Analysis
- user interaction
yes - max time kernel
529s - max time network
486s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
27/05/2026, 23:32
General
- Target download.html
- Size 9KB
- Sample260527-3jalmac16x
- SHA256 0bc7204256e18ea837bf4c0f7ae502208a4d8bf7d48eb9360e39785c350de5d8
Score
8/10
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Downloads MZ/PE file 2 IoCs
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 10 IoCs
- Loads dropped DLL 64 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in System32 directory 5 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Inno Setup is an open-source installation builder for Windows applications. 1 IoCs
Inno Setup installer
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 64 IoCs
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs
- Suspicious use of AdjustPrivilegeToken 41 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 48 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\download.html1⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x290,0x7ffc0da6c188,0x7ffc0da6c194,0x7ffc0da6c1a02⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1688,i,11035851383507752878,4520916437660882168,524288 --field-trial-handle=2464,i,10797469281252057618,2542768620735512314,262144 --variations-seed-version --mojo-platform-channel-handle=2484 /prefetch:32⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1684,i,9741097500086313018,3742165793742984436,262144 --field-trial-handle=2464,i,10797469281252057618,2542768620735512314,262144 --variations-seed-version --mojo-platform-channel-handle=2460 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2504,i,3187973358683198140,15491926047875735900,524288 --field-trial-handle=2464,i,10797469281252057618,2542768620735512314,262144 --variations-seed-version --mojo-platform-channel-handle=2592 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3468,i,5521372428382200319,14699625868834903569,2097152 --field-trial-handle=2464,i,10797469281252057618,2542768620735512314,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3492,i,12403599418437212809,374667695117496539,2097152 --field-trial-handle=2464,i,10797469281252057618,2542768620735512314,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4280,i,16468834587474057002,3710284302018799381,2097152 --field-trial-handle=2464,i,10797469281252057618,2542768620735512314,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4304,i,5738397890898389602,12178064394314458768,2097152 --field-trial-handle=2464,i,10797469281252057618,2542768620735512314,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3620,i,14290562480744147276,16555663699461442931,524288 --field-trial-handle=2464,i,10797469281252057618,2542768620735512314,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3652,i,2937615253199782539,14136181392108977832,524288 --field-trial-handle=2464,i,10797469281252057618,2542768620735512314,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,15789734160059644656,6891110928888039523,524288 --field-trial-handle=2464,i,10797469281252057618,2542768620735512314,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3600,i,14728343532088826803,1719695217283621038,524288 --field-trial-handle=2464,i,10797469281252057618,2542768620735512314,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5948,i,4536774868441365508,16802141896896349264,524288 --field-trial-handle=2464,i,10797469281252057618,2542768620735512314,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5948,i,4536774868441365508,16802141896896349264,524288 --field-trial-handle=2464,i,10797469281252057618,2542768620735512314,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6100,i,4636116681924597093,14748974478380454953,524288 --field-trial-handle=2464,i,10797469281252057618,2542768620735512314,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6268,i,5809838815306676698,16517501302915337060,524288 --field-trial-handle=2464,i,10797469281252057618,2542768620735512314,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,10077691917536753358,10505478225366033972,524288 --field-trial-handle=2464,i,10797469281252057618,2542768620735512314,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6340,i,11090425447988915720,10128992399961855758,524288 --field-trial-handle=2464,i,10797469281252057618,2542768620735512314,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6332,i,8165212160201514471,4756224033767603652,524288 --field-trial-handle=2464,i,10797469281252057618,2542768620735512314,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=3604,i,9472548121225523833,3784684431033934173,2097152 --field-trial-handle=2464,i,10797469281252057618,2542768620735512314,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6620,i,16324769476865939942,3823487602203256798,2097152 --field-trial-handle=2464,i,10797469281252057618,2542768620735512314,262144 --variations-seed-version --mojo-platform-channel-handle=6600 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4396,i,5412184601946582566,2629618461436876262,524288 --field-trial-handle=2464,i,10797469281252057618,2542768620735512314,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4420,i,8587646030532014336,10396403319310704067,524288 --field-trial-handle=2464,i,10797469281252057618,2542768620735512314,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4412,i,16805284187245425608,7382828442673337252,524288 --field-trial-handle=2464,i,10797469281252057618,2542768620735512314,262144 --variations-seed-version --mojo-platform-channel-handle=4916 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4380,i,2733524669336815585,11620183359381393580,524288 --field-trial-handle=2464,i,10797469281252057618,2542768620735512314,262144 --variations-seed-version --mojo-platform-channel-handle=4520 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=5364,i,3027749085957688553,14366994712526522079,2097152 --field-trial-handle=2464,i,10797469281252057618,2542768620735512314,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=6300,i,17046266696410290891,5871730461007304474,2097152 --field-trial-handle=2464,i,10797469281252057618,2542768620735512314,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=6388,i,9331323162545245809,9183263472322259415,2097152 --field-trial-handle=2464,i,10797469281252057618,2542768620735512314,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=3900,i,11307867501798433861,2125012307086709749,2097152 --field-trial-handle=2464,i,10797469281252057618,2542768620735512314,262144 --variations-seed-version --mojo-platform-channel-handle=6924 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7040,i,12051230420821912965,14261608413468879354,524288 --field-trial-handle=2464,i,10797469281252057618,2542768620735512314,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=7084,i,13911914134062782159,218611120919443544,2097152 --field-trial-handle=2464,i,10797469281252057618,2542768620735512314,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7372,i,6986430015888337112,3925968659752106271,524288 --field-trial-handle=2464,i,10797469281252057618,2542768620735512314,262144 --variations-seed-version --mojo-platform-channel-handle=7472 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7620,i,3781487898719384530,3131220876971628570,524288 --field-trial-handle=2464,i,10797469281252057618,2542768620735512314,262144 --variations-seed-version --mojo-platform-channel-handle=7612 /prefetch:82⤵
-
-
C:\Users\Admin\Downloads\BBRWSetup.EXE"C:\Users\Admin\Downloads\BBRWSetup.EXE"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\PROGRA~2\BONZIB~1\Runtimes\Msagent.exe"C:\PROGRA~2\BONZIB~1\Runtimes\Msagent.exe"3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s "C:\Windows\msagent\AgentCtl.dll"4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s "C:\Windows\msagent\AgentDPv.dll"4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s "C:\Windows\msagent\mslwvtts.dll"4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s "C:\Windows\msagent\AgentDP2.dll"4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s "C:\Windows\msagent\AgentMPx.dll"4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s "C:\Windows\msagent\AgentSR.dll"4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s "C:\Windows\msagent\AgentPsh.dll"4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\msagent\AgentSvr.exe"C:\Windows\msagent\AgentSvr.exe" /regserver4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
C:\Windows\SysWOW64\grpconv.exegrpconv.exe -o4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\PROGRA~2\BONZIB~1\Runtimes\tv_enua.exe"C:\PROGRA~2\BONZIB~1\Runtimes\tv_enua.exe"3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s C:\Windows\lhsp\tv\tv_enua.dll4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s C:\Windows\lhsp\tv\tvenuax.dll4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
