Analysis
- user interaction
yes - max time kernel
706s - max time network
717s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
20/04/2026, 03:10
Errors
Reason
Machine shutdown
General
- Target image.png
- Size 37KB
- Sample260420-dph3hsby81
- SHA256 9e110904e395da651a0a2a3bf19c3e8311332abcaa6c2b5d3c3f368ddddfab69
Score
8/10
Malware Config
Signatures
- Badlisted process makes network request 3 IoCs
Network request originating from process or tool commonly abused by malware.
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Downloads MZ/PE file 2 IoCs
- Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings 2 TTPs 6 IoCs
Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 52 IoCs
- Loads dropped DLL 64 IoCs
- Adds Run key to start application 2 TTPs 3 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Drops Chrome extension 1 IoCs
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- System Binary Proxy Execution: Verclsid 1 TTPs 5 IoCs
Adversaries may abuse Verclsid to proxy execution of malicious code.
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Drops file in System32 directory 3 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 51 IoCs
- UPX packed file 7 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 39 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- System Time Discovery 1 TTPs 5 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks processor information in registry 2 TTPs 10 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 15 IoCs
- Modifies Internet Explorer settings 1 TTPs 23 IoCs
- Modifies data under HKEY_USERS 6 IoCs
- Modifies registry class 64 IoCs
- Modifies system certificate store 2 TTPs 2 IoCs
- Suspicious behavior: EnumeratesProcesses 52 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 64 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 18 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\mspaint.exe"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\image.png"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService1⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff96cebc728,0x7ff96cebc734,0x7ff96cebc7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1604,i,16502866651025507444,13340370205349852214,524288 --field-trial-handle=1832,i,3784642741099537180,1911677337751295369,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2104 /prefetch:32⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1712,i,12216162819483974507,4798161979003530254,262144 --field-trial-handle=1832,i,3784642741099537180,1911677337751295369,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=1828 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2428,i,15516879828204932310,1107961672504400924,524288 --field-trial-handle=1832,i,3784642741099537180,1911677337751295369,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2588 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3216,i,13967025413141066044,4233970369262539870,2097152 --field-trial-handle=1832,i,3784642741099537180,1911677337751295369,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3228 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3236,i,6481288030560127759,3680471950243843757,2097152 --field-trial-handle=1832,i,3784642741099537180,1911677337751295369,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3268 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4316,i,13967683531516503320,5747512632818623229,2097152 --field-trial-handle=1832,i,3784642741099537180,1911677337751295369,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4344 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4776,i,13104734854508883935,8040311322439378424,2097152 --field-trial-handle=1832,i,3784642741099537180,1911677337751295369,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4728 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5536,i,14271312078837349892,7131910796065097670,524288 --field-trial-handle=1832,i,3784642741099537180,1911677337751295369,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5488 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5932,i,12138893412605264290,5999437406315151112,2097152 --field-trial-handle=1832,i,3784642741099537180,1911677337751295369,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5868 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5944,i,3371489888677012556,2002379988483943915,2097152 --field-trial-handle=1832,i,3784642741099537180,1911677337751295369,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3328 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5932,i,6642869455364686654,13270219579283455375,524288 --field-trial-handle=1832,i,3784642741099537180,1911677337751295369,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=240 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5928,i,9526801571953816205,7144503001686550327,524288 --field-trial-handle=1832,i,3784642741099537180,1911677337751295369,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5936 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5564,i,10273497483348512325,16280848867575356181,524288 --field-trial-handle=1832,i,3784642741099537180,1911677337751295369,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3384 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6088,i,4800286040611465350,12064553132648328046,2097152 --field-trial-handle=1832,i,3784642741099537180,1911677337751295369,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3920 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=4396,i,4116892099646988303,16663139374446654530,2097152 --field-trial-handle=1832,i,3784642741099537180,1911677337751295369,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6096 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=4452,i,7185102381982957531,5488420295131420057,2097152 --field-trial-handle=1832,i,3784642741099537180,1911677337751295369,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3444 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5548,i,10069604937726695663,18088232311493977443,2097152 --field-trial-handle=1832,i,3784642741099537180,1911677337751295369,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5784 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6460,i,5609005316625381585,6395944861910053814,2097152 --field-trial-handle=1832,i,3784642741099537180,1911677337751295369,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6476 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6584,i,16410839477283577443,6612489887895879799,2097152 --field-trial-handle=1832,i,3784642741099537180,1911677337751295369,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6676 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6596,i,9485808826911990122,7356336034259292565,524288 --field-trial-handle=1832,i,3784642741099537180,1911677337751295369,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6960 /prefetch:82⤵
-
-
