Resubmissions
31/10/2026, 02:21
261031-ctb94ah18m1031/10/2026, 01:52
261031-cavbkat12j1031/10/2026, 01:21
261031-bqxwyshy9q1031/10/2026, 01:05
261031-bfhz2sga891031/10/2026, 00:14
261031-ajr7fsfz5x1022/10/2026, 20:07
261022-yvx4vafs7y1022/10/2026, 06:21
261022-g4b5asyxcy1022/10/2026, 05:49
261022-gh947sz17n1022/10/2026, 05:26
261022-f4xkkahd441015/10/2026, 04:53
261015-fh67wavv6k10Analysis
- user interaction
yes - max time kernel
1169s - max time network
419s - platform
windows11-21h2_x64 - resource
win11-20260911-en - resource tags
- submitted
31/10/2026, 01:52
General
- Target AsyncClient.exe
- Size 45KB
- Sample261031-cavbkat12j
- SHA256 cbedcca6956457e43397a42f31cd90b9eb4160ca24ff96fa59fba34ce0b03e30
Malware Config
Extracted
-
asyncrat
-
0.5.8
-
Default
-
echodex.io:6606
-
echodex.io:7707
-
echodex.io:8808
-
echodex.io:443
-
echodex.io:80
-
echodex.io:8844
-
echodex.io:22
-
echodex.io:53
-
popit.io:6606
-
popit.io:7707
-
popit.io:8808
-
popit.io:443
-
popit.io:80
-
popit.io:8844
-
popit.io:22
-
popit.io:53
-
www.pdf-books.org:6606
-
www.pdf-books.org:7707
-
www.pdf-books.org:8808
-
www.pdf-books.org:443
-
FtTRmAL1FxCo
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
- Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 2 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 62 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 8 IoCs
- Modifies registry class 64 IoCs
- NTFS ADS 4 IoCs
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious behavior: LoadsDriver 6 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 49 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 13 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe"C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe"1⤵
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ffed989c728,0x7ffed989c734,0x7ffed989c7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1604,i,16724758658189710042,3791062313696427971,262144 --field-trial-handle=1912,i,12395408652133230643,11242887254811534630,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1908 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1460,i,12607253924045003428,4242697981099134802,524288 --field-trial-handle=1912,i,12395408652133230643,11242887254811534630,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2256 /prefetch:112⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2372,i,10260872982045811474,10625920573656379394,524288 --field-trial-handle=1912,i,12395408652133230643,11242887254811534630,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2344 /prefetch:132⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3228,i,6690022817983021511,2492503921699552788,2097152 --field-trial-handle=1912,i,12395408652133230643,11242887254811534630,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3248 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3256,i,12034188379243251383,7886434475804477947,2097152 --field-trial-handle=1912,i,12395408652133230643,11242887254811534630,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3292 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4504,i,13241153181301850157,15123055556551903453,2097152 --field-trial-handle=1912,i,12395408652133230643,11242887254811534630,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4508 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4708,i,5409785292084503420,9541433630464335318,524288 --field-trial-handle=1912,i,12395408652133230643,11242887254811534630,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4696 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5308,i,12259562409125186103,6030174263834546829,524288 --field-trial-handle=1912,i,12395408652133230643,11242887254811534630,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5304 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5412,i,13889623307782701576,14588972066646746969,524288 --field-trial-handle=1912,i,12395408652133230643,11242887254811534630,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5432 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5440,i,6427019445835863845,2972041521881632626,524288 --field-trial-handle=1912,i,12395408652133230643,11242887254811534630,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5216 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5328,i,18164822314774739747,7312887018849432300,524288 --field-trial-handle=1912,i,12395408652133230643,11242887254811534630,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5316 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5712,i,1384777646490285027,10255081014767942505,2097152 --field-trial-handle=1912,i,12395408652133230643,11242887254811534630,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5664 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5688,i,4757093030929268293,14075669497034131120,2097152 --field-trial-handle=1912,i,12395408652133230643,11242887254811534630,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5720 /prefetch:92⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5488,i,13252830078962519984,2891553304631355984,2097152 --field-trial-handle=1912,i,12395408652133230643,11242887254811534630,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4512 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6248,i,15994781266493797677,1495962111764077325,2097152 --field-trial-handle=1912,i,12395408652133230643,11242887254811534630,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6264 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=3280,i,17962290687478717691,16627965842266973817,2097152 --field-trial-handle=1912,i,12395408652133230643,11242887254811534630,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3412 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5952,i,7287730858189370816,11029163764035960827,2097152 --field-trial-handle=1912,i,12395408652133230643,11242887254811534630,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5956 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4416,i,11943860357443531800,15613187366504076373,524288 --field-trial-handle=1912,i,12395408652133230643,11242887254811534630,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5920 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5840,i,5545449917496056806,14347171667219112037,524288 --field-trial-handle=1912,i,12395408652133230643,11242887254811534630,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5944 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5648,i,11326366138738631764,6858636240045211038,524288 --field-trial-handle=1912,i,12395408652133230643,11242887254811534630,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5728 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6288,i,12744979456907057677,14340416361027964010,2097152 --field-trial-handle=1912,i,12395408652133230643,11242887254811534630,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6004 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6024,i,2912257420617641384,18305725218882002651,2097152 --field-trial-handle=1912,i,12395408652133230643,11242887254811534630,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3344 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5336,i,1578149469211337954,13214381399645758356,262144 --field-trial-handle=1912,i,12395408652133230643,11242887254811534630,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6224 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4488,i,13098387215243291562,2818570626356777618,524288 --field-trial-handle=1912,i,12395408652133230643,11242887254811534630,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6236 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6256,i,15748765159389272832,4946508314645304803,524288 --field-trial-handle=1912,i,12395408652133230643,11242887254811534630,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3324 /prefetch:142⤵
