Analysis
- user interaction
yes - max time kernel
899s - max time network
901s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
19/04/2026, 03:39
General
- Target Read_Me_Instructions.txt
- Size 1KB
- Sample260419-d72btahs3s
- SHA256 1a3623d7653b8b056d4c471412445ca22bc9e8708f6f64d062f4742cd654f570
Score
8/10
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Downloads MZ/PE file 3 IoCs
- ASPack v2.12-2.42 1 IoCs
Detects executables packed with ASPack v2.12-2.42
- Executes dropped EXE 11 IoCs
- Loads dropped DLL 46 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Drops file in System32 directory 3 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 64 IoCs
- Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 3 IoCs
When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 27 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 4 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Inno Setup is an open-source installation builder for Windows applications. 4 IoCs
Inno Setup installer
- Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 12 IoCs
- Modifies Internet Explorer settings 1 TTPs 53 IoCs
- Modifies data under HKEY_USERS 5 IoCs
- Modifies registry class 64 IoCs
- NTFS ADS 6 IoCs
- Opens file in notepad (likely ransom note) 1 IoCs
- Suspicious behavior: EnumeratesProcesses 10 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 49 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 23 IoCs
- Suspicious use of SetWindowsHookEx 12 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Read_Me_Instructions.txt1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Read_Me_Instructions.txt2⤵
- Opens file in notepad (likely ransom note)
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc566ac728,0x7ffc566ac734,0x7ffc566ac7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1588,i,7483074589768537957,3315540766482455396,262144 --field-trial-handle=1960,i,9785666782328787809,1624345349863324906,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1956 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1468,i,9068147825100812728,4158520514782097494,524288 --field-trial-handle=1960,i,9785666782328787809,1624345349863324906,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2260 /prefetch:112⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2380,i,6022457781457892986,8867854894161307448,524288 --field-trial-handle=1960,i,9785666782328787809,1624345349863324906,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2412 /prefetch:132⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3204,i,14333775580440949548,8600444850367219714,2097152 --field-trial-handle=1960,i,9785666782328787809,1624345349863324906,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3344 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3248,i,7874243294340008073,7923914926566853736,2097152 --field-trial-handle=1960,i,9785666782328787809,1624345349863324906,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3400 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4164,i,5140032915958007422,2467078232607785717,2097152 --field-trial-handle=1960,i,9785666782328787809,1624345349863324906,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3924 /prefetch:92⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4600,i,16262540594049704820,17938039061987627113,2097152 --field-trial-handle=1960,i,9785666782328787809,1624345349863324906,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4624 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5400,i,9057474151204835359,15371818039543244277,524288 --field-trial-handle=1960,i,9785666782328787809,1624345349863324906,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5312 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5716,i,12099064376559485507,12354334123208359454,2097152 --field-trial-handle=1960,i,9785666782328787809,1624345349863324906,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5396 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3584,i,9695528798877914486,7118684415498440695,2097152 --field-trial-handle=1960,i,9785666782328787809,1624345349863324906,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3360 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6060,i,14649630507045456949,12144132016741095527,524288 --field-trial-handle=1960,i,9785666782328787809,1624345349863324906,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6080 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6064,i,10547209133648049489,3384269104653522357,524288 --field-trial-handle=1960,i,9785666782328787809,1624345349863324906,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6000 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5984,i,3856161098884869125,1699751800073875685,524288 --field-trial-handle=1960,i,9785666782328787809,1624345349863324906,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6020 