Analysis
- user interaction
yes - max time kernel
314s - max time network
315s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
13/11/2026, 08:11
General
- Target download.html
- Size 86KB
- Sample261113-j3hlssst3l
- SHA256 f9f784a2c88879859ba28fdedbcb47005cbf5e09c6840619ce02b291747afd6a
Score
8/10
Malware Config
Signatures
- Downloads MZ/PE file 1 IoCs
- Checks computer location settings 2 TTPs 9 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 34 IoCs
- Loads dropped DLL 24 IoCs
- Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
- Adds Run key to start application 2 TTPs 2 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Discovers running processes 1 TTPs 1 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
- Drops file in Program Files directory 9 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 18 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 4 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 56 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 12 IoCs
- Modifies registry class 20 IoCs
- Modifies registry key 1 TTPs 4 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 5 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 43 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\download.html1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffe9b96c188,0x7ffe9b96c194,0x7ffe9b96c1a02⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1868,i,9985865403386350468,7895692353286395624,524288 --field-trial-handle=2184,i,3761233844755047592,16752430088668211295,262144 --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:32⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1644,i,2248266803121690501,5886592313780787278,262144 --field-trial-handle=2184,i,3761233844755047592,16752430088668211295,262144 --variations-seed-version --mojo-platform-channel-handle=2180 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2392,i,9114763516683675552,1130086286285676837,524288 --field-trial-handle=2184,i,3761233844755047592,16752430088668211295,262144 --variations-seed-version --mojo-platform-channel-handle=2424 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3476,i,15780329956657728095,12369002842913759009,2097152 --field-trial-handle=2184,i,3761233844755047592,16752430088668211295,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3484,i,7623536395084368984,508850328329243216,2097152 --field-trial-handle=2184,i,3761233844755047592,16752430088668211295,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4240,i,5981239846882567159,7536062157033580094,2097152 --field-trial-handle=2184,i,3761233844755047592,16752430088668211295,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4284,i,826947883273072108,6439312688465576506,2097152 --field-trial-handle=2184,i,3761233844755047592,16752430088668211295,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5164,i,2060840460461904315,9300063893285922629,524288 --field-trial-handle=2184,i,3761233844755047592,16752430088668211295,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5168,i,11720328343210438885,18346161398309066680,524288 --field-trial-handle=2184,i,3761233844755047592,16752430088668211295,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,16866936675844895457,12538701012219106813,524288 --field-trial-handle=2184,i,3761233844755047592,16752430088668211295,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,16866936675844895457,12538701012219106813,524288 --field-trial-handle=2184,i,3761233844755047592,16752430088668211295,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4272,i,15453746595562631033,18079782977127206451,524288 --field-trial-handle=2184,i,3761233844755047592,16752430088668211295,262144 --variations-seed-version --mojo-platform-channel-handle=4424 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4396,i,5804231237304965021,16537657553500827453,524288 --field-trial-handle=2184,i,3761233844755047592,16752430088668211295,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4508,i,7613265845409018261,15814558162968679375,524288 --field-trial-handle=2184,i,3761233844755047592,16752430088668211295,262144 --variations-seed-version --mojo-platform-channel-handle=4516 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffe98b3c728,0x7ffe98b3c734,0x7ffe98b3c7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2088,i,15317577031946979961,877765267594667054,524288 --field-trial-handle=1976,i,11823428433910116750,13123065635708038690,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2084 /prefetch:32⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1720,i,15373414293897474663,4090401933486698808,262144 --field-trial-handle=1976,i,11823428433910116750,13123065635708038690,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1972 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2428,i,9961341100102350676,14769793621935406159,524288 --field-trial-handle=1976,i,11823428433910116750,13123065635708038690,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2452 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3248,i,6529419163523690605,2994549467752377664,2097152 --field-trial-handle=1976,i,11823428433910116750,13123065635708038690,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3260 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3276,i,11018064127944213878,4483905714415855380,2097152 --field-trial-handle=1976,i,11823428433910116750,13123065635708038690,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3296 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4452,i,12178713473434981128,12930420477551708725,2097152 --field-trial-handle=1976,i,11823428433910116750,13123065635708038690,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4464 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4656,i,8458997559767913616,1870146614584778868,2097152 --field-trial-handle=1976,i,11823428433910116750,13123065635708038690,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4600 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5520,i,2700352937885912499,393094455661588660,524288 --field-trial-handle=1976,i,11823428433910116750,13123065635708038690,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5516 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5824,i,8922465522902522441,11115150120706236542,2097152 --field-trial-handle=1976,i,11823428433910116750,13123065635708038690,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5796 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5988,i,18087649841532582335,13608531356186479985,2097152 --field-trial-handle=1976,i,11823428433910116750,13123065635708038690,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6128 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3420,i,7960670845661651170,14604834816192228123,524288 --field-trial-handle=1976,i,11823428433910116750,13123065635708038690,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3404 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3256,i,1809378988460946727,16166213673688512308,524288 --field-trial-handle=1976,i,11823428433910116750,13123065635708038690,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3384 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3444,i,4305709112776278969,7694421961048628914,524288 --field-trial-handle=1976,i,11823428433910116750,13123065635708038690,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4640 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3296,i,13718383035764935876,12401470233368735255,524288 --field-trial-handle=1976,i,11823428433910116750,13123065635708038690,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4844 /prefetch:82⤵
-
-
C:\Users\Admin\Downloads\Melty-Setup-1.0.220.exe"C:\Users\Admin\Downloads\Melty-Setup-1.0.220.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /s /c ""C:\Windows\system32\tasklist.exe" /FI "USERNAME eq Admin" /FI "IMAGENAME eq Melty.exe" /FO csv | "C:\Windows\system32\find.exe" /I "Melty.exe""3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\tasklist.exe"C:\Windows\system32\tasklist.exe" /FI "USERNAME eq Admin" /FI "IMAGENAME eq Melty.exe" /FO csv4⤵
- Discovers running processes
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\find.exe"C:\Windows\system32\find.exe" /I "Melty.exe"4⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5676,i,15921063244272107428,1344513718756900130,262144 --field-trial-handle=1976,i,11823428433910116750,13123065635708038690,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3272 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=3268,i,17267690225759405556,7618424540357941318,524288 --field-trial-handle=1976,i,11823428433910116750,13123065635708038690,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5672 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Users\Admin\AppData\Local\Programs\melty\Melty.exe"C:\Users\Admin\AppData\Local\Programs\melty\Melty.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Programs\melty\Melty.exeC:\Users\Admin\AppData\Local\Programs\melty\Melty.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\Melty /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\Melty\Crashpad --url=https://f.a.k/e --annotation=_productName=Melty --annotation=_version=1.0.220 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=39.8.10 --initial-client-data=0x608,0x60c,0x610,0x594,0x614,0x7ff7e77c072c,0x7ff7e77c0738,0x7ff7e77c07482⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Programs\melty\resources\app.asar.unpacked\dist\windows-inspector.exeC:\Users\Admin\AppData\Local\Programs\melty\resources\app.asar.unpacked\dist\windows-inspector.exe --generation 12⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Programs\melty\Melty.exe"C:\Users\Admin\AppData\Local\Programs\melty\Melty.exe" --type=gpu-process --disable-gpu-rasterization --user-data-dir="C:\Users\Admin\AppData\Roaming\Melty" --gpu-preferences=SAAAAAAAAADhABAEAAAAAAAAAAAAAGAAAAAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=2012,i,8096127326970290083,16316236500000194468,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2000 /prefetch:22⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe export HKCU\Software\Valve\Steam C:\Users\Admin\AppData\Local\Temp\melty-registry-7R9wDj\key.reg /y /reg:642⤵
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe export HKLM\Software\Valve\Steam C:\Users\Admin\AppData\Local\Temp\melty-registry-VRWKFY\key.reg /y /reg:642⤵
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe export HKLM\Software\Valve\Steam C:\Users\Admin\AppData\Local\Temp\melty-registry-GgN8wW\key.reg /y /reg:322⤵
-
-
C:\Users\Admin\AppData\Local\Programs\melty\Melty.exe"C:\Users\Admin\AppData\Local\Programs\melty\Melty.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Melty" --secure-schemes=sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --field-trial-handle=2012,i,8096127326970290083,16316236500000194468,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2316 /prefetch:32⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
-
-
C:\Windows\system32\reg.exereg.exe DELETE HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Serialize /v StartupDelayInMSec /f2⤵
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg.exe ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v gg.melty.desktop /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Programs\melty\Melty.exe\" --melty-startup" /f2⤵
- Adds Run key to start application
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders"2⤵
-
-
C:\Users\Admin\AppData\Local\Programs\melty\Melty.exe"C:\Users\Admin\AppData\Local\Programs\melty\Melty.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Melty" --secure-schemes=sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --app-user-model-id=gg.melty.desktop --app-path="C:\Users\Admin\AppData\Local\Programs\melty\resources\app.asar" --no-sandbox --no-zygote --disable-accelerated-video-decode --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --time-ticks-at-unix-epoch=-1794556947431547 --launch-time-ticks=627909719 --field-trial-handle=2012,i,8096127326970290083,16316236500000194468,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=3556 /prefetch:12⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