- NTFS ADS
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=6452,i,9032624113574800243,7153715180776347437,2097152 --field-trial-handle=1912,i,12395408652133230643,11242887254811534630,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3324 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=5328,i,6910499636140849755,13418291285604674053,2097152 --field-trial-handle=1912,i,12395408652133230643,11242887254811534630,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3228 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=6572,i,5493674699880780364,1389953937909443567,2097152 --field-trial-handle=1912,i,12395408652133230643,11242887254811534630,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6528 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=6468,i,16899256355768492998,7235754729203279709,2097152 --field-trial-handle=1912,i,12395408652133230643,11242887254811534630,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6484 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6884,i,6273774684367393258,17493563265024403808,524288 --field-trial-handle=1912,i,12395408652133230643,11242887254811534630,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6888 /prefetch:142⤵
- NTFS ADS
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=6876,i,6426336381522471083,6081308838273873976,2097152 --field-trial-handle=1912,i,12395408652133230643,11242887254811534630,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6940 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=6596,i,15531138781422882054,2718674231697910469,2097152 --field-trial-handle=1912,i,12395408652133230643,11242887254811534630,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --metrics-shmem-handle=7196,i,988008541631118539,8066306795536054188,2097152 --field-trial-handle=1912,i,12395408652133230643,11242887254811534630,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7208 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --metrics-shmem-handle=7040,i,15176081298469625214,16687872795829897372,2097152 --field-trial-handle=1912,i,12395408652133230643,11242887254811534630,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7368 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6400,i,369422070887231308,2980491818248828196,524288 --field-trial-handle=1912,i,12395408652133230643,11242887254811534630,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7084 /prefetch:142⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6856,i,363369674017038297,1869541181534377858,524288 --field-trial-handle=1912,i,12395408652133230643,11242887254811534630,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7144 /prefetch:142⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6740,i,4113491001079905029,16609529495333692244,524288 --field-trial-handle=1912,i,12395408652133230643,11242887254811534630,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5336 /prefetch:142⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=7144,i,13565372651640900290,3718151415331911081,524288 --field-trial-handle=1912,i,12395408652133230643,11242887254811534630,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6856 /prefetch:142⤵
- NTFS ADS
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --metrics-shmem-handle=7092,i,6959074217931115683,9514237557189894374,2097152 --field-trial-handle=1912,i,12395408652133230643,11242887254811534630,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7576 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --metrics-shmem-handle=6912,i,8001363616710821601,5131224625519042254,2097152 --field-trial-handle=1912,i,12395408652133230643,11242887254811534630,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6596 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --metrics-shmem-handle=7552,i,5492578269743346351,18312320856044356183,2097152 --field-trial-handle=1912,i,12395408652133230643,11242887254811534630,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7424 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --metrics-shmem-handle=7628,i,6372558667675313897,11855316445544596560,2097152 --field-trial-handle=1912,i,12395408652133230643,11242887254811534630,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6836 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --metrics-shmem-handle=7492,i,17040676319185570936,5076141065477820842,2097152 --field-trial-handle=1912,i,12395408652133230643,11242887254811534630,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7020 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --metrics-shmem-handle=6400,i,17016326605150111869,12153296642810055208,2097152 --field-trial-handle=1912,i,12395408652133230643,11242887254811534630,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7632 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --metrics-shmem-handle=7080,i,3588216016547628138,6882197838640384077,2097152 --field-trial-handle=1912,i,12395408652133230643,11242887254811534630,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6944 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --metrics-shmem-handle=7584,i,8248718510962611951,9058266248876692523,2097152 --field-trial-handle=1912,i,12395408652133230643,11242887254811534630,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6440 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --metrics-shmem-handle=5496,i,11515001162594697604,11124535840445425648,2097152 --field-trial-handle=1912,i,12395408652133230643,11242887254811534630,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7756 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --metrics-shmem-handle=6580,i,11401253440298905918,4711722865685737947,2097152 --field-trial-handle=1912,i,12395408652133230643,11242887254811534630,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7020 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3408,i,4324437193083532364,8829301368064840192,524288 --field-trial-handle=1912,i,12395408652133230643,11242887254811534630,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3332 /prefetch:142⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"3⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"3⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"3⤵
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4480,i,12299105477929078439,4362197049591722728,524288 --field-trial-handle=1912,i,12395408652133230643,11242887254811534630,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6172 /prefetch:142⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --metrics-shmem-handle=7704,i,10394912221398473052,15901496060869769311,2097152 --field-trial-handle=1912,i,12395408652133230643,11242887254811534630,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3344 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --metrics-shmem-handle=6456,i,4978553734167676421,8900464182130155152,2097152 --field-trial-handle=1912,i,12395408652133230643,11242887254811534630,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6460 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --metrics-shmem-handle=7408,i,13726836888234175723,15357909309184206084,2097152 --field-trial-handle=1912,i,12395408652133230643,11242887254811534630,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7712 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --metrics-shmem-handle=7588,i,16348590517988454565,5289425931329091137,2097152 --field-trial-handle=1912,i,12395408652133230643,11242887254811534630,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7352 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --metrics-shmem-handle=7840,i,4681709111746091187,7562012485369721303,2097152 --field-trial-handle=1912,i,12395408652133230643,11242887254811534630,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=8080 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --metrics-shmem-handle=7428,i,16053767215549371809,14198477917477982193,2097152 --field-trial-handle=1912,i,12395408652133230643,11242887254811534630,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7408 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --metrics-shmem-handle=8092,i,8406456075484985954,11436598592315530339,2097152 --field-trial-handle=1912,i,12395408652133230643,11242887254811534630,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=8044 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --metrics-shmem-handle=7484,i,14553038041985246546,17090032694252405251,2097152 --field-trial-handle=1912,i,12395408652133230643,11242887254811534630,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7908 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --metrics-shmem-handle=7000,i,6929839361639484122,3602968834898633547,2097152 --field-trial-handle=1912,i,12395408652133230643,11242887254811534630,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7180 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --metrics-shmem-handle=8224,i,16911337961068647735,4100356353016167345,2097152 --field-trial-handle=1912,i,12395408652133230643,11242887254811534630,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7736 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --metrics-shmem-handle=7812,i,13853601956043348439,1444821556938727898,2097152 --field-trial-handle=1912,i,12395408652133230643,11242887254811534630,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7608 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --metrics-shmem-handle=8256,i,13315301320159795357,1142411080492125539,2097152 --field-trial-handle=1912,i,12395408652133230643,11242887254811534630,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=8456 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --metrics-shmem-handle=5792,i,9751375834784955794,4185326612748925005,2097152 --field-trial-handle=1912,i,12395408652133230643,11242887254811534630,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=8472 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=8112,i,16762682997711864074,8075556357166980991,524288 --field-trial-handle=1912,i,12395408652133230643,11242887254811534630,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=8572 /prefetch:142⤵
- NTFS ADS
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --metrics-shmem-handle=7836,i,14074352354572482455,4727818930044103885,2097152 --field-trial-handle=1912,i,12395408652133230643,11242887254811534630,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6992 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"1⤵
-
C:\Users\Admin\Downloads\tomo-x86_64-pc-windows-msvc\tomo.exetomo.exe nsp extract "C:\Users\Admin\Downloads\Tomodachi goon Living the bean" --out "C:\Users\Admin\Desktop\tomo_extracted"2⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://cmdd/1⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x2f0,0x7ffee7a5c188,0x7ffee7a5c194,0x7ffee7a5c1a02⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1764,i,15091386101322588625,14753461512866858871,262144 --field-trial-handle=2032,i,11742976902699033757,8141292656563313220,262144 --variations-seed-version --mojo-platform-channel-handle=1976 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2140,i,15065138942271577302,7739738930483367101,524288 --field-trial-handle=2032,i,11742976902699033757,8141292656563313220,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:112⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2580,i,9469413484088021850,4110272532365981837,524288 --field-trial-handle=2032,i,11742976902699033757,8141292656563313220,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:132⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3568,i,17110345969079564132,3668883343781798110,2097152 --field-trial-handle=2032,i,11742976902699033757,8141292656563313220,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3612,i,16750271837898454723,12595950078575893715,2097152 --field-trial-handle=2032,i,11742976902699033757,8141292656563313220,262144 --variations-seed-version --mojo-platform-channel-handle=3728 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4344,i,3150319297955866918,4941766703578363568,2097152 --field-trial-handle=2032,i,11742976902699033757,8141292656563313220,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:92⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4400,i,6355398838945526582,11614763963264618296,2097152 --field-trial-handle=2032,i,11742976902699033757,8141292656563313220,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:92⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4396,i,9154763346264358268,9960282178239524382,2097152 --field-trial-handle=2032,i,11742976902699033757,8141292656563313220,262144 --variations-seed-version --mojo-platform-channel-handle=4420 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4288,i,8108848566857312368,1396119095935673014,2097152 --field-trial-handle=2032,i,11742976902699033757,8141292656563313220,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5236,i,14292661220260356516,12425041370292408477,524288 --field-trial-handle=2032,i,11742976902699033757,8141292656563313220,262144 --variations-seed-version --mojo-platform-channel-handle=3716 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3708,i,13330777989588557209,2738822281370215258,524288 --field-trial-handle=2032,i,11742976902699033757,8141292656563313220,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"1⤵
-
C:\Users\Admin\Desktop\tomo_extracted\tomo.exetomo.exe nca extract "2e88713715d1d950ece6ce679a2fd456.nca" --out program_extracted2⤵
-
-
C:\Users\Admin\Desktop\tomo_extracted\tomo.exetomo.exe nca extract "2e88713715d1d950ece6ce679a2fd456.nca" --out program_extracted2⤵
-
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
011ea821-0d1d-4f5c-aa57-64f05fb2a491.tmp
3785bbfc-f213-4249-b991-338d2d3419d6.tmp
49169155-cac9-495d-8738-354e8d11de8e.tmp
4b2d59b3-5d4f-4a94-b623-7b293d529449.tmp
55560837-32ae-4eda-9b41-c959d5bf0f8c.tmp
5f9031f4-2b4c-422b-addf-8fb2908bf800.tmp
7f48985c-3f4c-4216-ba18-f911c6f57186.tmp
0efcdfe8-57e1-472c-b4e0-8cea5537e191.tmp
13cf4db2-13c5-4c44-8502-6a6ce6350768.tmp
1a80cde2-cbfc-4081-b019-75332cd75b54.tmp
299bb42c-75f3-4b16-90ef-cdb6fce07671.tmp
37ce5ff1-2c7d-4469-b18a-c2a2bcb44f2b.tmp
4eba49ea-1fef-44bc-bc1d-f8c1008adbfd.tmp
50f09bc6-151f-4b7f-bba9-02b692201231.tmp
5a8aeed3-f0e9-41d6-a883-a91faff5f805.tmp
5fcf36bd-982f-44ce-9eda-d208c85e0035.tmp
654b7df1-90ef-4f7d-874b-9903b6d65615.tmp
814f1acd-3a08-46a3-abd9-57e78033899d.tmp
849c0517-9cf6-4e5f-9853-255826742122.tmp
f_000004
f_000005
f_000008
f_000009
f_00000a
f_000048
f_000049
f_00004a
f_000050
temp-index
temp-index
temp-index
temp-index
temp-index
temp-index
the-real-index
messages.json
craw_background.js
225194ec-954c-4941-8c94-36ade807a25f.tmp
2c8ad545-a8ce-45af-867a-39ba232613b4.tmp
526e2d57-4012-4292-92de-936972c83155.tmp
5540180f-096e-4b20-a754-e4f9c995fc11.tmp
68eee8b1-a864-431d-81c4-eb84e01139c6.tmp
83d7894a-5d40-4516-a018-fd747e046f1d.tmp
a1ba8f00-81c5-44c8-a99e-b0b19fcc7050.tmp
c14a1531-1fca-4398-9a2f-dd381e09d664.tmp
ce441fa2-7c44-4c7a-b1fc-ee862858486e.tmp
temp-index
temp-index
data_1
CURRENT
MANIFEST-000001
a00fbe6f-dff6-4449-b90b-1bcbe115991d.tmp
a7789a82-1dc3-4136-9b0e-67a2d869c51f.tmp
b036b099-713e-4d0d-92a7-74942edc484b.tmp
c8cb3da9-c673-44ad-8d8b-59d031b710f6.tmp
d1a455bd-8f4f-4876-9b2b-03e92bc586fa.tmp
e2721b88-b2a1-4821-a327-dfaa06176741.tmp
ef515f9f-f593-4dcc-b840-43a9f5d5ee2c.tmp
f357711d-8a23-42d8-93de-8cebaf3c92cf.tmp
fb1700f6-61fc-42df-a82b-b184f5eb70e0.tmp
