Resubmissions
12/09/2026, 13:30
260912-qrt9sace72812/09/2026, 13:01
260912-p87e1azwfs812/09/2026, 12:57
260912-p63n2acb763Analysis
- user interaction
yes - max time kernel
1800s - max time network
1801s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
12/09/2026, 13:01
General
- Target CustomRP.exe
- Size 1.2MB
- Sample260912-p87e1azwfs
- SHA256 912cc56c88a786941a4ba1da25eef70c398a2eb16b7e38a8a5e2b4f33eba7d7d
Score
8/10
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Downloads MZ/PE file 1 IoCs
- Executes dropped EXE 4 IoCs
- Loads dropped DLL 64 IoCs
- Drops desktop.ini file(s) 3 IoCs
- Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Hide Artifacts: Hidden Files and Directories 1 TTPs 5 IoCs
- Drops file in Windows directory 36 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 2 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Inno Setup is an open-source installation builder for Windows applications. 1 IoCs
Inno Setup installer
- Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 6 IoCs
- Kills process with taskkill 4 IoCs
- Modifies Internet Explorer settings 1 TTPs 8 IoCs
- Modifies data under HKEY_USERS 9 IoCs
- Modifies registry class 64 IoCs
- Suspicious behavior: AddClipboardFormatListener 3 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 3 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 64 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 19 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
- Views/modifies file attributes 1 TTPs 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\CustomRP.exe"C:\Users\Admin\AppData\Local\Temp\CustomRP.exe"1⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3020 -s 8722⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3020 -ip 30201⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffb1074c728,0x7ffb1074c734,0x7ffb1074c7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1716,i,9551574670544842497,3112029846283417980,262144 --field-trial-handle=1860,i,5536489848650673739,15078451967604778844,262144 --variations-seed-version --mojo-platform-channel-handle=1856 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2188,i,15858289998831595609,5051752837983459582,524288 --field-trial-handle=1860,i,5536489848650673739,15078451967604778844,262144 --variations-seed-version --mojo-platform-channel-handle=2192 /prefetch:112⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2340,i,7132350980045517491,10390056702925452383,524288 --field-trial-handle=1860,i,5536489848650673739,15078451967604778844,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:132⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3316,i,15267355904704220950,1006738616410271591,2097152 --field-trial-handle=1860,i,5536489848650673739,15078451967604778844,262144 --variations-seed-version --mojo-platform-channel-handle=3396 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3384,i,13741269057571500879,8220086817321236275,2097152 --field-trial-handle=1860,i,5536489848650673739,15078451967604778844,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4484,i,4526553579928677472,6331122864898787628,2097152 --field-trial-handle=1860,i,5536489848650673739,15078451967604778844,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4808,i,4003368035925418071,2431795889022802637,524288 --field-trial-handle=1860,i,5536489848650673739,15078451967604778844,262144 --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5296,i,7452396844544146857,5689571674128414277,524288 --field-trial-handle=1860,i,5536489848650673739,15078451967604778844,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4892,i,5049311825917283692,5528451499373380571,2097152 --field-trial-handle=1860,i,5536489848650673739,15078451967604778844,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5364,i,8350310875053538571,2595711815633727668,2097152 --field-trial-handle=1860,i,5536489848650673739,15078451967604778844,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5648,i,5168386157382052667,15893042163820922075,2097152 --field-trial-handle=1860,i,5536489848650673739,15078451967604778844,262144 --variations-seed-version --mojo-platform-channel-handle=5660 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5668,i,17509689067296944374,8390177480565745074,524288 --field-trial-handle=1860,i,5536489848650673739,15078451967604778844,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5548,i,3626509337512375901,3313502829732807304,2097152 --field-trial-handle=1860,i,5536489848650673739,15078451967604778844,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5900,i,8867300457551656318,11092546948701704747,2097152 --field-trial-handle=1860,i,5536489848650673739,15078451967604778844,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5288,i,15388122490712549838,6411947822917667628,524288 --field-trial-handle=1860,i,5536489848650673739,15078451967604778844,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5448,i,4266039186036570328,13734592655795039893,2097152 --field-trial-handle=1860,i,5536489848650673739,15078451967604778844,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5944,i,16524730442120908365,3847122004053245521,2097152 --field-trial-handle=1860,i,5536489848650673739,15078451967604778844,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6008,i,6297990275312371354,298160049427750288,524288 --field-trial-handle=1860,i,5536489848650673739,15078451967604778844,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6012,i,4153962380349739521,7152097349411426736,2097152 --field-trial-handle=1860,i,5536489848650673739,15078451967604778844,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=4608,i,6922561530478407945,11559699209518057736,2097152 --field-trial-handle=1860,i,5536489848650673739,15078451967604778844,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:92⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5412,i,2310956846250957575,12200823185059332826,2097152 --field-trial-handle=1860,i,5536489848650673739,15078451967604778844,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6224,i,10329432830815057865,8193266821692028396,2097152 --field-trial-handle=1860,i,5536489848650673739,15078451967604778844,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5940,i,10812782321142367352,4939266099281019896,524288 --field-trial-handle=1860,i,5536489848650673739,15078451967604778844,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6036,i,2256785524293047085,9536618070760624747,524288 --field-trial-handle=1860,i,5536489848650673739,15078451967604778844,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6108,i,7960398015320960446,7054823709161204226,524288 --field-trial-handle=1860,i,5536489848650673739,15078451967604778844,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=6108,i,6490974505542414318,13399602044920042225,2097152 --field-trial-handle=1860,i,5536489848650673739,15078451967604778844,262144 --variations-seed-version --mojo-platform-channel-handle=4572 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=5712,i,10235630159503220669,16649457149482022219,2097152 --field-trial-handle=1860,i,5536489848650673739,15078451967604778844,262144 --variations-seed-version --mojo-platform-channel-handle=4684 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=4588,i,12340451869037411638,9890873253001246553,2097152 --field-trial-handle=1860,i,5536489848650673739,15078451967604778844,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=3704,i,7896623932088440202,12250945396153153134,2097152 --field-trial-handle=1860,i,5536489848650673739,15078451967604778844,262144 --variations-seed-version --mojo-platform-channel-handle=3744 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=3660,i,1489120138517055028,3238737057795179423,2097152 --field-trial-handle=1860,i,5536489848650673739,15078451967604778844,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=6312,i,17639141069696225296,6417272352478092625,2097152 --field-trial-handle=1860,i,5536489848650673739,15078451967604778844,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=6724,i,11729562737935021921,9286031760180690736,2097152 --field-trial-handle=1860,i,5536489848650673739,15078451967604778844,262144 --variations-seed-version --mojo-platform-channel-handle=6716 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --metrics-shmem-handle=3740,i,16364392832249110081,8634528826171710576,2097152 --field-trial-handle=1860,i,5536489848650673739,15078451967604778844,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --metrics-shmem-handle=5396,i,12071459498276411013,15560425479178991691,2097152 --field-trial-handle=1860,i,5536489848650673739,15078451967604778844,262144 --variations-seed-version --mojo-platform-channel-handle=3724 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --metrics-shmem-handle=6936,i,18292972810592097136,12160534723124936788,2097152 --field-trial-handle=1860,i,5536489848650673739,15078451967604778844,262144 --variations-seed-version --mojo-platform-channel-handle=6920 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --metrics-shmem-handle=7080,i,16761680655085171733,193892735091300442,2097152 --field-trial-handle=1860,i,5536489848650673739,15078451967604778844,262144 --variations-seed-version --mojo-platform-channel-handle=7108 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --metrics-shmem-handle=7596,i,17890624971299706861,10840122018397469361,2097152 --field-trial-handle=1860,i,5536489848650673739,15078451967604778844,262144 --variations-seed-version --mojo-platform-channel-handle=7632 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=7924,i,844380888854070136,7204024066507176415,262144 --field-trial-handle=1860,i,5536489848650673739,15078451967604778844,262144 --variations-seed-version --mojo-platform-channel-handle=7884 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --metrics-shmem-handle=6944,i,15517583629640887924,2029241790245770769,2097152 --field-trial-handle=1860,i,5536489848650673739,15078451967604778844,262144 --variations-seed-version --mojo-platform-channel-handle=7612 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --metrics-shmem-handle=6132,i,3495620413991511555,18072000713742592498,2097152 --field-trial-handle=1860,i,5536489848650673739,15078451967604778844,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --metrics-shmem-handle=8056,i,16879353477732650640,17358116009905080634,2097152 --field-trial-handle=1860,i,5536489848650673739,15078451967604778844,262144 --variations-seed-version --mojo-platform-channel-handle=8072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3756,i,7255157365552295322,1610373738043190795,524288 --field-trial-handle=1860,i,5536489848650673739,15078451967604778844,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --metrics-shmem-handle=7076,i,12036887025898610842,14423837404843111654,2097152 --field-trial-handle=1860,i,5536489848650673739,15078451967604778844,262144 --variations-seed-version --mojo-platform-channel-handle=7064 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=8012,i,2815398105017936074,6453570798368040839,524288 --field-trial-handle=1860,i,5536489848650673739,15078451967604778844,262144 --variations-seed-version --mojo-platform-channel-handle=3724 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --metrics-shmem-handle=7800,i,10365197985926328102,410434005068587236,2097152 --field-trial-handle=1860,i,5536489848650673739,15078451967604778844,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --metrics-shmem-handle=6248,i,6935712259722689314,7696018793297528620,2097152 --field-trial-handle=1860,i,5536489848650673739,15078451967604778844,262144 --variations-seed-version --mojo-platform-channel-handle=7064 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --metrics-shmem-handle=6296,i,1002999493714210823,12134976891358438041,2097152 --field-trial-handle=1860,i,5536489848650673739,15078451967604778844,262144 --variations-seed-version --mojo-platform-channel-handle=7216 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --metrics-shmem-handle=7604,i,2479856842802976269,14344264029704225635,2097152 --field-trial-handle=1860,i,5536489848650673739,15078451967604778844,262144 --variations-seed-version --mojo-platform-channel-handle=7956 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --metrics-shmem-handle=7044,i,7768812778021899835,16821226249260125399,2097152 --field-trial-handle=1860,i,5536489848650673739,15078451967604778844,262144 --variations-seed-version --mojo-platform-channel-handle=7020 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --metrics-shmem-handle=3716,i,14219693805738362152,14946659914716964446,2097152 --field-trial-handle=1860,i,5536489848650673739,15078451967604778844,262144 --variations-seed-version --mojo-platform-channel-handle=6860 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --metrics-shmem-handle=7068,i,10289541002008843244,15373805832177103286,2097152 --field-trial-handle=1860,i,5536489848650673739,15078451967604778844,262144 --variations-seed-version --mojo-platform-channel-handle=1588 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5708,i,16040485300630589231,6862049687018533903,524288 --field-trial-handle=1860,i,5536489848650673739,15078451967604778844,262144 --variations-seed-version --mojo-platform-channel-handle=6872 /prefetch:142⤵
- Modifies registry class
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=5404,i,15027193098976961162,571548866409595389,524288 --field-trial-handle=1860,i,5536489848650673739,15078451967604778844,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:122⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --metrics-shmem-handle=6732,i,4119865020052542322,16109102663180434073,2097152 --field-trial-handle=1860,i,5536489848650673739,15078451967604778844,262144 --variations-seed-version --mojo-platform-channel-handle=6936 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵
- Modifies data under HKEY_USERS
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Users\Admin\Desktop\YUNA-Release\YUNA-Release\YUNA.exe"C:\Users\Admin\Desktop\YUNA-Release\YUNA-Release\YUNA.exe"1⤵
-
C:\Users\Admin\Desktop\YUNA-Release\YUNA-Release\YUNA.exe"C:\Users\Admin\Desktop\YUNA-Release\YUNA-Release\YUNA.exe"2⤵
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "attrib +H +S C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\.yuna_auth"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +H +S C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\.yuna_auth4⤵
- Views/modifies file attributes
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "attrib +H +S C:\Users\Admin\AppData\Local\Temp\.~yuna_cache"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +H +S C:\Users\Admin\AppData\Local\Temp\.~yuna_cache4⤵
- Views/modifies file attributes
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "attrib +H +S C:\Users\Admin\AppData\Local\Temp\_MEI42962\.yuna_state"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +H +S C:\Users\Admin\AppData\Local\Temp\_MEI42962\.yuna_state4⤵
- Views/modifies file attributes