C:\Users\Admin\Downloads\FlyPDFy.exe"C:\Users\Admin\Downloads\FlyPDFy.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\TEMP\{5A2C730E-DFCD-41E6-8369-1D5ED00AF59F}\.cr\FlyPDFy.exe"C:\Windows\TEMP\{5A2C730E-DFCD-41E6-8369-1D5ED00AF59F}\.cr\FlyPDFy.exe" -burn.clean.room="C:\Users\Admin\Downloads\FlyPDFy.exe" -burn.filehandle.attached=748 -burn.filehandle.self=7523⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=7160,i,4744984657106928365,18211494500755429915,2097152 --field-trial-handle=1832,i,3784642741099537180,1911677337751295369,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6944 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=4408,i,11125851587412808053,11532816609296899945,2097152 --field-trial-handle=1832,i,3784642741099537180,1911677337751295369,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4348 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=4396,i,14599429083999908076,2610429128890719931,2097152 --field-trial-handle=1832,i,3784642741099537180,1911677337751295369,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6676 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=4368,i,1840722911329237436,15321715270069338371,2097152 --field-trial-handle=1832,i,3784642741099537180,1911677337751295369,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6560 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=7424,i,5368153285790009257,15410884226701108873,524288 --field-trial-handle=1832,i,3784642741099537180,1911677337751295369,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=7420 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=6104,i,3621302220556010163,277368695571307392,2097152 --field-trial-handle=1832,i,3784642741099537180,1911677337751295369,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=7444 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6508,i,11463326185816364652,4948913587734203521,262144 --field-trial-handle=1832,i,3784642741099537180,1911677337751295369,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6548 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=7676,i,17456175308678552366,3669920192873496633,2097152 --field-trial-handle=1832,i,3784642741099537180,1911677337751295369,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=7684 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=7652,i,16843068807447922886,14880979671223982492,2097152 --field-trial-handle=1832,i,3784642741099537180,1911677337751295369,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6596 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=7904,i,15486804218824004871,4163228525929761906,2097152 --field-trial-handle=1832,i,3784642741099537180,1911677337751295369,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=7932 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=7908,i,2894157589017051891,8455226350053681823,2097152 --field-trial-handle=1832,i,3784642741099537180,1911677337751295369,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=8004 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=7628,i,7601943062866130288,14123423136064295445,2097152 --field-trial-handle=1832,i,3784642741099537180,1911677337751295369,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=7692 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --metrics-shmem-handle=7756,i,13750140453923992606,17973695512796671077,2097152 --field-trial-handle=1832,i,3784642741099537180,1911677337751295369,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=8104 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --metrics-shmem-handle=8220,i,4588525432829878331,15096643115765636995,2097152 --field-trial-handle=1832,i,3784642741099537180,1911677337751295369,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=7636 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=media.mojom.CdmServiceBroker --lang=en-US --service-sandbox-type=cdm --force-high-res-timeticks=disabled --metrics-shmem-handle=8392,i,12873270693238686847,17893560514479857068,524288 --field-trial-handle=1832,i,3784642741099537180,1911677337751295369,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=8404 /prefetch:82⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=8712,i,5937146968436793314,82409766233665399,524288 --field-trial-handle=1832,i,3784642741099537180,1911677337751295369,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=8720 /prefetch:82⤵
-
-
C:\Users\Admin\Downloads\setup.exe"C:\Users\Admin\Downloads\setup.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\PulseSoftware5868_922944294\bin\updater.exe"C:\Program Files\PulseSoftware5868_922944294\bin\updater.exe" --install=appguid={2F4E88B4-E690-4E1F-AA9E-B7A4617F881D}&appname=PulseBrowser&iid={5bf57fa1-6f4d-49ce-431d-e3c35cbf5ecc} --enable-logging --vmodule=*/components/winhttp/*=1,*/components/update_client/*=2,*/chrome/enterprise_companion/*=2,*/chrome/updater/*=23⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\PulseSoftware5868_922944294\bin\updater.exe"C:\Program Files\PulseSoftware5868_922944294\bin\updater.exe" --crash-handler --database=C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowserUpdater\133.0.6943.177\Crashpad --url=https://pulsebrowser.com/ --annotation=prod=PulseBrowserUpdater --annotation=ver=133.0.6943.177 --initial-client-data=0x250,0x254,0x258,0x22c,0x25c,0x7ff64f66454c,0x7ff64f664558,0x7ff64f6645684⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\pulsebrowser.exe"C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\pulsebrowser.exe" --from-installer4⤵
- Executes dropped EXE
-
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --metrics-shmem-handle=8464,i,14252620133645574903,2321625863827762373,2097152 --field-trial-handle=1832,i,3784642741099537180,1911677337751295369,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=8168 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 4F69AF4E33F6139DBBA8F49F0FDBD80D2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSIE7F5.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240773500 2 RequestSender!Installer.Actions.CustomActions.Start3⤵
- Badlisted process makes network request
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSIED74.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240774531 6 RequestSender!Installer.Actions.CustomActions.CreateScheduledTask3⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSIEFF7.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240775156 10 RequestSender!Installer.Actions.CustomActions.Finish3⤵
- Badlisted process makes network request
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSIF70C.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240777000 14 RequestSender!Installer.Actions.CustomActions.OpenUrl3⤵
- Checks computer location settings
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" https://web.flypdfapp.com/#/done4⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff96cebc728,0x7ff96cebc734,0x7ff96cebc7405⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Package Cache\{49AD0552-A7B5-4655-BB4F-DCD7E2DD7B28}\FlyPDFy.exe"C:\Users\Admin\AppData\Local\Package Cache\{49AD0552-A7B5-4655-BB4F-DCD7E2DD7B28}\FlyPDFy.exe" /burn.clean.room /burn.runonce1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Package Cache\{49AD0552-A7B5-4655-BB4F-DCD7E2DD7B28}\FlyPDFy.exe"C:\Users\Admin\AppData\Local\Package Cache\{49AD0552-A7B5-4655-BB4F-DCD7E2DD7B28}\FlyPDFy.exe" /burn.clean.room /burn.log.append "C:\Users\Admin\AppData\Local\Temp\.\FlyPDFy_3.0.0_20260420041254.log"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowserUpdater\133.0.6943.177\updater.exe"C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowserUpdater\133.0.6943.177\updater.exe" --server --service=update-internal -Embedding1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowserUpdater\133.0.6943.177\updater.exeC:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowserUpdater\133.0.6943.177\updater.exe --crash-handler --database=C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowserUpdater\133.0.6943.177\Crashpad --url=https://pulsebrowser.com/ --annotation=prod=PulseBrowserUpdater --annotation=ver=133.0.6943.177 --initial-client-data=0x250,0x254,0x258,0x22c,0x25c,0x7ff72955454c,0x7ff729554558,0x7ff7295545682⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowserUpdater\133.0.6943.177\updater.exe"C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowserUpdater\133.0.6943.177\updater.exe" --server --service=update -Embedding1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowserUpdater\133.0.6943.177\updater.exeC:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowserUpdater\133.0.6943.177\updater.exe --crash-handler --database=C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowserUpdater\133.0.6943.177\Crashpad --url=https://pulsebrowser.com/ --annotation=prod=PulseBrowserUpdater --annotation=ver=133.0.6943.177 --initial-client-data=0x250,0x254,0x258,0x22c,0x25c,0x7ff72955454c,0x7ff729554558,0x7ff7295545682⤵
- Executes dropped EXE
-
-
