Analysis
- user interaction
yes - max time kernel
1048s - max time network
1015s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
24/10/2026, 19:35
General
- Target https://www.mediafire.com/file/2asv7t03pzr7f0q/EAX.zip/file
- Sample261024-ya2arsdx4p
Score
8/10
Malware Config
Signatures
- Drops file in Drivers directory 2 IoCs
- Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 10 IoCs
- Loads dropped DLL 13 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in System32 directory 16 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 6 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 54 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 9 IoCs
- Modifies data under HKEY_USERS 41 IoCs
- Modifies registry class 62 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 29 IoCs
- Suspicious use of AdjustPrivilegeToken 16 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 36 IoCs
- Suspicious use of SetWindowsHookEx 23 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.mediafire.com/file/2asv7t03pzr7f0q/EAX.zip/file1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffc9189c188,0x7ffc9189c194,0x7ffc9189c1a02⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1916,i,8276087236681726710,1759757484097347949,524288 --field-trial-handle=2152,i,3761524570791633347,17172350191915235911,262144 --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:32⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1660,i,2100680022016101685,15139500059123782895,262144 --field-trial-handle=2152,i,3761524570791633347,17172350191915235911,262144 --variations-seed-version --mojo-platform-channel-handle=2148 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2544,i,8559813159399826811,18352331976562471297,524288 --field-trial-handle=2152,i,3761524570791633347,17172350191915235911,262144 --variations-seed-version --mojo-platform-channel-handle=2740 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3400,i,15029158868118294141,6575443022257936534,2097152 --field-trial-handle=2152,i,3761524570791633347,17172350191915235911,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3408,i,17525071580093639959,16904172784254927093,2097152 --field-trial-handle=2152,i,3761524570791633347,17172350191915235911,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4204,i,8988196505953788180,18304792752838148307,2097152 --field-trial-handle=2152,i,3761524570791633347,17172350191915235911,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4244,i,23668168326341554,1077473882550757145,2097152 --field-trial-handle=2152,i,3761524570791633347,17172350191915235911,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5124,i,15217290585923518130,17012329851393537251,2097152 --field-trial-handle=2152,i,3761524570791633347,17172350191915235911,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5260,i,10489137777658483000,15611166340718067564,2097152 --field-trial-handle=2152,i,3761524570791633347,17172350191915235911,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5704,i,12921061461042812177,8947728539535383442,2097152 --field-trial-handle=2152,i,3761524570791633347,17172350191915235911,262144 --variations-seed-version --mojo-platform-channel-handle=5712 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5484,i,4167751331368187121,8318636776634749498,524288 --field-trial-handle=2152,i,3761524570791633347,17172350191915235911,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5716,i,16100235971970235684,11339745346573470326,524288 --field-trial-handle=2152,i,3761524570791633347,17172350191915235911,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6420,i,7474705638547031975,718958476519764572,524288 --field-trial-handle=2152,i,3761524570791633347,17172350191915235911,262144 --variations-seed-version --mojo-platform-channel-handle=6548 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6420,i,7474705638547031975,718958476519764572,524288 --field-trial-handle=2152,i,3761524570791633347,17172350191915235911,262144 --variations-seed-version --mojo-platform-channel-handle=6548 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5092,i,8226610552318230686,6387094912885004094,2097152 --field-trial-handle=2152,i,3761524570791633347,17172350191915235911,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6812,i,12526905861653817225,6279899642980513829,2097152 --field-trial-handle=2152,i,3761524570791633347,17172350191915235911,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=7012,i,14182498335917357516,10380161651006448031,2097152 --field-trial-handle=2152,i,3761524570791633347,17172350191915235911,262144 --variations-seed-version --mojo-platform-channel-handle=7008 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6856,i,16929445005557522709,6309456006586001091,2097152 --field-trial-handle=2152,i,3761524570791633347,17172350191915235911,262144 --variations-seed-version --mojo-platform-channel-handle=7336 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=7348,i,2919052009468273657,4284856714804617305,2097152 --field-trial-handle=2152,i,3761524570791633347,17172350191915235911,262144 --variations-seed-version --mojo-platform-channel-handle=7520 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=7656,i,11413747243041559648,16371435933208177662,2097152 --field-trial-handle=2152,i,3761524570791633347,17172350191915235911,262144 --variations-seed-version --mojo-platform-channel-handle=7668 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=7888,i,9300714320242721487,4957147731049928326,2097152 --field-trial-handle=2152,i,3761524570791633347,17172350191915235911,262144 --variations-seed-version --mojo-platform-channel-handle=5104 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8128,i,8583437881376572071,4778080244111127667,524288 --field-trial-handle=2152,i,3761524570791633347,17172350191915235911,262144 --variations-seed-version --mojo-platform-channel-handle=8136 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=8088,i,252358287001605166,13126602802328066873,2097152 --field-trial-handle=2152,i,3761524570791633347,17172350191915235911,262144 --variations-seed-version --mojo-platform-channel-handle=8168 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=8576,i,7723154200439488813,5172582094526633021,2097152 --field-trial-handle=2152,i,3761524570791633347,17172350191915235911,262144 --variations-seed-version --mojo-platform-channel-handle=8596 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8020,i,7199871208015506021,15290008175548986230,524288 --field-trial-handle=2152,i,3761524570791633347,17172350191915235911,262144 --variations-seed-version --mojo-platform-channel-handle=8448 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7344,i,12801994915276253119,5282804227962104945,2097152 --field-trial-handle=2152,i,3761524570791633347,17172350191915235911,262144 --variations-seed-version --mojo-platform-channel-handle=7340 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7336,i,6096885896777918364,361154416324170604,524288 --field-trial-handle=2152,i,3761524570791633347,17172350191915235911,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=8152,i,15037027583344908718,6056123840923115042,2097152 --field-trial-handle=2152,i,3761524570791633347,17172350191915235911,262144 --variations-seed-version --mojo-platform-channel-handle=8160 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=8292,i,2085205852261242654,12586081957787946474,2097152 --field-trial-handle=2152,i,3761524570791633347,17172350191915235911,262144 --variations-seed-version --mojo-platform-channel-handle=8248 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7908,i,11089033161440596765,10055975153568888866,524288 --field-trial-handle=2152,i,3761524570791633347,17172350191915235911,262144 --variations-seed-version --mojo-platform-channel-handle=8488 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7732,i,2732641022066871458,11786539812465806836,524288 --field-trial-handle=2152,i,3761524570791633347,17172350191915235911,262144 --variations-seed-version --mojo-platform-channel-handle=7816 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7736,i,1708442129741127058,9180692872941573845,524288 --field-trial-handle=2152,i,3761524570791633347,17172350191915235911,262144 --variations-seed-version --mojo-platform-channel-handle=7716 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7720,i,5679432714286262329,11875023761436237247,524288 --field-trial-handle=2152,i,3761524570791633347,17172350191915235911,262144 --variations-seed-version --mojo-platform-channel-handle=8472 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=7788,i,1702757741413583696,11052935537945979621,2097152 --field-trial-handle=2152,i,3761524570791633347,17172350191915235911,262144 --variations-seed-version --mojo-platform-channel-handle=7748 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=8772,i,16682837175471524626,16712602133688345805,2097152 --field-trial-handle=2152,i,3761524570791633347,17172350191915235911,262144 --variations-seed-version --mojo-platform-channel-handle=7180 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8352,i,15095796201919252160,2115597458501960413,524288 --field-trial-handle=2152,i,3761524570791633347,17172350191915235911,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8352,i,15095796201919252160,2115597458501960413,524288 --field-trial-handle=2152,i,3761524570791633347,17172350191915235911,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=8852,i,16801728154982298992,3882504522450650844,2097152 --field-trial-handle=2152,i,3761524570791633347,17172350191915235911,262144 --variations-seed-version --mojo-platform-channel-handle=8424 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8364,i,4658885799617241416,17428169259399525608,524288 --field-trial-handle=2152,i,3761524570791633347,17172350191915235911,262144 --variations-seed-version --mojo-platform-channel-handle=9004 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=7224,i,5782177558023308863,14660242052300804095,2097152 --field-trial-handle=2152,i,3761524570791633347,17172350191915235911,262144 --variations-seed-version --mojo-platform-channel-handle=8792 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=9008,i,5240036537520725356,2742069344645015467,2097152 --field-trial-handle=2152,i,3761524570791633347,17172350191915235911,262144 --variations-seed-version --mojo-platform-channel-handle=8804 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5832,i,18233297551279165542,9570599819191641461,524288 --field-trial-handle=2152,i,3761524570791633347,17172350191915235911,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=780,i,16646123212543779189,12400932497534466675,524288 --field-trial-handle=2152,i,3761524570791633347,17172350191915235911,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6124,i,8178517345047998444,3540023612273319859,262144 --field-trial-handle=2152,i,3761524570791633347,17172350191915235911,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1204,i,15111580922781380375,598822432221600510,524288 --field-trial-handle=2152,i,3761524570791633347,17172350191915235911,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,14947244191789280050,11647188943499170185,524288 --field-trial-handle=2152,i,3761524570791633347,17172350191915235911,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8892,i,9847918839627014138,3623306632399250659,524288 --field-trial-handle=2152,i,3761524570791633347,17172350191915235911,262144 --variations-seed-version --mojo-platform-channel-handle=7208 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=3480,i,5679974196487371198,8738606028939676406,2097152 --field-trial-handle=2152,i,3761524570791633347,17172350191915235911,262144 --variations-seed-version --mojo-platform-channel-handle=3736 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9440,i,13927814351074871174,12235189527122213058,524288 --field-trial-handle=2152,i,3761524570791633347,17172350191915235911,262144 --variations-seed-version --mojo-platform-channel-handle=9432 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9360,i,14966768400342840081,297247111473607511,524288 --field-trial-handle=2152,i,3761524570791633347,17172350191915235911,262144 --variations-seed-version --mojo-platform-channel-handle=8900 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3724,i,7332742796608173268,13874763810977178416,524288 --field-trial-handle=2152,i,3761524570791633347,17172350191915235911,262144 --variations-seed-version --mojo-platform-channel-handle=9448 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=7696,i,15012564701805330142,7239263717463639072,2097152 --field-trial-handle=2152,i,3761524570791633347,17172350191915235911,262144 --variations-seed-version --mojo-platform-channel-handle=7032 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --metrics-shmem-handle=6068,i,8797236843055641266,7957592010927730891,2097152 --field-trial-handle=2152,i,3761524570791633347,17172350191915235911,262144 --variations-seed-version --mojo-platform-channel-handle=8440 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --always-read-main-dll --metrics-shmem-handle=5604,i,14623248415846033775,1946518237053760095,2097152 --field-trial-handle=2152,i,3761524570791633347,17172350191915235911,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\EAX\" -spe -an -ai#7zMap27410:68:7zEvent95481⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Temp1_Voicemeeter8Setup_v3130.zip\Voicemeeter8Setup.exe"C:\Users\Admin\AppData\Local\Temp\Temp1_Voicemeeter8Setup_v3130.zip\Voicemeeter8Setup.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\VB\Voicemeeter\VBVoicemeeterVAIO_Setup_x64.exe-h -i -H -n2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\VB\Voicemeeter\vbregsvr64.exe-fC:\Program Files (x86)\VB\Voicemeeter\vbvm_asiodriver64.dll2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\VB\Voicemeeter\vbregsvr64.exe-fC:\Program Files (x86)\VB\Voicemeeter\vbvmaux_asiodriver64.dll2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\VB\Voicemeeter\vbregsvr64.exe-fC:\Program Files (x86)\VB\Voicemeeter\vbvmins_asiodriver64.dll2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\VB\Voicemeeter\vbregsvr64.exe-fC:\Program Files (x86)\VB\Voicemeeter\vbvmvaio3_asiodriver64.dll2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\VB\Voicemeeter\vbregsvr64.exe-fC:\Program Files (x86)\VB\Voicemeeter\vbvmpins_asiodriver64.dll2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://vb-audio.com/Voicemeeter/ThankYou.htm2⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://vb-audio.com/Voicemeeter/ThankYou.htm3⤵