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://ollama.com/download3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2e8,0x310,0x7ffaff3dc188,0x7ffaff3dc194,0x7ffaff3dc1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1828,i,2663401354807809148,18258332035587457964,524288 --field-trial-handle=2276,i,7055776073098673543,2333727433067622259,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:114⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1600,i,10805233760962495311,13761722648069813460,262144 --field-trial-handle=2276,i,7055776073098673543,2333727433067622259,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2644,i,2170504599814761217,150306219046803770,524288 --field-trial-handle=2276,i,7055776073098673543,2333727433067622259,262144 --variations-seed-version --mojo-platform-channel-handle=2660 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3524,i,6771173817919582463,8885413155539724196,2097152 --field-trial-handle=2276,i,7055776073098673543,2333727433067622259,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3544,i,6980112697420379259,9156818014273300263,2097152 --field-trial-handle=2276,i,7055776073098673543,2333727433067622259,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4292,i,15851661427036884692,8103719648507763024,2097152 --field-trial-handle=2276,i,7055776073098673543,2333727433067622259,262144 --variations-seed-version --mojo-platform-channel-handle=4544 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4304,i,3512462999054908382,12192055581129987410,2097152 --field-trial-handle=2276,i,7055776073098673543,2333727433067622259,262144 --variations-seed-version --mojo-platform-channel-handle=4548 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5372,i,15452978259221133923,13981833043402928445,524288 --field-trial-handle=2276,i,7055776073098673543,2333727433067622259,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5468,i,11450993667463703790,12756609005321483751,524288 --field-trial-handle=2276,i,7055776073098673543,2333727433067622259,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5464,i,12241472684240224270,7313106535292811965,524288 --field-trial-handle=2276,i,7055776073098673543,2333727433067622259,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6132,i,2337125172911773412,4832755751975932418,524288 --field-trial-handle=2276,i,7055776073098673543,2333727433067622259,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6132,i,2337125172911773412,4832755751975932418,524288 --field-trial-handle=2276,i,7055776073098673543,2333727433067622259,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6296,i,8671586985626572380,1641226277267371198,524288 --field-trial-handle=2276,i,7055776073098673543,2333727433067622259,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6612,i,18011419002432586091,10621417658337641458,524288 --field-trial-handle=2276,i,7055776073098673543,2333727433067622259,262144 --variations-seed-version --mojo-platform-channel-handle=6632 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=4608,i,4666207372189525726,17098754581516850381,2097152 --field-trial-handle=2276,i,7055776073098673543,2333727433067622259,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6352,i,13157517996682210063,2640324517064362927,524288 --field-trial-handle=2276,i,7055776073098673543,2333727433067622259,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6636,i,11203381383730581348,7864515688688646401,524288 --field-trial-handle=2276,i,7055776073098673543,2333727433067622259,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6648,i,10947784673911710076,8666360683444489185,524288 --field-trial-handle=2276,i,7055776073098673543,2333727433067622259,262144 --variations-seed-version --mojo-platform-channel-handle=6728 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1300,i,3862616160928689566,8932548859123733219,524288 --field-trial-handle=2276,i,7055776073098673543,2333727433067622259,262144 --variations-seed-version --mojo-platform-channel-handle=6608 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,4553654094773809069,2165481526936025855,524288 --field-trial-handle=2276,i,7055776073098673543,2333727433067622259,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5536,i,383949215233588005,15137791797236180315,524288 --field-trial-handle=2276,i,7055776073098673543,2333727433067622259,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5568,i,9681466504860285316,11929082336511741608,524288 --field-trial-handle=2276,i,7055776073098673543,2333727433067622259,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5468,i,4832400841948615430,15822135453704225356,524288 --field-trial-handle=2276,i,7055776073098673543,2333727433067622259,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5448,i,7129137480377647853,13359340707354161803,262144 --field-trial-handle=2276,i,7055776073098673543,2333727433067622259,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=6092,i,2460890806210087078,13435521145244231583,2097152 --field-trial-handle=2276,i,7055776073098673543,2333727433067622259,262144 --variations-seed-version --mojo-platform-channel-handle=6736 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2064,i,1602808564746469593,10009831696607694643,524288 --field-trial-handle=2276,i,7055776073098673543,2333727433067622259,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7088,i,13466996080717019982,13235948509983064514,524288 --field-trial-handle=2276,i,7055776073098673543,2333727433067622259,262144 --variations-seed-version --mojo-platform-channel-handle=7140 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=5616,i,9317165207449002315,3048207316736916922,2097152 --field-trial-handle=2276,i,7055776073098673543,2333727433067622259,262144 --variations-seed-version --mojo-platform-channel-handle=5640 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=5132,i,2707073158894389692,16910919461579429121,2097152 --field-trial-handle=2276,i,7055776073098673543,2333727433067622259,262144 --variations-seed-version --mojo-platform-channel-handle=4700 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=4680,i,11096395161851134296,12238601990113422551,2097152 --field-trial-handle=2276,i,7055776073098673543,2333727433067622259,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=5652,i,6913240975466961310,16351441060636404272,2097152 --field-trial-handle=2276,i,7055776073098673543,2333727433067622259,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5704,i,7841842048376681222,8197004835846854391,524288 --field-trial-handle=2276,i,7055776073098673543,2333727433067622259,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:124⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=5612,i,4900000014516111904,12102173501382055218,2097152 --field-trial-handle=2276,i,7055776073098673543,2333727433067622259,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5440,i,5329009464330999776,2205880001162615385,524288 --field-trial-handle=2276,i,7055776073098673543,2333727433067622259,262144 --variations-seed-version --mojo-platform-channel-handle=4524 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=7432,i,18242646204431765367,1579886488349423902,2097152 --field-trial-handle=2276,i,7055776073098673543,2333727433067622259,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=7508,i,13434646971121763344,11827304864749619986,2097152 --field-trial-handle=2276,i,7055776073098673543,2333727433067622259,262144 --variations-seed-version --mojo-platform-channel-handle=7532 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=7664,i,9671090151215773209,5212595717351522064,2097152 --field-trial-handle=2276,i,7055776073098673543,2333727433067622259,262144 --variations-seed-version --mojo-platform-channel-handle=7688 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=7376,i,15151952677822889640,12924937695080732881,2097152 --field-trial-handle=2276,i,7055776073098673543,2333727433067622259,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=7556,i,5082787602681643503,2053790339709258098,2097152 --field-trial-handle=2276,i,7055776073098673543,2333727433067622259,262144 --variations-seed-version --mojo-platform-channel-handle=7616 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5436,i,6430936740717737621,1856304719242825837,524288 --field-trial-handle=2276,i,7055776073098673543,2333727433067622259,262144 --variations-seed-version --mojo-platform-channel-handle=7832 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6424,i,3769076855757742586,8686316322249529042,524288 --field-trial-handle=2276,i,7055776073098673543,2333727433067622259,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8044,i,15871425216297558189,556274775715395594,524288 --field-trial-handle=2276,i,7055776073098673543,2333727433067622259,262144 --variations-seed-version --mojo-platform-channel-handle=8040 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=8184,i,4452204461747359650,15289841148697098997,2097152 --field-trial-handle=2276,i,7055776073098673543,2333727433067622259,262144 --variations-seed-version --mojo-platform-channel-handle=8200 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=7672,i,7719626515211793933,9536870425509413017,2097152 --field-trial-handle=2276,i,7055776073098673543,2333727433067622259,262144 --variations-seed-version --mojo-platform-channel-handle=8400 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8552,i,7449999681352143665,3381167781797281811,524288 --field-trial-handle=2276,i,7055776073098673543,2333727433067622259,262144 --variations-seed-version --mojo-platform-channel-handle=8644 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8672,i,7985209658046326945,416154006430800111,524288 --field-trial-handle=2276,i,7055776073098673543,2333727433067622259,262144 --variations-seed-version --mojo-platform-channel-handle=8668 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8616,i,17013609248321430757,2383239104392343369,524288 --field-trial-handle=2276,i,7055776073098673543,2333727433067622259,262144 --variations-seed-version --mojo-platform-channel-handle=8836 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=8932,i,7145044855730785745,8585140109193520244,2097152 --field-trial-handle=2276,i,7055776073098673543,2333727433067622259,262144 --variations-seed-version --mojo-platform-channel-handle=8928 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=8816,i,5475150356020140500,18255445327061698614,2097152 --field-trial-handle=2276,i,7055776073098673543,2333727433067622259,262144 --variations-seed-version --mojo-platform-channel-handle=7288 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8688,i,1912440183457271917,14396521334213653361,524288 --field-trial-handle=2276,i,7055776073098673543,2333727433067622259,262144 --variations-seed-version --mojo-platform-channel-handle=7456 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=proxy_resolver.mojom.ProxyResolverFactory --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7984,i,7086734369017024519,16324110624853706794,524288 --field-trial-handle=2276,i,7055776073098673543,2333727433067622259,262144 --variations-seed-version --mojo-platform-channel-handle=8028 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7512,i,5095095383539235521,6174464334453832954,524288 --field-trial-handle=2276,i,7055776073098673543,2333727433067622259,262144 --variations-seed-version --mojo-platform-channel-handle=8832 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --always-read-main-dll --metrics-shmem-handle=7332,i,5494656351493551267,12295737321515095882,2097152 --field-trial-handle=2276,i,7055776073098673543,2333727433067622259,262144 --variations-seed-version --mojo-platform-channel-handle=8744 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --always-read-main-dll --metrics-shmem-handle=8968,i,5498436878706275306,4482952961639630686,2097152 --field-trial-handle=2276,i,7055776073098673543,2333727433067622259,262144 --variations-seed-version --mojo-platform-channel-handle=7684 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --always-read-main-dll --metrics-shmem-handle=8500,i,1663023348159291067,7624391687156676219,2097152 --field-trial-handle=2276,i,7055776073098673543,2333727433067622259,262144 --variations-seed-version --mojo-platform-channel-handle=8492 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8588,i,11685576358530139464,17650662865046169505,524288 --field-trial-handle=2276,i,7055776073098673543,2333727433067622259,262144 --variations-seed-version --mojo-platform-channel-handle=8820 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --always-read-main-dll --metrics-shmem-handle=7936,i,14555665652246192376,8817970583966348647,2097152 --field-trial-handle=2276,i,7055776073098673543,2333727433067622259,262144 --variations-seed-version --mojo-platform-channel-handle=7944 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --always-read-main-dll --metrics-shmem-handle=9136,i,18190702278248593383,6633501157675243523,2097152 --field-trial-handle=2276,i,7055776073098673543,2333727433067622259,262144 --variations-seed-version --mojo-platform-channel-handle=9164 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --always-read-main-dll --metrics-shmem-handle=7684,i,13968683372914443977,16226990213469480738,2097152 --field-trial-handle=2276,i,7055776073098673543,2333727433067622259,262144 --variations-seed-version --mojo-platform-channel-handle=8028 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --always-read-main-dll --metrics-shmem-handle=8460,i,15467939102498088261,6842102356985827152,2097152 --field-trial-handle=2276,i,7055776073098673543,2333727433067622259,262144 --variations-seed-version --mojo-platform-channel-handle=7948 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --always-read-main-dll --metrics-shmem-handle=4672,i,3123532149388070351,5630459616532977686,2097152 --field-trial-handle=2276,i,7055776073098673543,2333727433067622259,262144 --variations-seed-version --mojo-platform-channel-handle=9144 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7468,i,8000519760479455225,17075855292031999004,524288 --field-trial-handle=2276,i,7055776073098673543,2333727433067622259,262144 --variations-seed-version --mojo-platform-channel-handle=8740 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --always-read-main-dll --metrics-shmem-handle=7732,i,10815499890964825672,10356616450831809181,2097152 --field-trial-handle=2276,i,7055776073098673543,2333727433067622259,262144 --variations-seed-version --mojo-platform-channel-handle=9400 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9444,i,11150734038493809882,2252901339215326828,524288 --field-trial-handle=2276,i,7055776073098673543,2333727433067622259,262144 --variations-seed-version --mojo-platform-channel-handle=9456 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --always-read-main-dll --metrics-shmem-handle=5844,i,10686971185505296367,13819808086983718309,2097152 --field-trial-handle=2276,i,7055776073098673543,2333727433067622259,262144 --variations-seed-version --mojo-platform-channel-handle=8456 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5988,i,3032698902711248452,10604671546498726403,524288 --field-trial-handle=2276,i,7055776073098673543,2333727433067622259,262144 --variations-seed-version --mojo-platform-channel-handle=8424 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8720,i,8266548622606017558,17683803679153364561,524288 --field-trial-handle=2276,i,7055776073098673543,2333727433067622259,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9404,i,635961792831524147,5526759293271147762,524288 --field-trial-handle=2276,i,7055776073098673543,2333727433067622259,262144 --variations-seed-version --mojo-platform-channel-handle=7524 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7992,i,15346025234838687159,8942530402908842019,524288 --field-trial-handle=2276,i,7055776073098673543,2333727433067622259,262144 --variations-seed-version --mojo-platform-channel-handle=9324 /prefetch:144⤵