C:\Program Files\chrome_Unpacker_BeginUnzipping3216_1040703289\pulsebrowser_installer_144.0.7559.70.exe"C:\Program Files\chrome_Unpacker_BeginUnzipping3216_1040703289\pulsebrowser_installer_144.0.7559.70.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Program Files\chrome_Unpacker_BeginUnzipping3216_1040703289\CR_D77DB.tmp\setup.exe"C:\Program Files\chrome_Unpacker_BeginUnzipping3216_1040703289\CR_D77DB.tmp\setup.exe" --install-archive="C:\Program Files\chrome_Unpacker_BeginUnzipping3216_1040703289\CR_D77DB.tmp\PULSEBROWSER.PACKED.7Z"3⤵
- Executes dropped EXE
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Program Files\chrome_Unpacker_BeginUnzipping3216_1040703289\CR_D77DB.tmp\setup.exe"C:\Program Files\chrome_Unpacker_BeginUnzipping3216_1040703289\CR_D77DB.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=PulseBrowser --annotation=ver=144.0.7559.70 "--attachment=C:\Program Files\chromium_installer.log" --initial-client-data=0x26c,0x270,0x274,0x248,0x278,0x7ff67ba7a000,0x7ff67ba7a00c,0x7ff67ba7a0184⤵
- Executes dropped EXE
-
-
C:\Program Files\chrome_Unpacker_BeginUnzipping3216_1040703289\CR_D77DB.tmp\setup.exe"C:\Program Files\chrome_Unpacker_BeginUnzipping3216_1040703289\CR_D77DB.tmp\setup.exe" --verbose-logging --create-shortcuts=0 --install-level=04⤵
- Executes dropped EXE
-
C:\Program Files\chrome_Unpacker_BeginUnzipping3216_1040703289\CR_D77DB.tmp\setup.exe"C:\Program Files\chrome_Unpacker_BeginUnzipping3216_1040703289\CR_D77DB.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=PulseBrowser --annotation=ver=144.0.7559.70 "--attachment=C:\Program Files\chromium_installer.log" --initial-client-data=0x26c,0x270,0x274,0x248,0x278,0x7ff67ba7a000,0x7ff67ba7a00c,0x7ff67ba7a0185⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\pulsebrowser.exe"C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\pulsebrowser.exe" --from-installer4⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\pulsebrowser.exe"C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\pulsebrowser.exe" --type=gpu-process --force-high-res-timeticks=disabled --start-stack-profiler --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1884,i,16845264496422441222,12327555039537885800,262144 --field-trial-handle=2068,i,11853578781360174295,5800446748407886832,262144 --variations-seed-version --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2064 /prefetch:25⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\pulsebrowser.exe"C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\pulsebrowser.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --start-stack-profiler --metrics-shmem-handle=2320,i,9873665626708083742,3490499881069277918,524288 --field-trial-handle=2068,i,11853578781360174295,5800446748407886832,262144 --variations-seed-version --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2324 /prefetch:35⤵
- Executes dropped EXE
- Loads dropped DLL
- System Time Discovery
-
-
C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\pulsebrowser.exe"C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\pulsebrowser.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2492,i,10559870674976105398,3211327767195995083,524288 --field-trial-handle=2068,i,11853578781360174295,5800446748407886832,262144 --variations-seed-version --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2504 /prefetch:85⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\pulsebrowser.exe"C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\pulsebrowser.exe" --type=renderer --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3500,i,8545082485742299303,5394987297327712721,2097152 --field-trial-handle=2068,i,11853578781360174295,5800446748407886832,262144 --variations-seed-version --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3528 /prefetch:15⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\pulsebrowser.exe"C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\pulsebrowser.exe" --type=renderer --instant-process --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3508,i,11156845452319847832,3395742470011696635,2097152 --field-trial-handle=2068,i,11853578781360174295,5800446748407886832,262144 --variations-seed-version --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3532 /prefetch:15⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\pulsebrowser.exe"C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\pulsebrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3912,i,5205068621675979503,11180835246551034549,524288 --field-trial-handle=2068,i,11853578781360174295,5800446748407886832,262144 --variations-seed-version --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=3840 /prefetch:85⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\pulsebrowser.exe"C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\pulsebrowser.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5012,i,9282590186155835640,12981934494335412220,524288 --field-trial-handle=2068,i,11853578781360174295,5800446748407886832,262144 --variations-seed-version --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=5072 /prefetch:85⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\pulsebrowser.exe"C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\pulsebrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5220,i,4030187749754794212,10275149122759426199,524288 --field-trial-handle=2068,i,11853578781360174295,5800446748407886832,262144 --variations-seed-version --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=5232 /prefetch:85⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\pulsebrowser.exe"C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\pulsebrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5204,i,16712879280716864993,2201861959485566187,524288 --field-trial-handle=2068,i,11853578781360174295,5800446748407886832,262144 --variations-seed-version --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=5144 /prefetch:85⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\pulsebrowser.exe"C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\pulsebrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5072,i,8620519038759713727,13729938210554153581,524288 --field-trial-handle=2068,i,11853578781360174295,5800446748407886832,262144 --variations-seed-version --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=5260 /prefetch:85⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\pulsebrowser.exe"C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\pulsebrowser.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5472,i,18281557165204860371,2757175342549453218,2097152 --field-trial-handle=2068,i,11853578781360174295,5800446748407886832,262144 --variations-seed-version --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=5500 /prefetch:25⤵
- Checks computer location settings
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\pulsebrowser.exe"C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\pulsebrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5904,i,16656642448270543646,18285668369691779215,524288 --field-trial-handle=2068,i,11853578781360174295,5800446748407886832,262144 --variations-seed-version --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=5932 /prefetch:85⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\pulsebrowser.exe"C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\pulsebrowser.exe" --type=renderer --force-high-res-timeticks=disabled --start-stack-profiler --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6052,i,18210501550400649184,15600390120801359617,2097152 --field-trial-handle=2068,i,11853578781360174295,5800446748407886832,262144 --variations-seed-version --trace-process-track-uuid=3190708999430457380 --mojo-platform-channel-handle=6024 /prefetch:15⤵
- Checks computer location settings
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\pulsebrowser.exe"C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\pulsebrowser.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=6160,i,13288825495308227110,8887535152124304914,524288 --field-trial-handle=2068,i,11853578781360174295,5800446748407886832,262144 --variations-seed-version --trace-process-track-uuid=3190709000367499229 --mojo-platform-channel-handle=6172 /prefetch:85⤵