fc120def-34f3-4ed5-a48a-3b7cc9ca4b75.tmp
fc2b5059-8b60-439e-afc5-a9bb29a23cd1.tmp
ff2d140c-34ef-4b18-ba7a-a1a3f1b6350a.tmp
a2b09247-7285-474c-a4b4-7187860f0910.tmp
a90d083c-5fbe-4432-b583-62d83af06f01.tmp
aeeaeae4-f1c5-46fa-b0fe-ebeb42410700.tmp
cbec9d8c-2d9e-4800-af23-b02bf2ab773e.tmp
fd847f24-a69b-4492-bf1b-812b66cf5a21.tmp
0faef140-cbb3-488e-b424-1d980d103b9d.tmp
766973ed-6681-4626-92fa-8dbeef5be7fe.tmp
settings.dat
settings.dat
25812fb8-19f8-4bb5-b3fd-cbebcf0e9969.tmp
6fd40dc7-bf2a-4295-bffe-b1ffea5dc654.tmp
temp-index
9974d938-fed7-498d-a0a8-41fa0666a70e.tmp
2ddebb42-e1b7-4747-b2f4-0fa9e058edf7.tmp
f98f4578-15bf-472c-874c-872b1c6d5924.tmp
b6910330-3eba-44ae-b5b2-537bd23f6be0.tmp
562015d3-79e6-4d0c-a385-1a42e2f5a9a2.tmp
cce47a11-a592-4fec-84bc-84cffef8d540.tmp
messages.json
5d696d521de238c3.customDestinations-ms
C5WJRL75QXPK6RML3PDI.temp
LIY6CBAWH57SF0YI4X13.temp
BackupOpen.vssm
BlockSet.crw
CompareEdit.cfg
ConvertFromExpand.7z
CopySuspend.dotx
DebugStop.mid
DisableClear.xht
DismountRename.ps1
EnterBackup.tif
FormatPublish.wpl
GroupUnpublish.mpp
InstallFind.mpp
InvokeComplete.docx
LimitAssert.pptx
MergeTrace.vstx
Microsoft Edge.lnk
NewCheckpoint.xlsx
PopOpen.mov
ReadUpdate.3gp2
RepairClose.bin
ResetProtect.gif
ResetTrace.dll
SearchPublish.xls
SkipDisable.vstm
StartRestart.mht
StepConvert.TTS
UnlockReceive.docx
UnregisterResolve.mpp
WatchAdd.mhtml
WatchRequest.mov
AnimationDemoPR000005.baev
AnimationDemoPR000123.baev
HouseUgc05.Nin_NX_NVN.esetb.byml.zs
ItemMiiTouchPresentGoodsBookSideR.Nin_NX_NVN.esetb.byml.zs
LocatorNewsBreaking005_09.Nin_NX_NVN.esetb.byml.zs
MiiDemoDM104015.Nin_NX_NVN.esetb.byml.zs
ObjHeart00_Ceiling_04.Nin_NX_NVN.esetb.byml.zs
ObjLovely00_Ceiling_05.Nin_NX_NVN.esetb.byml.zs
ObjNatural00_Table.Nin_NX_NVN.esetb.byml.zs
ObjStuffed00_Desk.Nin_NX_NVN.esetb.byml.zs
DemoPR000091_MapObject.byml
MiiNewsBreaking005_09.game__MiiNewsParam.bgyml
Fruit04_Table.bfres.zs
DecoRoomDollHouseIntPartsRight00.gfx__IconCamera.bgyml
ItemBabybed.gfx__IconCamera.bgyml
ItemParkDemoLight.gfx__IconCamera.bgyml
ObjBenchPark.gfx__IconCamera.bgyml
ObjFenceStake.gfx__IconCamera.bgyml
RoomStyleVariationData.Product.100.rstbl.byml.zs
NotUnderstandShort.game__ScenarioChatParam.bgyml
Antique00_Ceiling_Body_Nrm.07.bntx.zs
BeachParasol_Body_Nrm.07.bntx.zs
Country00_Kitchen_Body_Nrm.07.bntx.zs
Country00_Shelf_Props_Nrm.07.bntx.zs
Country00_Table_Body_Nrm.07.bntx.zs
DollHouseIntSF04_LDKWall_Mix.00.bntx.zs
DollHouseIntUgc_LDKFloor_Bathroom03_Moc.bntx.zs
DollHouseIntUgc_LDKFloor_Camouflage03_Moc.bntx.zs
DollHouseIntUgc_LDKFloor_Damask07_Moc.bntx.zs
DollHouseIntUgc_LDKFloor_Dot03_Moc.bntx.zs
DollHouseIntUgc_LDKFloor_Fruit03_Moc.bntx.zs
DollHouseIntUgc_LDKFloor_Garage04_Moc.bntx.zs
DollHouseIntUgc_LDKFloor_Heart03_Moc.bntx.zs
DollHouseIntUgc_LDKFloor_HoneycombTile03_Moc.bntx.zs
DollHouseIntUgc_LDKFloor_Lace03_Moc.bntx.zs
DollHouseIntUgc_LDKFloor_LightStick04_Moc.bntx.zs
DollHouseIntUgc_LDKFloor_Minimul03_Moc.bntx.zs
DollHouseIntUgc_LDKFloor_MultiDot03_Moc.bntx.zs
DollHouseIntUgc_LDKFloor_Party03_Moc.bntx.zs
DollHouseIntUgc_LDKFloor_SF03_Moc.bntx.zs
DollHouseIntUgc_LDKFloor_SmallFlower04_Moc.bntx.zs
DollHouseIntUgc_LDKFloor_Stuffed03_Moc.bntx.zs
DollHouseIntUgc_LDKFloor_Triangle03_Moc.bntx.zs
DollHouseIntUgc_LDKFloor_WesternStyle03_Moc.bntx.zs
DollHouseIntUgc_LDKFloor_WoodBoard03_Moc.bntx.zs
DollHouseIntUgc_LDKWall_BigFlower03_Moc.bntx.zs
DollHouseIntUgc_LDKWall_Damask03_Moc.bntx.zs
DollHouseIntUgc_LDKWall_Dot03_Moc.bntx.zs
DollHouseIntUgc_LDKWall_Garage05_Moc.bntx.zs
DollHouseIntUgc_LDKWall_HoneycombTile03_Moc.bntx.zs
DollHouseIntUgc_LDKWall_Party03_Moc.bntx.zs
DollHouseIntUgc_LDKWall_SF03_Moc.bntx.zs
DollHouseIntUgc_LDKWall_SmallFlower04_Moc.bntx.zs
DollHouseIntUgc_LDKWall_StarPrint03_Moc.bntx.zs
DollHouseIntUgc_LDKWall_Triangle04_Moc.bntx.zs
DollHouseIntUgc_LDKWall_WoodBoard03_Moc.bntx.zs