C:\Windows\SysWOW64\grpconv.exegrpconv.exe -o4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\PROGRA~2\BONZIB~1\Runtimes\spchapi.EXE"C:\PROGRA~2\BONZIB~1\Runtimes\spchapi.EXE"3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Windows\SysWOW64\grpconv.exegrpconv.exe -o4⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7740,i,3274962665702558392,7304354595398745304,524288 --field-trial-handle=2464,i,10797469281252057618,2542768620735512314,262144 --variations-seed-version --mojo-platform-channel-handle=6728 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6116,i,6985613161184162193,18164963861520441625,524288 --field-trial-handle=2464,i,10797469281252057618,2542768620735512314,262144 --variations-seed-version --mojo-platform-channel-handle=7164 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5448,i,6778804903949503000,3815352202159444040,524288 --field-trial-handle=2464,i,10797469281252057618,2542768620735512314,262144 --variations-seed-version --mojo-platform-channel-handle=7056 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5448,i,5163956996832210111,3136899062954326506,262144 --field-trial-handle=2464,i,10797469281252057618,2542768620735512314,262144 --variations-seed-version --mojo-platform-channel-handle=7728 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=5484,i,14917394079588149956,10988792456010234925,2097152 --field-trial-handle=2464,i,10797469281252057618,2542768620735512314,262144 --variations-seed-version --mojo-platform-channel-handle=6948 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5564,i,14829882978872085727,12283290008310343745,524288 --field-trial-handle=2464,i,10797469281252057618,2542768620735512314,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=3416,i,3029044819973055039,3754126668532664330,2097152 --field-trial-handle=2464,i,10797469281252057618,2542768620735512314,262144 --variations-seed-version --mojo-platform-channel-handle=3412 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6904,i,12629590865913520182,5770165178026870379,524288 --field-trial-handle=2464,i,10797469281252057618,2542768620735512314,262144 --variations-seed-version --mojo-platform-channel-handle=6820 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=6844,i,5470169963943922157,15568195634943086704,2097152 --field-trial-handle=2464,i,10797469281252057618,2542768620735512314,262144 --variations-seed-version --mojo-platform-channel-handle=6848 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7812,i,14645065031179402563,12948050805234162609,524288 --field-trial-handle=2464,i,10797469281252057618,2542768620735512314,262144 --variations-seed-version --mojo-platform-channel-handle=7060 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5424,i,5288408694030467034,1852616171117733263,524288 --field-trial-handle=2464,i,10797469281252057618,2542768620735512314,262144 --variations-seed-version --mojo-platform-channel-handle=7388 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8008,i,11856884540111694497,3235992594989064007,524288 --field-trial-handle=2464,i,10797469281252057618,2542768620735512314,262144 --variations-seed-version --mojo-platform-channel-handle=8020 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5384,i,16620835952662874015,9418728637090632467,524288 --field-trial-handle=2464,i,10797469281252057618,2542768620735512314,262144 --variations-seed-version --mojo-platform-channel-handle=8188 /prefetch:82⤵
-
-
C:\Users\Admin\Downloads\kinitopet.exe"C:\Users\Admin\Downloads\kinitopet.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
-
C:\PROGRA~2\KINITO~1\Runtimes\spchapi.EXE"C:\PROGRA~2\KINITO~1\Runtimes\spchapi.EXE"3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Windows\SysWOW64\grpconv.exegrpconv.exe -o4⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3428,i,3450342592858457223,2035245356514930915,524288 --field-trial-handle=2464,i,10797469281252057618,2542768620735512314,262144 --variations-seed-version --mojo-platform-channel-handle=3412 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8200,i,13804440181523163558,10738100599592470764,524288 --field-trial-handle=2464,i,10797469281252057618,2542768620735512314,262144 --variations-seed-version --mojo-platform-channel-handle=7996 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6488,i,3181529518194680845,10701984618367370387,524288 --field-trial-handle=2464,i,10797469281252057618,2542768620735512314,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5384,i,10564347556435043349,7279543266391198047,524288 --field-trial-handle=2464,i,10797469281252057618,2542768620735512314,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5468,i,14200413220912988898,1823349611436726343,524288 --field-trial-handle=2464,i,10797469281252057618,2542768620735512314,262144 --variations-seed-version --mojo-platform-channel-handle=7756 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5160,i,10231704580207503402,16707851432999795494,524288 --field-trial-handle=2464,i,10797469281252057618,2542768620735512314,262144 --variations-seed-version --mojo-platform-channel-handle=3412 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5552,i,10369923928815772998,16927790764449452456,524288 --field-trial-handle=2464,i,10797469281252057618,2542768620735512314,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8268,i,16597483990672735812,1882872198406511183,524288 --field-trial-handle=2464,i,10797469281252057618,2542768620735512314,262144 --variations-seed-version --mojo-platform-channel-handle=7996 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5548,i,12058326908858428864,6343736780909220623,524288 --field-trial-handle=2464,i,10797469281252057618,2542768620735512314,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\BonziBUDDY Rewritten\BonziRW.exe"C:\Program Files (x86)\BonziBUDDY Rewritten\BonziRW.