- Executes dropped EXE
-
-
-
-
-
C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowserUpdater\133.0.6943.177\updater.exe"C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowserUpdater\133.0.6943.177\updater.exe" --wake1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowserUpdater\133.0.6943.177\updater.exeC:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowserUpdater\133.0.6943.177\updater.exe --crash-handler --database=C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowserUpdater\133.0.6943.177\Crashpad --url=https://pulsebrowser.com/ --annotation=prod=PulseBrowserUpdater --annotation=ver=133.0.6943.177 --initial-client-data=0x234,0x238,0x23c,0x210,0x240,0x7ff72955454c,0x7ff729554558,0x7ff7295545682⤵
- Executes dropped EXE
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe" -Embedding1⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x1e8,0x1ec,0x1f0,0x1c4,0x1f4,0x7ff605023764,0x7ff605023770,0x7ff6050237802⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Drops Chrome extension
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff96cebc728,0x7ff96cebc734,0x7ff96cebc7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1928,i,15587775924157089430,9532527392805735381,524288 --field-trial-handle=2032,i,11718577789553960899,1285541337802272080,262144 --variations-seed-version=20260419-030044.020000-production --mojo-platform-channel-handle=2088 /prefetch:32⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1636,i,5835045661630444947,11892069634349525987,262144 --field-trial-handle=2032,i,11718577789553960899,1285541337802272080,262144 --variations-seed-version=20260419-030044.020000-production --mojo-platform-channel-handle=2028 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2380,i,16496489770673357218,5535385944485442481,524288 --field-trial-handle=2032,i,11718577789553960899,1285541337802272080,262144 --variations-seed-version=20260419-030044.020000-production --mojo-platform-channel-handle=2548 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3204,i,10907378069727273056,10018773724781075766,2097152 --field-trial-handle=2032,i,11718577789553960899,1285541337802272080,262144 --variations-seed-version=20260419-030044.020000-production --mojo-platform-channel-handle=3236 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3208,i,1120937398862949121,17316508442787450829,2097152 --field-trial-handle=2032,i,11718577789553960899,1285541337802272080,262144 --variations-seed-version=20260419-030044.020000-production --mojo-platform-channel-handle=3276 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4528,i,10501901887493426605,13911178705613791863,2097152 --field-trial-handle=2032,i,11718577789553960899,1285541337802272080,262144 --variations-seed-version=20260419-030044.020000-production --mojo-platform-channel-handle=4532 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5320,i,10367262466826919303,6684372518624071619,524288 --field-trial-handle=2032,i,11718577789553960899,1285541337802272080,262144 --variations-seed-version=20260419-030044.020000-production --mojo-platform-channel-handle=5336 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5668,i,18295456312131585495,9393173408763255697,2097152 --field-trial-handle=2032,i,11718577789553960899,1285541337802272080,262144 --variations-seed-version=20260419-030044.020000-production --mojo-platform-channel-handle=5572 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=3268,i,33599709895667883,12951397701530925398,2097152 --field-trial-handle=2032,i,11718577789553960899,1285541337802272080,262144 --variations-seed-version=20260419-030044.020000-production --mojo-platform-channel-handle=4560 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3416,i,13167742538554392764,6883947552757354727,2097152 --field-trial-handle=2032,i,11718577789553960899,1285541337802272080,262144 --variations-seed-version=20260419-030044.020000-production --mojo-platform-channel-handle=5844 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5960,i,10500033506745788810,5884304606811036630,2097152 --field-trial-handle=2032,i,11718577789553960899,1285541337802272080,262144 --variations-seed-version=20260419-030044.020000-production --mojo-platform-channel-handle=5976 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=6168,i,2775976169482349816,8682920861240477456,2097152 --field-trial-handle=2032,i,11718577789553960899,1285541337802272080,262144 --variations-seed-version=20260419-030044.020000-production --mojo-platform-channel-handle=6152 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6288,i,9957045403439402516,17501250013973137052,2097152 --field-trial-handle=2032,i,11718577789553960899,1285541337802272080,262144 --variations-seed-version=20260419-030044.020000-production --mojo-platform-channel-handle=6260 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6220,i,16575121822097136756,2051145039415304064,524288 --field-trial-handle=2032,i,11718577789553960899,1285541337802272080,262144 --variations-seed-version=20260419-030044.020000-production --mojo-platform-channel-handle=6456 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6228,i,10100939045809357029,1179345285086312112,524288 --field-trial-handle=2032,i,11718577789553960899,1285541337802272080,262144 --variations-seed-version=20260419-030044.020000-production --mojo-platform-channel-handle=208 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6240,i,3345703408680300046,14637229129342632784,524288 --field-trial-handle=2032,i,11718577789553960899,1285541337802272080,262144 --variations-seed-version=20260419-030044.020000-production --mojo-platform-channel-handle=3452 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5964,i,2331085691197445305,15265998283074305778,2097152 --field-trial-handle=2032,i,11718577789553960899,1285541337802272080,262144 --variations-seed-version=20260419-030044.020000-production --mojo-platform-channel-handle=6464 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6428,i,3233692791399711383,2534228273792120959,2097152 --field-trial-handle=2032,i,11718577789553960899,1285541337802272080,262144 --variations-seed-version=20260419-030044.020000-production --mojo-platform-channel-handle=6288 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=5384,i,16068728866365533137,7157383359924671940,2097152 --field-trial-handle=2032,i,11718577789553960899,1285541337802272080,262144 --variations-seed-version=20260419-030044.020000-production --mojo-platform-channel-handle=6860 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6236,i,9346931643469060410,7942832042837025431,2097152 --field-trial-handle=2032,i,11718577789553960899,1285541337802272080,262144 --variations-seed-version=20260419-030044.020000-production --mojo-platform-channel-handle=6808 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5892,i,11219270305303649162,7281665429780094061,2097152 --field-trial-handle=2032,i,11718577789553960899,1285541337802272080,262144 --variations-seed-version=20260419-030044.020000-production --mojo-platform-channel-handle=5776 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6532,i,4178692266620717427,12306315902446846144,2097152 --field-trial-handle=2032,i,11718577789553960899,1285541337802272080,262144 --variations-seed-version=20260419-030044.020000-production --mojo-platform-channel-handle=6560 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6644,i,10540759848508331824,15101756429540472946,262144 --field-trial-handle=2032,i,11718577789553960899,1285541337802272080,262144 --variations-seed-version=20260419-030044.020000-production --mojo-platform-channel-handle=6324 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6536,i,15280564283697176655,14036558297907591882,2097152 --field-trial-handle=2032,i,11718577789553960899,1285541337802272080,262144 --variations-seed-version=20260419-030044.020000-production --mojo-platform-channel-handle=6288 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6472,i,7648092887533957796,1155127933967883802,524288 --field-trial-handle=2032,i,11718577789553960899,1285541337802272080,262144 --variations-seed-version=20260419-030044.020000-production --mojo-platform-channel-handle=6644 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=6268,i,15570064039255743774,1211900766908684315,2097152 --field-trial-handle=2032,i,11718577789553960899,1285541337802272080,262144 --variations-seed-version=20260419-030044.020000-production --mojo-platform-channel-handle=6600 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=5908,i,16694079469313990672,9863607896081262939,2097152 --field-trial-handle=2032,i,11718577789553960899,1285541337802272080,262144 --variations-seed-version=20260419-030044.020000-production --mojo-platform-channel-handle=6644 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=3428,i,17453690242199086411,12397250577428042492,2097152 --field-trial-handle=2032,i,11718577789553960899,1285541337802272080,262144 --variations-seed-version=20260419-030044.020000-production --mojo-platform-channel-handle=6284 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=7040,i,11889643522648830632,8968057224071045806,524288 --field-trial-handle=2032,i,11718577789553960899,1285541337802272080,262144 --variations-seed-version=20260419-030044.020000-production --mojo-platform-channel-handle=7000 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=7148,i,10498228078151457135,2716452337587187811,524288 --field-trial-handle=2032,i,11718577789553960899,1285541337802272080,262144 --variations-seed-version=20260419-030044.020000-production --mojo-platform-channel-handle=7136 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=7144,i,997320064835363221,8749625402034600931,524288 --field-trial-handle=2032,i,11718577789553960899,1285541337802272080,262144 --variations-seed-version=20260419-030044.020000-production --mojo-platform-channel-handle=5484 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=7124,i,8898358816440748346,8485889786349881497,524288 --field-trial-handle=2032,i,11718577789553960899,1285541337802272080,262144 --variations-seed-version=20260419-030044.020000-production --mojo-platform-channel-handle=7252 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=7148,i,3942373626276138808,18382447226743588666,524288 --field-trial-handle=2032,i,11718577789553960899,1285541337802272080,262144 --variations-seed-version=20260419-030044.020000-production --mojo-platform-channel-handle=7248 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --metrics-shmem-handle=3272,i,2910245204300459775,6103538231973595284,2097152 --field-trial-handle=2032,i,11718577789553960899,1285541337802272080,262144 --variations-seed-version=20260419-030044.020000-production --mojo-platform-channel-handle=5904 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --metrics-shmem-handle=4536,i,8766138269537110624,5681690827347544522,2097152 --field-trial-handle=2032,i,11718577789553960899,1285541337802272080,262144 --variations-seed-version=20260419-030044.020000-production --mojo-platform-channel-handle=4652 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --metrics-shmem-handle=6584,i,3879411633905381558,1646485705764839226,2097152 --field-trial-handle=2032,i,11718577789553960899,1285541337802272080,262144 --variations-seed-version=20260419-030044.020000-production --mojo-platform-channel-handle=1516 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --metrics-shmem-handle=6856,i,13768497955975823016,17842376891445424539,2097152 --field-trial-handle=2032,i,11718577789553960899,1285541337802272080,262144 --variations-seed-version=20260419-030044.020000-production --mojo-platform-channel-handle=5584 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=6832,i,15400085009336983650,2539207087185209036,524288 --field-trial-handle=2032,i,11718577789553960899,1285541337802272080,262144 --variations-seed-version=20260419-030044.020000-production --mojo-platform-channel-handle=7008 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --metrics-shmem-handle=6504,i,2302800443318436044,7536265016499002142,2097152 --field-trial-handle=2032,i,11718577789553960899,1285541337802272080,262144 --variations-seed-version=20260419-030044.020000-production --mojo-platform-channel-handle=6968 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --metrics-shmem-handle=6536,i,9766068443960893300,3524373224983884233,2097152 --field-trial-handle=2032,i,11718577789553960899,1285541337802272080,262144 --variations-seed-version=20260419-030044.020000-production --mojo-platform-channel-handle=6448 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --metrics-shmem-handle=7268,i,8909913363304906246,11336702500371152439,2097152 --field-trial-handle=2032,i,11718577789553960899,1285541337802272080,262144 --variations-seed-version=20260419-030044.020000-production --mojo-platform-channel-handle=7316 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --metrics-shmem-handle=6628,i,14110155742698823099,7193388179040427364,2097152 --field-trial-handle=2032,i,11718577789553960899,1285541337802272080,262144 --variations-seed-version=20260419-030044.020000-production --mojo-platform-channel-handle=5872 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=7196,i,1004286200050247367,12584957992734170641,524288 --field-trial-handle=2032,i,11718577789553960899,1285541337802272080,262144 --variations-seed-version=20260419-030044.020000-production --mojo-platform-channel-handle=7112 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --metrics-shmem-handle=6916,i,2247742063561317821,12256869750064986035,2097152 --field-trial-handle=2032,i,11718577789553960899,1285541337802272080,262144 --variations-seed-version=20260419-030044.020000-production --mojo-platform-channel-handle=6656 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6668,i,17047799689864483819,14126137210822351787,524288 --field-trial-handle=2032,i,11718577789553960899,1285541337802272080,262144 --variations-seed-version=20260419-030044.020000-production --mojo-platform-channel-handle=7184 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --metrics-shmem-handle=7448,i,746625387245529251,6508194405417554739,524288 --field-trial-handle=2032,i,11718577789553960899,1285541337802272080,262144 --variations-seed-version=20260419-030044.020000-production --mojo-platform-channel-handle=5872 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --metrics-shmem-handle=7484,i,616481987087580217,3358080736943156957,524288 --field-trial-handle=2032,i,11718577789553960899,1285541337802272080,262144 --variations-seed-version=20260419-030044.020000-production --mojo-platform-channel-handle=7496 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\Downloads\bon4\BonziBuddy432.exe"C:\Users\Admin\Downloads\bon4\BonziBuddy432.exe"1⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\BonziBuddy432\Runtimes\CheckRuntimes.bat" "2⤵
