Analysis
- max time kernel
959s - max time network
821s - platform
windows11-21h2_x64 - resource
win11-20251015-en - resource tags
- submitted
14/11/2025, 16:54
General
- Target Apa, aerul si solul.pptx
- Size 679KB
- Sample251114-vel5vstrbz
- SHA256 68dd7d93c6528df6c84b7f748817c632ac796262f61f167212d1c47136626c4b
Score
10/10
Malware Config
Extracted
Path
-
C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML
Ransom Note
- <html> <head> <style> body{ background-color: #3366CC; } h1 { background-color: RGB(249, 201, 16); } p { background-color: maroon; color: white; } </style> </head> <body> <center> <h1><b> Attention ! All your files </b> have been encrypted. </h1></br> <p> Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br> That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br> Getting a decryption of your files is - SIMPLY task.</br></br> That all what you need:</br> 1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br> 2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br> 3. Pay our services. </br> 4. GET software with passwords for decrypt you files.</br> 5. Make measures to prevent this type situations again.</br></br> IMPORTANT(1)</br> Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br> IMPORTANT(2) </br> We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption. </p> <p> Your ID_KEY: <br> </p> <table width="1024" border="0"> <tbody> <tr> <td><p>B9aWL5Z7NmlpwuVftQAqcJRBCe6pAMcgpZ3iE2V14A9zrZtk+JkyGqmGJ11jmqBOy1Kca65YZIWhck/WuiPgMPQPsyb+cFoxOcBjhcUDVRjPfPFGsXYPEh0XP7Il15QeB0nqutr3Uwlns2CxQr+m50FMkQpaxaGyPh3y6b+Qe9kxR/cpXbPFTm+DxwNpca+7fiRGbncII+QT+uYYS1au+53iNPFGTrH5WsNNDFCdW5qI8n1C0LCWJtmZPIC+qLi/OzLI9vJ+/9cgJ7+xOYLNmFZgV+JFBPYEYCbkU+xUqd9plHxsAxHeDHfyDKLiB8KC3fq6u0fHbsphAesFq4GHNw==ZW4tVVM=</p></td> </tr> </tbody> </table> </center></html></body>
Signatures
- Fantom
Ransomware which hides encryption process behind fake Windows Update screen.
- Fantom family
- Renames multiple (5498) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Disables Task Manager via registry modification
- Drops file in Drivers directory 21 IoCs
- Drops startup file 2 IoCs
- Executes dropped EXE 1 IoCs
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
- Drops file in System32 directory 64 IoCs
- Sets desktop wallpaper using registry 2 TTPs 1 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 18 IoCs
- Modifies data under HKEY_USERS 5 IoCs
- Modifies registry class 5 IoCs
- NTFS ADS 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 15 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 27 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 40 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" "C:\Users\Admin\AppData\Local\Temp\Apa, aerul si solul.pptx" /ou ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService1⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xfc,0x100,0x104,0xdc,0x108,0x7ffe5fdddcf8,0x7ffe5fdddd04,0x7ffe5fdddd102⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=580,i,3112204941423520366,15619369986986983381,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=2028 /prefetch:112⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2000,i,3112204941423520366,15619369986986983381,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=1996 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2336,i,3112204941423520366,15619369986986983381,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=2396 /prefetch:132⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3196,i,3112204941423520366,15619369986986983381,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=3440 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3204,i,3112204941423520366,15619369986986983381,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=3460 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4180,i,3112204941423520366,15619369986986983381,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=3192 /prefetch:92⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4560,i,3112204941423520366,15619369986986983381,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=4640 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5356,i,3112204941423520366,15619369986986983381,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=5368 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5548,i,3112204941423520366,15619369986986983381,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=5452 