Analysis
- user interaction
yes - max time kernel
750s - max time network
730s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
01/10/2026, 16:25
Errors
Reason
Machine shutdown
General
- Target satellitestress_token_1789404065292.txt
- Size 607B
- Sample261001-twza3sys4q
- SHA256 2bdbdde08d55a3789394e97f1d3f25e606363645a6fca536f73c0f5e01497037
Score
8/10
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Disables RegEdit via registry modification 1 IoCs
- Disables Task Manager via registry modification
- Executes dropped EXE 6 IoCs
- Loads dropped DLL 46 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Drops file in System32 directory 3 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 56 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 24 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 9 IoCs
- Modifies Internet Explorer settings 1 TTPs 2 IoCs
- Modifies data under HKEY_USERS 7 IoCs
- Modifies registry class 64 IoCs
- Opens file in notepad (likely ransom note) 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 34 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 34 IoCs
- Suspicious use of SetWindowsHookEx 22 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\NOTEPAD.EXEC:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\satellitestress_token_1789404065292.txt1⤵
- Opens file in notepad (likely ransom note)
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff8f1e3c728,0x7ff8f1e3c734,0x7ff8f1e3c7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1716,i,7740278314636727951,8361720633105929816,262144 --field-trial-handle=1900,i,3309751896338726858,6354104338722010755,262144 --variations-seed-version --mojo-platform-channel-handle=1896 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2224,i,2074056284695686261,7284360710453354067,524288 --field-trial-handle=1900,i,3309751896338726858,6354104338722010755,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:112⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2372,i,7356523297988943439,3072209064353236563,524288 --field-trial-handle=1900,i,3309751896338726858,6354104338722010755,262144 --variations-seed-version --mojo-platform-channel-handle=1860 /prefetch:132⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3356,i,16753250524965411870,5318555640592841210,2097152 --field-trial-handle=1900,i,3309751896338726858,6354104338722010755,262144 --variations-seed-version --mojo-platform-channel-handle=3368 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3360,i,10333768978080072953,4171945093462328616,2097152 --field-trial-handle=1900,i,3309751896338726858,6354104338722010755,262144 --variations-seed-version --mojo-platform-channel-handle=3396 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4704,i,11383939658132190649,3565333820117608501,2097152 --field-trial-handle=1900,i,3309751896338726858,6354104338722010755,262144 --variations-seed-version --mojo-platform-channel-handle=4756 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4880,i,10047848644484992301,12881543090575349529,524288 --field-trial-handle=1900,i,3309751896338726858,6354104338722010755,262144 --variations-seed-version --mojo-platform-channel-handle=4888 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5400,i,8861212973130701275,40295706263199435,524288 --field-trial-handle=1900,i,3309751896338726858,6354104338722010755,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5448,i,14768176875250428907,17209358901645499109,2097152 --field-trial-handle=1900,i,3309751896338726858,6354104338722010755,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5456,i,6213495920397387880,11225234999772080224,2097152 --field-trial-handle=1900,i,3309751896338726858,6354104338722010755,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5768,i,5455263333365355714,14094628561568240337,2097152 --field-trial-handle=1900,i,3309751896338726858,6354104338722010755,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5756,i,15975419117406999823,11257304221766118383,524288 --field-trial-handle=1900,i,3309751896338726858,6354104338722010755,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5452,i,12938257258256410800,15442219914187671565,2097152 --field-trial-handle=1900,i,3309751896338726858,6354104338722010755,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5820,i,11256586363211256434,16108842158085130644,524288 --field-trial-handle=1900,i,3309751896338726858,6354104338722010755,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5484,i,14147360776039010456,10819939552352820953,2097152 --field-trial-handle=1900,i,3309751896338726858,6354104338722010755,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5704,i,18387561184953676525,430277332160907546,2097152 --field-trial-handle=1900,i,3309751896338726858,6354104338722010755,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5780,i,6666665956464866851,14265685908157299773,2097152 --field-trial-handle=1900,i,3309751896338726858,6354104338722010755,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=3356,i,9912832880764708616,11778153649118421092,2097152 --field-trial-handle=1900,i,3309751896338726858,6354104338722010755,262144 --variations-seed-version --mojo-platform-channel-handle=3336 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6400,i,6363618922348556880,12318544441563882297,524288 --field-trial-handle=1900,i,3309751896338726858,6354104338722010755,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5604,i,18235366441883004908,7178534333596268934,2097152 --field-trial-handle=1900,i,3309751896338726858,6354104338722010755,262144 --variations-seed-version --mojo-platform-channel-handle=5780 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=4900,i,12780829329253860727,10409056889337397723,2097152 --field-trial-handle=1900,i,3309751896338726858,6354104338722010755,262144 --variations-seed-version --mojo-platform-channel-handle=3416 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=5504,i,3979635646545225530,121858471551895439,2097152 --field-trial-handle=1900,i,3309751896338726858,6354104338722010755,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:92⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=5668,i,3546149437232066127,6935685292755593667,2097152 --field-trial-handle=1900,i,3309751896338726858,6354104338722010755,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5488,i,3230260542999636169,14312719314081073901,524288 --field-trial-handle=1900,i,3309751896338726858,6354104338722010755,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5536,i,1862303263049110171,2139605850106425653,524288 --field-trial-handle=1900,i,3309751896338726858,6354104338722010755,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3592,i,9932690453390183563,7417737675671084071,524288 --field-trial-handle=1900,i,3309751896338726858,6354104338722010755,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=3584,i,4721431211410726407,8060438875633421174,2097152 --field-trial-handle=1900,i,3309751896338726858,6354104338722010755,262144 --variations-seed-version --mojo-platform-channel-handle=3412 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=3588,i,4023159040678218387,1789144062251372524,2097152 --field-trial-handle=1900,i,3309751896338726858,6354104338722010755,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=6376,i,12290044455200889935,15878491265751144178,2097152 --field-trial-handle=1900,i,3309751896338726858,6354104338722010755,262144 --variations-seed-version --mojo-platform-channel-handle=3252 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6036,i,9751864328917949356,828791896124511638,524288 --field-trial-handle=1900,i,3309751896338726858,6354104338722010755,262144 --variations-seed-version --mojo-platform-channel-handle=4812 