Analysis
- user interaction
yes - max time kernel
686s - max time network
687s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
10/05/2026, 17:07
General
- Target Anti Combat Log BP/scripts/main.js
- Size 92KB
- Sample260510-vm34cafv2p
- SHA256 b3101a3ea53eb22520a49f62d063c5dd891d70c3995c12f4c9de3329a60e4754
Score
8/10
Malware Config
Signatures
- Downloads MZ/PE file 3 IoCs
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 44 IoCs
- Loads dropped DLL 64 IoCs
- Modifies system executable filetype association 2 TTPs 21 IoCs
- Adds Run key to start application 2 TTPs 6 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 8 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Drops desktop.ini file(s) 1 IoCs
- Network Share Discovery 1 TTPs
Attempt to gather information on host network.
- Checks system information in the registry 2 TTPs 30 IoCs
System information is often read in order to detect sandboxing environments.
- Drops file in Windows directory 18 IoCs
- Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 3 IoCs
When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 4 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 15 IoCs
- Modifies Control Panel 4 IoCs
- Modifies Internet Explorer settings 1 TTPs 22 IoCs
- Modifies data under HKEY_USERS 5 IoCs
- Modifies registry class 64 IoCs
- Modifies system certificate store 2 TTPs 2 IoCs
- NTFS ADS 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 3 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 64 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 11 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- System policy modification 1 TTPs 5 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\Anti Combat Log BP\scripts\main.js"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8ab03c728,0x7ff8ab03c734,0x7ff8ab03c7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1456,i,10337960552427255431,11781324772024496067,524288 --field-trial-handle=2056,i,15989848452369645987,7193669729782505198,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2084 /prefetch:112⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1616,i,18112904052894288753,2290832344266444879,262144 --field-trial-handle=2056,i,15989848452369645987,7193669729782505198,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2052 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2380,i,2691498093170612457,6872967078253543206,524288 --field-trial-handle=2056,i,15989848452369645987,7193669729782505198,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2392 /prefetch:132⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3244,i,14285590417844786380,3240062761286885087,2097152 --field-trial-handle=2056,i,15989848452369645987,7193669729782505198,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3324 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3296,i,8653428643763687015,5871687763316104378,2097152 --field-trial-handle=2056,i,15989848452369645987,7193669729782505198,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3388 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4216,i,11893699220780661431,6432232355710447884,2097152 --field-trial-handle=2056,i,15989848452369645987,7193669729782505198,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4188 /prefetch:92⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4636,i,11886771999271191593,4776104953680324242,2097152 --field-trial-handle=2056,i,15989848452369645987,7193669729782505198,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4640 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5420,i,1496337295311473850,13665205295253480764,524288 --field-trial-handle=2056,i,15989848452369645987,7193669729782505198,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5428 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5708,i,12151027712738412213,18162007700701310226,2097152 --field-trial-handle=2056,i,15989848452369645987,7193669729782505198,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5756 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4528,i,14559573492039846686,17694527504579539658,2097152 --field-trial-handle=2056,i,15989848452369645987,7193669729782505198,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5772 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=3664,i,14267965522099046706,13866099697411858081,2097152 --field-trial-handle=2056,i,15989848452369645987,7193669729782505198,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3644 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=3616,i,5275457119420821831,10477214488101482989,2097152 --field-trial-handle=2056,i,15989848452369645987,7193669729782505198,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3572 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=4780,i,2658980077539158747,2237858646400135050,2097152 --field-trial-handle=2056,i,15989848452369645987,7193669729782505198,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4704 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6000,i,10144159864133595723,10232366448759699317,2097152 --field-trial-handle=2056,i,15989848452369645987,7193669729782505198,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6032 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6128,i,14574514186497439834,4436237851142501692,2097152 --field-trial-handle=2056,i,15989848452369645987,7193669729782505198,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3644 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=3400,i,6466629846096697557,12812161556284465580,2097152 --field-trial-handle=2056,i,15989848452369645987,7193669729782505198,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5872 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5860,i,12190692278259062360,3158718043542501294,524288 --field-trial-handle=2056,i,15989848452369645987,7193669729782505198,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6140 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5456,i,16358294093165709634,15989065959942937938,524288 --field-trial-handle=2056,i,15989848452369645987,7193669729782505198,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3332 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5976,i,7887963141572651949,12694876532180419584,524288 --field-trial-handle=2056,i,15989848452369645987,7193669729782505198,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3388 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=4272,i,16399601304884656876,12742091170713526666,2097152 --field-trial-handle=2056,i,15989848452369645987,7193669729782505198,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4324 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6136,i,14561873520337472520,9651951396222133293,2097152 --field-trial-handle=2056,i,15989848452369645987,7193669729782505198,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3616 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=876,i,11580046647371628213,16938922601739479599,2097152 --field-trial-handle=2056,i,15989848452369645987,7193669729782505198,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5420 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6268,i,321492599795558450,4255269993229398281,2097152 --field-trial-handle=2056,i,15989848452369645987,7193669729782505198,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4188 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=3656,i,5168646826483359753,3971724368961877521,524288 --field-trial-handle=2056,i,15989848452369645987,7193669729782505198,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6456 /prefetch:122⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6364,i,6317944083963701203,14256162007143114036,524288 --field-trial-handle=2056,i,15989848452369645987,7193669729782505198,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6436 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=6648,i,7219528285351758259,829583255225212273,2097152 --field-trial-handle=2056,i,15989848452369645987,7193669729782505198,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6620 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=6716,i,15380873969666507364,10707288342146024413,2097152 --field-trial-handle=2056,i,15989848452369645987,7193669729782505198,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6680 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=6880,i,16009443705810734493,8570651192326362430,2097152 --field-trial-handle=2056,i,15989848452369645987,7193669729782505198,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6892 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=7064,i,4079416459137756353,741377566590447574,2097152 --field-trial-handle=2056,i,15989848452369645987,7193669729782505198,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=7156 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=6304,i,13111412733659172934,11373251323177775654,2097152 --field-trial-handle=2056,i,15989848452369645987,7193669729782505198,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6648 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=6300,i,4462348560862918645,16886654274183016140,2097152 --field-trial-handle=2056,i,15989848452369645987,7193669729782505198,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6684 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --metrics-shmem-handle=7016,i,4986583266689722521,3460857756241660780,2097152 --field-trial-handle=2056,i,15989848452369645987,7193669729782505198,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=7072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6828,i,13423941160097521579,14577374533221665583,262144 --field-trial-handle=2056,i,15989848452369645987,7193669729782505198,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6668 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --metrics-shmem-handle=6036,i,2970144379375182924,16794060470275878799,2097152 --field-trial-handle=2056,i,15989848452369645987,7193669729782505198,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6096 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --metrics-shmem-handle=6884,i,16489031130513372020,2578214259774499514,2097152 --field-trial-handle=2056,i,15989848452369645987,7193669729782505198,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6796 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --metrics-shmem-handle=7124,i,9129968474597393004,17945719678641865348,2097152 --field-trial-handle=2056,i,15989848452369645987,7193669729782505198,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=7252 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --metrics-shmem-handle=7196,i,6543586142303402658,17610450853546579232,2097152 --field-trial-handle=2056,i,15989848452369645987,7193669729782505198,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6228 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --metrics-shmem-handle=6256,i,16330897047367094310,18295248557384692672,2097152 --field-trial-handle=2056,i,15989848452369645987,7193669729782505198,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6244 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4572,i,14029777942855370919,9333497184568550111,524288 --field-trial-handle=2056,i,15989848452369645987,7193669729782505198,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3648 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --metrics-shmem-handle=7584,i,6339169332510388702,10989976071713255131,2097152 --field-trial-handle=2056,i,15989848452369645987,7193669729782505198,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5752 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --metrics-shmem-handle=5820,i,16841552144094075454,4239144548415808865,2097152 --field-trial-handle=2056,i,15989848452369645987,7193669729782505198,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3320 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --metrics-shmem-handle=6916,i,11137095689485093822,8500482550012443065,2097152 --field-trial-handle=2056,i,15989848452369645987,7193669729782505198,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5976 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3616,i,10996310633004648745,16208391894480961398,524288 --field-trial-handle=2056,i,15989848452369645987,7193669729782505198,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6668 /prefetch:142⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
-
-
C:\Users\Admin\Downloads\Xeno-v1.3.40.exe"C:\Users\Admin\Downloads\Xeno-v1.3.40.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\3DCcfRv6Yp9kdkBmjQtSb0eB1PY\Xeno-v1.3.40.exeC:\Users\Admin\AppData\Local\Temp\3DCcfRv6Yp9kdkBmjQtSb0eB1PY\Xeno-v1.3.40.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\3DCcfRv6Yp9kdkBmjQtSb0eB1PY\Xeno-v1.3.40.exe"C:\Users\Admin\AppData\Local\Temp\3DCcfRv6Yp9kdkBmjQtSb0eB1PY\Xeno-v1.3.40.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Xeno" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1588 --field-trial-handle=1592,i,17572433692856807463,10796233139167737435,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:24⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\3DCcfRv6Yp9kdkBmjQtSb0eB1PY\Xeno-v1.3.40.exe"C:\Users\Admin\AppData\Local\Temp\3DCcfRv6Yp9kdkBmjQtSb0eB1PY\Xeno-v1.3.40.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Xeno" --mojo-platform-channel-handle=1924 --field-trial-handle=1592,i,17572433692856807463,10796233139167737435,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:84⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\3DCcfRv6Yp9kdkBmjQtSb0eB1PY\Xeno-v1.3.40.exe"C:\Users\Admin\AppData\Local\Temp\3DCcfRv6Yp9kdkBmjQtSb0eB1PY\Xeno-v1.3.40.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Xeno" --app-user-model-id=Xeno --app-path="C:\Users\Admin\AppData\Local\Temp\3DCcfRv6Yp9kdkBmjQtSb0eB1PY\resources\app.asar" --enable-sandbox --first-renderer-process --lang --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2136 --field-trial-handle=1592,i,17572433692856807463,10796233139167737435,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:14⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\3DCcfRv6Yp9kdkBmjQtSb0eB1PY\Xeno-v1.3.40.exe"C:\Users\Admin\AppData\Local\Temp\3DCcfRv6Yp9kdkBmjQtSb0eB1PY\Xeno-v1.3.40.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Xeno" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=3200 --field-trial-handle=1592,i,17572433692856807463,10796233139167737435,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:24⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\3DCcfRv6Yp9kdkBmjQtSb0eB1PY\Xeno-v1.3.40.exe"C:\Users\Admin\AppData\Local\Temp\3DCcfRv6Yp9kdkBmjQtSb0eB1PY\Xeno-v1.3.40.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Xeno" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=disabled --mojo-platform-channel-handle=1660 --field-trial-handle=1592,i,17572433692856807463,10796233139167737435,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:24⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\3DCcfRv6Yp9kdkBmjQtSb0eB1PY\Xeno-v1.3.40.exe"C:\Users\Admin\AppData\Local\Temp\3DCcfRv6Yp9kdkBmjQtSb0eB1PY\Xeno-v1.3.40.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang --service-sandbox-type=audio --user-data-dir="C:\Users\Admin\AppData\Roaming\Xeno" --mojo-platform-channel-handle=1776 --field-trial-handle=1592,i,17572433692856807463,10796233139167737435,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:84⤵
