⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2388,i,4607313670723682863,6459401224926517780,524288 --field-trial-handle=1968,i,14320471090249589796,9944714972427602563,262144 --variations-seed-version=20261019-010044.269000-production --mojo-platform-channel-handle=2536 /prefetch:88⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3300,i,6319060268776573076,7387007752636348786,2097152 --field-trial-handle=1968,i,14320471090249589796,9944714972427602563,262144 --variations-seed-version=20261019-010044.269000-production --mojo-platform-channel-handle=3312 /prefetch:18⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3332,i,3524764868502415926,4384466868697445083,2097152 --field-trial-handle=1968,i,14320471090249589796,9944714972427602563,262144 --variations-seed-version=20261019-010044.269000-production --mojo-platform-channel-handle=3364 /prefetch:18⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4560,i,14361401974912363256,2597149586187885069,2097152 --field-trial-handle=1968,i,14320471090249589796,9944714972427602563,262144 --variations-seed-version=20261019-010044.269000-production --mojo-platform-channel-handle=4556 /prefetch:18⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5056,i,1299499514831264302,14881482546524545051,524288 --field-trial-handle=1968,i,14320471090249589796,9944714972427602563,262144 --variations-seed-version=20261019-010044.269000-production --mojo-platform-channel-handle=5044 /prefetch:88⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5788,i,1564356550496244806,12324179561032345228,2097152 --field-trial-handle=1968,i,14320471090249589796,9944714972427602563,262144 --variations-seed-version=20261019-010044.269000-production --mojo-platform-channel-handle=5776 /prefetch:18⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4008,i,1958183318928581484,12001450545149099950,2097152 --field-trial-handle=1968,i,14320471090249589796,9944714972427602563,262144 --variations-seed-version=20261019-010044.269000-production --mojo-platform-channel-handle=3536 /prefetch:18⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3564,i,7963385629211450209,7188709411715990585,2097152 --field-trial-handle=1968,i,14320471090249589796,9944714972427602563,262144 --variations-seed-version=20261019-010044.269000-production --mojo-platform-channel-handle=5732 /prefetch:18⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5760,i,10566239957809702703,16942787477631544429,524288 --field-trial-handle=1968,i,14320471090249589796,9944714972427602563,262144 --variations-seed-version=20261019-010044.269000-production --mojo-platform-channel-handle=5112 /prefetch:88⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=5700,i,2819840726465387237,3621993417635918337,524288 --field-trial-handle=1968,i,14320471090249589796,9944714972427602563,262144 --variations-seed-version=20261019-010044.269000-production --mojo-platform-channel-handle=5752 /prefetch:88⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5868,i,4578853055485009917,15477360847947265363,524288 --field-trial-handle=1968,i,14320471090249589796,9944714972427602563,262144 --variations-seed-version=20261019-010044.269000-production --mojo-platform-channel-handle=6120 /prefetch:88⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5792,i,14655960091721487598,6772238085617413777,524288 --field-trial-handle=1968,i,14320471090249589796,9944714972427602563,262144 --variations-seed-version=20261019-010044.269000-production --mojo-platform-channel-handle=5804 /prefetch:88⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5908,i,8024972614884526214,14838199937821002823,524288 --field-trial-handle=1968,i,14320471090249589796,9944714972427602563,262144 --variations-seed-version=20261019-010044.269000-production --mojo-platform-channel-handle=6016 /prefetch:88⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=3392,i,10436488334434855579,12199894627084770220,2097152 --field-trial-handle=1968,i,14320471090249589796,9944714972427602563,262144 --variations-seed-version=20261019-010044.269000-production --mojo-platform-channel-handle=5924 /prefetch:18⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=3512,i,12672604433147997698,14939530691201489112,2097152 --field-trial-handle=1968,i,14320471090249589796,9944714972427602563,262144 --variations-seed-version=20261019-010044.269000-production --mojo-platform-channel-handle=5948 /prefetch:18⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=5848,i,294093571309855202,1950237809531749035,2097152 --field-trial-handle=1968,i,14320471090249589796,9944714972427602563,262144 --variations-seed-version=20261019-010044.269000-production --mojo-platform-channel-handle=4464 /prefetch:18⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6164,i,7535964387432601420,9858674810470288073,2097152 --field-trial-handle=1968,i,14320471090249589796,9944714972427602563,262144 --variations-seed-version=20261019-010044.269000-production --mojo-platform-channel-handle=6236 /prefetch:18⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6352,i,4754538353466491379,3603467147081519847,2097152 --field-trial-handle=1968,i,14320471090249589796,9944714972427602563,262144 --variations-seed-version=20261019-010044.269000-production --mojo-platform-channel-handle=6356 /prefetch:18⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5808,i,709212544581963587,9275176336449052221,2097152 --field-trial-handle=1968,i,14320471090249589796,9944714972427602563,262144 --variations-seed-version=20261019-010044.269000-production --mojo-platform-channel-handle=6156 /prefetch:18⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6076,i,3846611841451576655,7251000594255420455,2097152 --field-trial-handle=1968,i,14320471090249589796,9944714972427602563,262144 --variations-seed-version=20261019-010044.269000-production --mojo-platform-channel-handle=6052 /prefetch:18⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6740,i,8458346554679132546,774713778626575779,2097152 --field-trial-handle=1968,i,14320471090249589796,9944714972427602563,262144 --variations-seed-version=20261019-010044.269000-production --mojo-platform-channel-handle=6084 /prefetch:18⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4628,i,1268386044300086728,16445645852220830720,262144 --field-trial-handle=1968,i,14320471090249589796,9944714972427602563,262144 --variations-seed-version=20261019-010044.269000-production --mojo-platform-channel-handle=4616 /prefetch:88⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=4600,i,15311675146215715422,7633902733960912211,2097152 --field-trial-handle=1968,i,14320471090249589796,9944714972427602563,262144 --variations-seed-version=20261019-010044.269000-production --mojo-platform-channel-handle=3432 /prefetch:18⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=6184,i,8765378647490989788,6470901558097323148,2097152 --field-trial-handle=1968,i,14320471090249589796,9944714972427602563,262144 --variations-seed-version=20261019-010044.269000-production --mojo-platform-channel-handle=3420 /prefetch:18⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=6784,i,15138348371128605897,15077024470293656095,2097152 --field-trial-handle=1968,i,14320471090249589796,9944714972427602563,262144 --variations-seed-version=20261019-010044.269000-production --mojo-platform-channel-handle=6240 /prefetch:18⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=5756,i,18359412880110082988,9490942797616805277,2097152 --field-trial-handle=1968,i,14320471090249589796,9944714972427602563,262144 --variations-seed-version=20261019-010044.269000-production --mojo-platform-channel-handle=6104 /prefetch:18⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=5924,i,9453608806822716434,11577608846673567936,2097152 --field-trial-handle=1968,i,14320471090249589796,9944714972427602563,262144 --variations-seed-version=20261019-010044.269000-production --mojo-platform-channel-handle=6300 /prefetch:18⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=6796,i,5492504892046543692,5801513449577452467,2097152 --field-trial-handle=1968,i,14320471090249589796,9944714972427602563,262144 --variations-seed-version=20261019-010044.269000-production --mojo-platform-channel-handle=6280 /prefetch:18⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=6912,i,1828850997391716021,325545506634324320,2097152 --field-trial-handle=1968,i,14320471090249589796,9944714972427602563,262144 --variations-seed-version=20261019-010044.269000-production --mojo-platform-channel-handle=6904 /prefetch:18⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --metrics-shmem-handle=5684,i,6107870822594072656,8599716936284434089,2097152 --field-trial-handle=1968,i,14320471090249589796,9944714972427602563,262144 --variations-seed-version=20261019-010044.269000-production --mojo-platform-channel-handle=3160 /prefetch:18⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --metrics-shmem-handle=6580,i,9176227544413257013,3338024964554252423,2097152 --field-trial-handle=1968,i,14320471090249589796,9944714972427602563,262144 --variations-seed-version=20261019-010044.269000-production --mojo-platform-channel-handle=6164 /prefetch:18⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=6980,i,653847738079522231,9827359735212806453,524288 --field-trial-handle=1968,i,14320471090249589796,9944714972427602563,262144 --variations-seed-version=20261019-010044.269000-production --mojo-platform-channel-handle=6956 /prefetch:88⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --metrics-shmem-handle=7120,i,14714628268967507206,1618832678568401985,2097152 --field-trial-handle=1968,i,14320471090249589796,9944714972427602563,262144 --variations-seed-version=20261019-010044.269000-production --mojo-platform-channel-handle=5640 /prefetch:18⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --metrics-shmem-handle=5696,i,11722121891246034962,16986419035295445448,2097152 --field-trial-handle=1968,i,14320471090249589796,9944714972427602563,262144 --variations-seed-version=20261019-010044.269000-production --mojo-platform-channel-handle=6912 /prefetch:18⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --metrics-shmem-handle=6504,i,4841657962454885701,119892784168274163,2097152 --field-trial-handle=1968,i,14320471090249589796,9944714972427602563,262144 --variations-seed-version=20261019-010044.269000-production --mojo-platform-channel-handle=6728 /prefetch:18⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --metrics-shmem-handle=7144,i,8045022646395472417,16176703349132471558,2097152 --field-trial-handle=1968,i,14320471090249589796,9944714972427602563,262144 --variations-seed-version=20261019-010044.269000-production --mojo-platform-channel-handle=3556 /prefetch:18⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --metrics-shmem-handle=5816,i,1083680582823320881,14175565426095987737,2097152 --field-trial-handle=1968,i,14320471090249589796,9944714972427602563,262144 --variations-seed-version=20261019-010044.269000-production --mojo-platform-channel-handle=6344 /prefetch:18⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --metrics-shmem-handle=5908,i,7136196669191621443,552690444703650560,2097152 --field-trial-handle=1968,i,14320471090249589796,9944714972427602563,262144 --variations-seed-version=20261019-010044.269000-production --mojo-platform-channel-handle=5928 /prefetch:18⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --metrics-shmem-handle=5780,i,347191490235594335,12731106419301360901,2097152 --field-trial-handle=1968,i,14320471090249589796,9944714972427602563,262144 --variations-seed-version=20261019-010044.269000-production --mojo-platform-channel-handle=5896 /prefetch:18⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --metrics-shmem-handle=6456,i,7614827958922971304,16839109137869321110,2097152 --field-trial-handle=1968,i,14320471090249589796,9944714972427602563,262144 --variations-seed-version=20261019-010044.269000-production --mojo-platform-channel-handle=6376 /prefetch:18⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6332,i,9783025744053910622,14026305628130170691,524288 --field-trial-handle=1968,i,14320471090249589796,9944714972427602563,262144 --variations-seed-version=20261019-010044.269000-production --mojo-platform-channel-handle=3576 /prefetch:88⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\MEMZ-Destructive.bat" "8⤵
- Executes a command shell one-liner
-
C:\Windows\system32\cscript.execscript x.js9⤵
-
-
C:\Users\Admin\AppData\Roaming\MEMZ.exe"C:\Users\Admin\AppData\Roaming\MEMZ.exe"9⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\MEMZ.exe"C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog10⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Roaming\MEMZ.exe"C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog10⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Roaming\MEMZ.exe"C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog10⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Roaming\MEMZ.exe"C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog10⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Roaming\MEMZ.exe"C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog10⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Roaming\MEMZ.exe"C:\Users\Admin\AppData\Roaming\MEMZ.exe" /main10⤵
- Checks computer location settings
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
-
C:\Program Files\notepad\app\notepad.exe"C:\Program Files\notepad\app\notepad.exe" \note.txt11⤵
- Executes dropped EXE
-
-
-
-
-
-
C:\Program Files\ClassicTaskmgr\tm.exe"C:\Program Files\ClassicTaskmgr\tm.exe" "C:\Windows\system32\taskmgr.exe" /47⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
-
-
-
C:\Windows\system32\timeout.exetimeout /t 46⤵
- Delays execution with timeout.exe
-
-
-
-
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files\OpenWithEx\OpenWith.exe"C:\Program Files\OpenWithEx\OpenWith.exe" -Embedding1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"2⤵
- Loads dropped DLL
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "C:\Users\Admin\Downloads\Rewind11\Rewind11src\KIT\Firefox\Setup-Firefox.ps1"2⤵
- Loads dropped DLL
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{E2B3C97F-6AE1-41AC-817A-F6F92166D7DD}1⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\System32\rundll32.exerundll32.exe uxtheme.dll,#64 C:\Windows\Resources\Themes\Aero\Aero.msstyles?NormalColor?NormalSize1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