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=3924,i,6506202321241278510,1760970886769865072,2097152 --field-trial-handle=1960,i,9785666782328787809,1624345349863324906,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4168 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6124,i,1964113533715254872,8946095589424192551,2097152 --field-trial-handle=1960,i,9785666782328787809,1624345349863324906,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5996 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6292,i,3055672002568833868,6300791210757262625,2097152 --field-trial-handle=1960,i,9785666782328787809,1624345349863324906,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6200 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=4264,i,2047214769952581169,4890999875141804696,2097152 --field-trial-handle=1960,i,9785666782328787809,1624345349863324906,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4268 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6164,i,7076161271519951168,17596570815035297528,2097152 --field-trial-handle=1960,i,9785666782328787809,1624345349863324906,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4220 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6408,i,2312466300319238329,14963327558408213998,2097152 --field-trial-handle=1960,i,9785666782328787809,1624345349863324906,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6428 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6128,i,9835109557648599173,16838005671264427575,2097152 --field-trial-handle=1960,i,9785666782328787809,1624345349863324906,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4196 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6300,i,15034393676730340423,5384236991869000436,524288 --field-trial-handle=1960,i,9785666782328787809,1624345349863324906,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6240 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=6248,i,5634354970117008165,5205032777520830954,524288 --field-trial-handle=1960,i,9785666782328787809,1624345349863324906,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6288 /prefetch:122⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6588,i,5091537858832758700,4819001028921619328,2097152 --field-trial-handle=1960,i,9785666782328787809,1624345349863324906,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6620 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=6780,i,16513214803055849611,2164241544681016001,2097152 --field-trial-handle=1960,i,9785666782328787809,1624345349863324906,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6800 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=6908,i,6183992462294537613,17563337883223616494,2097152 --field-trial-handle=1960,i,9785666782328787809,1624345349863324906,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=7096 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=6960,i,9333168931609102590,18217301962526940939,2097152 --field-trial-handle=1960,i,9785666782328787809,1624345349863324906,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=7016 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=6936,i,3619775932603810369,9998458163794610875,2097152 --field-trial-handle=1960,i,9785666782328787809,1624345349863324906,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=7292 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=7416,i,17661074762909479477,8039019079159916403,2097152 --field-trial-handle=1960,i,9785666782328787809,1624345349863324906,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=7316 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=7560,i,12750813251617355060,8630450846586679542,2097152 --field-trial-handle=1960,i,9785666782328787809,1624345349863324906,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=7576 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6996,i,13606802433825369896,13467949928141357215,262144 --field-trial-handle=1960,i,9785666782328787809,1624345349863324906,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=7256 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=7768,i,11374351687904085270,3649571984567649284,2097152 --field-trial-handle=1960,i,9785666782328787809,1624345349863324906,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6960 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3184,i,6440893076938659158,4806813994793593174,524288 --field-trial-handle=1960,i,9785666782328787809,1624345349863324906,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=8060 /prefetch:142⤵
- NTFS ADS
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=7700,i,14094547592066688794,3759861202561012369,524288 --field-trial-handle=1960,i,9785666782328787809,1624345349863324906,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=7656 /prefetch:142⤵
- NTFS ADS