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5556,i,3112204941423520366,15619369986986983381,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=5376 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5404,i,3112204941423520366,15619369986986983381,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=5808 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5384,i,3112204941423520366,15619369986986983381,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=5396 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5832,i,3112204941423520366,15619369986986983381,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=5828 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=5456,i,3112204941423520366,15619369986986983381,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=5624 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=5392,i,3112204941423520366,15619369986986983381,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=5720 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=3456,i,3112204941423520366,15619369986986983381,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=3672 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=4648,i,3112204941423520366,15619369986986983381,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=4728 /prefetch:142⤵
- Modifies registry class
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=4652,i,3112204941423520366,15619369986986983381,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=4748 /prefetch:122⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=4576,i,3112204941423520366,15619369986986983381,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=4664 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5592,i,3112204941423520366,15619369986986983381,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=5752 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=4820,i,3112204941423520366,15619369986986983381,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=5764 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5960,i,3112204941423520366,15619369986986983381,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=5996 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5664,i,3112204941423520366,15619369986986983381,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=5736 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --field-trial-handle=4300,i,3112204941423520366,15619369986986983381,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=5772 /prefetch:92⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=4248,i,3112204941423520366,15619369986986983381,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=6020 /prefetch:142⤵
- NTFS ADS
-
-
C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\helppane.exeC:\Windows\helppane.exe -Embedding1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument microsoft-edge:https://go.microsoft.com/fwlink/?LinkId=5170092⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2e0,0x308,0x7ffe4dcef208,0x7ffe4dcef214,0x7ffe4dcef2203⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1676,i,3552214450477705508,18059076999570734620,262144 --variations-seed-version --mojo-platform-channel-handle=2168 /prefetch:113⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1864,i,3552214450477705508,18059076999570734620,262144 --variations-seed-version --mojo-platform-channel-handle=1876 /prefetch:23⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2356,i,3552214450477705508,18059076999570734620,262144 --variations-seed-version --mojo-platform-channel-handle=2756 /prefetch:133⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3436,i,3552214450477705508,18059076999570734620,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3444,i,3552214450477705508,18059076999570734620,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4860,i,3552214450477705508,18059076999570734620,262144 --variations-seed-version --mojo-platform-channel-handle=4748 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=5012,i,3552214450477705508,18059076999570734620,262144 --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --field-trial-handle=4224,i,3552214450477705508,18059076999570734620,262144 --variations-seed-version --mojo-platform-channel-handle=5024 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window3⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x240,0x244,0x248,0x23c,0x260,0x7ffe4dcef208,0x7ffe4dcef214,0x7ffe4dcef2204⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1800,i,2887961277330147451,8237205905776551755,262144 --variations-seed-version --mojo-platform-channel-handle=2184 /prefetch:114⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2156,i,2887961277330147451,8237205905776551755,262144 --variations-seed-version --mojo-platform-channel-handle=2152 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2372,i,2887961277330147451,8237205905776551755,262144 --variations-seed-version --mojo-platform-channel-handle=2880 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4368,i,2887961277330147451,8237205905776551755,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4368,i,2887961277330147451,8237205905776551755,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4336,i,2887961277330147451,8237205905776551755,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4512,i,2887961277330147451,8237205905776551755,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4632,i,2887961277330147451,8237205905776551755,262144 --variations-seed-version --mojo-platform-channel-handle=4636 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=568,i,2887961277330147451,8237205905776551755,262144 --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4876,i,2887961277330147451,8237205905776551755,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4864,i,2887961277330147451,8237205905776551755,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4104,i,2887961277330147451,8237205905776551755,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4908,i,2887961277330147451,8237205905776551755,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4428,i,2887961277330147451,8237205905776551755,262144 --variations-seed-version --mojo-platform-channel-handle=4828 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=4832,i,2887961277330147451,8237205905776551755,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:104⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4032,i,2887961277330147451,8237205905776551755,262144 --variations-seed-version --mojo-platform-channel-handle=4768 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5252,i,2887961277330147451,8237205905776551755,262144 --variations-seed-version --mojo-platform-channel-handle=764 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5244,i,2887961277330147451,8237205905776551755,262144 --variations-seed-version --mojo-platform-channel-handle=3832 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5060,i,2887961277330147451,8237205905776551755,262144 --variations-seed-version --mojo-platform-channel-handle=4020 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3128,i,2887961277330147451,8237205905776551755,262144 --variations-seed-version --mojo-platform-channel-handle=4688 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5124,i,2887961277330147451,8237205905776551755,262144 --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4012,i,2887961277330147451,8237205905776551755,262144 --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xfc,0x100,0x104,0x84,0x108,0x7ffe5fdddcf8,0x7ffe5fdddd04,0x7ffe5fdddd102⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1760,i,18296361950077867993,15170824225954402281,262144 --variations-seed-version=20251114-010042.738000 --mojo-platform-channel-handle=2020 /prefetch:112⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1992,i,18296361950077867993,15170824225954402281,262144 --variations-seed-version=20251114-010042.738000 --mojo-platform-channel-handle=1988 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2300,i,18296361950077867993,15170824225954402281,262144 --variations-seed-version=20251114-010042.738000 --mojo-platform-channel-handle=2400 /prefetch:132⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3200,i,18296361950077867993,15170824225954402281,262144 --variations-seed-version=20251114-010042.738000 --mojo-platform-channel-handle=3308 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3268,i,18296361950077867993,15170824225954402281,262144 --variations-seed-version=20251114-010042.738000 --mojo-platform-channel-handle=3388 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4496,i,18296361950077867993,15170824225954402281,262144 --variations-seed-version=20251114-010042.738000 --mojo-platform-channel-handle=4472 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4644,i,18296361950077867993,15170824225954402281,262144 --variations-seed-version=20251114-010042.738000 --mojo-platform-channel-handle=4668 