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4796,i,18338116384145697802,8100038939993631848,262144 --field-trial-handle=1900,i,3309751896338726858,6354104338722010755,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=6380,i,2060585368207507623,755325982862802369,2097152 --field-trial-handle=1900,i,3309751896338726858,6354104338722010755,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=6668,i,2489981957332899590,5747603695791598555,524288 --field-trial-handle=1900,i,3309751896338726858,6354104338722010755,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --metrics-shmem-handle=6804,i,4693487604249330282,10166811185437869763,2097152 --field-trial-handle=1900,i,3309751896338726858,6354104338722010755,262144 --variations-seed-version --mojo-platform-channel-handle=6808 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --metrics-shmem-handle=7000,i,16228635360136948931,11224983946093363047,2097152 --field-trial-handle=1900,i,3309751896338726858,6354104338722010755,262144 --variations-seed-version --mojo-platform-channel-handle=7016 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --metrics-shmem-handle=3520,i,14241025485805016718,4640732931391800423,2097152 --field-trial-handle=1900,i,3309751896338726858,6354104338722010755,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6340,i,4599950557314785289,2072783914836089544,524288 --field-trial-handle=1900,i,3309751896338726858,6354104338722010755,262144 --variations-seed-version --mojo-platform-channel-handle=6800 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --metrics-shmem-handle=7200,i,13491577198598310023,7553222432729357816,2097152 --field-trial-handle=1900,i,3309751896338726858,6354104338722010755,262144 --variations-seed-version --mojo-platform-channel-handle=4684 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --metrics-shmem-handle=7292,i,13271224298892308648,4923001757963086624,2097152 --field-trial-handle=1900,i,3309751896338726858,6354104338722010755,262144 --variations-seed-version --mojo-platform-channel-handle=7352 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --metrics-shmem-handle=7248,i,7225644916358723400,1068848747330208215,2097152 --field-trial-handle=1900,i,3309751896338726858,6354104338722010755,262144 --variations-seed-version --mojo-platform-channel-handle=7312 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --metrics-shmem-handle=5460,i,6431809295190687100,14681234160135191965,2097152 --field-trial-handle=1900,i,3309751896338726858,6354104338722010755,262144 --variations-seed-version --mojo-platform-channel-handle=6964 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --metrics-shmem-handle=6360,i,17391250260962490559,918119421846585827,2097152 --field-trial-handle=1900,i,3309751896338726858,6354104338722010755,262144 --variations-seed-version --mojo-platform-channel-handle=4828 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --metrics-shmem-handle=7680,i,9272195227282801466,4730979993524960991,2097152 --field-trial-handle=1900,i,3309751896338726858,6354104338722010755,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --metrics-shmem-handle=7888,i,411448942562855450,3273960880098205211,2097152 --field-trial-handle=1900,i,3309751896338726858,6354104338722010755,262144 --variations-seed-version --mojo-platform-channel-handle=7884 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=7592,i,12566721470381466546,9464492511150204540,524288 --field-trial-handle=1900,i,3309751896338726858,6354104338722010755,262144 --variations-seed-version --mojo-platform-channel-handle=7660 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --metrics-shmem-handle=7992,i,7273354570186023325,13436106911756180924,2097152 --field-trial-handle=1900,i,3309751896338726858,6354104338722010755,262144 --variations-seed-version --mojo-platform-channel-handle=7724 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --metrics-shmem-handle=7696,i,6483551972666268328,2274654014834374118,2097152 --field-trial-handle=1900,i,3309751896338726858,6354104338722010755,262144 --variations-seed-version --mojo-platform-channel-handle=8080 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --metrics-shmem-handle=8148,i,11401825572822474955,16765811290551927658,2097152 --field-trial-handle=1900,i,3309751896338726858,6354104338722010755,262144 --variations-seed-version --mojo-platform-channel-handle=8144 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=8240,i,8922276402636618521,12163828734729373932,524288 --field-trial-handle=1900,i,3309751896338726858,6354104338722010755,262144 --variations-seed-version --mojo-platform-channel-handle=7976 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=8124,i,8927838375211983556,18392642806435863554,524288 --field-trial-handle=1900,i,3309751896338726858,6354104338722010755,262144 --variations-seed-version --mojo-platform-channel-handle=8332 /prefetch:122⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --metrics-shmem-handle=7940,i,2881311633464043395,6737250306686874689,2097152 --field-trial-handle=1900,i,3309751896338726858,6354104338722010755,262144 --variations-seed-version --mojo-platform-channel-handle=7828 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --metrics-shmem-handle=6836,i,9320691900778676939,1494195804017460174,2097152 --field-trial-handle=1900,i,3309751896338726858,6354104338722010755,262144 --variations-seed-version --mojo-platform-channel-handle=8416 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=8504,i,14651568722885310200,5008987416864397421,524288 --field-trial-handle=1900,i,3309751896338726858,6354104338722010755,262144 --variations-seed-version --mojo-platform-channel-handle=8580 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵
- Modifies data under HKEY_USERS
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\System32\DataExchangeHost.exeC:\Windows\System32\DataExchangeHost.exe -Embedding1⤵
-
C:\Users\Admin\Desktop\Pikachu.exe"C:\Users\Admin\Desktop\Pikachu.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE"C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Desktop\Pikachu.exe"C:\Users\Admin\Desktop\Pikachu.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\bbd33541-4d0f-4c46-958b-46a6354d85ba_Pikachu virus.zip.5ba\Email-worm.Pikachu MBR overwriter2⤵
-
-
C:\Users\Admin\Desktop\Pikachu.exe"C:\Users\Admin\Desktop\Pikachu.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE"C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\DataExchangeHost.exeC:\Windows\System32\DataExchangeHost.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\DataExchangeHost.exeC:\Windows\System32\DataExchangeHost.exe -Embedding1⤵
-
C:\Users\Admin\Desktop\BonziBuddy432.exe"C:\Users\Admin\Desktop\BonziBuddy432.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\BonziBuddy432\Runtimes\CheckRuntimes.bat" "2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\BonziBuddy432\Runtimes\MSAGENT.EXEMSAGENT.EXE3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s "C:\Windows\msagent\AgentCtl.dll"4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s "C:\Windows\msagent\AgentDPv.dll"4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s "C:\Windows\msagent\mslwvtts.dll"4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s "C:\Windows\msagent\AgentDP2.dll"4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s "C:\Windows\msagent\AgentMPx.dll"4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s "C:\Windows\msagent\AgentSR.dll"4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s "C:\Windows\msagent\AgentPsh.dll"4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\msagent\AgentSvr.exe"C:\Windows\msagent\AgentSvr.exe" /regserver4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