- Executes dropped EXE
-
-
-
-
C:\Users\Admin\Downloads\Xeno-v1.3.40.exe"C:\Users\Admin\Downloads\Xeno-v1.3.40.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\3DCcfRv6Yp9kdkBmjQtSb0eB1PY\Xeno-v1.3.40.exeC:\Users\Admin\AppData\Local\Temp\3DCcfRv6Yp9kdkBmjQtSb0eB1PY\Xeno-v1.3.40.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3DCcfRv6Yp9kdkBmjQtSb0eB1PY\Xeno-v1.3.40.exe"C:\Users\Admin\AppData\Local\Temp\3DCcfRv6Yp9kdkBmjQtSb0eB1PY\Xeno-v1.3.40.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Xeno" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1632 --field-trial-handle=1636,i,14728988518334005630,2889193316758967343,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:24⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\3DCcfRv6Yp9kdkBmjQtSb0eB1PY\Xeno-v1.3.40.exe"C:\Users\Admin\AppData\Local\Temp\3DCcfRv6Yp9kdkBmjQtSb0eB1PY\Xeno-v1.3.40.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Xeno" --mojo-platform-channel-handle=1856 --field-trial-handle=1636,i,14728988518334005630,2889193316758967343,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:84⤵
- Executes dropped EXE
-
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --metrics-shmem-handle=6048,i,15408705607341482757,5039703407494348658,2097152 --field-trial-handle=2056,i,15989848452369645987,7193669729782505198,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4532 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --metrics-shmem-handle=6792,i,2557012889465496467,1149076708943174706,2097152 --field-trial-handle=2056,i,15989848452369645987,7193669729782505198,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6728 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --metrics-shmem-handle=7408,i,14371223515817207744,14502297726340034824,2097152 --field-trial-handle=2056,i,15989848452369645987,7193669729782505198,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6824 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --metrics-shmem-handle=6808,i,476466455801674891,14020234830098332817,2097152 --field-trial-handle=2056,i,15989848452369645987,7193669729782505198,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6052 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --metrics-shmem-handle=7744,i,3737531416144968699,2832370036680291041,2097152 --field-trial-handle=2056,i,15989848452369645987,7193669729782505198,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6212 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --metrics-shmem-handle=7448,i,4291821983954658115,7488035303452787542,2097152 --field-trial-handle=2056,i,15989848452369645987,7193669729782505198,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=7628 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --metrics-shmem-handle=8032,i,16083045495236405143,396766411186433463,2097152 --field-trial-handle=2056,i,15989848452369645987,7193669729782505198,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=8048 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --metrics-shmem-handle=8008,i,6674778173779732509,17023796467078139387,2097152 --field-trial-handle=2056,i,15989848452369645987,7193669729782505198,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=7904 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --metrics-shmem-handle=7000,i,2011132667932465751,13546249183584755445,2097152 --field-trial-handle=2056,i,15989848452369645987,7193669729782505198,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=7492 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe"C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe"1⤵
- Modifies system executable filetype association
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe"C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe" /update /restart2⤵
- Executes dropped EXE
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe /update /restart /peruser /childprocess /extractFilesWithLessThreadCount /renameReplaceOneDriveExe /renameReplaceODSUExe /removeNonCurrentVersions /enableODSUReportingMode3⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Adds Run key to start application
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\FileSyncConfig.exe"C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\FileSyncConfig.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops desktop.ini file(s)
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe/updateInstalled /background4⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
-
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exeC:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe"C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe" /update /restart /updateSource:ODSU2⤵
- Executes dropped EXE
- Checks system information in the registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exeC:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe /update /restart /updateSource:ODSU /peruser /childprocess /extractFilesWithLessThreadCount /renameReplaceOneDriveExe /renameReplaceODSUExe /removeNonCurrentVersions /enableODSUReportingMode /installWebView2 /SetPerProcessSystemDPIForceOffKey /EnableNucleusAutoStartFix /RegisterOneDriveLauncherAutoStartTask /EnableOneDriveLauncherRampDownloads /EnableDeltaBuildToTelemetryFeatureSet /ArgPerformNucleusLocalAccessRepair /PerformEdgeNucleusRepair /PerformChromeNucleusRepair /NucleusLNARepairVersion:1 /DisableRedirectionForShortCuts3⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Adds Run key to start application
- Checks system information in the registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.063.0405.0002\FileSyncConfig.exe"C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.063.0405.0002\FileSyncConfig.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe/updateInstalled /background4⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
- Checks system information in the registry
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Modifies system certificate store
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe"C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe" /update /restart /updateSource:ODU5⤵
- Executes dropped EXE
- Checks system information in the registry
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe /update /restart /updateSource:ODU /peruser /childprocess /extractFilesWithLessThreadCount /renameReplaceOneDriveExe /renameReplaceODSUExe /removeNonCurrentVersions /enableODSUReportingMode /installWebView2 /SetPerProcessSystemDPIForceOffKey /EnableNucleusAutoStartFix /RegisterOneDriveLauncherAutoStartTask /EnableOneDriveLauncherRampDownloads /EnableDeltaBuildToTelemetryFeatureSet /ArgPerformNucleusLocalAccessRepair /PerformEdgeNucleusRepair /PerformChromeNucleusRepair /NucleusLNARepairVersion:1 /DisableRedirectionForShortCuts6⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Adds Run key to start application
- Checks system information in the registry
- Modifies Internet Explorer settings
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.070.0414.0001\FileSyncConfig.exe"C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.070.0414.0001\FileSyncConfig.exe"7⤵
- Executes dropped EXE
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe/updateInstalled /background7⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Checks system information in the registry