-
-
C:\Users\Admin\Downloads\OllamaSetup (1).exe"C:\Users\Admin\Downloads\OllamaSetup (1).exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\is-TAV2QVCEXP.tmp\OllamaSetup (1).tmp"C:\Users\Admin\AppData\Local\Temp\is-TAV2QVCEXP.tmp\OllamaSetup (1).tmp" /SL5="$10048A,1573016807,845824,C:\Users\Admin\Downloads\OllamaSetup (1).exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /f /t /im "ollama app.exe"6⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /f /t /im "llama-server.exe"6⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /f /t /im "ollama.exe"6⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /f /t /im "llama-server.exe"6⤵
- Kills process with taskkill
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9248,i,15429085490888878553,4751637235980461677,524288 --field-trial-handle=2276,i,7055776073098673543,2333727433067622259,262144 --variations-seed-version --mojo-platform-channel-handle=7380 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6844,i,16142123289024724923,4078848176714586437,524288 --field-trial-handle=2276,i,7055776073098673543,2333727433067622259,262144 --variations-seed-version --mojo-platform-channel-handle=9420 /prefetch:144⤵
-
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\YUNA-Release\YUNA-Release\New Text Document.txt1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops desktop.ini file(s)
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Desktop\YUNA-Release\YUNA-Release\YUNA.exe"C:\Users\Admin\Desktop\YUNA-Release\YUNA-Release\YUNA.exe"3⤵
-
C:\Users\Admin\Desktop\YUNA-Release\YUNA-Release\YUNA.exe"C:\Users\Admin\Desktop\YUNA-Release\YUNA-Release\YUNA.exe"4⤵
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "attrib +H +S C:\Users\Admin\AppData\Local\Temp\_MEI28162\.yuna_state"5⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +H +S C:\Users\Admin\AppData\Local\Temp\_MEI28162\.yuna_state6⤵
- Views/modifies file attributes
-
-
-
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\YUNA-Release\YUNA-Release\New Text Document.txt3⤵
-
-
C:\Users\Admin\Desktop\YUNA-Release\YUNA-Release\YUNA.exe"C:\Users\Admin\Desktop\YUNA-Release\YUNA-Release\YUNA.exe"3⤵
-
C:\Users\Admin\Desktop\YUNA-Release\YUNA-Release\YUNA.exe"C:\Users\Admin\Desktop\YUNA-Release\YUNA-Release\YUNA.exe"4⤵
- Checks SCSI registry key(s)
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "attrib +H +S C:\Users\Admin\AppData\Local\Temp\_MEI60682\.yuna_state"5⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +H +S C:\Users\Admin\AppData\Local\Temp\_MEI60682\.yuna_state6⤵
- Views/modifies file attributes
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://ollama.com/download5⤵
-
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /43⤵
- Checks SCSI registry key(s)
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\Downloads\OllamaSetup (1).exe"C:\Users\Admin\Downloads\OllamaSetup (1).exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\is-E14U21IZ4C.tmp\OllamaSetup (1).tmp"C:\Users\Admin\AppData\Local\Temp\is-E14U21IZ4C.tmp\OllamaSetup (1).tmp" /SL5="$30522,1573016807,845824,C:\Users\Admin\Downloads\OllamaSetup (1).exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v16
Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
settings.dat
67402b36-d97b-41f3-a264-68d58faab113.tmp
BookmarkMergedSurfaceOrdering
f_000005
f_000053
f_00005d
f_00005e
temp-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
messages.json
craw_background.js
CURRENT
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
TransportSecurity
TransportSecurity
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
73a70d7d7cb48ca0_0
the-real-index
the-real-index
the-real-index
the-real-index~RFe5bd4e0.TMP
data_0
data_1
data_2
data_3
MANIFEST-000001
index.txt
index.txt~RFe6c3bda.TMP
Local State
Local State
Local State
Local State
Local State
Local State
Local State
settings.dat
settings.dat
LOG.old
LOG.old
LOG.old
f_00004b
f_00004c
f_00004d
f_00004e
f_00004f
f_000090
f_0000b4
temp-index
the-real-index
the-real-index
the-real-index~RFe6b47c6.TMP
SiteList-Enterprise.json
Edge Profile.ico
MANIFEST-000001
Network Persistent State
Network Persistent State
Network Persistent State
Sdch Dictionaries
Sdch Dictionaries
Sdch Dictionaries
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
index
the-real-index
the-real-index~RFe6e1c23.TMP
the-real-index
the-real-index
the-real-index~RFe6d83fa.TMP
index.txt
index.txt
the-real-index
the-real-index
the-real-index~RFe6dd6bd.TMP
97e3af94-c2f4-492e-8567-6aa608faa3a4.tmp
Local State
Local State
Local State
Local State
Local State
Local State
Local State
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter~RFe6d693e.TMP