-
-
C:\Users\Admin\AppData\Local\Programs\melty\resources\app.asar.unpacked\dist\windows-inspector.exeC:\Users\Admin\AppData\Local\Programs\melty\resources\app.asar.unpacked\dist\windows-inspector.exe --process-names2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\system32\reg.exereg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders"2⤵
-
-
C:\Users\Admin\AppData\Local\Programs\melty\resources\app.asar.unpacked\dist\windows-inspector.exeC:\Users\Admin\AppData\Local\Programs\melty\resources\app.asar.unpacked\dist\windows-inspector.exe --process-names2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Programs\melty\resources\app.asar.unpacked\dist\windows-inspector.exeC:\Users\Admin\AppData\Local\Programs\melty\resources\app.asar.unpacked\dist\windows-inspector.exe --process-names2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Programs\melty\resources\app.asar.unpacked\dist\windows-inspector.exeC:\Users\Admin\AppData\Local\Programs\melty\resources\app.asar.unpacked\dist\windows-inspector.exe --process-names2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://melty.gg/auth/login?desktop=1&mode=signup&next=%2Fdiscover2⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://melty.gg/auth/login?desktop=1&mode=signup&next=%2Fdiscover3⤵
- Drops file in Program Files directory
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x2f4,0x7ffe9b96c188,0x7ffe9b96c194,0x7ffe9b96c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1884,i,4120849377946786980,10530019299774877092,524288 --field-trial-handle=2328,i,10030581591357548589,4964009044217139867,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:34⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1688,i,10932650666473863250,6244886923567456322,262144 --field-trial-handle=2328,i,10030581591357548589,4964009044217139867,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2572,i,2956764792491994385,15763095047282222805,524288 --field-trial-handle=2328,i,10030581591357548589,4964009044217139867,262144 --variations-seed-version --mojo-platform-channel-handle=2588 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3420,i,10819214911748747376,9059671036697869164,2097152 --field-trial-handle=2328,i,10030581591357548589,4964009044217139867,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3428,i,1360279253826628496,15204507906738757372,2097152 --field-trial-handle=2328,i,10030581591357548589,4964009044217139867,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4712,i,903088815466418507,10593294301799409754,524288 --field-trial-handle=2328,i,10030581591357548589,4964009044217139867,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5024,i,9774814868747652465,4131254960896641385,524288 --field-trial-handle=2328,i,10030581591357548589,4964009044217139867,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5068,i,5198059401525381357,12797304955936386347,2097152 --field-trial-handle=2328,i,10030581591357548589,4964009044217139867,262144 --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=4956,i,11325438110912693273,14541026466475124202,2097152 --field-trial-handle=2328,i,10030581591357548589,4964009044217139867,262144 --variations-seed-version --mojo-platform-channel-handle=4764 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5444,i,5837886762844950333,8403870525872991018,524288 --field-trial-handle=2328,i,10030581591357548589,4964009044217139867,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5452,i,7344859209674084743,9215551827733448526,524288 --field-trial-handle=2328,i,10030581591357548589,4964009044217139867,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6092,i,15666544709666801618,31558393629847513,524288 --field-trial-handle=2328,i,10030581591357548589,4964009044217139867,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6092,i,15666544709666801618,31558393629847513,524288 --field-trial-handle=2328,i,10030581591357548589,4964009044217139867,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6372,i,2973073412284534388,15488562478611707247,524288 --field-trial-handle=2328,i,10030581591357548589,4964009044217139867,262144 --variations-seed-version --mojo-platform-channel-handle=6388 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6388,i,6368070414179098030,1466878631498106859,524288 --field-trial-handle=2328,i,10030581591357548589,4964009044217139867,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6424,i,16546884780392936164,1954059315248821678,524288 --field-trial-handle=2328,i,10030581591357548589,4964009044217139867,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6460,i,4342714192974945118,6351569781721443192,524288 --field-trial-handle=2328,i,10030581591357548589,4964009044217139867,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6760,i,10719669182310903059,14243945690403384197,524288 --field-trial-handle=2328,i,10030581591357548589,4964009044217139867,262144 --variations-seed-version --mojo-platform-channel-handle=6776 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6772,i,6390862826709525181,15898169197832148653,2097152 --field-trial-handle=2328,i,10030581591357548589,4964009044217139867,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7056,i,10092370516474192777,15918026699541905715,2097152 --field-trial-handle=2328,i,10030581591357548589,4964009044217139867,262144 --variations-seed-version --mojo-platform-channel-handle=7116 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6396,i,7092633150632517259,12424493616416092913,2097152 --field-trial-handle=2328,i,10030581591357548589,4964009044217139867,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7116,i,13801193889597479210,8727823711225724384,2097152 --field-trial-handle=2328,i,10030581591357548589,4964009044217139867,262144 --variations-seed-version --mojo-platform-channel-handle=7156 