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\BonziBuddy432\Runtimes\MSAGENT.EXEMSAGENT.EXE3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s "C:\Windows\msagent\AgentCtl.dll"4⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s "C:\Windows\msagent\AgentDPv.dll"4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s "C:\Windows\msagent\mslwvtts.dll"4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s "C:\Windows\msagent\AgentDP2.dll"4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s "C:\Windows\msagent\AgentMPx.dll"4⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s "C:\Windows\msagent\AgentSR.dll"4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s "C:\Windows\msagent\AgentPsh.dll"4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\msagent\AgentSvr.exe"C:\Windows\msagent\AgentSvr.exe" /regserver4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SysWOW64\grpconv.exegrpconv.exe -o4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Program Files (x86)\BonziBuddy432\Runtimes\tv_enua.exetv_enua.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s C:\Windows\lhsp\tv\tv_enua.dll4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s C:\Windows\lhsp\tv\tvenuax.dll4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\grpconv.exegrpconv.exe -o4⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bonzibuddy.tk/2⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://bonzibuddy.tk/3⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x244,0x7ff9604fc188,0x7ff9604fc194,0x7ff9604fc1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2000,i,1903091296513498776,6486987283275375503,524288 --field-trial-handle=2060,i,18031795401863450886,11759666654321842676,262144 --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:34⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1892,i,10806710124468072668,5697226560857698458,262144 --field-trial-handle=2060,i,18031795401863450886,11759666654321842676,262144 --variations-seed-version --mojo-platform-channel-handle=2056 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1996,i,979468562949597961,14171539085552492098,524288 --field-trial-handle=2060,i,18031795401863450886,11759666654321842676,262144 --variations-seed-version --mojo-platform-channel-handle=2596 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3536,i,7697556363825051501,4388023954818928504,2097152 --field-trial-handle=2060,i,18031795401863450886,11759666654321842676,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3564,i,1421805965241356431,9228294583971343841,2097152 --field-trial-handle=2060,i,18031795401863450886,11759666654321842676,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4348,i,6535031147900210852,2777418704104464168,2097152 --field-trial-handle=2060,i,18031795401863450886,11759666654321842676,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4332,i,17281448039294787052,11717528977795468734,2097152 --field-trial-handle=2060,i,18031795401863450886,11759666654321842676,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5232,i,15852704409646865693,6715125149027537475,524288 --field-trial-handle=2060,i,18031795401863450886,11759666654321842676,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5276,i,765511265958942482,3203508106459149226,524288 --field-trial-handle=2060,i,18031795401863450886,11759666654321842676,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5416,i,2212850152737686767,12719177303329453573,2097152 --field-trial-handle=2060,i,18031795401863450886,11759666654321842676,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,14575839222164585886,14166958775217550286,524288 --field-trial-handle=2060,i,18031795401863450886,11759666654321842676,262144 --variations-seed-version --mojo-platform-channel-handle=3848 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3616,i,5123489165598094820,17320533201135819694,524288 --field-trial-handle=2060,i,18031795401863450886,11759666654321842676,262144 --variations-seed-version --mojo-platform-channel-handle=3788 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5980,i,11426975879039950655,95259951922669366,524288 --field-trial-handle=2060,i,18031795401863450886,11759666654321842676,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5980,i,11426975879039950655,95259951922669366,524288 --field-trial-handle=2060,i,18031795401863450886,11759666654321842676,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6152,i,1150574919002124667,13100103595776193380,524288 --field-trial-handle=2060,i,18031795401863450886,11759666654321842676,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6332,i,6320741055834781284,16893739887999488456,524288 --field-trial-handle=2060,i,18031795401863450886,11759666654321842676,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6444,i,3243831479000955607,11748804370431929263,524288 --field-trial-handle=2060,i,18031795401863450886,11759666654321842676,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6340,i,17788209996827997864,14107648145131396064,524288 --field-trial-handle=2060,i,18031795401863450886,11759666654321842676,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6416,i,2492491104821963267,10435219841042576215,524288 --field-trial-handle=2060,i,18031795401863450886,11759666654321842676,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:84⤵
-
-
-
-
C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowserUpdater\133.0.6943.177\updater.exeC:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowserUpdater\133.0.6943.177\updater.exe --wake1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowserUpdater\133.0.6943.177\updater.exeC:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowserUpdater\133.0.6943.177\updater.exe --crash-handler --database=C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowserUpdater\133.0.6943.177\Crashpad --url=https://pulsebrowser.com/ --annotation=prod=PulseBrowserUpdater --annotation=ver=133.0.6943.177 --initial-client-data=0x234,0x238,0x23c,0x210,0x240,0x7ff72955454c,0x7ff729554558,0x7ff7295545682⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowserUpdater\133.0.6943.177\updater.exe"C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowserUpdater\133.0.6943.177\updater.exe" --server --service=update-internal -Embedding1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowserUpdater\133.0.6943.177\updater.exeC:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowserUpdater\133.0.6943.177\updater.exe --crash-handler --database=C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowserUpdater\133.0.6943.177\Crashpad --url=https://pulsebrowser.com/ --annotation=prod=PulseBrowserUpdater --annotation=ver=133.0.6943.177 --initial-client-data=0x234,0x238,0x23c,0x210,0x240,0x7ff72955454c,0x7ff729554558,0x7ff7295545682⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowserUpdater\133.0.6943.177\updater.exe"C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowserUpdater\133.0.6943.177\updater.exe" --server --service=update -Embedding1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowserUpdater\133.0.6943.177\updater.exeC:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowserUpdater\133.0.6943.177\updater.exe --crash-handler --database=C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowserUpdater\133.0.6943.177\Crashpad --url=https://pulsebrowser.com/ --annotation=prod=PulseBrowserUpdater --annotation=ver=133.0.6943.177 --initial-client-data=0x234,0x238,0x23c,0x210,0x240,0x7ff72955454c,0x7ff729554558,0x7ff7295545682⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\BonziBuddy432\BonziBDY_2.EXE"C:\Program Files (x86)\BonziBuddy432\BonziBDY_2.EXE"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\msagent\AgentSvr.exeC:\Windows\msagent\AgentSvr.exe -Embedding1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x304 0x4e41⤵
-
C:\Program Files (x86)\BonziBuddy432\BonziBDY_35.EXE"C:\Program Files (x86)\BonziBuddy432\BonziBDY_35.EXE"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\BonziBuddy432\BonziBDY_4.EXE"C:\Program Files (x86)\BonziBuddy432\BonziBDY_4.EXE"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe shell32.dll,Control_RunDLL speech.cpl,,02⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\RunDll32.exeC:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL speech.cpl,,03⤵
-
-
-
C:\Program Files (x86)\Internet Explorer\ielowutil.exe"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding1⤵
- System Location Discovery: System Language Discovery