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe"C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe" /client=Personal /background8⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Checks whether UAC is enabled
- Checks system information in the registry
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=OneDrive.exe --webview-exe-version=26.070.0414.0001 --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\OneDrive\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --disable-features=msEnhancedTrackingPreventionEnabled --mojo-named-platform-channel-pipe=4988.1120.176183374334872849179⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\OneDrive\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Microsoft\OneDrive\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x17c,0x180,0x184,0x158,0x18c,0x7ff89967b078,0x7ff89967b084,0x7ff89967b09010⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\OneDrive\EBWebView" --webview-exe-name=OneDrive.exe --webview-exe-version=26.070.0414.0001 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1724,i,2320538344256390789,11152873689871212565,262144 --disable-features=msEnhancedTrackingPreventionEnabled --variations-seed-version --mojo-platform-channel-handle=1720 /prefetch:210⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\OneDrive\EBWebView" --webview-exe-name=OneDrive.exe --webview-exe-version=26.070.0414.0001 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=1616,i,2320538344256390789,11152873689871212565,262144 --disable-features=msEnhancedTrackingPreventionEnabled --variations-seed-version --mojo-platform-channel-handle=2040 /prefetch:1110⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\OneDrive\EBWebView" --webview-exe-name=OneDrive.exe --webview-exe-version=26.070.0414.0001 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=2016,i,2320538344256390789,11152873689871212565,262144 --disable-features=msEnhancedTrackingPreventionEnabled --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:1310⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\OneDrive\EBWebView" --webview-exe-name=OneDrive.exe --webview-exe-version=26.070.0414.0001 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3168,i,2320538344256390789,11152873689871212565,262144 --disable-features=msEnhancedTrackingPreventionEnabled --variations-seed-version --mojo-platform-channel-handle=3220 /prefetch:110⤵
-
-
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe"C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe" /client=Personal /background9⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Checks system information in the registry
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
-
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.070.0414.0001\OneDrive.Sync.Service.exe/silentConfig7⤵
- Executes dropped EXE
- Checks system information in the registry
- System policy modification
-
-
-
-
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.063.0405.0002\OneDrive.Sync.Service.exe/silentConfig4⤵
- Executes dropped EXE
- Checks system information in the registry
-
-
-
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.063.0405.0002\OneDriveLauncher.exeC:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.063.0405.0002\OneDriveLauncher.exe1⤵
- Executes dropped EXE
- Checks system information in the registry
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.063.0405.0002\FileCoAuth.exe"C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.063.0405.0002\FileCoAuth.exe" -Embedding1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.070.0414.0001\OneDriveLauncher.exeC:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.070.0414.0001\OneDriveLauncher.exe1⤵
- Executes dropped EXE
- Checks system information in the registry
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.070.0414.0001\FileCoAuth.exe"C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.070.0414.0001\FileCoAuth.exe" -Embedding1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.070.0414.0001\FileCoAuth.exe"C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.070.0414.0001\FileCoAuth.exe" -Embedding1⤵
- Executes dropped EXE
-
C:\Users\Admin\Downloads\Xeno-v1.3.40.exe"C:\Users\Admin\Downloads\Xeno-v1.3.40.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\3DCcfRv6Yp9kdkBmjQtSb0eB1PY\Xeno-v1.3.40.exeC:\Users\Admin\AppData\Local\Temp\3DCcfRv6Yp9kdkBmjQtSb0eB1PY\Xeno-v1.3.40.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3DCcfRv6Yp9kdkBmjQtSb0eB1PY\Xeno-v1.3.40.exe"C:\Users\Admin\AppData\Local\Temp\3DCcfRv6Yp9kdkBmjQtSb0eB1PY\Xeno-v1.3.40.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Xeno" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1672 --field-trial-handle=1680,i,2424381524930922658,2878056804220371199,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:23⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\3DCcfRv6Yp9kdkBmjQtSb0eB1PY\Xeno-v1.3.40.exe"C:\Users\Admin\AppData\Local\Temp\3DCcfRv6Yp9kdkBmjQtSb0eB1PY\Xeno-v1.3.40.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Xeno" --mojo-platform-channel-handle=1976 --field-trial-handle=1680,i,2424381524930922658,2878056804220371199,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:83⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\3DCcfRv6Yp9kdkBmjQtSb0eB1PY\Xeno-v1.3.40.exe"C:\Users\Admin\AppData\Local\Temp\3DCcfRv6Yp9kdkBmjQtSb0eB1PY\Xeno-v1.3.40.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Xeno" --app-user-model-id=Xeno --app-path="C:\Users\Admin\AppData\Local\Temp\3DCcfRv6Yp9kdkBmjQtSb0eB1PY\resources\app.asar" --enable-sandbox --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=4 --mojo-platform-channel-handle=2312 --field-trial-handle=1680,i,2424381524930922658,2878056804220371199,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:13⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\3DCcfRv6Yp9kdkBmjQtSb0eB1PY\Xeno-v1.3.40.exe"C:\Users\Admin\AppData\Local\Temp\3DCcfRv6Yp9kdkBmjQtSb0eB1PY\Xeno-v1.3.40.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Xeno" --mojo-platform-channel-handle=3316 --field-trial-handle=1680,i,2424381524930922658,2878056804220371199,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:83⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\3DCcfRv6Yp9kdkBmjQtSb0eB1PY\Xeno-v1.3.40.exe"C:\Users\Admin\AppData\Local\Temp\3DCcfRv6Yp9kdkBmjQtSb0eB1PY\Xeno-v1.3.40.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Xeno" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=3468 --field-trial-handle=1680,i,2424381524930922658,2878056804220371199,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:23⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\3DCcfRv6Yp9kdkBmjQtSb0eB1PY\Xeno-v1.3.40.exe"C:\Users\Admin\AppData\Local\Temp\3DCcfRv6Yp9kdkBmjQtSb0eB1PY\Xeno-v1.3.40.