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=6116,i,4214523382983891685,14591955132712808357,2097152 --field-trial-handle=2328,i,10030581591357548589,4964009044217139867,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=7464,i,17740000158149812382,8877347654083363436,2097152 --field-trial-handle=2328,i,10030581591357548589,4964009044217139867,262144 --variations-seed-version --mojo-platform-channel-handle=7432 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=7572,i,16547262433251859540,12528485172038415909,2097152 --field-trial-handle=2328,i,10030581591357548589,4964009044217139867,262144 --variations-seed-version --mojo-platform-channel-handle=7436 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=7780,i,13221412002524998091,524938948402624819,2097152 --field-trial-handle=2328,i,10030581591357548589,4964009044217139867,262144 --variations-seed-version --mojo-platform-channel-handle=7756 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=8020,i,17811466735191623516,7442912252264204155,2097152 --field-trial-handle=2328,i,10030581591357548589,4964009044217139867,262144 --variations-seed-version --mojo-platform-channel-handle=8004 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=7312,i,6081255249156270313,4228222668557968220,2097152 --field-trial-handle=2328,i,10030581591357548589,4964009044217139867,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=7352,i,740629266747539735,15114265800923576021,2097152 --field-trial-handle=2328,i,10030581591357548589,4964009044217139867,262144 --variations-seed-version --mojo-platform-channel-handle=7408 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=8252,i,11369118803291812455,10191156559842543928,2097152 --field-trial-handle=2328,i,10030581591357548589,4964009044217139867,262144 --variations-seed-version --mojo-platform-channel-handle=8268 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=8400,i,4070527701423935603,7931389282034684977,2097152 --field-trial-handle=2328,i,10030581591357548589,4964009044217139867,262144 --variations-seed-version --mojo-platform-channel-handle=8412 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=8568,i,2399960584396695002,5848136800397630238,2097152 --field-trial-handle=2328,i,10030581591357548589,4964009044217139867,262144 --variations-seed-version --mojo-platform-channel-handle=8572 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=8704,i,7865116736946587656,6959615779546742977,2097152 --field-trial-handle=2328,i,10030581591357548589,4964009044217139867,262144 --variations-seed-version --mojo-platform-channel-handle=8716 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=8868,i,13459658153904927957,1718960912794010792,2097152 --field-trial-handle=2328,i,10030581591357548589,4964009044217139867,262144 --variations-seed-version --mojo-platform-channel-handle=8768 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=9020,i,12838844146751066147,11816531309650036359,2097152 --field-trial-handle=2328,i,10030581591357548589,4964009044217139867,262144 --variations-seed-version --mojo-platform-channel-handle=9024 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=9148,i,1312520410879443939,15731669537953336691,2097152 --field-trial-handle=2328,i,10030581591357548589,4964009044217139867,262144 --variations-seed-version --mojo-platform-channel-handle=9164 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=9316,i,12782743340466105533,12069880670586160384,2097152 --field-trial-handle=2328,i,10030581591357548589,4964009044217139867,262144 --variations-seed-version --mojo-platform-channel-handle=9320 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=9448,i,5543358901983570923,7358979883094986662,2097152 --field-trial-handle=2328,i,10030581591357548589,4964009044217139867,262144 --variations-seed-version --mojo-platform-channel-handle=9464 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=9596,i,15892464788591108969,2555505797232151917,2097152 --field-trial-handle=2328,i,10030581591357548589,4964009044217139867,262144 --variations-seed-version --mojo-platform-channel-handle=9612 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=9752,i,14219308353222885562,5212906828403161913,2097152 --field-trial-handle=2328,i,10030581591357548589,4964009044217139867,262144 --variations-seed-version --mojo-platform-channel-handle=9756 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=10060,i,70540986441507702,3701373167360541108,2097152 --field-trial-handle=2328,i,10030581591357548589,4964009044217139867,262144 --variations-seed-version --mojo-platform-channel-handle=7604 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=7760,i,4760832338586973069,9361437309244613641,2097152 --field-trial-handle=2328,i,10030581591357548589,4964009044217139867,262144 --variations-seed-version --mojo-platform-channel-handle=10140 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=9164,i,18143460804544432253,1856014519953641482,2097152 --field-trial-handle=2328,i,10030581591357548589,4964009044217139867,262144 --variations-seed-version --mojo-platform-channel-handle=7792 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=9208,i,4849771261955817838,6761966782830016057,2097152 --field-trial-handle=2328,i,10030581591357548589,4964009044217139867,262144 --variations-seed-version --mojo-platform-channel-handle=7824 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9676,i,3783179378963925616,17308057125706915944,524288 --field-trial-handle=2328,i,10030581591357548589,4964009044217139867,262144 --variations-seed-version --mojo-platform-channel-handle=9464 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=10428,i,5632540270394595432,4756750138164799612,524288 --field-trial-handle=2328,i,10030581591357548589,4964009044217139867,262144 --variations-seed-version --mojo-platform-channel-handle=10432 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9496,i,1551271189547951033,13812119050388601735,524288 --field-trial-handle=2328,i,10030581591357548589,4964009044217139867,262144 --variations-seed-version --mojo-platform-channel-handle=10344 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=9580,i,342225839389105178,8956076039041358784,2097152 --field-trial-handle=2328,i,10030581591357548589,4964009044217139867,262144 --variations-seed-version --mojo-platform-channel-handle=10400 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=10628,i,3318142485162767097,3478143650034272514,2097152 --field-trial-handle=2328,i,10030581591357548589,4964009044217139867,262144 --variations-seed-version --mojo-platform-channel-handle=10640 /prefetch:14⤵