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=8004,i,3315873201063711990,13004866421472502558,524288 --field-trial-handle=1960,i,9785666782328787809,1624345349863324906,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4504 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --metrics-shmem-handle=7828,i,7126363625836402083,10652370921850113514,2097152 --field-trial-handle=1960,i,9785666782328787809,1624345349863324906,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=7772 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --metrics-shmem-handle=8356,i,13785769851066156936,6790988361505748144,2097152 --field-trial-handle=1960,i,9785666782328787809,1624345349863324906,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=8384 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --metrics-shmem-handle=7748,i,17483561288424608331,16149281556968642623,2097152 --field-trial-handle=1960,i,9785666782328787809,1624345349863324906,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=8312 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --metrics-shmem-handle=8220,i,18019091767986203471,9408530804092584902,2097152 --field-trial-handle=1960,i,9785666782328787809,1624345349863324906,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=7584 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --metrics-shmem-handle=8700,i,13067009687866783685,140904777161637352,2097152 --field-trial-handle=1960,i,9785666782328787809,1624345349863324906,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=8728 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --metrics-shmem-handle=7728,i,15495845869142210127,10277288898828980803,2097152 --field-trial-handle=1960,i,9785666782328787809,1624345349863324906,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=7812 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=8324,i,3946747245047879785,3052378139761677257,524288 --field-trial-handle=1960,i,9785666782328787809,1624345349863324906,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=8980 /prefetch:142⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
-
-
C:\Users\Admin\Downloads\butterflyondesktop.exe"C:\Users\Admin\Downloads\butterflyondesktop.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\is-TF599.tmp\butterflyondesktop.tmp"C:\Users\Admin\AppData\Local\Temp\is-TF599.tmp\butterflyondesktop.tmp" /SL5="$9043C,2719719,54272,C:\Users\Admin\Downloads\butterflyondesktop.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\Butterfly on Desktop\ButterflyOnDesktop.exe"C:\Program Files (x86)\Butterfly on Desktop\ButterflyOnDesktop.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SendNotifyMessage
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://freedesktopsoft.com/butterflyondesktoplike.html4⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x34c,0x7ffc419ec188,0x7ffc419ec194,0x7ffc419ec1a05⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1592,i,17198821989116261625,13382978020926432493,262144 --field-trial-handle=2140,i,17163278354842516130,13027741964765850664,262144 --variations-seed-version --mojo-platform-channel-handle=2136 /prefetch:25⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1808,i,15793371115174825036,12630826696508622423,524288 --field-trial-handle=2140,i,17163278354842516130,13027741964765850664,262144 --variations-seed-version --mojo-platform-channel-handle=2192 /prefetch:115⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2432,i,9628487201571955819,14460517012915191815,524288 --field-trial-handle=2140,i,17163278354842516130,13027741964765850664,262144 --variations-seed-version --mojo-platform-channel-handle=3112 /prefetch:135⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3304,i,17517051363308701911,310807120542007064,2097152 --field-trial-handle=2140,i,17163278354842516130,13027741964765850664,262144 --variations-seed-version --mojo-platform-channel-handle=3312 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3308,i,6177607938811977500,13864422370194828695,2097152 --field-trial-handle=2140,i,17163278354842516130,13027741964765850664,262144 --variations-seed-version --mojo-platform-channel-handle=3384 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4876,i,596358249472611604,15886631738464356285,2097152 --field-trial-handle=2140,i,17163278354842516130,13027741964765850664,262144 --variations-seed-version --mojo-platform-channel-handle=4892 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5060,i,5430550483093289185,18189829052869157748,524288 --field-trial-handle=2140,i,17163278354842516130,13027741964765850664,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4848,i,12595271802887995623,5049028369333954939,524288 --field-trial-handle=2140,i,17163278354842516130,13027741964765850664,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5836,i,13644764110331536293,9884800198523532828,524288 --field-trial-handle=2140,i,17163278354842516130,13027741964765850664,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5836,i,13644764110331536293,9884800198523532828,524288 --field-trial-handle=2140,i,17163278354842516130,13027741964765850664,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=6272,i,9048203893875962529,11318180040959257089,2097152 --field-trial-handle=2140,i,17163278354842516130,13027741964765850664,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6444,i,9601267676570936234,14530755499140249092,2097152 --field-trial-handle=2140,i,17163278354842516130,13027741964765850664,262144 --variations-seed-version --mojo-platform-channel-handle=6504 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6484,i,15965139053703984634,10851818733793941476,2097152 --field-trial-handle=2140,i,17163278354842516130,13027741964765850664,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window5⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2f0,0x7ffc419ec188,0x7ffc419ec194,0x7ffc419ec1a06⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1848,i,17785844985155234950,17283759228462559900,524288 --field-trial-handle=2144,i,15662373850453197252,13463723402870921637,262144 --variations-seed-version --mojo-platform-channel-handle=2172 /prefetch:116⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1588,i,9201700905368052673,17943851216514642760,262144 --field-trial-handle=2144,i,15662373850453197252,13463723402870921637,262144 --variations-seed-version --mojo-platform-channel-handle=2140 /prefetch:26⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2532,i,7520530266988832138,3138637894781931825,524288 --field-trial-handle=2144,i,15662373850453197252,13463723402870921637,262144 --variations-seed-version --mojo-platform-channel-handle=2712 /prefetch:136⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4512,i,15984568321405094458,91483325447568430,524288 --field-trial-handle=2144,i,15662373850453197252,13463723402870921637,262144 --variations-seed-version --mojo-platform-channel-handle=4528 /prefetch:146⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4512,i,15984568321405094458,91483325447568430,524288 --field-trial-handle=2144,i,15662373850453197252,13463723402870921637,262144 --variations-seed-version --mojo-platform-channel-handle=4528 /prefetch:146⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4812,i,7849496701631742548,14389895779785686390,524288 --field-trial-handle=2144,i,15662373850453197252,13463723402870921637,262144 --variations-seed-version --mojo-platform-channel-handle=4524 /prefetch:146⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4820,i,2901883734596833917,12692826495409951106,524288 --field-trial-handle=2144,i,15662373850453197252,13463723402870921637,262144 --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:146⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4824,i,5216024507543346885,6139620623181600209,524288 --field-trial-handle=2144,i,15662373850453197252,13463723402870921637,262144 --variations-seed-version --mojo-platform-channel-handle=4884 /prefetch:146⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5076,i,3160921411599553030,321452256258858390,524288 --field-trial-handle=2144,i,15662373850453197252,13463723402870921637,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:146⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4880,i,7666008702336587006,9389393697538987005,524288 --field-trial-handle=2144,i,15662373850453197252,13463723402870921637,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:146⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5068,i,18059799399513745251,6853778651579458906,524288 --field-trial-handle=2144,i,15662373850453197252,13463723402870921637,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:146⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=748,i,967220638917847812,3196401588580080090,262144 --field-trial-handle=2144,i,15662373850453197252,13463723402870921637,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:106⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=564,i,4574829342748953761,15527493647624557693,524288 --field-trial-handle=2144,i,15662373850453197252,13463723402870921637,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:146⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,8012996396125233155,12327387342419577548,524288 --field-trial-handle=2144,i,15662373850453197252,13463723402870921637,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:146⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5416,i,10927552009513665647,7704481611783326999,524288 --field-trial-handle=2144,i,15662373850453197252,13463723402870921637,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:146⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5572,i,18208743745761335392,13065785354603103605,524288 --field-trial-handle=2144,i,15662373850453197252,13463723402870921637,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:146⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4124,i,9899188563235461643,7290196632462384219,524288 --field-trial-handle=2144,i,15662373850453197252,13463723402870921637,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:146⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5804,i,2348308791711832859,9779665425885493882,524288 --field-trial-handle=2144,i,15662373850453197252,13463723402870921637,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:146⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5596,i,14052606841052348201,4448759418223128125,524288 --field-trial-handle=2144,i,15662373850453197252,13463723402870921637,262144 --variations-seed-version --mojo-platform-channel-handle=5620 /prefetch:146⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5484,i,3621355879023523818,5241750918470665325,524288 --field-trial-handle=2144,i,15662373850453197252,13463723402870921637,262144 --variations-seed-version --mojo-platform-channel-handle=5104 /prefetch:146⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5612,i,9443899175369611908,8221214187816396651,524288 --field-trial-handle=2144,i,15662373850453197252,13463723402870921637,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:146⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5512,i,1363223651626316684,10132045162097436576,524288 --field-trial-handle=2144,i,15662373850453197252,13463723402870921637,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:146⤵
-
-
-
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --metrics-shmem-handle=9016,i,11336422839742343573,16550674918172000470,2097152 --field-trial-handle=1960,i,9785666782328787809,1624345349863324906,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=8780 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --metrics-shmem-handle=8888,i,298234707214525001,1275110362652636090,2097152 --field-trial-handle=1960,i,9785666782328787809,1624345349863324906,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=8884 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --metrics-shmem-handle=8908,i,13186325545833940595,10339365987964292165,2097152 --field-trial-handle=1960,i,9785666782328787809,1624345349863324906,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=7940 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --metrics-shmem-handle=7896,i,4324097343063969757,14678004557479623357,2097152 --field-trial-handle=1960,i,9785666782328787809,1624345349863324906,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=7184 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=7560,i,16186775377616951519,18010813850622726266,524288 --field-trial-handle=1960,i,9785666782328787809,1624345349863324906,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=8228 /prefetch:142⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
-
-
C:\Users\Admin\Downloads\Flasher.exe"C:\Users\Admin\Downloads\Flasher.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6012,i,3767580167252458203,6135686690532759763,524288 --field-trial-handle=1960,i,9785666782328787809,1624345349863324906,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=8660 /prefetch:142⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
-
-
C:\Users\Admin\Downloads\rickroll.exe"C:\Users\Admin\Downloads\rickroll.exe"2⤵
- Executes dropped EXE
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --metrics-shmem-handle=4256,i,9622168089815864602,14182061111902972785,2097152 --field-trial-handle=1960,i,9785666782328787809,1624345349863324906,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6128 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --metrics-shmem-handle=8668,i,5498914785899906045,13900843637173687546,2097152 --field-trial-handle=1960,i,9785666782328787809,1624345349863324906,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4240 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --metrics-shmem-handle=3924,i,3438253503489936996,10989677138047033801,2097152 --field-trial-handle=1960,i,9785666782328787809,1624345349863324906,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=872 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --metrics-shmem-handle=6048,i,2949355006469251877,7082311479108092490,2097152 --field-trial-handle=1960,i,9785666782328787809,1624345349863324906,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=7924 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --metrics-shmem-handle=7236,i,1463440217783816647,3550509130420158949,2097152 --field-trial-handle=1960,i,9785666782328787809,1624345349863324906,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=8948 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=8220,i,16145746409886467345,6875154647674950951,524288 --field-trial-handle=1960,i,9785666782328787809,1624345349863324906,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=8208 /prefetch:142⤵
- NTFS ADS