3JavaScript
1PowerShell
1Windows Command Shell
1System Services
2Service Execution
2Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Browser Extensions
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
3Change Default File Association
1Component Object Model Hijacking
1Image File Execution Options Injection
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
3Change Default File Association
1Component Object Model Hijacking
1Image File Execution Options Injection
1Defense Evasion
File and Directory Permissions Modification
1Hide Artifacts
1Hidden Files and Directories
1Impair Defenses
1Modify Registry
6Pre-OS Boot
1Bootkit
1Subvert Trust Controls
1Install Root Certificate
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
e5d2d5d.rbs
ReadMe.txt
ResourceHacker.exe
ResourceHacker.ini
is-T1KM9.tmp
is-BL5T1.tmp
is-27TGK.tmp
is-2TC5A.tmp
is-3MO7S.tmp
is-3OIG5.tmp
is-4FQ68.tmp
is-67IBV.tmp
is-78BDL.tmp
is-7A90N.tmp
is-BKVU4.tmp
is-BSCT8.tmp
is-DMAO9.tmp
is-IO0L7.tmp
is-K22IA.tmp
is-LU13T.tmp
is-NK3F1.tmp
is-NRP8O.tmp
is-P8U82.tmp
is-Q65QI.tmp
is-TIJOQ.tmp
is-UP3M1.tmp
is-VQS09.tmp
is-1C1SN.tmp
is-9KMUJ.tmp
is-092PT.tmp
is-1P83S.tmp
is-EB13N.tmp
is-F0KP8.tmp
is-JF0M8.tmp
is-JJGIU.tmp
is-MRPLJ.tmp
is-Q5GB9.tmp
is-QDST8.tmp
is-SOH33.tmp
is-V0V49.tmp
is-VM8G1.tmp
is-VSD6L.tmp
is-8LP23.tmp
sidebar.exe
mspaint1.exe.mui
mspaint1.exe
StikyNot.exe
StikyNot.exe.mui
msconfig1.exe
tm.exe
is-KRH9M.tmp
chess.exe
slc.dll
CardGames.dll
FreeCell.exe
Hearts.exe
Mahjong.exe
Minesweeper.exe
bckgzm.exe
cmncliM.dll
cmncliM.dll.mui
cmncliM.dll.mui
cmncliM.dll.mui
cmncliM.dll.mui
cmncliM.dll.mui
cmncliM.dll.mui
cmncliM.dll.mui
zgmprxy.dll
chkrzm.exe
shvlzm.exe
PurblePlace.exe
Solitaire.exe
SpiderSolitaire.exe
AccessibleMarshal.dll
AccessibleMarshal.dll
api-ms-win-core-file-l1-2-0.dll
api-ms-win-core-file-l2-1-0.dll
api-ms-win-core-localization-l1-2-0.dll
api-ms-win-core-processthreads-l1-1-1.dll
api-ms-win-core-synch-l1-2-0.dll
api-ms-win-core-timezone-l1-1-0.dll
api-ms-win-crt-conio-l1-1-0.dll
api-ms-win-crt-convert-l1-1-0.dll
api-ms-win-crt-environment-l1-1-0.dll
api-ms-win-crt-filesystem-l1-1-0.dll
api-ms-win-crt-heap-l1-1-0.dll
api-ms-win-crt-locale-l1-1-0.dll
api-ms-win-crt-math-l1-1-0.dll
api-ms-win-crt-multibyte-l1-1-0.dll
api-ms-win-crt-private-l1-1-0.dll
api-ms-win-crt-process-l1-1-0.dll
api-ms-win-crt-runtime-l1-1-0.dll
api-ms-win-crt-stdio-l1-1-0.dll
api-ms-win-crt-string-l1-1-0.dll
api-ms-win-crt-time-l1-1-0.dll
api-ms-win-crt-utility-l1-1-0.dll
application.ini
PrivateBrowsing_150.png
PrivateBrowsing_70.png
VisualElements_150.png
VisualElements_70.png
crashreporter-override.ini
omni.ja
crashreporter.exe
crashreporter.exe
crashreporter.ini
d3dcompiler_47.dll
default-browser-agent.exe
default-browser-agent.exe
defaultagent.ini
defaultagent_localized.ini
channel-prefs.js
dependentlibs.list
firefox.VisualElementsManifest.xml
firefox.exe
firefox.exe
firefox.exe.sig
TwemojiMozilla.ttf
freebl3.dll
freebl3.dll
clearkey.dll
clearkey.dll.sig
manifest.json
ipcclientcerts.dll
lgpllibs.dll
libEGL.dll
libGLESv2.dll
locale.ini
maintenanceservice.exe
maintenanceservice_installer.exe
minidump-analyzer.exe
mozavcodec.dll
mozavutil.dll
mozglue.dll
mozwer.dll
mozwer.dll
msvcp140.dll
notificationserver.dll
nss3.dll
nssckbi.dll
nssckbi.dll
omni.ja
osclientcerts.dll
pingsender.exe
pingsender.exe
platform.ini
plugin-container.exe
plugin-container.exe.sig
precomplete
private_browsing.VisualElementsManifest.xml
private_browsing.exe
qipcap64.dll
removed-files
softokn3.dll
ucrtbase.dll
helper.exe
shortcuts_log.ini
update-settings.ini
updater.exe
updater.exe
updater.ini
vcruntime140.dll
vcruntime140_1.dll
xul.dll.sig
calc1.exe
OpenGlass.dll
OpenGlassGUI.exe
OpenGlassHost.exe
dwmcore.pdb
uDWM.pdb
unins000.dat
unins000.exe
Does not start.txt
Third-party licenses.txt
Winaero EULA.txt
Winaero.url
WinaeroTweaker.exe
is-1J125.tmp
is-I2CF9.tmp
is-K59J5.tmp
is-1GEVO.tmp
is-ON64L.tmp
is-90APV.tmp
is-6PS3R.tmp
is-3HE9G.tmp
is-FKLPS.tmp
is-HNM6R.tmp
is-QISOC.tmp
dial_lrg.png
is-DG32H.tmp
is-GT6DA.tmp
is-N8162.tmp
is-OEKJR.tmp
is-P5L7Q.tmp
is-R4PA1.tmp
is-R7J60.tmp
is-T2UCU.tmp
is-UJ8D6.tmp
is-G5ISJ.tmp
is-O87MC.tmp
is-0I4LQ.tmp
is-N3M7L.tmp
is-CPPU5.tmp
is-I64P6.tmp
is-0GO08.tmp
is-5ASMT.tmp
is-KCL5P.tmp
is-1BHAM.tmp
is-MSBTO.tmp
is-ETOTA.tmp
is-VL0L0.tmp
is-NR34M.tmp
gadget.xml
is-H3L3J.tmp
is-N3FQ4.tmp
is-B56OD.tmp
is-NAD0G.tmp
is-ROSBT.tmp
is-28LTF.tmp
is-A92DQ.tmp
is-4VJ3V.tmp
is-0OHEH.tmp
is-2RUA0.tmp
is-3UUIG.tmp
is-3V5HQ.tmp
is-4D4GU.tmp
is-521AD.tmp
is-5F6TN.tmp
is-71BNF.tmp
is-749QU.tmp
is-9L8RH.tmp
is-9VDPG.tmp
is-ABQRO.tmp
is-AJMMA.tmp
is-BLFEC.tmp
is-D6CVS.tmp
is-EGCTV.tmp
is-FO1G3.tmp
is-GJ51U.tmp
is-GMKES.tmp
is-H6L9S.tmp
is-HP6CF.tmp
is-JBEIT.tmp
is-RVJA6.tmp
is-TKO7O.tmp
is-UDD6K.tmp
is-7NCTB.tmp
is-9OAOC.tmp