-
-
C:\Users\Admin\AppData\Local\Programs\melty\Melty.exe"C:\Users\Admin\AppData\Local\Programs\melty\Melty.exe" "melty://auth/success?access_token=eyJhbGciOiJFUzI1NiIsImtpZCI6ImI4M2U2MTMzLTcwNTUtNGEyZC04ZDc2LTYyZTM4ZGI4YWNiYyIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJodHRwczovL2VrdnpjdHdlaG13aWRzZW5nYXljLnN1cGFiYXNlLmNvL2F1dGgvdjEiLCJzdWIiOiI1OWI3M2FhYy1lNjE1LTQ4YWMtODdlZi0wNDhmZTkwYzBkYmIiLCJhdWQiOiJhdXRoZW50aWNhdGVkIiwiZXhwIjoxNzk0NTYxMjg1LCJpYXQiOjE3OTQ1NTc2ODUsImVtYWlsIjoiZGl0b3czNjkyOUBjaHV3ZWwuY29tIiwicGhvbmUiOiIiLCJhcHBfbWV0YWRhdGEiOnsicHJvdmlkZXIiOiJlbWFpbCIsInByb3ZpZGVycyI6WyJlbWFpbCJdfSwidXNlcl9tZXRhZGF0YSI6eyJlbWFpbCI6ImRpdG93MzY5MjlAY2h1d2VsLmNvbSIsImVtYWlsX3ZlcmlmaWVkIjp0cnVlLCJwaG9uZV92ZXJpZmllZCI6ZmFsc2UsInN1YiI6IjU5YjczYWFjLWU2MTUtNDhhYy04N2VmLTA0OGZlOTBjMGRiYiJ9LCJyb2xlIjoiYXV0aGVudGljYXRlZCIsImFhbCI6ImFhbDEiLCJhbXIiOlt7Im1ldGhvZCI6Im90cCIsInRpbWVzdGFtcCI6MTc5NDU1NzY4NX1dLCJzZXNzaW9uX2lkIjoiNWNlMjkyMGUtMWI1My00N2JhLThjMmYtZGEyMGFjZDQwMTlkIiwiaXNfYW5vbnltb3VzIjpmYWxzZX0.4fuP6DMyyhowu-AjBLTy_9sOtk-c9ZHPKPm6zJrF5QeUarbHdTIvwHEZqt3ImLWcrdLLs_VxGFgd_H1wHwivug&refresh_token=ymr2krl6gsj6&expires_at=1794561285&token_type=bearer"4⤵
- Checks computer location settings
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=10804,i,16184859890704419276,4669892638617725737,524288 --field-trial-handle=2328,i,10030581591357548589,4964009044217139867,262144 --variations-seed-version --mojo-platform-channel-handle=10796 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9512,i,8483054589005502961,13852970981748415586,524288 --field-trial-handle=2328,i,10030581591357548589,4964009044217139867,262144 --variations-seed-version --mojo-platform-channel-handle=10372 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window4⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x218,0x7ffe9b96c188,0x7ffe9b96c194,0x7ffe9b96c1a05⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1616,i,16699493166033416724,14652646407819883388,262144 --field-trial-handle=2236,i,7690036333582644806,3418678066119519408,262144 --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:25⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1936,i,17313539639736103456,9394352788244542223,524288 --field-trial-handle=2236,i,7690036333582644806,3418678066119519408,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:35⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2560,i,15884096712764623421,7223934257975292754,524288 --field-trial-handle=2236,i,7690036333582644806,3418678066119519408,262144 --variations-seed-version --mojo-platform-channel-handle=2548 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4540,i,12815758276332140394,4883730060295178299,524288 --field-trial-handle=2236,i,7690036333582644806,3418678066119519408,262144 --variations-seed-version --mojo-platform-channel-handle=4560 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4540,i,12815758276332140394,4883730060295178299,524288 --field-trial-handle=2236,i,7690036333582644806,3418678066119519408,262144 --variations-seed-version --mojo-platform-channel-handle=4560 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4560,i,3730326351772280398,13941354937959938099,524288 --field-trial-handle=2236,i,7690036333582644806,3418678066119519408,262144 --variations-seed-version --mojo-platform-channel-handle=4812 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4808,i,8781616179768553126,1819703678845460443,524288 --field-trial-handle=2236,i,7690036333582644806,3418678066119519408,262144 --variations-seed-version --mojo-platform-channel-handle=4180 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2552,i,15441264458467757678,16759161767000871290,524288 --field-trial-handle=2236,i,7690036333582644806,3418678066119519408,262144 --variations-seed-version --mojo-platform-channel-handle=4876 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4532,i,6621293364326954189,11878267681481006345,524288 --field-trial-handle=2236,i,7690036333582644806,3418678066119519408,262144 --variations-seed-version --mojo-platform-channel-handle=4172 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5000,i,13097005124244981090,2257986724612258821,524288 --field-trial-handle=2236,i,7690036333582644806,3418678066119519408,262144 --variations-seed-version --mojo-platform-channel-handle=4872 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=756,i,8851272435039086811,10555506273348742518,524288 --field-trial-handle=2236,i,7690036333582644806,3418678066119519408,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:85⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Programs\melty\resources\app.asar.unpacked\dist\windows-inspector.exeC:\Users\Admin\AppData\Local\Programs\melty\resources\app.asar.unpacked\dist\windows-inspector.exe --process-names2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://melty.gg/auth/login?desktop=1&mode=signup&next=%2Fdiscover2⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://melty.gg/auth/login?desktop=1&mode=signup&next=%2Fdiscover3⤵
-
-
-