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\AppData\Local\Temp\Temp1_bon4 (1).zip\BonziBuddy432.exe"C:\Users\Admin\AppData\Local\Temp\Temp1_bon4 (1).zip\BonziBuddy432.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\BonziBuddy432\Runtimes\CheckRuntimes.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\BonziBuddy432\Runtimes\MSAGENT.EXEMSAGENT.EXE3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s "C:\Windows\msagent\AgentCtl.dll"4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s "C:\Windows\msagent\AgentDPv.dll"4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s "C:\Windows\msagent\mslwvtts.dll"4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s "C:\Windows\msagent\AgentDP2.dll"4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s "C:\Windows\msagent\AgentMPx.dll"4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s "C:\Windows\msagent\AgentSR.dll"4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s "C:\Windows\msagent\AgentPsh.dll"4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\msagent\AgentSvr.exe"C:\Windows\msagent\AgentSvr.exe" /regserver4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
C:\Windows\SysWOW64\grpconv.exegrpconv.exe -o4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Program Files (x86)\BonziBuddy432\Runtimes\tv_enua.exetv_enua.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s C:\Windows\lhsp\tv\tv_enua.dll4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s C:\Windows\lhsp\tv\tvenuax.dll4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
C:\Windows\SysWOW64\grpconv.exegrpconv.exe -o4⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bonzibuddy.tk/2⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x368,0x7ffc419ec188,0x7ffc419ec194,0x7ffc419ec1a03⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1820,i,15039949820783579295,5938612275981695422,524288 --field-trial-handle=2032,i,13698361434981468823,13353776442850320340,262144 --variations-seed-version --mojo-platform-channel-handle=2144 /prefetch:113⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,11461555739361234727,3786773561955448679,262144 --field-trial-handle=2032,i,13698361434981468823,13353776442850320340,262144 --variations-seed-version --mojo-platform-channel-handle=2028 /prefetch:23⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2568,i,7521973601356072519,8837470876035661904,524288 --field-trial-handle=2032,i,13698361434981468823,13353776442850320340,262144 --variations-seed-version --mojo-platform-channel-handle=2748 /prefetch:133⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,562003949528478587,14731093444248996220,2097152 --field-trial-handle=2032,i,13698361434981468823,13353776442850320340,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,13612282897617790905,2166745479181225868,2097152 --field-trial-handle=2032,i,13698361434981468823,13353776442850320340,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4112,i,8708356658297672748,3680187575823178209,2097152 --field-trial-handle=2032,i,13698361434981468823,13353776442850320340,262144 --variations-seed-version --mojo-platform-channel-handle=4608 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4124,i,17840010831993402676,11431566529412769890,2097152 --field-trial-handle=2032,i,13698361434981468823,13353776442850320340,262144 --variations-seed-version --mojo-platform-channel-handle=4612 /prefetch:93⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4140,i,11211003861590021522,13429650114780991276,2097152 --field-trial-handle=2032,i,13698361434981468823,13353776442850320340,262144 --variations-seed-version --mojo-platform-channel-handle=4624 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4148,i,10156234531684568206,18296728536543066395,2097152 --field-trial-handle=2032,i,13698361434981468823,13353776442850320340,262144 --variations-seed-version --mojo-platform-channel-handle=4636 /prefetch:93⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5020,i,2990301466710743240,6560802398310421376,524288 --field-trial-handle=2032,i,13698361434981468823,13353776442850320340,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4984,i,6961190644362530296,471656926174088506,524288 --field-trial-handle=2032,i,13698361434981468823,13353776442850320340,262144 --variations-seed-version --mojo-platform-channel-handle=4964 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5320,i,9420010028859693281,527138833077346135,2097152 --field-trial-handle=2032,i,13698361434981468823,13353776442850320340,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5452,i,12835762041659139430,14092434193453774703,524288 --field-trial-handle=2032,i,13698361434981468823,13353776442850320340,262144 --variations-seed-version --mojo-platform-channel-handle=3764 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5312,i,4584011689600282621,12074711546757859750,524288 --field-trial-handle=2032,i,13698361434981468823,13353776442850320340,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,16564722303025426822,17513910035413410895,524288 --field-trial-handle=2032,i,13698361434981468823,13353776442850320340,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:143⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.execookie_exporter.exe --cookie-json=11444⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6184,i,5804084052657688584,585072987941442000,524288 --field-trial-handle=2032,i,13698361434981468823,13353776442850320340,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6184,i,5804084052657688584,585072987941442000,524288 --field-trial-handle=2032,i,13698361434981468823,13353776442850320340,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,15478379131490437873,11259214919959302655,524288 --field-trial-handle=2032,i,13698361434981468823,13353776442850320340,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6460,i,18291718240093250827,2919811374796290070,524288 --field-trial-handle=2032,i,13698361434981468823,13353776442850320340,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6476,i,5007612415089887770,18117966292795181917,524288 --field-trial-handle=2032,i,13698361434981468823,13353776442850320340,262144 --variations-seed-version --mojo-platform-channel-handle=6692 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6428,i,16878202863164863773,4762751042383778534,524288 --field-trial-handle=2032,i,13698361434981468823,13353776442850320340,262144 --variations-seed-version --mojo-platform-channel-handle=6700 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6420,i,7228827733079750833,11511848612904588263,524288 --field-trial-handle=2032,i,13698361434981468823,13353776442850320340,262144 --variations-seed-version --mojo-platform-channel-handle=6472 /prefetch:143⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\BonziBuddy432\BonziBDY_35.EXE"C:\Program Files (x86)\BonziBuddy432\BonziBDY_35.EXE"1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Windows\msagent\AgentSvr.exeC:\Windows\msagent\AgentSvr.exe -Embedding1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004EC 0x00000000000004C81⤵
-
C:\Program Files (x86)\Internet Explorer\ielowutil.exe"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding1⤵
- System Location Discovery: System Language Discovery
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:6004 CREDAT:17410 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵
-
C:\Program Files (x86)\BonziBuddy432\BonziBDY_4.EXE"C:\Program Files (x86)\BonziBuddy432\BonziBDY_4.EXE"1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe shell32.dll,Control_RunDLL speech.cpl,,02⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\RunDll32.exeC:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL speech.cpl,,03⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Temp1_Archive.zip\lnstaler.exe"C:\Users\Admin\AppData\Local\Temp\Temp1_Archive.zip\lnstaler.exe"1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\oobe\UserOOBEBroker.exeC:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding1⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exeC:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding1⤵
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Defense Evasion
Modify Registry
3Subvert Trust Controls
1SIP and Trust Provider Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
ActiveSkin.ocx
Bonzi's Beach Checkers.exe
BonziBDY_2.EXE
BonziBDY_35.EXE
BonziBDY_4.EXE
BonziCheckers.ocx
page17.jpg
page18.jpg
MSCOMCTL.OCX
MSINET.OCX
MSWINSCK.OCX
Reg.nbd
Reg.nbd
Regicon.ocx
CheckRuntimes.bat
MSAGENT.EXE
tv_enua.exe
SSCALA32.OCX
SSCALB32.OCX
Uninstall.exe
ssa3d30.ocx
sstabs2.ocx
ButterflyOnDesktop.exe
56b47e35-e7f9-403c-8646-bafc096ae051.tmp
BookmarkMergedSurfaceOrdering
BrowsingTopicsState
f_000006
f_000009
f_00000a
f_00000b
f_000085
f_00008b
f_000098
f_0000d6
f_0000d9
f_0000e7
f_0000ec
f_00010f
f_000123
f_00013c
f_00013e
f_000162
ca111150bb9d645a_0
df53bad28ea1e322_0
the-real-index
the-real-index
the-real-index
the-real-index
MANIFEST-000001
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
TransportSecurity
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
the-real-index
the-real-index~RFe58e22d.TMP
the-real-index
CURRENT
index.txt
index.txt~RFe59d3e0.TMP
MANIFEST-000001
6
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
blocklist
protocols.json
crl-set
settings.dat
settings.dat
settings.dat
settings.dat
settings.dat
f_000082
f_000095
the-real-index
the-real-index
the-real-index~RFe5b71c1.TMP
data_1
SiteList-Enterprise.json
Edge Profile.ico
HubApps
Network Persistent State
Network Persistent State
Network Persistent State
TransportSecurity
c0babee5-9e4e-46c1-b0e5-b0fb85b51e16.tmp
Preferences
Preferences
Preferences
Preferences
Secure Preferences
Secure Preferences
sync_diagnostic.log
f089cde3-4921-4826-9f07-e97e5cdaf338.tmp
OperationConfig
OperationConfig~RFe60d0c1.TMP
office_endpoints_list.json
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
manifest.json
keys.json
nav_config.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
a2a1569c-2986-46ff-a96a-dc68c5c3245b.tmp
suggestions[1].en-US