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=3404,i,18296361950077867993,15170824225954402281,262144 --variations-seed-version=20251114-010042.738000 --mojo-platform-channel-handle=3580 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4592,i,18296361950077867993,15170824225954402281,262144 --variations-seed-version=20251114-010042.738000 --mojo-platform-channel-handle=4544 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=4780,i,18296361950077867993,15170824225954402281,262144 --variations-seed-version=20251114-010042.738000 --mojo-platform-channel-handle=4684 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=4952,i,18296361950077867993,15170824225954402281,262144 --variations-seed-version=20251114-010042.738000 --mojo-platform-channel-handle=4984 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5172,i,18296361950077867993,15170824225954402281,262144 --variations-seed-version=20251114-010042.738000 --mojo-platform-channel-handle=5184 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5436,i,18296361950077867993,15170824225954402281,262144 --variations-seed-version=20251114-010042.738000 --mojo-platform-channel-handle=5464 /prefetch:142⤵
- NTFS ADS
-
-
C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of SendNotifyMessage
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe5fdddcf8,0x7ffe5fdddd04,0x7ffe5fdddd102⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1812,i,13526119529952331370,13849494239155348901,262144 --variations-seed-version=20251114-010042.738000 --mojo-platform-channel-handle=2032 /prefetch:112⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2004,i,13526119529952331370,13849494239155348901,262144 --variations-seed-version=20251114-010042.738000 --mojo-platform-channel-handle=2000 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2324,i,13526119529952331370,13849494239155348901,262144 --variations-seed-version=20251114-010042.738000 --mojo-platform-channel-handle=2340 /prefetch:132⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3184,i,13526119529952331370,13849494239155348901,262144 --variations-seed-version=20251114-010042.738000 --mojo-platform-channel-handle=3208 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3216,i,13526119529952331370,13849494239155348901,262144 --variations-seed-version=20251114-010042.738000 --mojo-platform-channel-handle=3236 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4464,i,13526119529952331370,13849494239155348901,262144 --variations-seed-version=20251114-010042.738000 --mojo-platform-channel-handle=4332 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=3796,i,13526119529952331370,13849494239155348901,262144 --variations-seed-version=20251114-010042.738000 --mojo-platform-channel-handle=4652 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=4592,i,13526119529952331370,13849494239155348901,262144 --variations-seed-version=20251114-010042.738000 --mojo-platform-channel-handle=4808 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4980,i,13526119529952331370,13849494239155348901,262144 --variations-seed-version=20251114-010042.738000 --mojo-platform-channel-handle=4956 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=3256,i,13526119529952331370,13849494239155348901,262144 --variations-seed-version=20251114-010042.738000 --mojo-platform-channel-handle=4480 /prefetch:142⤵
- Modifies registry class
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=4304,i,13526119529952331370,13849494239155348901,262144 --variations-seed-version=20251114-010042.738000 --mojo-platform-channel-handle=3176 /prefetch:122⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=4584,i,13526119529952331370,13849494239155348901,262144 --variations-seed-version=20251114-010042.738000 --mojo-platform-channel-handle=3552 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5144,i,13526119529952331370,13849494239155348901,262144 --variations-seed-version=20251114-010042.738000 --mojo-platform-channel-handle=3664 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=3572,i,13526119529952331370,13849494239155348901,262144 --variations-seed-version=20251114-010042.738000 --mojo-platform-channel-handle=5416 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5516,i,13526119529952331370,13849494239155348901,262144 --variations-seed-version=20251114-010042.738000 --mojo-platform-channel-handle=5536 /prefetch:142⤵
- NTFS ADS