is-UMT84.tmp
is-LT3N8.tmp
is-E9429.tmp
is-F49PF.tmp
is-HUI27.tmp
is-3UH7Q.tmp
is-AD2DK.tmp
is-BPU1O.tmp
calendar.js
is-ID3GB.tmp
is-TTRAK.tmp
is-APPFK.tmp
is-UDJTH.tmp
is-USSFI.tmp
is-4I553.tmp
is-A9A7D.tmp
is-MS423.tmp
is-4E34E.tmp
is-8CH4S.tmp
is-RGCBO.tmp
is-ASMAN.tmp
is-26I7L.tmp
is-L7TBO.tmp
is-U0HUD.tmp
is-4KIQD.tmp
is-1JH9I.tmp
is-87GA1.tmp
is-IF9DE.tmp
is-CSQM5.tmp
is-05RUO.tmp
is-1APO6.tmp
is-1MLD9.tmp
is-2NABN.tmp
is-345DS.tmp
is-4L002.tmp
is-4RIRI.tmp
is-5KF2O.tmp
is-6FLMK.tmp
is-6NGD8.tmp
is-73HVK.tmp
is-ANDE4.tmp
is-AOM2N.tmp
is-C1RSI.tmp
is-C9P9M.tmp
is-DL7DT.tmp
is-DR82N.tmp
is-E8F5E.tmp
is-ER45R.tmp
is-EV78A.tmp
is-FA918.tmp
is-HL7IE.tmp
is-IE2GA.tmp
is-ISRHS.tmp
is-J99H3.tmp
is-JIAK9.tmp
is-JP37N.tmp
is-JU592.tmp
is-KP4BS.tmp
is-NO450.tmp
is-NQ49G.tmp
is-NVBVQ.tmp
is-OL5EV.tmp
is-PMI4B.tmp
is-Q6FSD.tmp
is-QHK5H.tmp
is-RMDNG.tmp
is-S18ON.tmp
is-S2E8T.tmp
is-SGRRM.tmp
is-TRQ5J.tmp
is-U7QPJ.tmp
is-UFL7T.tmp
is-UMSE4.tmp
is-UNTA6.tmp
is-UP776.tmp
is-V3AKS.tmp
is-V42I3.tmp
is-VVBA7.tmp
is-O92R2.tmp
is-QKCCH.tmp
is-28GTU.tmp
is-F2AGS.tmp
is-KK8CB.tmp
is-1276H.tmp
is-180IN.tmp
is-4PQTQ.tmp
is-FEBLE.tmp
is-LLQF2.tmp
is-F5P5F.tmp
is-7BBUQ.tmp
is-CFHM2.tmp
is-NRA2F.tmp
is-TDB90.tmp
is-4056G.tmp
is-MTVFT.tmp
is-Q9GDV.tmp
is-E6O29.tmp
is-K3RQ5.tmp
is-L4P7R.tmp
is-NCLCD.tmp
is-RJ68R.tmp
is-21L1M.tmp
is-Q0DCK.tmp
is-3HTA6.tmp
is-29J0F.tmp
is-GNS1H.tmp
is-3GF5C.tmp
is-1SBDE.tmp
is-5SSRM.tmp
is-8RIR3.tmp
is-9VM0P.tmp
is-B49NR.tmp
is-BUIGJ.tmp
is-FQP2I.tmp
is-FS0IQ.tmp
is-G85OV.tmp
is-IIJJ3.tmp
is-K6SI1.tmp
is-LNUC2.tmp
is-P7NFR.tmp
is-RAGEM.tmp
is-RDLRJ.tmp
is-RDN8V.tmp
is-TLPCH.tmp
is-VP3SQ.tmp
is-ELDCA.tmp
is-A37BR.tmp
is-853GH.tmp
is-GV5S3.tmp
is-HCGF8.tmp
is-M3PS0.tmp
is-VJICF.tmp
is-7G14Q.tmp
is-JGFEC.tmp
is-Q23A1.tmp
is-NB9LK.tmp
is-RHOPP.tmp
is-6TF8F.tmp
is-K08TB.tmp
is-S19AC.tmp
is-8QREF.tmp
daisies.png
is-0KNE0.tmp
is-0TU6H.tmp
is-30RHH.tmp
is-4ISVA.tmp
is-4P3OQ.tmp
is-5MOGN.tmp
is-72472.tmp
is-80G4F.tmp
is-AIAEP.tmp
is-BDL3E.tmp
is-CMLH6.tmp
is-EHOU4.tmp
is-FHIVA.tmp
is-GA0UP.tmp
is-GAF82.tmp
is-H6A0H.tmp
is-JE784.tmp
is-JKAVC.tmp
is-JL013.tmp
is-K7NNJ.tmp
is-KUDTL.tmp
is-O1EGH.tmp
is-S79AS.tmp
is-U7FJ8.tmp
is-VM1G5.tmp
is-VM9SL.tmp
setting_back.png
is-89F26.tmp
is-ADCAU.tmp
is-23LUL.tmp
is-4CSVV.tmp
is-Q3P9O.tmp
is-4BMCJ.tmp
is-623FT.tmp
is-7OQAI.tmp
is-NC9LF.tmp
is-R7AN8.tmp
is-BGDJA.tmp
is-R8GJG.tmp
is-SG53F.tmp
is-GH5H1.tmp
is-HEA33.tmp
is-QASH9.tmp
is-5I273.tmp
is-AEIOE.tmp
is-BJLCP.tmp
is-M13N7.tmp
is-RMCKL.tmp
is-HMN9U.tmp
is-KKP8L.tmp
is-H7POR.tmp
is-KTURS.tmp
is-2QTJO.tmp
is-BN2DN.tmp
is-D3NN4.tmp
is-ABOMH.tmp
is-P3741.tmp
picturePuzzle.css
is-4SGA9.tmp
is-CD6DI.tmp
is-PR7GS.tmp
is-7U2EA.tmp
is-J93D1.tmp
is-GVU7V.tmp
is-PJ77B.tmp
is-SA608.tmp
is-7MU5M.tmp
settings.js
is-1B61B.tmp
is-2BKED.tmp
is-LTVR6.tmp
is-51NCO.tmp
is-AHKLD.tmp
is-DIVFG.tmp
is-J1UQ5.tmp
is-GSHMV.tmp
is-P9M60.tmp
is-1DM8O.tmp
is-43BO8.tmp
is-N7SVU.tmp
is-NPO9J.tmp
is-BIBE8.tmp
is-142I3.tmp
is-B38BB.tmp
is-QDAN5.tmp
is-R2EKE.tmp
is-EVVSR.tmp
is-0EQ6G.tmp
is-2CEF0.tmp
is-CFQGS.tmp
is-H3LOU.tmp
is-5TKCP.tmp
is-0SOJQ.tmp
is-2QR5S.tmp
is-54A37.tmp
is-5UE04.tmp
is-7GBRU.tmp
is-80K3F.tmp
is-BMKBN.tmp
is-CKAN6.tmp
is-DL4J0.tmp
is-G4MQJ.tmp
is-KS5IT.tmp
is-N0TVQ.tmp
is-P506T.tmp
is-PR4LC.tmp
is-PT6P5.tmp
is-TU0R1.tmp
is-Q735I.tmp
is-VM4AH.tmp
gadget.xml
is-7FAC6.tmp
is-8NJVC.tmp
is-FTHTR.tmp
is-CBQ3U.tmp
is-DAI9G.tmp
is-U8AUA.tmp
is-VB9HO.tmp
is-689EF.tmp
is-702J2.tmp
is-G0P4Q.tmp
is-G89SN.tmp
is-1J2C4.tmp
is-2NM0R.tmp
is-60M17.tmp
is-BM92S.tmp
is-DJPV9.tmp
RSSFeeds.js
is-N0U0V.tmp
is-VG4CA.tmp
is-GJG5B.tmp
is-SIF6F.tmp
is-A1HB9.tmp
settings.html
is-MSOA8.tmp
is-NEQ0F.tmp
is-TLJGO.tmp
is-0D5RS.tmp
is-34DFT.tmp
is-9PO1R.tmp
is-J79PE.tmp
is-7DLLH.tmp
is-6V1JO.tmp
is-FQSSU.tmp
is-MQK3D.tmp
is-CQVQ8.tmp
is-BHFDA.tmp
is-L38SV.tmp
is-0J1NF.tmp
is-28Q0T.tmp
is-2IJ37.tmp
is-7DLSG.tmp
is-AREG1.tmp
is-DEGQ0.tmp
is-E7L72.tmp
is-F5TOI.tmp
is-GLASJ.tmp
is-KMP3L.tmp
is-M8DRF.tmp
is-N4QQL.tmp
is-P38KF.tmp
is-QTI6N.tmp
is-RQG4P.tmp
is-RVI5R.tmp
is-SUIQ2.tmp
is-HMBTI.tmp
is-1UDR3.tmp
is-EM68N.tmp
is-2J037.tmp
is-58F0F.tmp
is-AMO80.tmp
is-BM681.tmp
is-BS4UJ.tmp
is-5SPVT.tmp
is-8K4OH.tmp
is-VLP1V.tmp
is-SAP4N.tmp
is-75T8D.tmp
is-CLPP6.tmp
is-MTIIA.tmp
is-K2MSV.tmp
is-0DQ8O.tmp
is-0MUFK.tmp
is-SG4AB.tmp
is-EPC3R.tmp
is-H059K.tmp
is-N1S5B.tmp
is-01D17.tmp
is-4GNK7.tmp
is-DK2H0.tmp
is-NOP9I.tmp
is-O7T93.tmp
is-TGNQA.tmp
is-CITSJ.tmp
is-A29M6.tmp
is-C030P.tmp
is-F6E5P.tmp
is-T4004.tmp
(144DPI)alertIcon.png
is-CMCBV.tmp
is-JF01G.tmp
btn_search_down_BIDI.png
is-0KTCC.tmp
is-1BRF3.tmp
is-1FMA5.tmp
is-1IVS4.tmp
is-1R99M.tmp
is-1S780.tmp
is-27U14.tmp
is-2LFJK.tmp
is-3KNU0.tmp
is-3P091.tmp
is-3VEB5.tmp
is-40P3G.tmp
is-4IF30.tmp
is-4KRGU.tmp
is-5MFJI.tmp
is-6QVCR.tmp
is-6R025.tmp
is-6UI67.tmp
is-72IRN.tmp
is-72ML2.tmp
is-74N9V.tmp
is-7RV2S.tmp
is-7S9QF.tmp
is-8CFUE.tmp