0001.tmp
0002.tmp
0003.tmp
0004.tmp
0005.tmp
0006.tmp
42677dd5-bd21-4a0a-8045-f9090388734e.tmp
ADVPACK.DLL
AGENTANM.DLL
AGENTCTL.DLL
AGENTDP2.DLL
AGENTDPV.DLL
AGENTMPX.DLL
AGENTPSH.DLL
AGENTSR.DLL
AGENTSVR.EXE
AGT0409.DLL
AGT0409.HLP
AGT20.INF
AGTCTL15.TLB
AGTINST.INF
Msvcirt.dll
Msvcp50.dll
W95INF16.DLL
W95INF32.DLL
andmoipa.ttf
tv_enua.dll
tv_enua.hlp
tv_enua.inf
tvenuax.dll
d576dce8-88a9-43ea-98ee-8ee29881c30f.tmp
af5a7667-1fb1-465f-bf15-201b71a1134a.tmp
content_new.js
Flasher.exe
bon4 (1).zip
bon4.zip:Zone.Identifier
rickroll.exe
manifest.json
manifest.json
manifest.json
manifest.json
LICENSE
manifest.json
manifest.json
manifest.json
manifest.json
Bonzi.acs
Peedy.acs
mslwvtts.dll
memory/232-3917-0x00000124A2870000-0x00000124A298E000-memory.dmp
memory/780-1188-0x0000025789820000-0x000002578993E000-memory.dmp
memory/1364-2000-0x0000000002090000-0x00000000020F4000-memory.dmp
memory/1804-3939-0x0000000000C30000-0x0000000000C94000-memory.dmp
memory/1804-2916-0x0000000000C30000-0x0000000000C94000-memory.dmp
memory/3192-0-0x000001DA7CD00000-0x000001DA7CE1E000-memory.dmp
memory/3868-3922-0x0000000000400000-0x000000000070B000-memory.dmp
memory/3868-4901-0x0000000000400000-0x000000000070B000-memory.dmp
memory/3868-5015-0x0000000000400000-0x000000000070B000-memory.dmp
memory/3868-4248-0x0000000000400000-0x000000000070B000-memory.dmp
memory/3868-4164-0x0000000000400000-0x000000000070B000-memory.dmp
memory/3868-4093-0x0000000000400000-0x000000000070B000-memory.dmp
memory/3868-4037-0x0000000000400000-0x000000000070B000-memory.dmp
memory/3868-4562-0x0000000000400000-0x000000000070B000-memory.dmp
memory/3868-4992-0x0000000000400000-0x000000000070B000-memory.dmp
memory/3868-3976-0x0000000000400000-0x000000000070B000-memory.dmp
memory/3868-3943-0x0000000000400000-0x000000000070B000-memory.dmp
memory/3868-4704-0x0000000000400000-0x000000000070B000-memory.dmp
memory/3868-4984-0x0000000000400000-0x000000000070B000-memory.dmp
memory/3868-3936-0x0000000000400000-0x000000000070B000-memory.dmp
memory/3868-4963-0x0000000000400000-0x000000000070B000-memory.dmp
memory/3868-4741-0x0000000000400000-0x000000000070B000-memory.dmp
memory/3868-3892-0x0000000000400000-0x000000000070B000-memory.dmp
memory/3868-4925-0x0000000000400000-0x000000000070B000-memory.dmp
memory/3868-4768-0x0000000000400000-0x000000000070B000-memory.dmp
memory/3868-4205-0x0000000000400000-0x000000000070B000-memory.dmp
memory/3868-3786-0x00000000044C0000-0x0000000004524000-memory.dmp
memory/3868-4796-0x0000000000400000-0x000000000070B000-memory.dmp
memory/3868-3785-0x0000000000400000-0x000000000070B000-memory.dmp
memory/3868-4815-0x0000000000400000-0x000000000070B000-memory.dmp
memory/3868-4882-0x0000000000400000-0x000000000070B000-memory.dmp
memory/3868-4845-0x0000000000400000-0x000000000070B000-memory.dmp
memory/4036-1997-0x0000000000910000-0x0000000000974000-memory.dmp
memory/4244-2013-0x0000000002530000-0x0000000002594000-memory.dmp
memory/4364-3784-0x0000020607CA0000-0x0000020607DBE000-memory.dmp
memory/4520-2222-0x0000000000F90000-0x0000000000FF4000-memory.dmp
memory/4572-3397-0x0000000000400000-0x0000000000414000-memory.dmp
memory/4572-3439-0x0000000000400000-0x0000000000414000-memory.dmp
memory/4572-3435-0x0000000000400000-0x0000000000414000-memory.dmp
memory/4736-3437-0x0000000000400000-0x00000000004BC000-memory.dmp
memory/4736-3438-0x00000000024A0000-0x0000000002504000-memory.dmp
memory/4884-2226-0x0000000002570000-0x00000000025D4000-memory.dmp
memory/4884-2225-0x0000000000400000-0x0000000000424000-memory.dmp
memory/4884-1887-0x0000000000400000-0x0000000000424000-memory.dmp
memory/4884-1888-0x0000000002570000-0x00000000025D4000-memory.dmp
memory/4920-1994-0x00000000005F0000-0x0000000000654000-memory.dmp
memory/5196-2751-0x0000019388080000-0x000001938819E000-memory.dmp
memory/5304-2187-0x00000000011F0000-0x0000000001254000-memory.dmp
memory/5332-2190-0x0000000002E50000-0x0000000002EB4000-memory.dmp
memory/5360-2192-0x00000000024E0000-0x0000000002544000-memory.dmp
memory/5384-2193-0x0000000000A40000-0x0000000000AA4000-memory.dmp
memory/5404-2194-0x0000000000C40000-0x0000000000CA4000-memory.dmp
memory/5424-2195-0x0000000002220000-0x0000000002284000-memory.dmp
memory/5444-2196-0x0000000000B70000-0x0000000000BD4000-memory.dmp
memory/5464-2198-0x0000000002070000-0x00000000020D4000-memory.dmp
memory/5496-2201-0x00000000008C0000-0x0000000000924000-memory.dmp
memory/5536-3891-0x0000000000CA0000-0x0000000000D04000-memory.dmp
memory/5548-4954-0x0000000002470000-0x00000000024D4000-memory.dmp
memory/5548-3074-0x0000000002470000-0x00000000024D4000-memory.dmp
memory/5664-3890-0x00000148BB580000-0x00000148BB69E000-memory.dmp
memory/6836-4981-0x00000000023B0000-0x0000000002414000-memory.dmp
memory/6836-2914-0x00000000023B0000-0x0000000002414000-memory.dmp
memory/6884-2915-0x0000000002070000-0x00000000020D4000-memory.dmp
memory/6884-4236-0x0000000002070000-0x00000000020D4000-memory.dmp