C:\Windows\SysWOW64\grpconv.exegrpconv.exe -o4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Program Files (x86)\BonziBuddy432\Runtimes\tv_enua.exetv_enua.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s C:\Windows\lhsp\tv\tv_enua.dll4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s C:\Windows\lhsp\tv\tvenuax.dll4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\grpconv.exegrpconv.exe -o4⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Program Files (x86)\BonziBuddy432\BonziBDY_35.EXE"C:\Program Files (x86)\BonziBuddy432\BonziBDY_35.EXE"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\msagent\AgentSvr.exeC:\Windows\msagent\AgentSvr.exe -Embedding1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004F4 0x00000000000004F01⤵
-
C:\Program Files (x86)\BonziBuddy432\BonziBDY_4.EXE"C:\Program Files (x86)\BonziBuddy432\BonziBDY_4.EXE"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe shell32.dll,Control_RunDLL speech.cpl,,02⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\RunDll32.exeC:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL speech.cpl,,03⤵
-
-
-
C:\Users\Admin\Desktop\salinewin1.5.exe"C:\Users\Admin\Desktop\salinewin1.5.exe"1⤵
- Disables RegEdit via registry modification
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
AUTOEXEC.BAT
ActiveSkin.ocx
Bonzi's Beach Checkers.exe
BonziBDY_2.EXE
BonziBDY_35.EXE
BonziBDY_4.EXE
BonziCheckers.ocx
page17.jpg
page18.jpg
MSCOMCTL.OCX
MSINET.OCX
MSWINSCK.OCX
Reg.nbd
Reg.nbd
Reg.nbd
Reg.nbd
Reg.nbd
Reg.nbd.temp
Regicon.ocx
CheckRuntimes.bat
SSCALA32.OCX
SSCALB32.OCX
Uninstall.exe
ssa3d30.ocx
sstabs2.ocx
B76BE66D46C355931939D8CF818D03FD_879AFEB08DCB012707582D902977FF92
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F
B76BE66D46C355931939D8CF818D03FD_879AFEB08DCB012707582D902977FF92
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F
0eba3831-a3da-471a-a2b5-fc955b56aafd.tmp
6aa32ea6-a399-4277-a834-5c9947b1e596.tmp
7236ae6a-fb84-4fb0-8ea7-8f3a1d4769b9.tmp
73c52419-7fe9-49be-8d82-3570818a1bb7.tmp
settings.dat
06d10c14-9fcb-4e1f-8b2b-324bb27416ff.tmp
1ff8515a-d670-4726-9b98-e67a85a163cf.tmp
24e13ee6-5e99-466b-bc95-09e2a4e85b07.tmp
276ad07f-120c-4620-88d1-a79716c13ad8.tmp
37aeea95-5dd5-47fc-9e8f-56de1da267d7.tmp
46382471-464e-41dd-b788-d54e731c90a9.tmp
67e73342-c392-46ed-91ce-3589346deaf2.tmp
8fec7338-8f57-4d26-81f7-0ad7a8cf3e76.tmp
91cc7936-f5ef-46b4-84f2-b76c803fd75d.tmp
97e0a92f-8ff3-4ec0-8d92-3771c0f35f04.tmp
98e7550f-b4e2-476a-8371-e59f1fed66e6.tmp
f_000004
f_000006
f_00000a
f_00000c
f_00000e
f_00000f
f_000019
f_00001a
f_00001b
f_00001c
f_000024
f_000025
f_000026
f_000027
f_000028
f_000037
f_000038
f_000039
f_00003a
f_00003b
f_00003c
f_00003d
f_00003e
f_00003f
f_000040
f_000041
f_000042
f_000043
f_000044
f_000045
f_000046
f_000047
f_000048
f_000049
f_00004a
f_00004b
f_00004c
f_00004d
f_00004e
f_00004f
f_000050
f_000051
f_000052
f_000053
f_000056
f_000057
f_000058
f_000059
f_00005b
f_000067
f_000073
f_000083
f_00009d
037c17119ef4054b_0
04150c24be4f3e75_0
071c1128df643428_0
0c858290d59bf1fc_0
0cbbf6c27ec4e19b_0
0f81b7a088b6906e_0
134b2347d7ea5987_0
16efeb492bada89a_0
1891a22b028d3b24_0
19f0c5de1d49ad39_0
1d553b00886d559b_0
2302b8926f339d74_0
234c1e8c5294adf4_0
273662d41e0ada37_0
277ea7de6603fe47_0
33ed520404acc1d9_0
33edb5573c119dc1_0
3bc095c2add1de5e_0
3cf627ba18e5418b_0
417ce13111469d84_0
42a312271724cde6_0
44b327f3a8c7bfd7_0
492dd17394e54761_0
49523b8630b10b1a_0
49ccc1c07cdb9ea2_0
4ab942382c038941_0
4aed36ccc49c93ef_0
4fd018567c990084_0
504d1c624fcb17ba_0
5f417ab305b6b825_0
612a407446c0f49f_0
689c651fb6bfc5af_0
6c450651c73fd7e3_0
6cfbdf47b5435b91_0
6f904d63c59b76b9_0
729d72d89670d34d_0
76a9a6d36dcc6f28_0
78472403e5ab7a20_0
799e5901ac9ed935_0
7b248997d737eb1c_0
7decbe87d7f42702_0
83e684f073c162db_0
88a07113dcc9b61e_0
89a6ebd98e80525e_0
8b0d13b2ac049591_0
8baff564a24ef342_0
8bbe70ba6b7c245b_0
8d1da5ed6bb4a93d_0
904d337094047b79_0
90ba3b09560a6650_0
92bddab21bd6ee5a_0
95aec484256288ad_0