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=212,i,13526119529952331370,13849494239155348901,262144 --variations-seed-version=20251114-010042.738000 --mojo-platform-channel-handle=5152 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5744,i,13526119529952331370,13849494239155348901,262144 --variations-seed-version=20251114-010042.738000 --mojo-platform-channel-handle=5796 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5752,i,13526119529952331370,13849494239155348901,262144 --variations-seed-version=20251114-010042.738000 --mojo-platform-channel-handle=5812 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"1⤵
-
C:\Users\Admin\Downloads\Fantom\Fantom.exe"C:\Users\Admin\Downloads\Fantom\Fantom.exe"1⤵
- Drops file in Drivers directory
- Drops startup file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
-
C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe"C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe"2⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Roaming\delback.bat"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\Fantom\update0.bat" "2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\Fantom\update.bat" "2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
cef_200_percent.pak
aic_file_icons.png
selection-actions.png
selection-actions2x.png
s_remove_18.svg
duplicate.svg
remove.svg
s_backarrow_default.svg
s_comment_18.svg
s_editpdf_18.svg
s_export_18.svg
s_fillandsign_18.svg
s_folder-default_32.svg
s_move_18.svg
s_nextarrow_default.svg
s_organize_18.svg
s_rename_18.svg
s_sendforsignature_18.svg
s_share_18.svg
ui-strings.js
ui-strings.js
ui-strings.js
ui-strings.js
ui-strings.js
ui-strings.js
convertpdf-rna-selector.js
convertpdf-rna-tool-view.js
ui-strings.js
ui-strings.js
example_icons.png
example_icons2x.png
rhp_world_icon.png
rhp_world_icon_2x.png
rhp_world_icon_hover.png
rhp_world_icon_hover_2x.png
rhp_world_icon.png
rhp_world_icon_2x.png
rhp_world_icon_hover.png
rhp_world_icon_hover_2x.png
ui-strings.js
ui-strings.js
s_checkbox_unselected_18.svg
s_checkbox_selected_18.svg
ui-strings.js
ui-strings.js
ui-strings.js
icons.png
icons_ie8.gif
icons_retina.png
new_icons.png
new_icons_retina.png
ui-strings.js
ui-strings.js
ui-strings.js
bg_pattern_RHP.png
bg_patterns_header.png
illustrations.png
illustrations_retina.png
ui-strings.js
ui-strings.js
main-selector.css
ui-strings.js
ui-strings.js
ui-strings.js
ui-strings.js
PlayStore_icon.svg
ui-strings.js
ui-strings.js
ui-strings.js
main-selector.css
Download_on_the_App_Store_Badge_cs_135x40.svg
Download_on_the_App_Store_Badge_da_135x40.svg
Download_on_the_App_Store_Badge_de_135x40.svg
Download_on_the_App_Store_Badge_es_135x40.svg
Download_on_the_App_Store_Badge_fi_135x40.svg
Download_on_the_App_Store_Badge_fr_135x40.svg
Download_on_the_App_Store_Badge_it_135x40.svg
Download_on_the_App_Store_Badge_ja_135x40.svg
Download_on_the_App_Store_Badge_ko_135x40.svg
Download_on_the_App_Store_Badge_nb_135x40.svg
Download_on_the_App_Store_Badge_pl_135x40.svg
Download_on_the_App_Store_Badge_pt_135x40.svg
Download_on_the_App_Store_Badge_ru_135x40.svg
Download_on_the_App_Store_Badge_sv_135x40.svg
Download_on_the_App_Store_Badge_tr_135x40.svg
Download_on_the_App_Store_Badge_zh_cn_135x40.svg
Download_on_the_App_Store_Badge_zh_tw_135x40.svg
cs_get.svg
da_get.svg
de_get.svg
es-419_get.svg
fi_get.svg
fr_get.svg
it_get.svg
ko_get.svg
no_get.svg
pl_get.svg
pt-br_get.svg
ru_get.svg
sv_get.svg
tr_get.svg
zh-cn_get.svg
zh-tw_get.svg
ui-strings.js
ui-strings.js
main.css
ui-strings.js
ui-strings.js
ui-strings.js
main-selector.css
progress.gif
faf_icons.png
ui-strings.js
ui-strings.js
ui-strings.js
bun.png
cstm_brand_preview.png
cstm_brand_preview2x.png
dd_arrow_small.png
dd_arrow_small2x.png
illustrations.png
nub.png
s_filter_18.svg
s_listview_18.svg
s_opencarat_18.svg
s_thumbnailview_18.svg
share_icons.png
share_icons2x.png
ui-strings.js
adc_logo.png
adobe_spinner.gif
logo_retina.png
sat_logo.png
sat_logo_2x.png
ui-strings.js
ui-strings.js
ui-strings.js
ui-strings.js
ui-strings.js
ui-strings.js
ui-strings.js
DisplayLanguageNames.en_GB_EURO.txt
external_extensions.json
manifest.json
vk_swiftshader_icd.json
manifest.json
manifest.json
Logo.png
LogoBeta.png
LogoCanary.png
LogoDev.png
SmallLogo.png
SmallLogoBeta.png
SmallLogoCanary.png
SmallLogoDev.png
manifest.json
DECRYPT_YOUR_FILES.HTML
win32_LinkNoDrop32x32.gif
THIRDPARTYLICENSEREADME-JAVAFX.txt
THIRDPARTYLICENSEREADME.txt
directshow.md
glib.md
gstreamer.md
icu_web.md
jpeg_fx.md
libffi.md
libxml2.md
libxslt.md
mesa3d.md
public_suffix.md
webkit.md
asm.md
bcel.md
cldr.md