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --user-data-dir="C:\Users\Admin\AppData\Roaming\Xeno" --mojo-platform-channel-handle=3724 --field-trial-handle=1680,i,2424381524930922658,2878056804220371199,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:83⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/xe-no3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2dc,0x2e0,0x2e4,0x2d8,0x2ec,0x7ff896d0c188,0x7ff896d0c194,0x7ff896d0c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1772,i,10815778017838195661,14368879279980303105,262144 --field-trial-handle=2060,i,1006945709795893157,2001280021389092665,262144 --variations-seed-version --mojo-platform-channel-handle=2072 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2272,i,2750310199103572764,2377158033715883167,524288 --field-trial-handle=2060,i,1006945709795893157,2001280021389092665,262144 --variations-seed-version --mojo-platform-channel-handle=2164 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2564,i,17134977437721854854,16014041970978266283,524288 --field-trial-handle=2060,i,1006945709795893157,2001280021389092665,262144 --variations-seed-version --mojo-platform-channel-handle=2560 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3524,i,6348002648143362443,7719063822145322029,2097152 --field-trial-handle=2060,i,1006945709795893157,2001280021389092665,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3428,i,12756364238938802660,4473295033134540374,2097152 --field-trial-handle=2060,i,1006945709795893157,2001280021389092665,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4220,i,2334670181374838038,17445714094298082991,2097152 --field-trial-handle=2060,i,1006945709795893157,2001280021389092665,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4264,i,13244665778703876336,5650143707470512995,2097152 --field-trial-handle=2060,i,1006945709795893157,2001280021389092665,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4148,i,5275397280977155323,1025395506184137249,2097152 --field-trial-handle=2060,i,1006945709795893157,2001280021389092665,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4424,i,12684465690561866159,16897645290575969724,2097152 --field-trial-handle=2060,i,1006945709795893157,2001280021389092665,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3736,i,4898391213391064669,10519183282851531151,524288 --field-trial-handle=2060,i,1006945709795893157,2001280021389092665,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4368,i,1049975666578627985,15374888170157038097,524288 --field-trial-handle=2060,i,1006945709795893157,2001280021389092665,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=4384,i,15966171874591434511,10969893017316976950,2097152 --field-trial-handle=2060,i,1006945709795893157,2001280021389092665,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3776,i,13173894030169932978,25884379518536595,524288 --field-trial-handle=2060,i,1006945709795893157,2001280021389092665,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3640,i,6151076133685790190,3194721506303148137,524288 --field-trial-handle=2060,i,1006945709795893157,2001280021389092665,262144 --variations-seed-version --mojo-platform-channel-handle=3764 /prefetch:124⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5432,i,4969276138571577249,17566266940682219831,524288 --field-trial-handle=2060,i,1006945709795893157,2001280021389092665,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5436,i,8539723636384414694,8269767432756008349,524288 --field-trial-handle=2060,i,1006945709795893157,2001280021389092665,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6264,i,2589965428458642326,3318489131512618105,524288 --field-trial-handle=2060,i,1006945709795893157,2001280021389092665,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6264,i,2589965428458642326,3318489131512618105,524288 --field-trial-handle=2060,i,1006945709795893157,2001280021389092665,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6532,i,17198272571514455753,6846314906449009652,524288 --field-trial-handle=2060,i,1006945709795893157,2001280021389092665,262144 --variations-seed-version --mojo-platform-channel-handle=6556 /prefetch:144⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.execookie_exporter.exe --cookie-json=11325⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6680,i,6951104179961727250,5505604537100878869,524288 --field-trial-handle=2060,i,1006945709795893157,2001280021389092665,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6812,i,17253828404986053951,2592446714280084679,524288 --field-trial-handle=2060,i,1006945709795893157,2001280021389092665,262144 --variations-seed-version --mojo-platform-channel-handle=6816 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6904,i,11170772348183019495,4834188621420845963,524288 --field-trial-handle=2060,i,1006945709795893157,2001280021389092665,262144 --variations-seed-version --mojo-platform-channel-handle=6832 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6880,i,10434785822601120968,4626296100539000009,524288 --field-trial-handle=2060,i,1006945709795893157,2001280021389092665,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6664,i,4167540062450931534,9882420398701658855,524288 --field-trial-handle=2060,i,1006945709795893157,2001280021389092665,262144 --variations-seed-version --mojo-platform-channel-handle=6676 /prefetch:144⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\3DCcfRv6Yp9kdkBmjQtSb0eB1PY\Xeno-v1.3.40.exe"C:\Users\Admin\AppData\Local\Temp\3DCcfRv6Yp9kdkBmjQtSb0eB1PY\Xeno-v1.3.40.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --user-data-dir="C:\Users\Admin\AppData\Roaming\Xeno" --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2656 --field-trial-handle=1680,i,2424381524930922658,2878056804220371199,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:23⤵
- Executes dropped EXE
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of SendNotifyMessage
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x2f0,0x7ff896d0c188,0x7ff896d0c194,0x7ff896d0c1a02⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1788,i,564534967957102453,18207225078772552439,524288 --field-trial-handle=2140,i,4072705574882764584,6554578257912744898,262144 --variations-seed-version --mojo-platform-channel-handle=2168 /prefetch:112⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,124155901906521789,342704268587623164,262144 --field-trial-handle=2140,i,4072705574882764584,6554578257912744898,262144 --variations-seed-version --mojo-platform-channel-handle=2136 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2536,i,13736689191082005658,3870638103581095080,524288 --field-trial-handle=2140,i,4072705574882764584,6554578257912744898,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:132⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3472,i,11607284058799662686,2915426146470677560,2097152 --field-trial-handle=2140,i,4072705574882764584,6554578257912744898,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3468,i,9154702601378133703,4842730188468544364,2097152 --field-trial-handle=2140,i,4072705574882764584,6554578257912744898,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4972,i,3552722926589191063,3986691152471261952,524288 --field-trial-handle=2140,i,4072705574882764584,6554578257912744898,262144 --variations-seed-version --mojo-platform-channel-handle=4900 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5100,i,6407957551484792727,9801260436559463667,2097152 --field-trial-handle=2140,i,4072705574882764584,6554578257912744898,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5448,i,14280470841911644895,13285171559051871170,2097152 --field-trial-handle=2140,i,4072705574882764584,6554578257912744898,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5652,i,18087581750839128941,11734556192211210421,2097152 --field-trial-handle=2140,i,4072705574882764584,6554578257912744898,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5876,i,5616445733475624042,2081960270169866961,2097152 --field-trial-handle=2140,i,4072705574882764584,6554578257912744898,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5632,i,4698646499150112354,6673903308142631856,524288 --field-trial-handle=2140,i,4072705574882764584,6554578257912744898,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5748,i,5705585515109465705,16137126066177837959,524288 --field-trial-handle=2140,i,4072705574882764584,6554578257912744898,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6740,i,17812573493514583845,14231812725987766908,524288 --field-trial-handle=2140,i,4072705574882764584,6554578257912744898,262144 --variations-seed-version --mojo-platform-channel-handle=6756 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6740,i,17812573493514583845,14231812725987766908,524288 --field-trial-handle=2140,i,4072705574882764584,6554578257912744898,262144 --variations-seed-version --mojo-platform-channel-handle=6756 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=7392,i,11227213413609887020,5048283472162709505,2097152 --field-trial-handle=2140,i,4072705574882764584,6554578257912744898,262144 --variations-seed-version --mojo-platform-channel-handle=7404 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=4912,i,17909912002038675488,18377838535674757569,2097152 --field-trial-handle=2140,i,4072705574882764584,6554578257912744898,262144 --variations-seed-version --mojo-platform-channel-handle=7436 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=7576,i,4556616762021277658,6716605746305688984,2097152 --field-trial-handle=2140,i,4072705574882764584,6554578257912744898,262144 --variations-seed-version --mojo-platform-channel-handle=7228 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=5372,i,4551072749833012052,1973097217199169731,2097152 --field-trial-handle=2140,i,4072705574882764584,6554578257912744898,262144 --variations-seed-version --mojo-platform-channel-handle=7612 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7176,i,1232203748781715322,12265332592963578216,524288 --field-trial-handle=2140,i,4072705574882764584,6554578257912744898,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=5996,i,5015432493096933498,13343472330591796070,2097152 --field-trial-handle=2140,i,4072705574882764584,6554578257912744898,262144 --variations-seed-version --mojo-platform-channel-handle=7604 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7776,i,17306282050557499811,13703370070456919791,524288 --field-trial-handle=2140,i,4072705574882764584,6554578257912744898,262144 --variations-seed-version --mojo-platform-channel-handle=7780 /prefetch:142⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
-
-
C:\Users\Admin\Downloads\Roblox - Windows Installer.exe"C:\Users\Admin\Downloads\Roblox - Windows Installer.exe"2⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://apps.microsoft.com/store/detail/9PMF91N3LZ3M?ocid=bingwebsearch&referrer=psi3⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7796,i,1962963005541141622,11533641989442353007,524288 --field-trial-handle=2140,i,4072705574882764584,6554578257912744898,262144 --variations-seed-version --mojo-platform-channel-handle=8468 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7788,i,6633804217195276664,9819258809812327295,524288 --field-trial-handle=2140,i,4072705574882764584,6554578257912744898,262144 --variations-seed-version --mojo-platform-channel-handle=8460 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7940,i,16841153385130665939,40684049949135401,524288 --field-trial-handle=2140,i,4072705574882764584,6554578257912744898,262144 --variations-seed-version --mojo-platform-channel-handle=8564 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=5412,i,3510359372163046601,13425135214577052571,2097152 --field-trial-handle=2140,i,4072705574882764584,6554578257912744898,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=8628,i,8596000972892037086,4877379663782842457,2097152 --field-trial-handle=2140,i,4072705574882764584,6554578257912744898,262144 --variations-seed-version --mojo-platform-channel-handle=8584 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=3584,i,9227062839322536972,4865145745163379773,2097152 --field-trial-handle=2140,i,4072705574882764584,6554578257912744898,262144 --variations-seed-version --mojo-platform-channel-handle=3400 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8580,i,1689808828551096931,12713549647302541450,524288 --field-trial-handle=2140,i,4072705574882764584,6554578257912744898,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:142⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window2⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x24c,0x7ff896d0c188,0x7ff896d0c194,0x7ff896d0c1a03⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1840,i,9020646101113540901,7256013743134770466,524288 --field-trial-handle=2184,i,15342781503292184103,10027168053987833897,262144 --variations-seed-version --mojo-platform-channel-handle=2212 /prefetch:113⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1712,i,5054033250948829134,12094861994173644460,262144 --field-trial-handle=2184,i,15342781503292184103,10027168053987833897,262144 --variations-seed-version --mojo-platform-channel-handle=2188 /prefetch:23⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2248,i,8518079671570579482,3542311971146930427,524288 --field-trial-handle=2184,i,15342781503292184103,10027168053987833897,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:133⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4456,i,17213291955283543018,15066529165273796142,524288 --field-trial-handle=2184,i,15342781503292184103,10027168053987833897,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4456,i,17213291955283543018,15066529165273796142,524288 --field-trial-handle=2184,i,15342781503292184103,10027168053987833897,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4832,i,14811051037387172610,4763779317994033279,2097152 --field-trial-handle=2184,i,15342781503292184103,10027168053987833897,262144 --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4984,i,12645839013800433807,10012402000855366941,524288 --field-trial-handle=2184,i,15342781503292184103,10027168053987833897,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4980,i,12902379727155365768,5383220367363662214,524288 --field-trial-handle=2184,i,15342781503292184103,10027168053987833897,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5588,i,1410634660288432111,15021027722928084261,2097152 --field-trial-handle=2184,i,15342781503292184103,10027168053987833897,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4552,i,11488134093502991864,4677212745971621494,524288 --field-trial-handle=2184,i,15342781503292184103,10027168053987833897,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5804,i,11092737933746479105,16269234896299541991,524288 --field-trial-handle=2184,i,15342781503292184103,10027168053987833897,262144 --variations-seed-version --mojo-platform-channel-handle=4748 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5736,i,11814544586541555206,15041112960417739154,524288 --field-trial-handle=2184,i,15342781503292184103,10027168053987833897,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5756,i,12052373774981388786,1474665159207075072,524288 --field-trial-handle=2184,i,15342781503292184103,10027168053987833897,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6052,i,8098706020926800256,17270015341326268672,524288 --field-trial-handle=2184,i,15342781503292184103,10027168053987833897,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5316,i,16806803459813438370,2872242407940057342,524288 --field-trial-handle=2184,i,15342781503292184103,10027168053987833897,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6056,i,15928245035105112169,15937954992411457832,262144 --field-trial-handle=2184,i,15342781503292184103,10027168053987833897,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:103⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4120,i,8182273930994922799,1633121889810069435,524288 --field-trial-handle=2184,i,15342781503292184103,10027168053987833897,262144 --variations-seed-version --mojo-platform-channel-handle=3836 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3772,i,1003561727442155918,484854582492657793,524288 --field-trial-handle=2184,i,15342781503292184103,10027168053987833897,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3028,i,17436156046158129995,2039286860048569973,524288 --field-trial-handle=2184,i,15342781503292184103,10027168053987833897,262144 --variations-seed-version --mojo-platform-channel-handle=4608 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6140,i,10433824543417218987,17631936576329193521,524288 --field-trial-handle=2184,i,15342781503292184103,10027168053987833897,262144 --variations-seed-version --mojo-platform-channel-handle=4992 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5652,i,9381284589644882643,8870551603362589515,524288 --field-trial-handle=2184,i,15342781503292184103,10027168053987833897,262144 --variations-seed-version --mojo-platform-channel-handle=3820 /prefetch:143⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
2Change Default File Association
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
2Change Default File Association
1Component Object Model Hijacking
1Defense Evasion
Modify Registry
5Subvert Trust Controls
2Install Root Certificate
1SIP and Trust Provider Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F
BookmarkMergedSurfaceOrdering
BrowsingTopicsState
f_000006
f_00002d
f_000030
f_000059
f_00005b
f_000060
f_000081
f_0000c1
f_0000ce
f_0000d7
f_0000ec
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
LOG.old
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
TransportSecurity
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
the-real-index
the-real-index
the-real-index
the-real-index
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
blocklist
protocols.json
settings.dat
settings.dat
settings.dat
settings.dat
settings.dat
083dcda6-6911-4ac7-8cc8-4036c882504e.tmp
LOG.old
f_0000d4
f_0000d5
f_0000d6
f_0000d7
f_0000d8
f_00011b
the-real-index
the-real-index
the-real-index
the-real-index~RFe5f0b92.TMP
SiteList-Enterprise.json
Edge Profile.ico
HubApps
000003.log
LOG
MANIFEST-000001
Network Persistent State
Network Persistent State
Network Persistent State
Sdch Dictionaries
TransportSecurity
ae4e8608-01da-4ee8-8022-9e6b79cde91f.tmp
Preferences
Preferences
Preferences
Secure Preferences
Secure Preferences
the-real-index
the-real-index
the-real-index
temp-index
the-real-index
the-real-index~RFe5f47d0.TMP
the-real-index
index.txt
index.txt
index.txt
index.txt
index.txt~RFe5eba65.TMP
the-real-index
the-real-index~RFe5fecda.TMP
the-real-index
the-real-index~RFe5fecda.TMP
the-real-index
the-real-index~RFe5fecda.TMP
the-real-index
the-real-index~RFe5fece9.TMP
the-real-index
the-real-index~RFe5fecda.TMP
the-real-index
the-real-index~RFe5feb24.TMP
index.txt
index.txt
index.txt
index.txt
index.txt
index.txt
index.txt~RFe5f9cf5.TMP
the-real-index
the-real-index
the-real-index~RFe5f996a.TMP
sync_diagnostic.log
7982afac-011b-4c36-a8be-0407e38759a8.tmp
office_endpoints_list.json
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
manifest.json
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter~RFe5fa820.TMP
nav_config.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
cade01ee-86b8-4c10-b527-b75b9577694f.tmp
FileSyncConfig.exe
LoggingPlatform.dll
OneDriveMedTile.contrast-black_scale-100.png
OneDriveMedTile.contrast-black_scale-125.png
OneDriveMedTile.contrast-black_scale-150.png
OneDriveMedTile.contrast-black_scale-200.png
OneDriveMedTile.contrast-black_scale-400.png
OneDriveMedTile.contrast-white_scale-100.png
OneDriveMedTile.contrast-white_scale-125.png
OneDriveMedTile.contrast-white_scale-150.png
OneDriveMedTile.contrast-white_scale-200.png
OneDriveMedTile.contrast-white_scale-400.png
OneDriveMedTile.scale-100.png
OneDriveMedTile.scale-125.png
OneDriveMedTile.scale-150.png
OneDriveMedTile.scale-200.png
OneDriveMedTile.scale-400.png
OneDriveSmallTile.contrast-black_scale-100.png
OneDriveSmallTile.contrast-black_scale-125.png
OneDriveSmallTile.contrast-black_scale-150.png
OneDriveSmallTile.contrast-black_scale-200.png
OneDriveSmallTile.contrast-black_scale-400.png
OneDriveSmallTile.scale-100.png
OneDriveSmallTile.scale-125.png
OneDriveSmallTile.scale-150.png
OneDriveSmallTile.scale-200.png
OneDriveSmallTile.scale-400.png
OneDrive.VisualElementsManifest.xml
OneDrive.exe
OneDriveStandaloneUpdater.exe
OneDriveTelemetryStable.dll
Resources.pri
Telemetry.dll
UpdateRingSettings.dll
msvcp140.dll
ucrtbase.dll
vcruntime140.dll
Square44x44Logo.targetsize-256.png
Resources.resw
FileSyncConfig.exe
OneDriveMedTile.contrast-black_scale-100.png
OneDriveMedTile.contrast-black_scale-125.png
OneDriveMedTile.contrast-black_scale-150.png
OneDriveMedTile.contrast-black_scale-200.png
OneDriveMedTile.contrast-black_scale-400.png
OneDriveMedTile.contrast-white_scale-100.png
OneDriveMedTile.contrast-white_scale-125.png
OneDriveMedTile.contrast-white_scale-150.png
OneDriveMedTile.contrast-white_scale-200.png
OneDriveMedTile.contrast-white_scale-400.png
OneDriveMedTile.scale-100.png
OneDriveMedTile.scale-125.png
OneDriveMedTile.scale-150.png
OneDriveMedTile.scale-200.png
OneDriveMedTile.scale-400.png
OneDriveSmallTile.contrast-black_scale-100.png
OneDriveSmallTile.contrast-black_scale-125.png
OneDriveSmallTile.contrast-black_scale-150.png
OneDriveSmallTile.contrast-black_scale-200.png
OneDriveSmallTile.contrast-black_scale-400.png
OneDriveSmallTile.scale-100.png
OneDriveSmallTile.scale-125.png
OneDriveSmallTile.scale-150.png
OneDriveSmallTile.scale-200.png
OneDriveSmallTile.scale-400.png
Resources.pri
OneDrive.App.exe
OneDrive.exe
OneDriveStandaloneUpdater.exe
az-Latn-AZ.json
localizable.json
Square44x44Logo.altform-unplated_targetsize-16.png
Square44x44Logo.altform-unplated_targetsize-24.png
Square44x44Logo.altform-unplated_targetsize-32.png
Square44x44Logo.altform-unplated_targetsize-48.png
FileSyncConfig.exe
OneDrive.App.exe
OneDrive.exe
OneDriveStandaloneUpdater.exe
nso-ZA.json
acm_low_disk_space_online_only.svg
addedFolderIcon_mac.svg
addedFolderIcon_win.svg
blurrect.png
checkboxComposite.svg
clock_icon.svg
done_graphic.svg
errorIcon.svg
excel.svg
eyelash.svg
file.svg
fileLockIcon.svg
finderExtensionPrompt.svg
folder_image_desktop_mac.svg
folder_image_documents_mac.svg
folder_image_pictures_mac.svg
iceBucket.svg
loading.svg
loading_spinner.svg
lock_graphic.svg
lock_icon.svg
onDemandFiles.svg
onDemandFilesDehydrate.svg
onDemandSelectiveSync.svg
onenote.svg
outlook.svg
partiallyFreezing.svg
paused.svg
powerpoint.svg
premium_gem.svg
reSignIn.svg
recycleBin.svg
shield_icon.svg
signIn.svg
signInExclamation.svg
stackedIceCubes.svg
vaultFull.svg
vaultIntro.svg
vaultUnlocked.svg
warning-symbol_grey.svg
waterGlass.svg
word.svg
yellowFolder.svg
acmDismissIcon.svg
settings.dat
the-real-index
the-real-index~RFe5be8a7.TMP
index
MANIFEST-000001
CURRENT
data_0
data_1
data_2
data_3
Local State
Local State
Local State
Local State
Local State~RFe5bdbb6.TMP
Microsoft.ListSync.Settings.db
Microsoft.ListSync.Settings.db
Microsoft.ListSync.Settings.db