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://tmafe.com/kinitopet2⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://tmafe.com/kinitopet3⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://tmafe.com/bonzibuddy/themes2⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://tmafe.com/bonzibuddy/themes3⤵
-
-
-
C:\Windows\msagent\AgentSvr.exeC:\Windows\msagent\AgentSvr.exe -Embedding1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x2ec 0x2b41⤵
-
C:\Program Files (x86)\KinitoAfterStory\KinitoAS.exe"C:\Program Files (x86)\KinitoAfterStory\KinitoAS.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
BBREAD~1.CON
BBReader.xml
BONZIR~1.CON
BonziRW.xml
book
page0.jpg
page10.jpg
page11.jpg
page12.jpg
page13.jpg
page14.jpg
page15.jpg
page16.jpg
page17.htm
page17.jpg
page2.jpg
page3.jpg
page4.jpg
page5.jpg
page6.jpg
page7.jpg
page8.jpg
page9.jpg
book
cb001.gif
cb002.gif
cb003.gif
cb004.gif
cb005.gif
cb006.gif
cb007.gif
cb008.gif
cb009.gif
cb010.gif
cb011.gif
cb012.gif
cb013.gif
cb014.gif
cb015.gif
cb016.gif
page0.jpg
page1.jpg
page10.jpg
page11.jpg
page12.jpg
page13.jpg
page14.jpg
page15.jpg
page16.jpg
page2.jpg
page3.jpg
page4.jpg
page5.jpg
page6.jpg
page7.jpg
page8.jpg
page9.jpg
sp001.gif
Chord.wav
CHECKR~1.BAT
Readme.txt
temp.000
~GLH005a.TMP
~GLH005d.TMP
UNWISE.EXE
favicon.ico
BO60E4~1.PNG
BO9503~1.PNG
BONZIA~1.PNG
BONZIB~1.PNG
BONZIB~2.PNG
BONZIB~3.PNG
BONZIF~1.PNG
BONZIH~1.PNG
BONZIJ~1.PNG
BONZIK~1.PNG
BONZIM~1.PNG
BONZIS~1.PNG
BONZIS~2.PNG
BONZIS~3.PNG
BONZIS~4.PNG
BONZIT~1.PNG
BONZIT~2.PNG
BONZIU~1.PNG
BonziDM.png
BonziMSH.png
IMAGES~1.ZIP
speedup.ico
temp.000
temp.000
temp.000
~GLH0068.TMP
~GLH006d.TMP
book
page0.jpg
page1.jpg
page2.jpg
page3.jpg
page4.jpg
page5.jpg
page6.jpg
page7.jpg
page8.jpg
KINITO~1.CON
KinitoAS.xml
CHECKR~1.BAT
~GLH0004.TMP
~GLH003c.TMP
Snd1.wav
help.chm
IMAGES~1.ZIP
KI0636~1.PNG
KI1335~1.PNG
KI5734~1.PNG
KI69C5~1.PNG
KI6F83~1.PNG
KI83B8~1.PNG
KIA402~1.PNG
KID106~1.PNG
KID5A4~1.PNG
KINITO~1.BMP
KINITO~1.PNG
KINITO~2.PNG
KINITO~4.PNG
KinitoDM.png
temp.000
~GLH000c.TMP
~GLH000e.TMP
~GLH0010.TMP
~GLH0013.TMP
~GLH001f.TMP
~GLH0056.TMP
~GLH0060.TMP
~GLH000e.TMP
~GLH001a.TMP
~GLH0025.TMP
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
LICENSE
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
protocols.json
autofill_bypass_cache_forms.json
edge_autofill_global_block_list.json
v1FieldTypes.json
crl-set
settings.dat
settings.dat
LOG.old
MANIFEST-000001
BookmarkMergedSurfaceOrdering
f_00008a
f_00008d
the-real-index
the-real-index
the-real-index~RFe589f29.TMP
SiteList-Enterprise.json
Edge Profile.ico
HubApps
Network Persistent State
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Sdch Dictionaries~RFe592fa1.TMP
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
the-real-index
the-real-index
the-real-index~RFe58bafe.TMP
the-real-index
the-real-index
index.txt
the-real-index
the-real-index~RFe59140b.TMP
sync_diagnostic.log
domain_actions.dll
office_endpoints_list.json
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter~RFe58fba1.TMP
keys.json
nav_config.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
4cdcefba-dcba-439d-864d-70645f3d97a2.tmp
5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
hfzymc3l.newcfg
user.config
user.config
user.config
user.config
92aaee72-fae9-40eb-81d7-6d83e4fb4109.tmp
GLC45F8.tmp
GLF51D3.tmp
GLK4618.tmp
ADVPACK.DLL
ADVPACK.DLL
AGENTANM.DLL
AGENTCTL.DLL
AGENTDP2.DLL
AGENTDPV.DLL
AGENTMPX.DLL
AGENTPSH.DLL
AGENTSR.DLL
AGENTSVR.EXE
AGT0409.DLL
AGT0409.HLP
AGT20.INF
AGTCTL15.TLB
AGTINST.INF
MSLWVTTS.DLL
Msvcirt.dll
Msvcp50.dll
VText.dll
Vdict.dll
W95INF16.DLL
W95INF32.DLL
W95INF32.DLL
WrapSAPI.dll
XTel.Dll
Xcommand.dll
Xlisten.dll
Xvoice.dll
andmoipa.ttf
msvcrt.dll
spchapi.inf
spchtel.dll
speech.cnt
speech.dll
speech.hlp
tv_enua.dll
tv_enua.hlp
tv_enua.inf
tvenuax.dll
vcauto.tlb
vcmd.exe
vcmshl.dll
vtxtauto.tlb
d9126d12-b8da-491e-8c97-aab4d098e317.tmp
595b6eac-fdb7-4630-bb6c-502cbf383d63.tmp
content_new.js
BBRWSetup.EXE.crdownload
Bonzi.acs
Kinito.acs