is-8DUS2.tmp
is-ABR8D.tmp
is-AJ8A9.tmp
is-B9DIE.tmp
is-BDCPT.tmp
is-BQ255.tmp
is-C29IG.tmp
is-C39Q6.tmp
is-CFND0.tmp
is-CJMAF.tmp
is-CKCUQ.tmp
is-CROBI.tmp
is-DI2E4.tmp
is-DQ8OM.tmp
is-E75SJ.tmp
is-EE63K.tmp
is-EFV2V.tmp
is-EHCRD.tmp
is-ES2HI.tmp
is-F35T6.tmp
is-FVJG4.tmp
is-G2HG0.tmp
is-G946N.tmp
is-HE97T.tmp
is-IEP42.tmp
is-IFEH6.tmp
is-IIDN5.tmp
is-JBJGI.tmp
is-JD1OE.tmp
is-JUVBG.tmp
is-K0P51.tmp
is-LGJCQ.tmp
is-LI5U5.tmp
is-M67E8.tmp
is-M8086.tmp
is-MB6B9.tmp
is-MCKRA.tmp
is-MLM7U.tmp
is-NB9A4.tmp
is-O3KK1.tmp
is-OCIJR.tmp
is-ODSKL.tmp
is-OHT7M.tmp
is-OJH59.tmp
is-P617H.tmp
is-PA61I.tmp
is-Q9S2D.tmp
is-QCSQ4.tmp
is-QOF6G.tmp
is-QRDG0.tmp
is-RD8M3.tmp
is-RF20P.tmp
is-RFSAU.tmp
is-RQ19O.tmp
is-RT67C.tmp
is-SAFPJ.tmp
is-SEGJI.tmp
is-SMVJ8.tmp
is-SRHAF.tmp
is-T7D1C.tmp
is-U5BU9.tmp
is-U85EH.tmp
is-ULBRD.tmp
is-UQ1GQ.tmp
is-VLEVO.tmp
is-VLR88.tmp
is-VMIH0.tmp
is-HJAQO.tmp
is-QIKRN.tmp
is-77NNL.tmp
is-HCQ02.tmp
is-SPTP1.tmp
is-LAC47.tmp
is-A8PRV.tmp
is-CJ94Q.tmp
is-BP0TM.tmp
is-CHB6U.tmp
is-83M6V.tmp
is-96QVR.tmp
is-3Q5U2.tmp
is-K2ELA.tmp
is-MP6QR.tmp
is-75A4T.tmp
is-JAK51.tmp
is-0Q2SU.tmp
is-3QVCG.tmp
sidebar.exe
is-LGPCL.tmp
is-TKRFL.tmp
llm_user_input_extractor_config.json
office_endpoints_list.json
smart_switch_list.json
crl-set
autofill_bypass_cache_forms.json
edge_autofill_global_block_list.json
regex_patterns.json
v1FieldTypes.json
LICENSE
verified_contents.json
keys.json
arbitration_metadata.txt
verified_contents.json
sets.json
protocols.json
deny_domains.list
deny_etld1_domains.list
deny_full_domains.list
nav_config.json
automation.js
classification.js
extraction.js
travel-facilitated-booking-bing.js
travel-facilitated-booking-kayak.js
notepad.exe
wordpad.exe
Firefox.lnk
desktop.ini
~irefox.tmp
F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
251bf70b-f039-452d-a587-302ea62a40f4.tmp
3633135d-45da-40b7-a158-e67d68aaa364.tmp
39ef2b29-1756-40b9-8f33-8e55f9adcb35.tmp
3c48468e-8e8d-4ded-9644-c79d748642d4.tmp
4bbbe951-79db-4116-b62d-cb4149b94306.tmp
5a3dc260-ee98-4ba3-8596-91827a1de344.tmp
65531a81-b8d8-4890-bb13-c2a7178df2ff.tmp
766819c2-0cfc-433b-b349-ef14c5df4854.tmp
BrowserMetrics-spare.pma
975116e4-7dcd-4d4a-ac2d-54cb8198ec4d.dmp
settings.dat
1c8fd20a-db6c-43c6-aa3a-a2f66bda1390.tmp
27ed75aa-f15b-4021-b8d0-35319d4fae71.tmp
2880fc54-ef40-4450-b4ae-78ffd43bff51.tmp
3c19ed8e-2960-4755-bb6e-288729fd1ca9.tmp
42e24c0c-9b2b-48ea-8782-5175a96cc45c.tmp
4ae0158c-db82-4402-a0df-d48f7cb493ba.tmp
4bb70672-af60-49c8-a8f2-206c4582b087.tmp
567afcae-45e0-459b-b89f-d8fbd54f586a.tmp
6e654a62-346a-41e2-82c9-2318ae730a34.tmp
84b40f1c-31d9-4228-9b79-449b68109753.tmp
8df6215a-2891-4322-874d-acc74d02d7ee.tmp
93ff4c02-8794-414c-8a88-ca33a8e97044.tmp
959dc5e9-c985-417b-a9d0-a5a02dc37d57.tmp
9ccf4e11-4b13-42b1-87d0-f98a76f77986.tmp
9d5ee219-99ba-41e5-927d-b2718594abc7.tmp
9da7f8f5-5be5-48c9-86e8-119ad931ccd2.tmp
9f9b5be9-e69e-47a8-b926-3d0504fa5208.tmp
f_000005
f_00000b
f_00002d
f_00002e
f_00002f
f_000030
f_000037
f_00003b
f_000040
f_000041
f_000042
f_00006a
f_00006b
f_00006c
f_0000a9
f_0000ac
f_0000ad
f_0000b0
temp-index
temp-index
temp-index
temp-index
temp-index
the-real-index
the-real-index
messages.json
craw_background.js
04b1427b-dedb-4d9f-b7ec-f73027fb1b16.tmp
4c7c1fbe-6991-4f66-95a7-dcb734522b24.tmp
7b9018fc-f353-439f-bf1b-9669c3e9b2aa.tmp
b687201f-c911-43aa-a302-56c2ec3078e2.tmp
bf8bfb1b-59b9-4262-a545-3b1b5912c744.tmp
c53a398b-772a-4154-b9fa-181e142e578b.tmp
Preferences
temp-index
temp-index
MANIFEST-000001
index.txt
index.txt.tmp
c042c8d8-2e04-408c-815f-87f32cba696f.tmp
cd65d8cd-f7f6-44bf-8fbf-5858f3b25fb8.tmp
d5f125d7-a4c1-4ee2-8b17-9f78415d079f.tmp
d9d88ad6-42a7-4544-b696-8d812d103c86.tmp
debde9d5-ce6c-461e-b2be-5a1263bd4863.tmp
ac6b4f05-d240-4166-95ca-a6f96dedd17e.tmp
f29d7bb2-f3bd-46ed-81db-33984211bde8.tmp
3492c780-7d35-4ba6-9a71-9a6e4dd587e5.tmp
52daca1c-741f-44e5-94cb-74bc3ab53d58.tmp
54eb8a64-c2b0-45d4-bf42-0318afc51157.tmp
651999bf-636c-4a16-9f09-63118956cc91.tmp
7c33011b-5eaf-4cf7-88d2-47334440e554.tmp
81532f26-ab52-4d23-a312-1fcecb33383e.tmp
90ff6066-9ac9-4cd5-a249-4d7276791846.tmp
9239d54b-4c5b-4300-8539-9e49735ae7d2.tmp
manifest.json
manifest.json
manifest.json
settings.dat
settings.dat
settings.dat
settings.dat
00cb3e0d-04db-4045-af03-3c53dd7dc9bb.tmp
1b0eafc6-5a5b-4f39-8a73-24ec9b7e88fd.tmp
23969b11-8dd2-4be9-bdce-af9d4e3680fa.tmp
23cae384-d776-4567-9523-605d1de23f22.tmp
3cc62799-8007-46d4-898e-16fd9f069184.tmp
56ad6044-c725-4dd3-af2f-16158eaf7a28.tmp
7436900b-8ffc-4d18-b5ee-3b41fc265a23.tmp
767aec41-5991-406e-a40d-f192eb55cdc5.tmp
792ba170-82e4-4bc6-a6a6-d3922bef045d.tmp
9b2c5776-a1d5-4ae9-bdb2-b72ebaf88c11.tmp
LOG.old
f_000049
f_00004a
f_00004b
f_00004c
f_00004d
f_000053
f_000054
f_000055
f_000056
f_000057
f_000058
f_000059
f_00005a
f_00005c
f_00005e
f_00005f
f_000060
f_000061
f_000062
f_000064
f_000066