colorimaging.md
cryptix.md
dom.md
dynalink.md
ecc.md
freebxml.md
giflib.md
icu.md
jcup.md
joni.md
jopt-simple.md
jpeg.md
lcms.md
libpng.md
mesa3d.md
pkcs11cryptotoken.md
pkcs11wrapper.md
relaxngcc.md
relaxngdatatype.md
relaxngom.md
santuario.md
thaidict.md
unicode.md
xalan.md
xerces.md
xmlresolver.md
zlib.md
ClientSub2019_eula.txt
settings.dat
BrowsingTopicsState
f_00003d
f_00003e
the-real-index
the-real-index
the-real-index
the-real-index
data_1
dasherSettingSchema.json
Network Persistent State
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
TransportSecurity
TransportSecurity
TransportSecurity
CURRENT
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
Secure Preferences
the-real-index
the-real-index
the-real-index~RFe584afe.TMP
index.txt
index.txt
index.txt~RFe581bff.TMP
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
data_0
data_1
settings.dat
settings.dat
50298fd3-bd16-4b33-a6bb-b4dde09820e3.tmp
MANIFEST-000001
data_0
data_1
data_2
data_3
f_00005f
f_000060
f_000061
f_000062
f_000063
f_000064
f_000065
f_000066
f_000067
f_000068
f_000069
f_00006a
the-real-index
the-real-index~RFe58e75d.TMP
a66bedcb-ffee-4c1e-9a1d-02a40208beed.tmp
messages.json
messages.json
History
Network Persistent State
Network Persistent State
Sdch Dictionaries
Preferences
Secure Preferences
LOG
LOG
LOG
sync_diagnostic.log
Visited Links
data.txt
CloudConfigLog
edge_driver.js
strings.json
Last Version
Local State
Local State
Local State
Local State
Local State
crs.pb
ct_config.pb
kp_pinslist.pb
data_1
Advertising
Analytics
CompatExceptions
Content
Cryptomining
Fingerprinting
LICENSE
Other
Social
TransparentAdvertisers
Advertising
Analytics
Content
Cryptomining
Entities
Fingerprinting
LICENSE
Other
Social
manifest.fingerprint
typosquatting_list.pb
Variations
edbtmp.log
powerpnt.exe_Rules.xml.fantom
0.1.filtertrie.intermediate.txt
0.2.filtertrie.intermediate.txt
WindowsUpdate.exe
d39ef9dc-22e3-4eee-9603-e6c729a69bd0.tmp
messages.json
messages.json
manifest.json
SmartArtGraphicsLog.xml
Cerber 5.zip
Cerber 5.zip:Zone.Identifier
Fantom.zip
Krotten.zip
CreateAppSetting.aspx
EditAppSetting.aspx
ManageAppSettings.aspx
GroupedProviders.xml
ASPdotNET_logo.jpg
HelpIcon_solid.gif
alert_lrg.gif
aspx_file.gif.fantom
branding_Full2.gif
darkBlue_GRAD.jpg
deselectedTab_1x1.gif
folder.gif
gradient_onBlue.gif
gradient_onWhite.gif
headerGRADIENT_Tall.gif
help.jpg
image1.gif
image2.gif
requiredBang.gif
topGradRepeat.jpg
yellowCORNER.gif
ManageConsolidatedProviders.aspx
ManageProviders.aspx
ProviderList.ascx
chooseProviderManagement.aspx
createPermission.aspx
managePermissions.aspx
editUser.aspx
wizard.aspx
wizardAuthentication.ascx
wizardCreateRoles.ascx
wizardFinish.ascx
wizardInit.ascx
wizardPermission.ascx
wizardProviderInfo.ascx
security.aspx
security0.aspx
setUpAuthentication.aspx
WebAdminHelp.aspx
WebAdminHelp_Application.aspx
WebAdminHelp_Internals.aspx
WebAdminHelp_Provider.aspx
WebAdminHelp_Security.aspx
default.aspx
error.aspx
home0.aspx
home1.aspx
home2.aspx
navigationBar.ascx
DefaultWsdlHelpGenerator.aspx
InstallCommon.sql
InstallMembership.sql
InstallPersistSqlState.sql
InstallPersonalization.sql
InstallRoles.sql
InstallSqlState.sql
InstallSqlStateTemplate.sql
InstallWebEventSqlProvider.sql
UninstallCommon.sql
UninstallMembership.sql
UninstallPersistSqlState.sql
UninstallPersonalization.sql
UninstallRoles.sql
UninstallSqlState.sql
UninstallSqlStateTemplate.sql
UninstallWebEventSqlProvider.sql
SqlPersistenceService_Logic.sql
SqlPersistenceService_Schema.sql
Tracking_Logic.sql
Tracking_Schema.sql
DropSqlPersistenceProviderLogic.sql
SqlPersistenceProviderLogic.sql
security_watermark.jpg
selectedTab_leftCorner.gif
selectedTab_rightCorner.gif
DefaultLayouts.xml
edge_checkout_page_validator.js
manifest.json
manifest.json
deny_domains.list
manifest.json
manifest.json
Entities
Staging
manifest.json
manifest.json
manifest.json
messages.json
memory/4468-5-0x00007FFE6EFC0000-0x00007FFE6F1C9000-memory.dmp
memory/4468-2-0x00007FFE2F050000-0x00007FFE2F060000-memory.dmp
memory/4468-3-0x00007FFE6F064000-0x00007FFE6F065000-memory.dmp
memory/4468-6-0x00007FFE6EFC0000-0x00007FFE6F1C9000-memory.dmp
memory/4468-7-0x00007FFE2F050000-0x00007FFE2F060000-memory.dmp
memory/4468-4-0x00007FFE2F050000-0x00007FFE2F060000-memory.dmp
memory/4468-1-0x00007FFE2F050000-0x00007FFE2F060000-memory.dmp
memory/4468-8-0x00007FFE6EFC0000-0x00007FFE6F1C9000-memory.dmp
memory/4468-9-0x00007FFE2C8F0000-0x00007FFE2C900000-memory.dmp