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
8851ac61-d2eb-46c1-be59-bf337c364201.tmp
prep_Activatable Class_Hermes_perf.cache
92bfb164-4153-4fe6-bdee-04122be1fe25.tmp
qt_help_en.qm
namespace_packages.txt
VCRUNTIME140.dll
_bz2.pyd
_ctypes.pyd
_lzma.pyd
base_library.zip
freetype.dll
INSTALLER
libcrypto-1_1.dll
libffi-7.dll
libjpeg-9.dll
libmodplug-1.dll
libogg-0.dll
libopus-0.dll
python3.dll
python38.dll
SDL2.dll
SDL2_image.dll
SDL2_mixer.dll
SDL2_ttf.dll
euc-cn.enc
libpng16-16.dll
zlib1.dll
OllamaSetup (1).tmp
messages.json
content_new.js
intro-offer.tsx-loader-Bj3sR8sI.js
welcome-C_MeboU8.css
bv.svg
gb.svg
mf.svg
ms.svg
us.svg
YUNA.log
YUNA.log
YUNA.log
LICENSE
memory/1260-2426-0x0000020B43CC0000-0x0000020B43CC1000-memory.dmp
memory/1260-2452-0x0000020B3ACF0000-0x0000020B3AD0C000-memory.dmp
memory/1260-2433-0x0000020B43CC0000-0x0000020B43CC1000-memory.dmp
memory/1260-2432-0x0000020B43CC0000-0x0000020B43CC1000-memory.dmp
memory/1260-3407-0x0000020B3ACF0000-0x0000020B3AD0C000-memory.dmp
memory/1260-2428-0x0000020B43CC0000-0x0000020B43CC1000-memory.dmp
memory/1260-2434-0x0000020B43CC0000-0x0000020B43CC1000-memory.dmp
memory/1260-2436-0x0000020B43CC0000-0x0000020B43CC1000-memory.dmp
memory/1260-2437-0x0000020B43CC0000-0x0000020B43CC1000-memory.dmp
memory/1260-2435-0x0000020B43CC0000-0x0000020B43CC1000-memory.dmp
memory/2492-6015-0x000001CB6A750000-0x000001CB6A751000-memory.dmp
memory/2492-6013-0x000001CB6A750000-0x000001CB6A751000-memory.dmp
memory/2776-2556-0x00000206801E0000-0x00000206802E0000-memory.dmp
memory/2776-2602-0x0000020684280000-0x00000206842A0000-memory.dmp
memory/2776-2573-0x0000020681E60000-0x0000020681F60000-memory.dmp
memory/2776-2588-0x0000020681D60000-0x0000020681D80000-memory.dmp
memory/2776-2569-0x0000020681A30000-0x0000020681A50000-memory.dmp
memory/3020-0-0x0000000074952000-0x0000000074953000-memory.dmp
memory/3020-2-0x00000000056D0000-0x0000000005C8A000-memory.dmp
memory/3020-1-0x00000000004E0000-0x000000000061C000-memory.dmp
memory/4384-5995-0x00007FFAF0350000-0x00007FFAF05B0000-memory.dmp
memory/4560-4740-0x00007FFAF2110000-0x00007FFAF237C000-memory.dmp
memory/4560-4692-0x00007FFAF32E0000-0x00007FFAF3540000-memory.dmp
memory/5384-2409-0x00007FFAFE910000-0x00007FFAFEB70000-memory.dmp
memory/5384-3060-0x00007FFAF4DB0000-0x00007FFAF501C000-memory.dmp
memory/5384-2899-0x00007FFAF4DB0000-0x00007FFAF501C000-memory.dmp
memory/5384-2892-0x00007FFAF4DB0000-0x00007FFAF501C000-memory.dmp
memory/5384-2890-0x00007FFAF4DB0000-0x00007FFAF501C000-memory.dmp
memory/5384-2888-0x00007FFAF4DB0000-0x00007FFAF501C000-memory.dmp
memory/5384-2886-0x00007FFAF4DB0000-0x00007FFAF501C000-memory.dmp
memory/5384-2881-0x00007FFAF4DB0000-0x00007FFAF501C000-memory.dmp
memory/5384-2835-0x00007FFAF4DB0000-0x00007FFAF501C000-memory.dmp
memory/5384-2833-0x00007FFAF4DB0000-0x00007FFAF501C000-memory.dmp
memory/5384-2831-0x00007FFAF4DB0000-0x00007FFAF501C000-memory.dmp
memory/5384-2829-0x00007FFAF4DB0000-0x00007FFAF501C000-memory.dmp
memory/5384-2827-0x00007FFAF4DB0000-0x00007FFAF501C000-memory.dmp
memory/5384-2825-0x00007FFAF4DB0000-0x00007FFAF501C000-memory.dmp
memory/5384-2823-0x00007FFAF4DB0000-0x00007FFAF501C000-memory.dmp
memory/5384-2821-0x00007FFAF4DB0000-0x00007FFAF501C000-memory.dmp
memory/5384-2819-0x00007FFAF4DB0000-0x00007FFAF501C000-memory.dmp
memory/5384-2817-0x00007FFAF4DB0000-0x00007FFAF501C000-memory.dmp
memory/5384-2815-0x00007FFAF4DB0000-0x00007FFAF501C000-memory.dmp
memory/5384-2813-0x00007FFAF4DB0000-0x00007FFAF501C000-memory.dmp
memory/5384-2811-0x00007FFAF4DB0000-0x00007FFAF501C000-memory.dmp
memory/5384-2748-0x00007FFAF4DB0000-0x00007FFAF501C000-memory.dmp
memory/5384-2746-0x00007FFAF4DB0000-0x00007FFAF501C000-memory.dmp
memory/5384-2744-0x00007FFAF4DB0000-0x00007FFAF501C000-memory.dmp
memory/5384-2742-0x00007FFAF4DB0000-0x00007FFAF501C000-memory.dmp
memory/5384-2732-0x00007FFAF4DB0000-0x00007FFAF501C000-memory.dmp
memory/5384-2730-0x00007FFAF4DB0000-0x00007FFAF501C000-memory.dmp
memory/5384-2719-0x00007FFAF4DB0000-0x00007FFAF501C000-memory.dmp
memory/5384-2717-0x00007FFAF4DB0000-0x00007FFAF501C000-memory.dmp
memory/5384-2715-0x00007FFAF4DB0000-0x00007FFAF501C000-memory.dmp
memory/5384-2713-0x00007FFAF4DB0000-0x00007FFAF501C000-memory.dmp
memory/5384-2711-0x00007FFAF4DB0000-0x00007FFAF501C000-memory.dmp
memory/5384-2530-0x00007FFAF4DB0000-0x00007FFAF501C000-memory.dmp
memory/5384-2528-0x00007FFAF4DB0000-0x00007FFAF501C000-memory.dmp
memory/5384-2526-0x00007FFAF4DB0000-0x00007FFAF501C000-memory.dmp
memory/5384-2523-0x00007FFAF4DB0000-0x00007FFAF501C000-memory.dmp
memory/5384-2521-0x00007FFAF4DB0000-0x00007FFAF501C000-memory.dmp
memory/5384-2519-0x00007FFAF4DB0000-0x00007FFAF501C000-memory.dmp
memory/5384-2482-0x00007FFAF4DB0000-0x00007FFAF501C000-memory.dmp
memory/5384-2479-0x00007FFAF4DB0000-0x00007FFAF501C000-memory.dmp
memory/5384-2462-0x00007FFAF4DB0000-0x00007FFAF501C000-memory.dmp
memory/5384-2453-0x00007FFAF4DB0000-0x00007FFAF501C000-memory.dmp
memory/5384-2451-0x00007FFAF4DB0000-0x00007FFAF501C000-memory.dmp
memory/5384-2418-0x00007FFAF4DB0000-0x00007FFAF501C000-memory.dmp