C:\Users\Admin\AppData\Local\Programs\melty\resources\app.asar.unpacked\dist\windows-inspector.exeC:\Users\Admin\AppData\Local\Programs\melty\resources\app.asar.unpacked\dist\windows-inspector.exe --process-names2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Programs\melty\resources\app.asar.unpacked\dist\windows-inspector.exeC:\Users\Admin\AppData\Local\Programs\melty\resources\app.asar.unpacked\dist\windows-inspector.exe --process-names2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Programs\melty\resources\app.asar.unpacked\dist\windows-inspector.exeC:\Users\Admin\AppData\Local\Programs\melty\resources\app.asar.unpacked\dist\windows-inspector.exe --process-names2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Programs\melty\resources\app.asar.unpacked\dist\windows-inspector.exeC:\Users\Admin\AppData\Local\Programs\melty\resources\app.asar.unpacked\dist\windows-inspector.exe --process-names2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Programs\melty\resources\app.asar.unpacked\dist\windows-inspector.exeC:\Users\Admin\AppData\Local\Programs\melty\resources\app.asar.unpacked\dist\windows-inspector.exe --process-names2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Programs\melty\Melty.exe"C:\Users\Admin\AppData\Local\Programs\melty\Melty.exe" --melty-startup1⤵
- Checks computer location settings
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Users\Admin\AppData\Local\Programs\melty\Melty.exe"C:\Users\Admin\AppData\Local\Programs\melty\Melty.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Programs\melty\Melty.exeC:\Users\Admin\AppData\Local\Programs\melty\Melty.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\Melty /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\Melty\Crashpad --url=https://f.a.k/e --annotation=_productName=Melty --annotation=_version=1.0.220 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=39.8.10 --initial-client-data=0x5f4,0x5f8,0x5fc,0x580,0x600,0x7ff7e77c072c,0x7ff7e77c0738,0x7ff7e77c07482⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Programs\melty\resources\app.asar.unpacked\dist\windows-inspector.exeC:\Users\Admin\AppData\Local\Programs\melty\resources\app.asar.unpacked\dist\windows-inspector.exe --generation 12⤵
- Checks computer location settings
- Executes dropped EXE
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe export HKCU\Software\Valve\Steam C:\Users\Admin\AppData\Local\Temp\melty-registry-MQI7lv\key.reg /y /reg:642⤵
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe export HKLM\Software\Valve\Steam C:\Users\Admin\AppData\Local\Temp\melty-registry-f54xvX\key.reg /y /reg:642⤵
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe export HKLM\Software\Valve\Steam C:\Users\Admin\AppData\Local\Temp\melty-registry-xHbItO\key.reg /y /reg:322⤵
-
-
C:\Users\Admin\AppData\Local\Programs\melty\Melty.exe"C:\Users\Admin\AppData\Local\Programs\melty\Melty.exe" --type=gpu-process --disable-gpu-rasterization --user-data-dir="C:\Users\Admin\AppData\Roaming\Melty" --gpu-preferences=SAAAAAAAAADhABAEAAAAAAAAAAAAAGAAAAAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=2128,i,13759534686305847162,6309110381775968431,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2124 /prefetch:22⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Programs\melty\Melty.exe"C:\Users\Admin\AppData\Local\Programs\melty\Melty.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Melty" --secure-schemes=sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --field-trial-handle=2128,i,13759534686305847162,6309110381775968431,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2392 /prefetch:32⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
-
-
C:\Windows\system32\reg.exereg.exe ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v gg.melty.desktop /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Programs\melty\Melty.exe\" --melty-startup" /f2⤵
- Adds Run key to start application
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders"2⤵
-
-
C:\Users\Admin\AppData\Local\Programs\melty\Melty.exe"C:\Users\Admin\AppData\Local\Programs\melty\Melty.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Melty" --secure-schemes=sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --app-user-model-id=gg.melty.desktop --app-path="C:\Users\Admin\AppData\Local\Programs\melty\resources\app.asar" --no-sandbox --no-zygote --disable-accelerated-video-decode --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --time-ticks-at-unix-epoch=-1794556947431546 --launch-time-ticks=804756665 --field-trial-handle=2128,i,13759534686305847162,6309110381775968431,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=3368 /prefetch:12⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
-
-
C:\Windows\system32\reg.exereg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders"2⤵
-
-
C:\Users\Admin\AppData\Local\Programs\melty\resources\app.asar.unpacked\dist\windows-inspector.exeC:\Users\Admin\AppData\Local\Programs\melty\resources\app.asar.unpacked\dist\windows-inspector.exe --process-names2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Programs\melty\resources\app.asar.unpacked\dist\windows-inspector.exeC:\Users\Admin\AppData\Local\Programs\melty\resources\app.asar.unpacked\dist\windows-inspector.exe --process-names2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Programs\melty\resources\app.asar.unpacked\dist\windows-inspector.exeC:\Users\Admin\AppData\Local\Programs\melty\resources\app.asar.unpacked\dist\windows-inspector.exe --process-names2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Programs\melty\resources\app.asar.unpacked\dist\windows-inspector.exeC:\Users\Admin\AppData\Local\Programs\melty\resources\app.asar.unpacked\dist\windows-inspector.exe --process-names2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Programs\melty\resources\app.asar.unpacked\dist\windows-inspector.exeC:\Users\Admin\AppData\Local\Programs\melty\resources\app.asar.unpacked\dist\windows-inspector.exe --process-names2⤵
- Executes dropped EXE
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v Path2⤵
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe query HKCU\Environment /v Path2⤵
- Modifies registry key
-
-