memory/4468-10-0x00007FFE2C8F0000-0x00007FFE2C900000-memory.dmp
memory/4468-26-0x00007FFE6EFC0000-0x00007FFE6F1C9000-memory.dmp
memory/4468-165-0x00007FFE2F050000-0x00007FFE2F060000-memory.dmp
memory/4468-166-0x00007FFE2F050000-0x00007FFE2F060000-memory.dmp
memory/4468-168-0x00007FFE2F050000-0x00007FFE2F060000-memory.dmp
memory/4468-169-0x00007FFE6EFC0000-0x00007FFE6F1C9000-memory.dmp
memory/4468-167-0x00007FFE2F050000-0x00007FFE2F060000-memory.dmp
memory/4468-0-0x00007FFE2F050000-0x00007FFE2F060000-memory.dmp
memory/4484-2658-0x0000000006050000-0x000000000605E000-memory.dmp
memory/4484-2384-0x0000000004D70000-0x0000000004D7A000-memory.dmp
memory/4484-2271-0x0000000002540000-0x000000000256B000-memory.dmp
memory/4484-2275-0x0000000002540000-0x000000000256B000-memory.dmp
memory/4484-2277-0x0000000002540000-0x000000000256B000-memory.dmp
memory/4484-2281-0x0000000002540000-0x000000000256B000-memory.dmp
memory/4484-2283-0x0000000002540000-0x000000000256B000-memory.dmp
memory/4484-2285-0x0000000002540000-0x000000000256B000-memory.dmp
memory/4484-2287-0x0000000002540000-0x000000000256B000-memory.dmp
memory/4484-2289-0x0000000002540000-0x000000000256B000-memory.dmp
memory/4484-2293-0x0000000002540000-0x000000000256B000-memory.dmp
memory/4484-2297-0x0000000002540000-0x000000000256B000-memory.dmp
memory/4484-2305-0x0000000002540000-0x000000000256B000-memory.dmp
memory/4484-2307-0x0000000002540000-0x000000000256B000-memory.dmp
memory/4484-2311-0x0000000002540000-0x000000000256B000-memory.dmp
memory/4484-2313-0x0000000002540000-0x000000000256B000-memory.dmp
memory/4484-2315-0x0000000002540000-0x000000000256B000-memory.dmp
memory/4484-2317-0x0000000002540000-0x000000000256B000-memory.dmp
memory/4484-2321-0x0000000002540000-0x000000000256B000-memory.dmp
memory/4484-2325-0x0000000002540000-0x000000000256B000-memory.dmp
memory/4484-2329-0x0000000002540000-0x000000000256B000-memory.dmp
memory/4484-2333-0x0000000002540000-0x000000000256B000-memory.dmp
memory/4484-2337-0x0000000002540000-0x000000000256B000-memory.dmp
memory/4484-2339-0x0000000002540000-0x000000000256B000-memory.dmp
memory/4484-2341-0x0000000002540000-0x000000000256B000-memory.dmp
memory/4484-2343-0x0000000002540000-0x000000000256B000-memory.dmp
memory/4484-2345-0x0000000002540000-0x000000000256B000-memory.dmp
memory/4484-2347-0x0000000002540000-0x000000000256B000-memory.dmp
memory/4484-2349-0x0000000002540000-0x000000000256B000-memory.dmp
memory/4484-2353-0x0000000002540000-0x000000000256B000-memory.dmp
memory/4484-2355-0x0000000002540000-0x000000000256B000-memory.dmp
memory/4484-2357-0x0000000002540000-0x000000000256B000-memory.dmp
memory/4484-2383-0x0000000004C30000-0x0000000004CC2000-memory.dmp
memory/4484-2382-0x0000000004DA0000-0x0000000005346000-memory.dmp
memory/4484-2309-0x0000000002540000-0x000000000256B000-memory.dmp
memory/4484-2269-0x0000000002540000-0x000000000256B000-memory.dmp
memory/4484-2361-0x0000000002540000-0x000000000256B000-memory.dmp
memory/4484-2258-0x0000000002540000-0x000000000256B000-memory.dmp
memory/4484-2273-0x0000000002540000-0x000000000256B000-memory.dmp
memory/4484-2259-0x0000000002540000-0x000000000256B000-memory.dmp
memory/4484-2279-0x0000000002540000-0x000000000256B000-memory.dmp
memory/4484-2261-0x0000000002540000-0x000000000256B000-memory.dmp
memory/4484-2292-0x0000000002540000-0x000000000256B000-memory.dmp
memory/4484-2295-0x0000000002540000-0x000000000256B000-memory.dmp
memory/4484-2299-0x0000000002540000-0x000000000256B000-memory.dmp
memory/4484-2301-0x0000000002540000-0x000000000256B000-memory.dmp
memory/4484-2303-0x0000000002540000-0x000000000256B000-memory.dmp
memory/4484-2263-0x0000000002540000-0x000000000256B000-memory.dmp
memory/4484-2319-0x0000000002540000-0x000000000256B000-memory.dmp
memory/4484-2323-0x0000000002540000-0x000000000256B000-memory.dmp
memory/4484-2359-0x0000000002540000-0x000000000256B000-memory.dmp
memory/4484-2327-0x0000000002540000-0x000000000256B000-memory.dmp
memory/4484-2265-0x0000000002540000-0x000000000256B000-memory.dmp
memory/4484-2331-0x0000000002540000-0x000000000256B000-memory.dmp
memory/4484-2335-0x0000000002540000-0x000000000256B000-memory.dmp
memory/4484-2267-0x0000000002540000-0x000000000256B000-memory.dmp
memory/4484-2352-0x0000000002540000-0x000000000256B000-memory.dmp
memory/4484-2257-0x0000000002540000-0x0000000002572000-memory.dmp
memory/4484-2256-0x0000000002510000-0x0000000002542000-memory.dmp
memory/4732-2668-0x0000000000230000-0x000000000023C000-memory.dmp