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1964 CREDAT:17410 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff96cebc728,0x7ff96cebc734,0x7ff96cebc7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1740,i,10553330627997756532,8079665904122675671,262144 --field-trial-handle=1980,i,11863063869555974349,5949463374231919654,262144 --variations-seed-version=20260419-030044.020000-production --mojo-platform-channel-handle=1976 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2236,i,12404209206731036761,17477158593613683394,524288 --field-trial-handle=1980,i,11863063869555974349,5949463374231919654,262144 --variations-seed-version=20260419-030044.020000-production --mojo-platform-channel-handle=2244 /prefetch:32⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2356,i,12503466846707481271,14347227781257739506,524288 --field-trial-handle=1980,i,11863063869555974349,5949463374231919654,262144 --variations-seed-version=20260419-030044.020000-production --mojo-platform-channel-handle=2540 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3252,i,10951280628807358781,3105037800464290874,2097152 --field-trial-handle=1980,i,11863063869555974349,5949463374231919654,262144 --variations-seed-version=20260419-030044.020000-production --mojo-platform-channel-handle=3268 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3244,i,16359808877297065830,14033321021115248799,2097152 --field-trial-handle=1980,i,11863063869555974349,5949463374231919654,262144 --variations-seed-version=20260419-030044.020000-production --mojo-platform-channel-handle=3316 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5156,i,15591283694016790234,15805183614507241927,524288 --field-trial-handle=1980,i,11863063869555974349,5949463374231919654,262144 --variations-seed-version=20260419-030044.020000-production --mojo-platform-channel-handle=5160 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5260,i,12539932989076795346,14195490418146652308,2097152 --field-trial-handle=1980,i,11863063869555974349,5949463374231919654,262144 --variations-seed-version=20260419-030044.020000-production --mojo-platform-channel-handle=5448 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3948,i,9307988161708949042,14967400754087957784,2097152 --field-trial-handle=1980,i,11863063869555974349,5949463374231919654,262144 --variations-seed-version=20260419-030044.020000-production --mojo-platform-channel-handle=5556 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=3464,i,12713117560965134723,8305418808060082548,524288 --field-trial-handle=1980,i,11863063869555974349,5949463374231919654,262144 --variations-seed-version=20260419-030044.020000-production --mojo-platform-channel-handle=3060 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5796,i,14714457472174647890,10304449254704065294,2097152 --field-trial-handle=1980,i,11863063869555974349,5949463374231919654,262144 --variations-seed-version=20260419-030044.020000-production --mojo-platform-channel-handle=5764 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5944,i,599378919700808434,14847914677711009566,2097152 --field-trial-handle=1980,i,11863063869555974349,5949463374231919654,262144 --variations-seed-version=20260419-030044.020000-production --mojo-platform-channel-handle=5900 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5984,i,6887785542550339204,13742757653747309466,524288 --field-trial-handle=1980,i,11863063869555974349,5949463374231919654,262144 --variations-seed-version=20260419-030044.020000-production --mojo-platform-channel-handle=5880 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5612,i,6825612359835446766,10087587718397245478,524288 --field-trial-handle=1980,i,11863063869555974349,5949463374231919654,262144 --variations-seed-version=20260419-030044.020000-production --mojo-platform-channel-handle=5624 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5568,i,6062916741385969497,13849678368899567925,524288 --field-trial-handle=1980,i,11863063869555974349,5949463374231919654,262144 --variations-seed-version=20260419-030044.020000-production --mojo-platform-channel-handle=5936 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5984,i,5648271926069825404,16651908097037985832,2097152 --field-trial-handle=1980,i,11863063869555974349,5949463374231919654,262144 --variations-seed-version=20260419-030044.020000-production --mojo-platform-channel-handle=6084 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --metrics-shmem-handle=6208,i,17145800806075279828,17871336206941289489,524288 --field-trial-handle=1980,i,11863063869555974349,5949463374231919654,262144 --variations-seed-version=20260419-030044.020000-production --mojo-platform-channel-handle=6228 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --metrics-shmem-handle=6220,i,11225470173347328990,39890265951836963,524288 --field-trial-handle=1980,i,11863063869555974349,5949463374231919654,262144 --variations-seed-version=20260419-030044.020000-production --mojo-platform-channel-handle=6488 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=3220,i,6587201251051423548,12058283441243376987,2097152 --field-trial-handle=1980,i,11863063869555974349,5949463374231919654,262144 --variations-seed-version=20260419-030044.020000-production --mojo-platform-channel-handle=5904 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6532,i,17127700873235935600,6668564540678847134,2097152 --field-trial-handle=1980,i,11863063869555974349,5949463374231919654,262144 --variations-seed-version=20260419-030044.020000-production --mojo-platform-channel-handle=6148 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6584,i,16264115202948792782,3804639598827147320,524288 --field-trial-handle=1980,i,11863063869555974349,5949463374231919654,262144 --variations-seed-version=20260419-030044.020000-production --mojo-platform-channel-handle=6328 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6256,i,7664489160566786666,1862024190802998466,2097152 --field-trial-handle=1980,i,11863063869555974349,5949463374231919654,262144 --variations-seed-version=20260419-030044.020000-production --mojo-platform-channel-handle=6212 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6336,i,63842138819618372,17965997126659878302,262144 --field-trial-handle=1980,i,11863063869555974349,5949463374231919654,262144 --variations-seed-version=20260419-030044.020000-production --mojo-platform-channel-handle=5684 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\Ana.exe"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\Ana.exe"1⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\AV.EXE"C:\Users\Admin\AppData\Local\Temp\AV.EXE"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies system certificate store
-
-
C:\Users\Admin\AppData\Local\Temp\AV2.EXE"C:\Users\Admin\AppData\Local\Temp\AV2.EXE"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\DB.EXE"C:\Users\Admin\AppData\Local\Temp\DB.EXE"2⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\EN.EXE"C:\Users\Admin\AppData\Local\Temp\EN.EXE"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\SB.EXE"C:\Users\Admin\AppData\Local\Temp\SB.EXE"2⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\Alerta.exe"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\Alerta.exe"1⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\verclsid.exe"C:\Windows\system32\verclsid.exe" /S /C {088E3905-0323-4B02-9826-5D99428E115F} /I {000214E6-0000-0000-C000-000000000046} /X 0x4011⤵
- System Binary Proxy Execution: Verclsid
-
C:\Windows\system32\verclsid.exe"C:\Windows\system32\verclsid.exe" /S /C {088E3905-0323-4B02-9826-5D99428E115F} /I {000214E6-0000-0000-C000-000000000046} /X 0x4011⤵
- System Binary Proxy Execution: Verclsid
-
C:\Windows\system32\verclsid.exe"C:\Windows\system32\verclsid.exe" /S /C {088E3905-0323-4B02-9826-5D99428E115F} /I {000214E6-0000-0000-C000-000000000046} /X 0x4011⤵
- System Binary Proxy Execution: Verclsid
-
C:\Windows\system32\verclsid.exe"C:\Windows\system32\verclsid.exe" /S /C {088E3905-0323-4B02-9826-5D99428E115F} /I {000214E6-0000-0000-C000-000000000046} /X 0x4011⤵
- System Binary Proxy Execution: Verclsid
-
C:\Windows\system32\verclsid.exe"C:\Windows\system32\verclsid.exe" /S /C {088E3905-0323-4B02-9826-5D99428E115F} /I {000214E6-0000-0000-C000-000000000046} /X 0x4011⤵
- System Binary Proxy Execution: Verclsid
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Defense Evasion
Modify Registry
4Pre-OS Boot
1Bootkit