C:\Users\Admin\AppData\Local\Programs\melty\resources\app.asar.unpacked\dist\windows-inspector.exeC:\Users\Admin\AppData\Local\Programs\melty\resources\app.asar.unpacked\dist\windows-inspector.exe --process-names2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Programs\melty\resources\app.asar.unpacked\dist\windows-inspector.exeC:\Users\Admin\AppData\Local\Programs\melty\resources\app.asar.unpacked\dist\windows-inspector.exe --process-names2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Programs\melty\Melty.exe"C:\Users\Admin\AppData\Local\Programs\melty\Melty.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Melty" --secure-schemes=sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --app-user-model-id=gg.melty.desktop --app-path="C:\Users\Admin\AppData\Local\Programs\melty\resources\app.asar" --no-sandbox --no-zygote --disable-accelerated-video-decode --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1794556947431546 --launch-time-ticks=848528294 --field-trial-handle=2128,i,13759534686305847162,6309110381775968431,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3772 /prefetch:12⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
-
-
C:\Users\Admin\AppData\Local\Programs\melty\resources\app.asar.unpacked\dist\windows-inspector.exeC:\Users\Admin\AppData\Local\Programs\melty\resources\app.asar.unpacked\dist\windows-inspector.exe --process-names2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Discovery
Browser Information Discovery
1Peripheral Device Discovery
1Process Discovery
1Query Registry
5System Information Discovery
5System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1System Time Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
nav_config.json
manifest.json
protocols.json
llm_user_input_extractor_config.json
office_endpoints_list.json
smart_switch_list.json
1ba56918-bff0-438a-8a5f-19d2067f40e6.tmp
256f60d3-96a1-448c-abcf-516152a1fa90.tmp
39d32485-60c5-4bc7-965f-b81d7fe9783a.tmp
78baecd4-2953-480e-822b-c1f4f539d2b5.tmp
92c9443f-092c-4e07-81cf-3d7ce3e4d36c.tmp
settings.dat
09bc4b40-3788-47e0-b98e-11be38bcf1b3.tmp
1dbf08c0-69f9-491f-b854-0e44521da600.tmp
3e57b951-b838-4384-bac6-0d40a5b141e3.tmp
70ee2ae2-89aa-420c-ab5b-7c581cb88bc2.tmp
f_000016
temp-index
0780b939-f4de-4709-a062-9d3967a526a7.tmp
3f1d82ec-6d30-484a-a163-6e26e6c17e6c.tmp
61891763-c263-4b3f-92c9-6ab110b669f6.tmp
de3ed86c-1950-465a-8cdf-617a7d8d667e.tmp
temp-index
the-real-index
a0f0973a-fef7-45f5-ad86-db499a83b9e9.tmp
db090b84-c0b5-4335-b841-ecccb09832ed.tmp
dd080afc-2a99-4279-9bcd-374752ed7c76.tmp
ad83f467-db19-48b6-9627-834aa60a3207.tmp
e2ebd632-d154-460c-8944-876f052fa614.tmp
f7a13b77-b25a-4f98-ab47-539d6a5deab6.tmp
003e7dc5-baa3-42ae-a16e-34d6e5624112.tmp
098a8b7c-cf8d-4318-81d3-5e6573375387.tmp
0a3a2f92-5a01-42f4-9b33-77a6aa42894a.tmp
0c289e70-b80f-47d2-b722-8a95e04f1a8a.tmp
0d6b91f6-b0f8-4103-9fbf-514cbb3bde8a.tmp
2835d8db-7959-4e00-a3bb-f1754f4c23f0.tmp
3720ec0d-3696-47c2-bb0c-038a73f37675.tmp
3f10d860-6fc3-45cf-9570-63ee5de8c723.tmp
41a923fa-df7a-47e4-8e86-4724afccf2dd.tmp
4758442b-8b28-458f-a0ad-2d914c47d107.tmp
72a53ed2-bd1b-4075-ad34-c219bbc00fbc.tmp
7f4ca91e-073b-4cfd-b89b-a2c16fb35140.tmp
8145e680-7f9c-441a-969d-4661a0a2340a.tmp
settings.dat
settings.dat
settings.dat
settings.dat
settings.dat
0be3b0a7-1fda-4eee-ac1f-910eefc769d9.tmp
0f251be0-a1eb-4abd-95e9-dd9ea7571d38.tmp
1ace0cfc-4782-450b-8bd2-c24dfac71a98.tmp
1c26d12b-d52e-48b0-926b-e899828f1867.tmp
1f622b3c-a146-4717-9cbd-837ee1259c32.tmp
3854877e-89c2-4488-9503-b1092eb27d4b.tmp
99135d1a-6957-4408-bcad-ee19b0daadb7.tmp
f_00006c
f_000071
f_000073
f_000074
f_000075
f_000076
f_000078
f_00007a
f_00007b
f_00007c
f_00007d
f_00009d
f_0000ac
f_0000ad
f_0000ae
f_0000af
temp-index
temp-index
the-real-index
data_1
0fa1154a-4600-4d9b-a351-cb4303ed9032.tmp
dasherSettingSchema.json
1f3e8829-0966-4998-89b5-2c59fd41dae7.tmp
3365c9b5-72f6-4f9c-8dde-5fe0aac382a9.tmp
3eba72d3-fd1c-4fe9-820e-fd5c1a5da4b0.tmp
5bb36560-fde5-40b2-bb50-a903c58ec7ca.tmp
a585facb-10c5-4914-b746-0ab6db7ab459.tmp
bf0c6c72-e8f1-47cc-80da-0b36fd681234.tmp
eaf53308-7783-41a4-90eb-2516b7f96b11.tmp
temp-index
the-real-index
temp-index
the-real-index
index.txt.tmp
index.txt.tmp
temp-index
the-real-index
sync_diagnostic.log
a3a71f68-f730-445f-bf76-0396adabd461.tmp
ae7df65d-c82c-4751-8896-f2a82ff395f5.tmp
b03841bd-f4c2-4fda-b683-c9c30e1cc531.tmp
b7142aba-5571-49cb-a04c-e15a8e6382ed.tmp
cf0e20c5-38ff-497f-89ff-71dd74d5cd9d.tmp
d4e19e2a-ed2e-4261-8a91-6db6d196f06e.tmp
f05d4d6d-385c-4207-af8e-d59225ca6b4b.tmp
f7294be0-f6a1-4f3d-a335-f1c79d5a3148.tmp
7ca5ffba-7bd6-4940-8564-b04a416b21a1.tmp
OperationConfig
manifest.json
manifest.json
RevisitationBloomfilter
manifest.json
ce0de3c6-926a-49c8-a889-86c4720663dc.tmp
1a26a27c-5c83-4eb7-95d8-a3084b7fa5c4.tmp
798e5ec6-38ae-40bd-bd5d-3aaffc914964.tmp
ad1b5c1c-dcd5-432b-9cc5-fcb32dec80dd.tmp
f11d3905-c3cc-4ce4-bac2-9d81e2b7aa9c.tmp
5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
LICENSE.electron.txt
LICENSES.chromium.html
chrome_200_percent.pak
d3dcompiler_47.dll
debug.log
dxcompiler.dll
dxil.dll
ffmpeg.dll
icudtl.dat
libEGL.dll
libGLESv2.dll
af.pak
am.pak
ar.pak
bg.pak
bn.pak
ca.pak
cs.pak
da.pak
el.pak
en-GB.pak
es-419.pak
es.pak
et.pak
fa.pak
fi.pak
fr.pak
gu.pak
he.pak
hi.pak
hr.pak
hu.pak
id.pak
it.pak
ja.pak
kn.pak
ko.pak
lt.pak
lv.pak
ml.pak
mr.pak
ms.pak
nb.pak
nl.pak
pl.pak
pt-BR.pak
pt-PT.pak
ro.pak
ru.pak
sk.pak
sl.pak
sr.pak
sv.pak
sw.pak
ta.pak
te.pak
th.pak
tr.pak
uk.pak
ur.pak
vi.pak
zh-TW.pak
resources.pak
app-update.yml
app.asar
manifest.json
sandbox-worker.cjs
inspector-worker.cjs
net-lab-worker.mjs
relay-page-preload.cjs
steam-progress-worker.cjs
store-record-worker.cjs
voice-page-preload.cjs
window-tuck.exe
windows-inspector.exe
7x.sh
LICENSE.txt
index.js
7za
7za
7za
build.sh
do-build.sh
7za
7za
package.json
7za.exe
7za.exe
preload.cjs
elevate.exe
snapshot_blob.bin
v8_context_snapshot.bin
vk_swiftshader_icd.json
vulkan-1.dll
e910dae5-4a3b-4ed7-a2f7-0759b6199388.tmp
chrome_100_percent.pak
de.pak
en-US.pak
fil.pak
zh-CN.pak
api.mjs
node_datachannel.node
tunnel-worker.cjs
7za
7za.exe
wordmarkwhite.png
vk_swiftshader.dll