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{c6952a6b-7267-644d-87ca-91ad387956ff}\vbvoicemeetervaio64_win10.inf" "9" "43914f2f7" "0000000000000138" "WinSta0\Default" "0000000000000150" "208" "c:\program files (x86)\vb\voicemeeter"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "2" "211" "ROOT\MEDIA\0000" "C:\Windows\INF\oem3.inf" "oem3.inf:c14ce8840c48fa1f:VBCableInst.NTamd64:3.4.1.9:vbvoicemeetervaio," "43914f2f7" "000000000000014C"2⤵
- Drops file in Drivers directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵
- Checks processor information in registry
- Modifies registry class
-
C:\Program Files (x86)\VB\Voicemeeter\voicemeeter8x64.exe"C:\Program Files (x86)\VB\Voicemeeter\voicemeeter8x64.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Enumerates system info in registry
-
C:\Users\Admin\Downloads\EAX\publish\EAXset.exe"C:\Users\Admin\Downloads\EAX\publish\EAXset.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\Downloads\EAX\publish\EAXset.exe"C:\Users\Admin\Downloads\EAX\publish\EAXset.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\Downloads\EAX\publish\EAXset.exe"C:\Users\Admin\Downloads\EAX\publish\EAXset.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://creative.com/2⤵
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
VBAN2MIDI.exe
VBVoicemeeterVAIO_ControlPanel.exe
VBVoicemeeterVAIO_Setup_x64.exe
VMStreamerView.exe
VoicemeeterBUSGEQ15.exe
VoicemeeterBUSMatrix8.exe
VoicemeeterMacroButtons.exe
vbregsvr64.exe
vbvm_asiodriver.dll
vbvm_asiodriver64.dll
vbvmaux_asiodriver.dll
vbvmaux_asiodriver64.dll
vbvmins_asiodriver.dll
vbvmpins_asiodriver.dll
vbvmvaio3_asiodriver.dll
vbvoicemeetervaio64_win10.inf
voicemeeter.exe
voicemeeter8.exe
voicemeeter8x64.exe
voicemeeter_x64.exe
voicemeeterpro.exe
voicemeeterpro_x64.exe
PresetPictureBox3Positions_V2.dat
PresetPictureBox3Positions_V2.dat.0d02f227e0b74c0bb5f6879961d87874.tmp
PresetPictureBox3Positions_V2.dat.163a704bfa774b0a96e51fc7727d3b1b.tmp
PresetPictureBox3Positions_V2.dat.2793c76d12b44976be09a0398c3be890.tmp
PresetPictureBox3Positions_V2.dat.5772ff8634234166bb06f106b7c3fbc8.tmp
PresetPictureBox3Positions_V2.dat.7db1187fa11f410d9405d8be2020818d.tmp
PresetPictureBox3Positions_V2.dat.a03f5dea510646cf9d6bb1d104151432.tmp
PresetPictureBox3Positions_V2.dat.b401c827217645c1b429d3e3c9f851d0.tmp
19e8fc3e-b890-4a42-a65d-41e92ea9db21.tmp
1e85d598-5ead-40ad-a860-51395146edd1.tmp
2e2ec319-c1d1-4215-927e-5f12a203d4e1.tmp
41c60b23-0728-4c71-aaa9-252a8b7d720f.tmp
4284af58-9ebb-4ccb-92b5-6d4c57193df7.tmp
81cb85c4-69af-4e2d-8307-354eb3ef804b.tmp
87a9eeaa-726c-483c-8d45-0ad26814a7b4.tmp
settings.dat
settings.dat
settings.dat
0ea8c37f-1a47-4c7c-9cbc-f470b13081e9.tmp
17a3a2c7-38d0-4247-ba19-8430463b2c70.tmp
28ecacbe-3277-4aba-8e68-52ab3188adc4.tmp
64e09a23-f53a-4911-923b-a3a1a25be992.tmp
79f1e634-3137-4851-acfd-a3f4e6d7eba2.tmp
7b34eab2-a975-42a2-8236-4910b5034f0a.tmp
84a71b68-58e7-4dfa-8924-60332373ad71.tmp
914fb0ad-41ba-47b1-a74d-13d18aab9a5f.tmp
LOG
LOG.old
LOG.old
LOG.old
f_00008f
f_000091
f_000093
f_0000a3
f_0000a4
f_0000a5
f_0000a6
f_0000a7
f_0000a9
f_0000ab
f_0000ac
f_0000ad
f_0000cb
f_0000e2
f_0000e3
f_0000e4
f_0000e5
f_0000e6
temp-index
temp-index
the-real-index
94e9c42d-153e-4dfb-b793-c1b88c74512a.tmp
CURRENT
43b08a39-8d26-4962-856a-ac71742776bf.tmp
4fe4a8ea-06ed-4e2b-ad34-cbecaea62972.tmp
8d4d2ba3-b765-4078-a598-952360ab7849.tmp
Sdch Dictionaries
bb5756fd-3da6-47a1-b51f-5fc99eab6cbe.tmp
dd04b7eb-ae47-49a7-8442-5f41363b840a.tmp
temp-index
the-real-index
index.txt.tmp
index.txt.tmp
index.txt.tmp
index.txt.tmp
temp-index
the-real-index
temp-index
aff750fd-deef-40f4-bb7f-ed2dfdc4c8ba.tmp
ef4215a3-64e9-4291-89c6-5f1d30501566.tmp
39825f78-c8e3-4423-ad89-c9a3fd005ecc.tmp
RevisitationBloomfilter
a430d563-a779-4b5c-aa9b-218452375a4b.tmp
b7e301f0-473a-44cc-8f3a-593a64be35d2.tmp
ce0fee06-f2cf-4bb0-8b9d-7d7ae15e730d.tmp
d4593d01-1a30-4085-8a4b-534f23f71172.tmp
d74c7eb7-2893-44e4-8d7b-10dee075f740.tmp
da8b8dd8-2486-45fe-9ada-6aa6e1859b58.tmp
e2511d63-7dfe-4ad3-8115-9747e5e05a10.tmp
2e468ccd-69a1-46cc-9e3b-a0b1673c2a2d.tmp
f9f40a84-c697-463a-8deb-14916a00c369.tmp
5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
pk1hhgi2.0lz
vbvoicemeetervaio64_win10.sys
settings.ini.5be5f70de7224120bcfaf74f11fc60b9.tmp
EAX.zip
D3DCompiler_47_cor3.dll
HandBlue.cur
desktop.ini
vbvoicemeetervaio64_win10.cat
memory/724-2163-0x000002555A9B0000-0x000002555A9C0000-memory.dmp
memory/3176-2171-0x00000258C2020000-0x00000258C2030000-memory.dmp
memory/3892-2109-0x000001C2D3220000-0x000001C2D3230000-memory.dmp