1Subvert Trust Controls
1Install Root Certificate
1System Binary Proxy Execution
1Verclsid
1Discovery
Browser Information Discovery
1Peripheral Device Discovery
1Query Registry
7System Information Discovery
7System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1System Time Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
e59e45e.rbs
ActiveSkin.ocx
BonziBDY_2.EXE
BonziBDY_35.EXE
BonziBDY_4.EXE
BonziCheckers.ocx
page17.jpg
page18.jpg
MSCOMCTL.OCX
MSINET.OCX
MSWINSCK.OCX
Reg.nbd
Reg.nbd
Regicon.ocx
CheckRuntimes.bat
SSCALA32.OCX
SSCALB32.OCX
Uninstall.exe
ssa3d30.ocx
sstabs2.ocx
settings.dat
900ffe36-fc3e-4b15-9fc5-5d2dee21468b.tmp
BookmarkMergedSurfaceOrdering
BrowsingTopicsState
f_00004c
f_00008e
f_000091
f_000094
f_00009b
f_0000a1
f_0000a2
f_0000a4
f_0000a5
f_0000a6
f_0000c0
f_0000c9
f_0000d6
f_0000e6
f_0000f2
f_00014b
f_000188
f_0001ab
f_0001b7
f_0001c0
f_0001c2
f_0001f8
f_0001ff
f_000200
f_000201
f_000211
011cb5a193c1cdc2_0
5d72ae0f1b2cfa39_0
temp-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
verified_contents.json
popup-Cm0X7jZY.css
popup-BMmoFs5C.js
hiw-card-1.png
hiw-card-6.png
icon128.png
icon16.png
icon48.png
img.png
logo.png
menu-hover.svg
menu.svg
search-icon.svg
select-arrow.svg
manifest.json
script.js
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
TransportSecurity
TransportSecurity
CURRENT
MANIFEST-000001
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
temp-index
the-real-index
the-real-index
the-real-index
the-real-index~RFe58e133.TMP
da18a65c6f8efac3_0
the-real-index
the-real-index
MANIFEST-000001
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
data_1
rundll32.exe.log
4a4e6858-6d7b-4e41-8c35-0b2b3836c979.tmp
blocklist
settings.dat
settings.dat
settings.dat
f_000080
the-real-index
the-real-index~RFe5f88f0.TMP
SiteList-Enterprise.json
Edge Profile.ico
HubApps
Network Persistent State
Preferences
Secure Preferences
sync_diagnostic.log
Local State
Local State
5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
suggestions[1].en-US
FlyPDFy
prefs.json
prefs.json
prefs.json
prefs.json
prefs.json
pulsebrowser.exe
am_MASCULINE.pak
pulsebrowser_proxy.exe
5a33e47a-f335-4f91-b4ec-b38e5d7c0cc3.tmp
77cfb478-0cae-484d-a80b-0e780fad6d90.tmp
the-real-index
the-real-index~RFe5b8440.TMP
index
index
background.js
logo_48.png
Network Persistent State
Network Persistent State~RFe5b844f.TMP
Preferences
Preferences
Preferences~RFe5b6994.TMP
the-real-index
the-real-index~RFe5b7b95.TMP
data_0
data_2
data_3
Local State
Local State
Local State~RFe5b4013.TMP
656b7968-00b3-4469-bfb2-05ea576af7cb.tmp
0001.tmp
0002.tmp
0003.tmp
0004.tmp
0005.tmp
0006.tmp
7081f147-926f-4089-a467-712e854eed93.tmp
99e94271-37b3-47e7-b6c8-7a403447f592.tmp
AV.EXE
AV2.EXE
DB.EXE
EN.EXE
FlyPDFy_3.0.0_20260420041254_000_FlyPDFy.log
GB.EXE
ADVPACK.DLL
AGENTANM.DLL
AGENTCTL.DLL
AGENTDP2.DLL
AGENTDPV.DLL
AGENTMPX.DLL
AGENTPSH.DLL
AGENTSR.DLL
AGENTSVR.EXE
AGT0409.DLL
AGT0409.HLP
AGT20.INF
AGTCTL15.TLB
AGTINST.INF
MSLWVTTS.DLL
Msvcirt.dll
Msvcp50.dll
W95INF16.DLL
W95INF32.DLL
andmoipa.ttf
tv_enua.dll
tv_enua.hlp
tv_enua.inf
tvenuax.dll
SB.EXE
00c65ed2-f3a6-4a70-a42b-345c32ce0554.tmp
logo_48.png
background.js
popup.html
moolembpnahlkcpjaahngledgflmkhlb_11689.crx
content_new.js
6b8071a2-aa89-4434-887a-7afd4025f9e8.tmp
FlyPDFy.exe
default.dic
5d696d521de238c3.customDestinations-ms
tsa.crt
Unconfirmed 58270.crdownload
Unconfirmed 910864.crdownload
MSIE7F5.tmp
CustomAction.config
RequestSender.dll
WixToolset.Dtf.WindowsInstaller.dll
Microsoft.Win32.TaskScheduler.dll
FlyPDFy.exe
Bootstrapper.dll
WixToolset.Mba.Core.dll
WixToolset.Mba.Host.config
WixToolset.Mba.Host.dll
mbahost.dll
mbanative.dll
BootstrapperApplicationData.xml
Bonzi.acs
Peedy.acs
memory/64-6175-0x000001509C200000-0x000001509C2A9000-memory.dmp
memory/328-2973-0x00000234B4DF0000-0x00000234B4E99000-memory.dmp
memory/928-744-0x0000000004CA0000-0x0000000004CA7000-memory.dmp
memory/928-743-0x0000000002730000-0x0000000002736000-memory.dmp
memory/1356-689-0x00000000052E0000-0x00000000052E6000-memory.dmp
memory/1356-684-0x00000000053B0000-0x0000000005416000-memory.dmp
memory/1356-678-0x0000000005300000-0x0000000005334000-memory.dmp
memory/1356-690-0x00000000054A0000-0x00000000054A7000-memory.dmp
memory/1356-682-0x00000000052D0000-0x00000000052DC000-memory.dmp
memory/1604-889-0x0000029533480000-0x0000029533529000-memory.dmp
memory/1604-4506-0x0000029533D70000-0x0000029533D7C000-memory.dmp
memory/1604-4505-0x0000029533480000-0x0000029533529000-memory.dmp
memory/1604-890-0x0000029533D70000-0x0000029533D7C000-memory.dmp
memory/1716-715-0x00000000029E0000-0x0000000002A38000-memory.dmp
memory/1824-6383-0x0000024B859C0000-0x0000024B85A69000-memory.dmp
memory/1852-6300-0x0000026188210000-0x00000261882B9000-memory.dmp
memory/2304-2608-0x000001D546710000-0x000001D5467B9000-memory.dmp
memory/2304-2966-0x000001D54D3C0000-0x000001D54D3E7000-memory.dmp
memory/2304-2610-0x000001D54E140000-0x000001D54E17B000-memory.dmp
memory/2304-2609-0x000001D54D3C0000-0x000001D54D3E7000-memory.dmp
memory/2304-2965-0x000001D546710000-0x000001D5467B9000-memory.dmp
memory/2304-2967-0x000001D54E140000-0x000001D54E17B000-memory.dmp
memory/2648-7512-0x0000000000700000-0x0000000000793000-memory.dmp
memory/2648-7508-0x0000000000700000-0x0000000000793000-memory.dmp
memory/2648-7511-0x0000000000700000-0x0000000000793000-memory.dmp
memory/2648-7520-0x0000000000400000-0x0000000000445000-memory.dmp
memory/2676-1-0x000002107B0C0000-0x000002107B169000-memory.dmp
memory/2692-818-0x0000000005510000-0x000000000573B000-memory.dmp
memory/2692-15-0x0000019086C00000-0x0000019086CA9000-memory.dmp
memory/3216-1537-0x000001CDA7770000-0x000001CDA7819000-memory.dmp
memory/3216-1538-0x000001CDA78A0000-0x000001CDA78DB000-memory.dmp
memory/3364-2293-0x00007FF97B410000-0x00007FF97B411000-memory.dmp
memory/3364-2294-0x00007FF97BD90000-0x00007FF97BD91000-memory.dmp
memory/3480-1004-0x0000000070BD0000-0x0000000070BF4000-memory.dmp
memory/3480-891-0x0000000002C50000-0x0000000002C64000-memory.dmp
memory/3480-1003-0x0000000002C50000-0x0000000002C64000-memory.dmp
memory/3480-1002-0x0000000074550000-0x000000007457B000-memory.dmp
memory/3504-6805-0x0000000003960000-0x0000000003967000-memory.dmp
memory/3600-6347-0x000001E2C07A0000-0x000001E2C0849000-memory.dmp
memory/3732-2261-0x00000164355E0000-0x0000016435689000-memory.dmp
memory/3836-1539-0x000001B672090000-0x000001B672139000-memory.dmp
memory/3952-849-0x00000000744D0000-0x00000000744FB000-memory.dmp
memory/3952-589-0x000000000AC70000-0x000000000AC78000-memory.dmp
memory/3952-575-0x0000000003A20000-0x0000000003A4C000-memory.dmp
memory/3952-581-0x0000000003C40000-0x0000000003C66000-memory.dmp
memory/3952-571-0x00000000036F0000-0x00000000036FA000-memory.dmp
memory/3952-850-0x0000000070B30000-0x0000000070B54000-memory.dmp
memory/3952-590-0x000000000AD00000-0x000000000AD38000-memory.dmp
memory/3952-591-0x000000000ACD0000-0x000000000ACDE000-memory.dmp
memory/4032-2621-0x0000020D14490000-0x0000020D14539000-memory.dmp
memory/4036-2491-0x000001ED0BA80000-0x000001ED0BB29000-memory.dmp
memory/4508-1536-0x00000246C7E30000-0x00000246C7ED9000-memory.dmp
memory/4648-5721-0x000001E55CC60000-0x000001E55CD09000-memory.dmp
memory/4808-2265-0x0000027F8E030000-0x0000027F8E0D9000-memory.dmp
memory/5052-5674-0x0000000000400000-0x0000000000424000-memory.dmp
memory/5052-5339-0x0000000000400000-0x0000000000424000-memory.dmp
memory/5052-5465-0x0000000000400000-0x0000000000424000-memory.dmp
memory/5152-6176-0x0000021BA1FA0000-0x0000021BA2049000-memory.dmp
memory/5336-2964-0x0000011C26720000-0x0000011C267C9000-memory.dmp
memory/5432-7250-0x00000000001F0000-0x00000000001F7000-memory.dmp
memory/5516-2253-0x000002336B7F0000-0x000002336B899000-memory.dmp
memory/5604-6372-0x0000000005E20000-0x0000000005E27000-memory.dmp
memory/5944-1514-0x000001DDB89C0000-0x000001DDB89CC000-memory.dmp
memory/5944-1513-0x000001DDB88E0000-0x000001DDB8989000-memory.dmp
memory/5976-7521-0x0000000000400000-0x000000000040A000-memory.dmp