965c85ac0f1da3c5_0
974b736a16eef29b_0
98fb17b4034f8f18_0
998ce1d080ce14e7_0
9d835ef469eb93a2_0
9f7e13f1f0ea9bb7_0
a9a3ca0da20dcad5_0
abf8be3ca32c3b01_0
ac45e1e3dc096bb0_0
b0958ad32fc09b08_0
b405a1d61bc72efb_0
b7efab72644e6a16_0
b9c2d9da317762d3_0
bce636dd102fe8dc_0
bda34ea700b97dfb_0
bdb627a446030d0e_0
c2a81345b71af473_0
c38dbcf0dc77caad_0
c698db1ea942fc28_0
c83af370fddff215_0
cf13e03e8d3cbed0_0
d6f51a44a600e81c_0
d847b38b11809bbb_0
d952b24d70ce556e_0
db76dc4784aee742_0
dbc35f1673cf94b5_0
e118723f056fa002_0
e2f7d3983a474a42_0
e35829e2bfbd2372_0
e9ad6bd6e6600c45_0
ec0e337a3818f384_0
ef90115c1d8ed176_0
efe79c86afe56142_0
f418d3750c61de23_0
f468acaf301492a4_0
f5c02764b4758976_0
f710cde02704f087_0
fc25e1933d697964_0
fcdcccf49d04dc77_0
fe829a96b684fa4f_0
temp-index
temp-index
temp-index
temp-index
the-real-index
messages.json
craw_background.js
CURRENT
MANIFEST-000001
MANIFEST-000001
00e9b2f6-b6ad-4d61-821b-09741e56fd33.tmp
33606a08-e3d6-4876-ba09-e01a380c08f2.tmp
3e970909-4d46-480f-8dcd-54a145c06066.tmp
47e8503b-5c11-48ac-ab60-ed81037fdb29.tmp
648346ac-4ca5-4cf5-92bf-203b285c9046.tmp
b099ec1d-855f-4152-8c05-c90d9571c593.tmp
c90da3d4-8854-4ea7-acd2-db80ebf5185b.tmp
d8e14409-b342-463f-a04b-bc12e62040fa.tmp
870b785f4c2321c8_0
e724e1086a23647b_0
temp-index
temp-index
the-real-index
data_0
data_1
data_2
data_3
69e7e1df-8d68-4fd0-9816-2faa5460ecfc.tmp
Network Persistent State
a23ce708-fd31-4391-b4cf-5a40985ce50f.tmp
c52b2f2c-03e8-41c6-b16f-78aefbc23fd1.tmp
d1f8f653-7b6f-4f54-8954-9633b3a2c13f.tmp
d26d9ba6-09a9-4a12-913b-d883f6490acd.tmp
f7b6bd32-066a-43cd-bc69-1bdacc46499d.tmp
f86440c8-eb67-499c-abf4-47761095879d.tmp
fc1005b3-9cc8-49e5-87f4-2597abe65a7c.tmp
a30522cb-ebbd-4058-b466-1979d96379fe.tmp
a32928ad-d806-4831-8043-c5c18a69936e.tmp
a9eb93fb-e157-416c-9410-6609b986cc30.tmp
c4d3fbb5-aa25-4cd3-9a70-1ebce11e1467.tmp
db75f15b-54b7-40e8-8ae4-0b605ea20573.tmp
edf25f42-ff9e-4809-aeec-c0acf33b8094.tmp
44C37E5A-218D-4C64-893C-551A551E7F0F
mip_sdk.miplog
outlook.exe.db-wal
Stream_AvailabilityOptions_2_F268211995D92E439541B21420E1F9EB.dat
Stream_Calendar_2_2EC752F3B1DA7541914FC2F4A2815BA9.dat
Stream_ConversationPrefs_2_B4FDEFF12C9663438B3F77A083C101BF.dat
Stream_RssRule_2_EDC5E66DDCF6C74E954A826FDDCF3202.dat
Stream_TCPrefs_2_2736DFEC66A367489E617EDF2F754C2D.dat
Stream_WorkHours_1_95630F061F179C46BECB6BBEADCE0E4F.dat
0001.tmp
0002.tmp
0003.tmp
0004.tmp
0005.tmp
0006.tmp
16.tmp
7.tmp
ADVPACK.DLL
AGENTANM.DLL
AGENTCTL.DLL
AGENTDP2.DLL
AGENTDPV.DLL
AGENTMPX.DLL
AGENTPSH.DLL
AGENTSR.DLL
AGENTSVR.EXE
AGT0409.DLL
AGT0409.HLP
AGT20.INF
AGTCTL15.TLB
AGTINST.INF
MSLWVTTS.DLL
Msvcirt.dll
Msvcp50.dll
W95INF16.DLL
W95INF32.DLL
andmoipa.ttf
tv_enua.dll
tv_enua.hlp
tv_enua.inf
tvenuax.dll
d0e53290-3c14-47f3-81d5-a7b61e8783a4.tmp
messages.json
Outlook Data File - ezlqmhjsoc.pst
Outlook Data File - ezlqmhjsoc.pst
b680215a-bd19-4a58-b944-55554ea48cab.tmp
bbdb696c-c261-4483-9184-bd81c646828e.tmp
bon4.zip.crdownload
Bonzi.acs
Peedy.acs
memory/1148-2780-0x0000000000400000-0x0000000000424000-memory.dmp
memory/1148-3088-0x0000000000400000-0x0000000000424000-memory.dmp
memory/4360-1086-0x00007FF8C27E0000-0x00007FF8C27F0000-memory.dmp
memory/4360-1088-0x00007FF8C27E0000-0x00007FF8C27F0000-memory.dmp
memory/4360-1087-0x00007FF8C27E0000-0x00007FF8C27F0000-memory.dmp
memory/4360-1085-0x00007FF8C27E0000-0x00007FF8C27F0000-memory.dmp
memory/4360-1084-0x00007FF8C27E0000-0x00007FF8C27F0000-memory.dmp
memory/5748-1019-0x00007FF8BFAB0000-0x00007FF8BFAC0000-memory.dmp
memory/5748-1018-0x00007FF8BFAB0000-0x00007FF8BFAC0000-memory.dmp
memory/5748-1017-0x00007FF8C27E0000-0x00007FF8C27F0000-memory.dmp
memory/5748-1016-0x00007FF8C27E0000-0x00007FF8C27F0000-memory.dmp
memory/5748-1014-0x00007FF8C27E0000-0x00007FF8C27F0000-memory.dmp
memory/5748-1015-0x00007FF8C27E0000-0x00007FF8C27F0000-memory.dmp
memory/5748-1013-0x00007FF8C27E0000-0x00007FF8C27F0000-memory.dmp