f_000067
f_000068
f_000069
f_00006b
f_00006c
f_00006d
f_00006f
temp-index
the-real-index
data_1
657ddb74-e858-4cc7-85fd-b0d89b9b66f9.tmp
dasherSettingSchema.json
MANIFEST-000001
000003.log
CURRENT
LOG.old
01f0a513-6e3b-4584-ae5a-4442514faf46.tmp
0de109c4-ab02-4e5a-b919-91a770a35c18.tmp
2f5e03ca-650a-4dea-b9b8-85dca13f7ae2.tmp
7acdd2b7-9d80-41a0-b93e-d31bb67911e2.tmp
9e2346e6-ce74-4ade-a0af-92b6a68cb7c1.tmp
Sdch Dictionaries
b6a06c3e-73bb-4bf4-8427-0f191a9bcb63.tmp
eb031f23-da9d-44aa-8e18-077cca74d8f7.tmp
sync_diagnostic.log
a2e018f9-8ff2-4dbf-85e7-e2e5cf1f9878.tmp
aa30d4c1-cba3-4416-824d-0757b867f302.tmp
ea7ba458-77c0-498a-91ab-b320bca7b3c4.tmp
ea82a876-e1bd-4770-bafc-36a02c8e22db.tmp
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
RevisitationBloomfilter
manifest.json
manifest.json
manifest.json
150c1cd7-7485-4be2-8f65-d8cd99d96506.tmp
33d82abc-a550-4b50-90e7-80f5fbed770d.tmp
497e51a3-ff99-4d3a-9b65-ba2722c5c9f0.tmp
75179aa1-0cf0-4dbc-b5e6-09686ff07a6b.tmp
83b49887-93a7-4200-be40-77f3c09a7f47.tmp
8b05649b-97c1-4ecb-833d-498eb59d62f3.tmp
9e676f93-68e7-4268-9b14-e2487a5486d9.tmp
c513ba19-6e54-4ab6-b59a-b4eb682a1c0d.tmp
cc095a3c-fb0c-4032-a03d-e5dd04b77a40.tmp
e54e42fe-7be7-4bcc-bf71-6c7c43c83e6e.tmp
f4925ab4-3e2a-402b-8c2a-b02637ccaf55.tmp
dee26b68-f08c-44eb-90f1-75346e162e81.tmp
eb4409eb-b640-4e5d-9216-71016e555fd9.tmp
ecba7c4c-b426-46a3-9891-27c62b256785.tmp
47789845-25b7-4807-b17b-cb72a88a02a7.tmp
fc3c3e0d-c142-408a-9aa3-ba9b54a1d103.tmp
Uninstall-2026-10-19.1615.4172.1.odl
Uninstall-PerMachine-2026-10-19.1615.5376.1.odl
Uninstall-PerUser-2026-10-19.1615.3264.1.aodl
Uninstall-PerUser-2026-10-19.1615.3264.1.odl
5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
19.043.0304[1].json
Aero11_Seven_Shiny.theme
Custom.theme
Custom.theme
Custom.theme
Microsoft_Windows_Explorer
https___docs_oracle_com_javase_8_docs
{6D809377-6AF0-444B-8957-A3773F02200E}_Winaero Tweaker_Does not start_txt
Apps.ft
0.0.filtertrie.intermediate.txt
0.1.filtertrie.intermediate.txt
0.2.filtertrie.intermediate.txt
Apps.ft
Apps.index
AppCache134368999893729217.txt.~tmp
0cb98379-96c3-4bc6-82f7-43fe0fed3963.tmp
97053f88-f701-4f96-8919-6745b4d971c8.tmp
REG8E4B.tmp
REG8E6A.tmp
__PSScriptPolicyTest_c1lhwzrj.ayg.ps1
ea3731aa-f623-41fc-b28f-ab04bdbdeb60.tmp
_setup64.tmp
OpenGlassSetup.Signed.tmp
reshacker_setup.tmp
_iscrypt.dll
_shfoldr.dll
System.dll
modern-wizard.bmp
nsDialogs.dll
AccessControl.dll
System.dll
modern-wizard.bmp
nsDialogs.dll
System.dll
modern-wizard.bmp
nsDialogs.dll
AccessControl.dll
AppAssocReg.dll
ApplicationID.dll
Banner.dll
CityHash.dll
InstallOptions.dll
ServicesHelper.dll
ShellLink.dll
System.dll
UAC.dll
UserInfo.dll
components.ini
ioSpecial.ini
ioSpecial.ini
ioSpecial.ini
ioSpecial.ini
ioSpecial.ini
liteFirewallW.dll
modern-header.bmp
modern-wizard.bmp
nsExec.dll
nsJSON.dll
options.ini
options.ini
options.ini
shortcuts.ini
summary.ini
summary.ini
messages.json
content.js
messages.json
tmp9695.tmp
MEMZ.exe
766c6474ef2adc83.automaticDestinations-ms
f01b4d95cf55d32a.automaticDestinations-ms
f01b4d95cf55d32a.automaticDestinations-ms
LI95POFFOOZQ6J0VJ8IG.temp
O2U0TUDTZR6W3P0F54LZ.temp
AuthUX-setup-x64.exe
aurora_x64_64bit.exe
ClassicPaint-1.1-setup.exe
OpenGlassSetup.Signed.exe
OpenWithEx-setup-x64.exe
reshacker_setup.exe
RUN_ME.bat
ee373892-5baa-496e-ac0e-11aa58c006f7.tmp
Firefox.lnk
~irefox.tmp
WinaeroTweaker-1.65.0.0-setup.exe
UIRibbon.dll.mui
trustedinstaller.reg
aero_ew_l.cur
aero_nwse.cur
no_rl.cur
no_rm.cur
size2_rl.cur
size3_rm.cur
ExplorerFrame.dll
explorerframe.dll.mui
gameux.dll.mui
dui71.dll
dui71.dll.mui
basebrd.dll
basebrd.dll.mui
license.rtf
license.rtf
DevicePairingFolder.dll.mun.res
WorkfoldersControl.dll.res
dsui.dll.res
newdev.exe.res
shell32.dll.mui1.res
WEI.res
SMSvcHost.exe.config
_SMSvcHostPerfCounters.reg
_SMSvcHostPerfCounters.vrg
_ServiceModelEndpointPerfCounters.reg
_ServiceModelEndpointPerfCounters.vrg
_ServiceModelOperationPerfCounters.reg
_ServiceModelOperationPerfCounters.vrg
_ServiceModelServicePerfCounters.reg
_ServiceModelServicePerfCounters.vrg
_TransactionBridgePerfCounters.reg
_TransactionBridgePerfCounters.vrg
Import Me.reg
ex7forw8.exe
6801.bmp
aero.msstyles
aero.msstyles.mui
wrp64.dll
en-EN.xml
en-GB.xml
jp-JP.xml
noActivity.ico
upActivity.ico
architecture.theme
characters.theme
landscapes.theme
nature.theme
scenes.theme
Desktop.ini
img14.jpg
Desktop.ini
Desktop.ini
Desktop.ini
Desktop.ini
img26.jpg
scenes.jpg
SbTasks.xml
gadgets_PainteR.ico
e5d2d5e.msi
memory/500-3547-0x00007FFAD7A90000-0x00007FFAD7AA0000-memory.dmp
memory/500-3548-0x00007FFAD7A90000-0x00007FFAD7AA0000-memory.dmp
memory/500-3549-0x00007FFAD7A90000-0x00007FFAD7AA0000-memory.dmp
memory/500-3550-0x00007FFAD7A90000-0x00007FFAD7AA0000-memory.dmp
memory/500-3551-0x00007FFAD7A90000-0x00007FFAD7AA0000-memory.dmp