SpiderBanner.dll
StdUtils.dll
System.dll
WinShell.dll
nsExec.dll
nsis7z.dll
messages.json
1a647bb0-988f-4dee-8abb-f7abd903de7f.tmp
content.js
f_000001
f_000002
f_000003
f_000004
f_000005
f_000007
f_000008
f_000009
f_00000a
f_00000b
f_00000c
f_00000d
f_00000e
f_00000f
f_000010
f_000011
f_000012
f_000013
f_000014
f_000015
f_000016
f_000017
f_000018
f_000019
f_00001a
f_00001b
f_00001c
f_00001d
f_00001e
f_00001f
f_000020
f_000021
f_000022
f_000023
f_00002c
f_00002d
f_00002e
f_00002f
f_000030
f_000031
f_000032
f_000033
f_000034
f_000038
f_000046
f_000048
f_0000b5
f_0000b6
f_0000b7
f_0000b8
f_0000b9
f_0000ba
f_0000bb
f_0000d7
f_0000d8
f_0000db
f_0000dc
f_0000dd
f_0000e0
f_0000e2
f_0000e3
f_0000e4
f_0000e5
f_0000e6
f_0000e7
f_0000e8
f_0000e9
f_0000f6
f_000102
temp-index
temp-index
temp-index
temp-index
temp-index
CURRENT
0cc24f54-24fc-4361-a70c-7cffddb9f9bb.tmp
Network Persistent State
dbb560c4-3406-48b8-973e-21693fbadcf9.tmp
e460bda9-34fc-4f1e-9c96-ab01425e7d90.tmp
Preferences
01c104b8df2a16cc_0
0277fd62f2160594_0
03bc0a62e97ceafc_0
043951bae8a668d0_0
0637212d96cb875d_0
0637212d96cb875d_1
0637212d96cb875d_1
0663c4aa8d1e7a17_0
07c5a85b2185daa6_0
07c5a85b2185daa6_1
1b02c27f80d05d89_0
1c12dd60face5654_0
1c12dd60face5654_1
1c12dd60face5654_1
1c468a64a4c5d86f_0
1c468a64a4c5d86f_1
1cc15ef49dbc144e_0
1cc15ef49dbc144e_1
1e2b05189a93a69f_0
1ebddd7cbecd6e5d_0
1ebddd7cbecd6e5d_1
296e6446badb3a88_0
296e6446badb3a88_1
304b5af4c519f6f4_0
304b5af4c519f6f4_1
3096cc1cdcca1725_0
3096cc1cdcca1725_1
35c6b19230307ea3_0
35c6b19230307ea3_1
3e927541bceed085_0
3e927541bceed085_1
3e927541bceed085_1
3f5e5839ace493ac_0
3f5e5839ace493ac_1
407c800b871aad16_0
41f299b8361b9096_0
41f299b8361b9096_1
4203b7e91f525005_0
4203b7e91f525005_1
4540eb43ea5114a6_0
4e9b3a0756408dd5_0
4e9b3a0756408dd5_1
52d0aaa2847ecb83_0
52d0aaa2847ecb83_1
52d0aaa2847ecb83_1
560f121f6f0cba4c_0
5a145f90d9aa3181_0
5a145f90d9aa3181_1
5a145f90d9aa3181_1
5a52a6307c3e8f62_0
5e08de9318c503dd_0
611f62c1772420f0_0
611f62c1772420f0_1
611f62c1772420f0_1
61ae97ca3d5fedc1_0
61ae97ca3d5fedc1_1
66278a0adf3cbef3_0
66278a0adf3cbef3_1
66278a0adf3cbef3_1
66632ab7be138ead_0
66c0d1d940c38175_0
66c0d1d940c38175_1
66c0d1d940c38175_1
6a3be5a088a323eb_0
6a3be5a088a323eb_1
712a7f335408a952_0
8266d216acd3f701_0
8266d216acd3f701_1
88f1c9dc05dc6493_0
927731e88faeaa94_0
927731e88faeaa94_1
94a566c9275633b5_0
94a566c9275633b5_1
963366c86b08afab_0
963366c86b08afab_1
9741785c1f56dd08_0
9741785c1f56dd08_1
9741785c1f56dd08_1
9adbc2888d6d1265_0
a49ed20e8db40ff3_0
a49ed20e8db40ff3_1
a65614362ea73ecd_0
a69efdfaa8ea560c_0
a99b3ee8af6b3505_0
ac54cf8e1a3a3b79_0
ac54cf8e1a3a3b79_1
bf207d0ef0c362d3_0
c21c93cb3b9c129f_0
c21c93cb3b9c129f_1
c222142588ed2222_0
c222142588ed2222_1
c5652b18195038d2_0
c5652b18195038d2_1
c773864ae3290eb6_1
cdd9b24423689d94_0
ce13147938dd66a5_0
ce13147938dd66a5_1
d2f4451e6d202fc6_0
d2f4451e6d202fc6_1
d2f4451e6d202fc6_1
d8fae38a2589ff8b_0
d8fae38a2589ff8b_1
e5e01e3eefe4a704_0
e5e01e3eefe4a704_1
e5e01e3eefe4a704_1
ecafd726c39e6821_0
ecafd726c39e6821_1
ed9f45b73e032bb4_0
edd286b2026f2471_0
edd286b2026f2471_1
edd286b2026f2471_1
ef1456dd4a647401_0
ef1456dd4a647401_1
efa1edbc5a21bac5_0
f56b963bec007a9d_0
fca888e264be4099_0
fca888e264be4099_1
ff01b57d3ff336b2_0
temp-index
temp-index
temp-index
the-real-index
the-real-index
fcf382c43702d91f_0
temp-index
temp-index
the-real-index
temp-index
the-real-index
index.txt
index.txt.tmp
index.txt.tmp
index.txt.tmp
index.txt.tmp
index.txt.tmp
index.txt.tmp
2cc80dabc69f58b6_0
index
temp-index
the-real-index
MANIFEST-000001
installed-games-stages.json
installed-games-stages.json
installed-games-stages.json
installed-games-stages.json
installed-games-stages.json
installed-games-stages.json
installed-games-stages.json
installed-games-stages.json
installed-games-stages.json
installed-games-stages.json
installed-games-stages.json
installed-games-stages.json
installed-games-stages.json
installed-games-stages.json
installed-games-stages.json
installed-games-stages.json
installed-games-stages.json
installed-games-stages.json
installed-games-stages.json
installed-games-stages.json
installed-games-stages.json
installed-games-stages.json
installed-games-stages.json
installed-games-stages.json
installed-games-stages.json
installed-games-stages.json
installed-games-stages.json
installed-games-stages.json
installed-games-stages.json
installed-games-stages.json
installed-games-stages.json
installed-games-stages.json
installed-games-stages.json
installed-games-stages.json
installed-games-stages.json
installed-games-stages.json
installed-games-stages.json
installed-games-stages.json
installed-games-stages.json
installed-games-stages.json
installed-games-stages.json
installed-games-stages.json
installed-games-stages.json
installed-games-stages.json
installed-games-stages.json
installed-games-stages.json
installed-games-stages.json
installed-games-stages.json
installed-games-stages.json
installed-games-stages.json
installed-games-stages.json.4204.tmp
installed-games-stages.json.4204.tmp
installed-games-stages.json.4204.tmp
installed-games-stages.json.4204.tmp
installed-games-stages.json.4204.tmp
installed-games-stages.json.4204.tmp
installed-games-stages.json.4204.tmp
installed-games-stages.json.4204.tmp
installed-games-stages.json.4204.tmp
installed-games-stages.json.4204.tmp
installed-games-stages.json.4204.tmp
installed-games-stages.json.4204.tmp
installed-games-stages.json.4204.tmp
installed-games-stages.json.4204.tmp
installed-games-stages.json.8636.tmp
installed-games-stages.json.8636.tmp
installed-games-stages.json.8636.tmp
installed-games-stages.json.8636.tmp
installed-games-stages.json.8636.tmp
installed-games-stages.json.8636.tmp
installed-games-stages.json.8636.tmp
installed-games-stages.json.8636.tmp
installed-games-stages.json.8636.tmp
melty-token.bin
8272d83b2692662098746f2d0ad0e2d85f3c8358ab1d63f75fbe835c2c8135fd.bin
state.json
scope_v3.json
scope_v3.json
session.json
updater.log
default.dic
c1352052-45ff-455d-8cbd-f762f9724adb.tmp