Microsoft.ListSync.Thumbnails.db
OneDriveSetup.exe
telemetry-dll-ramp-value.txt
SubmissionPayload.json
global.ini
global.ini
global.ini
global.ini
logUploaderSettings_temp.ini
logUploaderSettings_temp.ini
logUploaderSettings_temp.ini
DeviceHealthSummaryConfiguration.ini
PreSignInSettingsConfig[1].json
dc4dfcafaa1c77ec6c10e4daaff580474180acae[1].xml
update100[1].xml
0f3e7a30-b040-4bfe-9f67-def03d14f951.tmp
chrome_100_percent.pak
TmpB9F2.tmp
c8c8e647-3e79-4c67-8bb9-fd719fef24b5.tmp
LICENSE.electron.txt
LICENSES.chromium.html
chrome_200_percent.pak
d3dcompiler_47.dll
ffmpeg.dll
icudtl.dat
libEGL.dll
libGLESv2.dll
af.pak
am.pak
ar.pak
bg.pak
bn.pak
ca.pak
cs.pak
da.pak
de.pak
el.pak
en-GB.pak
en-US.pak
es-419.pak
es.pak
et.pak
fa.pak
fi.pak
fil.pak
fr.pak
gu.pak
he.pak
hi.pak
hr.pak
hu.pak
id.pak
it.pak
ja.pak
kn.pak
ko.pak
lt.pak
lv.pak
ml.pak
mr.pak
ms.pak
nb.pak
nl.pak
pl.pak
pt-BR.pak
pt-PT.pak
ro.pak
ru.pak
sk.pak
sl.pak
sr.pak
sv.pak
sw.pak
ta.pak
te.pak
th.pak
tr.pak
uk.pak
ur.pak
vi.pak
zh-CN.pak
zh-TW.pak
resources.pak
binding.gyp
addon.obj
vcpkg.applocal.log
win_delay_load_hook.obj
xeno.node.recipe
CL.command.1.tlog
CL.read.1.tlog
CL.write.1.tlog
Cl.items.tlog
link.command.1.tlog
link.read.1.tlog
link.secondary.1.tlog
link.write.1.tlog
xeno.lastbuildstate
xeno.iobj
xeno.ipdb
xeno.node
config.gypi
xeno.vcxproj
xeno.vcxproj.filters
package.json
elevate.exe
Failed.png
Xeno.dll
Xeno.ico
api-ms-win-crt-convert-l1-1-0.dll
api-ms-win-crt-environment-l1-1-0.dll
api-ms-win-crt-filesystem-l1-1-0.dll
api-ms-win-crt-heap-l1-1-0.dll
api-ms-win-crt-locale-l1-1-0.dll
api-ms-win-crt-math-l1-1-0.dll
api-ms-win-crt-runtime-l1-1-0.dll
api-ms-win-crt-stdio-l1-1-0.dll
api-ms-win-crt-string-l1-1-0.dll
api-ms-win-crt-utility-l1-1-0.dll
concrt140.dll
index.html
libcrypto-3-x64.dll
libcurl.dll
libssl-3-x64.dll
msvcp140.dll
msvcp140_1.dll
msvcrt.dll
notification.mp3
ucrtbase.dll
vcruntime140.dll
vcruntime140_1.dll
zlib1.dll
snapshot_blob.bin
v8_context_snapshot.bin
vk_swiftshader.dll
vk_swiftshader_icd.json
vulkan-1.dll
StdUtils.dll
System.dll
nsis7z.dll
3407c52b-ace6-4d23-a375-1d47bea060f2.tmp
content_new.js
tmp452.tmp
wct7DD7.tmp
wct7E45.tmp
wct9911.tmp
wctCF91.tmp
wctD790.tmp
wctEE25.tmp
default.dic
5d696d521de238c3.customDestinations-ms
5d696d521de238c3.customDestinations-ms
5d696d521de238c3.customDestinations-ms
index
Network Persistent State
Network Persistent State
Network Persistent State~RFe5e5a43.TMP
TransportSecurity
TransportSecurity
Roblox - Windows Installer.exe
desktop.ini
manifest.json
manifest.json
manifest.json
manifest.json
memory/576-0-0x000001D254350000-0x000001D2543EE000-memory.dmp
memory/576-36-0x000001D254350000-0x000001D2543EE000-memory.dmp
memory/576-37-0x000001D254480000-0x000001D25448C000-memory.dmp
memory/576-1-0x000001D254480000-0x000001D25448C000-memory.dmp
memory/1200-1920-0x0000000005580000-0x0000000005602000-memory.dmp
memory/3008-44-0x000001D4177A0000-0x000001D41783E000-memory.dmp
memory/4020-939-0x0000026583930000-0x00000265839CE000-memory.dmp
memory/4020-280-0x0000026583930000-0x00000265839CE000-memory.dmp
memory/4180-1980-0x0000000008F70000-0x0000000008FA9000-memory.dmp
memory/4180-2238-0x000000000A5A0000-0x000000000A5A1000-memory.dmp
memory/4180-2197-0x00000000053D0000-0x00000000053D2000-memory.dmp
memory/4180-2198-0x00000000053D0000-0x00000000053D2000-memory.dmp
memory/4180-2203-0x000000000A550000-0x000000000A554000-memory.dmp
memory/4180-2199-0x000000000A550000-0x000000000A554000-memory.dmp
memory/4180-2204-0x000000000A550000-0x000000000A554000-memory.dmp
memory/4180-2205-0x000000000A550000-0x000000000A554000-memory.dmp
memory/4180-2206-0x000000000A550000-0x000000000A554000-memory.dmp
memory/4180-2207-0x000000000A550000-0x000000000A554000-memory.dmp
memory/4180-2208-0x000000000A550000-0x000000000A554000-memory.dmp
memory/4180-2209-0x000000000A580000-0x000000000A581000-memory.dmp
memory/4180-2210-0x000000000A580000-0x000000000A581000-memory.dmp
memory/4180-2211-0x000000000A580000-0x000000000A581000-memory.dmp
memory/4180-2212-0x000000000A580000-0x000000000A581000-memory.dmp
memory/4180-2213-0x000000000A580000-0x000000000A581000-memory.dmp
memory/4180-2214-0x000000000A580000-0x000000000A581000-memory.dmp
memory/4180-2215-0x000000000A580000-0x000000000A581000-memory.dmp
memory/4180-2222-0x000000000A580000-0x000000000A581000-memory.dmp
memory/4180-2224-0x000000000A5A0000-0x000000000A5A1000-memory.dmp
memory/4180-2225-0x000000000A5A0000-0x000000000A5A1000-memory.dmp
memory/4180-2226-0x000000000A5A0000-0x000000000A5A1000-memory.dmp
memory/4180-2227-0x000000000A5A0000-0x000000000A5A1000-memory.dmp
memory/4180-2228-0x000000000A5A0000-0x000000000A5A1000-memory.dmp
memory/4180-2229-0x000000000A5A0000-0x000000000A5A1000-memory.dmp
memory/4180-2230-0x000000000A5A0000-0x000000000A5A1000-memory.dmp
memory/4180-2231-0x000000000A5A0000-0x000000000A5A1000-memory.dmp
memory/4180-2232-0x000000000A5A0000-0x000000000A5A1000-memory.dmp
memory/4180-2233-0x000000000A5A0000-0x000000000A5A1000-memory.dmp
memory/4180-2234-0x000000000A5A0000-0x000000000A5A1000-memory.dmp
memory/4180-2235-0x000000000A5A0000-0x000000000A5A1000-memory.dmp
memory/4180-2236-0x000000000A5A0000-0x000000000A5A1000-memory.dmp
memory/4180-2237-0x000000000A5A0000-0x000000000A5A1000-memory.dmp
memory/4180-2200-0x000000000A550000-0x000000000A554000-memory.dmp
memory/4180-2216-0x000000000A580000-0x000000000A581000-memory.dmp
memory/4180-2217-0x000000000A580000-0x000000000A581000-memory.dmp
memory/4180-2221-0x000000000A580000-0x000000000A581000-memory.dmp
memory/4180-2195-0x000000000A550000-0x000000000A554000-memory.dmp
memory/4180-2196-0x000000000A550000-0x000000000A554000-memory.dmp
memory/4180-2163-0x000000000A040000-0x000000000A480000-memory.dmp
memory/4180-2171-0x00000000053D0000-0x00000000053D2000-memory.dmp
memory/4180-2172-0x00000000053D0000-0x00000000053D2000-memory.dmp
memory/4180-2173-0x00000000053D0000-0x00000000053D2000-memory.dmp
memory/4180-2165-0x000000000A480000-0x000000000A680000-memory.dmp
memory/4180-1979-0x0000000002980000-0x0000000002A02000-memory.dmp
memory/4180-2201-0x000000000A550000-0x000000000A554000-memory.dmp
memory/4180-2202-0x000000000A550000-0x000000000A554000-memory.dmp
memory/4468-1915-0x0000000006ED0000-0x0000000006F5C000-memory.dmp
memory/4468-1914-0x0000000006240000-0x00000000062C2000-memory.dmp
memory/4468-1916-0x0000000006F70000-0x0000000006F78000-memory.dmp
memory/5204-12856-0x000001F626C60000-0x000001F626C6E000-memory.dmp
memory/5204-12825-0x000001F609440000-0x000001F60957C000-memory.dmp
memory/5204-12854-0x000001F6245E0000-0x000001F624606000-memory.dmp
memory/5204-12852-0x000001F623E60000-0x000001F623E72000-memory.dmp
memory/5204-12866-0x000001F6275B0000-0x000001F627738000-memory.dmp
memory/5204-12877-0x000001F627550000-0x000001F627558000-memory.dmp
memory/5204-12855-0x000001F6270B0000-0x000001F6270E8000-memory.dmp
memory/5204-12853-0x000001F623EC0000-0x000001F623EFC000-memory.dmp
memory/5204-12857-0x000001F627080000-0x000001F627088000-memory.dmp
memory/5204-12841-0x000001F623BB0000-0x000001F623BBA000-memory.dmp
memory/5204-12840-0x000001F624520000-0x000001F6245DA000-memory.dmp
memory/5624-1890-0x0000000002D90000-0x0000000002E12000-memory.dmp
memory/5932-1074-0x0000000002C60000-0x0000000002CE2000-memory.dmp
memory/5932-1724-0x0000000002C60000-0x0000000002CE2000-memory.dmp
memory/5932-1725-0x0000000003EB0000-0x0000000003F10000-memory.dmp
memory/6048-1964-0x0000000003420000-0x00000000034A2000-memory.dmp
memory/6048-1965-0x0000000004410000-0x0000000004422000-memory.dmp