memory/500-3546-0x00007FFAD7A90000-0x00007FFAD7AA0000-memory.dmp
memory/500-3545-0x00007FFAD7A90000-0x00007FFAD7AA0000-memory.dmp
memory/500-3542-0x00007FFAD7A90000-0x00007FFAD7AA0000-memory.dmp
memory/500-3544-0x00007FFAD7A90000-0x00007FFAD7AA0000-memory.dmp
memory/500-3543-0x00007FFAD7A90000-0x00007FFAD7AA0000-memory.dmp
memory/756-10623-0x0000000000D60000-0x0000000000DC1000-memory.dmp
memory/756-11401-0x0000000000D60000-0x0000000000DC1000-memory.dmp
memory/756-9979-0x0000000000D60000-0x0000000000DC1000-memory.dmp
memory/1132-3748-0x0000000000400000-0x0000000000713000-memory.dmp
memory/1132-3806-0x0000000000400000-0x0000000000713000-memory.dmp
memory/1132-3807-0x0000000000400000-0x0000000000713000-memory.dmp
memory/1228-3886-0x0000000000400000-0x000000000053C000-memory.dmp
memory/1228-3870-0x0000000000400000-0x000000000053C000-memory.dmp
memory/1228-3824-0x0000000000400000-0x000000000053C000-memory.dmp
memory/1272-3747-0x0000000000400000-0x00000000004D8000-memory.dmp
memory/1272-3739-0x0000000000400000-0x00000000004D8000-memory.dmp
memory/1272-3808-0x0000000000400000-0x00000000004D8000-memory.dmp
memory/1608-9711-0x000001CFDFE40000-0x000001CFDFE84000-memory.dmp
memory/1608-9712-0x000001CFE1010000-0x000001CFE1086000-memory.dmp
memory/1928-9691-0x000002266AF10000-0x000002266AF32000-memory.dmp
memory/2452-9752-0x0000025EF3BC0000-0x0000025EF3D82000-memory.dmp
memory/2452-9753-0x0000025EF42C0000-0x0000025EF47E8000-memory.dmp
memory/2756-9028-0x0000000000400000-0x0000000000540000-memory.dmp
memory/2756-9029-0x0000000000400000-0x0000000000540000-memory.dmp
memory/2988-3809-0x0000000000400000-0x0000000000439000-memory.dmp
memory/2988-3823-0x0000000000400000-0x0000000000439000-memory.dmp
memory/2988-3887-0x0000000000400000-0x0000000000439000-memory.dmp
memory/3284-3556-0x00000000005E0000-0x00000000006C9000-memory.dmp
memory/3284-3485-0x00000000005E0000-0x00000000006C9000-memory.dmp
memory/3284-3513-0x00000000005E0000-0x00000000006C9000-memory.dmp
memory/3484-3698-0x0000000000400000-0x00000000004E2000-memory.dmp
memory/3484-3625-0x0000000000400000-0x00000000004E2000-memory.dmp
memory/3700-8918-0x0000000000400000-0x0000000000540000-memory.dmp
memory/3700-8953-0x0000000000400000-0x0000000000540000-memory.dmp
memory/3900-3708-0x0000000000B10000-0x000000000113D000-memory.dmp
memory/3908-3555-0x0000000000BC0000-0x000000000100B000-memory.dmp
memory/3908-3553-0x0000000000BC0000-0x000000000100B000-memory.dmp
memory/3908-3520-0x0000000000BC0000-0x000000000100B000-memory.dmp
memory/3924-8917-0x0000000000400000-0x000000000043C000-memory.dmp
memory/3924-8954-0x0000000000400000-0x000000000043C000-memory.dmp
memory/3924-8906-0x0000000000400000-0x000000000043C000-memory.dmp
memory/4268-9031-0x0000000000400000-0x00000000004DD000-memory.dmp
memory/4268-9039-0x0000000000400000-0x00000000004DD000-memory.dmp
memory/4288-8955-0x0000000000400000-0x000000000043B000-memory.dmp
memory/4288-9030-0x0000000000400000-0x000000000043B000-memory.dmp
memory/4288-9027-0x0000000000400000-0x000000000043B000-memory.dmp
memory/4676-3987-0x0000000000400000-0x0000000000437000-memory.dmp
memory/4676-8856-0x0000000000400000-0x0000000000437000-memory.dmp
memory/4676-3976-0x0000000000400000-0x0000000000437000-memory.dmp
memory/4756-11416-0x0000000005950000-0x00000000059E2000-memory.dmp
memory/4756-11415-0x0000000005F00000-0x00000000064A4000-memory.dmp
memory/4756-11417-0x0000000005900000-0x000000000590A000-memory.dmp
memory/4756-11419-0x0000000006540000-0x000000000654A000-memory.dmp
memory/4756-11414-0x0000000000F30000-0x0000000000F5A000-memory.dmp
memory/4756-11418-0x0000000005920000-0x000000000592A000-memory.dmp
memory/5460-9189-0x0000000000400000-0x0000000000718000-memory.dmp
memory/5460-9042-0x0000000000400000-0x0000000000718000-memory.dmp
memory/5460-9040-0x0000000000400000-0x0000000000718000-memory.dmp
memory/5516-3697-0x0000000000400000-0x0000000000698000-memory.dmp
memory/5584-4909-0x0000000000400000-0x000000000053B000-memory.dmp
memory/5584-3988-0x0000000000400000-0x000000000053B000-memory.dmp
memory/5584-8855-0x0000000000400000-0x000000000053B000-memory.dmp
memory/5584-8854-0x0000000000400000-0x000000000053B000-memory.dmp
memory/5792-3961-0x0000000000400000-0x00000000004E6000-memory.dmp
memory/5792-3888-0x0000000000400000-0x00000000004E6000-memory.dmp
memory/5792-3974-0x0000000000400000-0x00000000004E6000-memory.dmp
memory/5952-3973-0x0000000000400000-0x0000000000720000-memory.dmp
memory/5952-3962-0x0000000000400000-0x0000000000720000-memory.dmp
memory/5992-8857-0x0000000000400000-0x00000000004E1000-memory.dmp
memory/5992-8902-0x0000000000400000-0x00000000004E1000-memory.dmp
memory/5992-8905-0x0000000000400000-0x00000000004E1000-memory.dmp
memory/5996-8903-0x0000000000400000-0x000000000071C000-memory.dmp
memory/5996-8904-0x0000000000400000-0x000000000071C000-memory.dmp