DollHouseInt_LDKCeiling_BigFlower03_Moc.bntx.zs
DollHouseInt_LDKCeiling_LightStick06_Moc.bntx.zs
DollHouseInt_LDKCeiling_Party03_Moc.bntx.zs
DollHouseInt_LDKFloor_Bathroom04_Moc.bntx.zs
DollHouseInt_LDKFloor_Camouflage03_Moc.bntx.zs
DollHouseInt_LDKFloor_Damask05_Moc.bntx.zs
DollHouseInt_LDKFloor_Damask07_Moc.bntx.zs
DollHouseInt_LDKFloor_Dot04_Moc.bntx.zs
DollHouseInt_LDKFloor_Garage03_Moc.bntx.zs
DollHouseInt_LDKFloor_Heart04_Moc.bntx.zs
DollHouseInt_LDKFloor_HoneycombTile03_Moc.bntx.zs
DollHouseInt_LDKFloor_Lace03_Moc.bntx.zs
DollHouseInt_LDKFloor_LightStick04_Moc.bntx.zs
DollHouseInt_LDKFloor_Minimul03_Moc.bntx.zs
DollHouseInt_LDKFloor_Party03_Moc.bntx.zs
DollHouseInt_LDKFloor_SF04_Moc.bntx.zs
DollHouseInt_LDKFloor_SmallFlower04_Moc.bntx.zs
DollHouseInt_LDKFloor_StarPrint03_Moc.bntx.zs
DollHouseInt_LDKFloor_Triangle03_Moc.bntx.zs
DollHouseInt_LDKFloor_WesternStyle05_Moc.bntx.zs
DollHouseInt_LDKFloor_WesternStyle07_Moc.bntx.zs
DollHouseInt_LDKFloor_WoodBoard03_Moc.bntx.zs
DollHouseInt_LDKWall_Bathroom04_Moc.bntx.zs
DollHouseInt_LDKWall_BigFlower03_Moc.bntx.zs
DollHouseInt_LDKWall_Camouflage03_Moc.bntx.zs
DollHouseInt_LDKWall_Damask05_Moc.bntx.zs
DollHouseInt_LDKWall_Dot03_Moc.bntx.zs
DollHouseInt_LDKWall_Garage04_Moc.bntx.zs
DollHouseInt_LDKWall_Heart04_Moc.bntx.zs
DollHouseInt_LDKWall_HoneycombTile03_Moc.bntx.zs
DollHouseInt_LDKWall_Lace03_Moc.bntx.zs
DollHouseInt_LDKWall_LightStick03_Moc.bntx.zs
DollHouseInt_LDKWall_Minimul03_Moc.bntx.zs
DollHouseInt_LDKWall_MultiDot03_Moc.bntx.zs
DollHouseInt_LDKWall_Party06_Moc.bntx.zs
DollHouseInt_LDKWall_SF03_Moc.bntx.zs
DollHouseInt_LDKWall_SmallFlower04_Moc.bntx.zs
DollHouseInt_LDKWall_Stuffed03_Moc.bntx.zs
DollHouseInt_LDKWall_Triangle04_Moc.bntx.zs
DollHouseInt_LDKWall_Wedding03_Moc.bntx.zs
DollHouseInt_LDKWall_WesternStyle03_Moc.bntx.zs
DollHouseInt_LDKWall_WoodBoard07_Moc.bntx.zs
Ft_CeilingPRM_Antique05_Moc.bntx.zs
Ft_CeilingPRM_Bathroom04_Moc.bntx.zs
Ft_CeilingPRM_ColorBox07_Moc.bntx.zs
Ft_CeilingPRM_Country05_Moc.bntx.zs
Ft_CeilingPRM_Garage05_Moc.bntx.zs
Ft_CeilingPRM_Heart03_Moc.bntx.zs
Ft_CeilingPRM_Kitchen03_Moc.bntx.zs
Ft_CeilingPRM_LightStick05_Moc.bntx.zs
Ft_CeilingPRM_Lovely05_Moc.bntx.zs
Ft_CeilingPRM_Minimul05_Moc.bntx.zs
Ft_CeilingPRM_Newlife05_Moc.bntx.zs
Ft_CeilingPRM_Party03_Moc.bntx.zs
Ft_CeilingPRM_SF05_Moc.bntx.zs
Ft_CeilingUGC_Antique05_Moc.bntx.zs
Ft_CeilingUGC_Bathroom04_Moc.bntx.zs
Ft_CeilingUGC_Cat03_Moc.bntx.zs
Ft_CeilingUGC_ColorBox04_Moc.bntx.zs
Ft_CeilingUGC_Country06_Moc.bntx.zs
Ft_CeilingUGC_Garage05_Moc.bntx.zs
Ft_CeilingUGC_Kitchen03_Moc.bntx.zs
Ft_CeilingUGC_LightStick04_Moc.bntx.zs
Ft_CeilingUGC_Lovely03_Moc.bntx.zs
Ft_CeilingUGC_Minimul03_Moc.bntx.zs
Ft_CeilingUGC_Natural04_Moc.bntx.zs
Ft_CeilingUGC_Newlife06_Moc.bntx.zs
Ft_CeilingUGC_Newlife07_Moc.bntx.zs
Ft_CeilingUGC_Party03_Moc.bntx.zs
Ft_CeilingUGC_SF03_Moc.bntx.zs
Ft_CeilingUGC_Star04_Moc.bntx.zs
Ft_CeilingUGC_Wedding03_Moc.bntx.zs
Ft_FloorPRM_Antique04_Moc.bntx.zs
Ft_FloorPRM_Bathroom04_Moc.bntx.zs
Ft_FloorPRM_Camouflage03_Moc.bntx.zs
Ft_FloorPRM_Cat03_Moc.bntx.zs
Ft_FloorPRM_ColorBox04_Moc.bntx.zs
Ft_FloorPRM_Country03_Moc.bntx.zs
Ft_FloorPRM_Garage03_Moc.bntx.zs
Ft_FloorPRM_LightStick03_Moc.bntx.zs
Ft_FloorPRM_Minimul03_Moc.bntx.zs
Ft_FloorPRM_Natural05_Moc.bntx.zs
Ft_FloorPRM_Newlife03_Moc.bntx.zs
Ft_FloorPRM_Party03_Moc.bntx.zs
Ft_FloorPRM_SF03_Moc.bntx.zs
Ft_FloorPRM_Stuffed03_Moc.bntx.zs
Ft_FloorPRM_Wedding03_Moc.bntx.zs
Ft_FloorUGC_Antique03_Moc.bntx.zs
Ft_FloorUGC_Bathroom04_Moc.bntx.zs
Ft_FloorUGC_Cat03_Moc.bntx.zs
Ft_FloorUGC_ColorBox03_Moc.bntx.zs
Ft_FloorUGC_Country06_Moc.bntx.zs
Ft_FloorUGC_Country07_Moc.bntx.zs
Ft_FloorUGC_Garage05_Moc.bntx.zs
Ft_FloorUGC_Honeycomb04_Moc.bntx.zs
Ft_FloorUGC_LightStick05_Moc.bntx.zs
Ft_FloorUGC_Lovely03_Moc.bntx.zs
Ft_FloorUGC_Minimul05_Moc.bntx.zs
Ft_FloorUGC_Natural05_Moc.bntx.zs
Ft_FloorUGC_Newlife04_Moc.bntx.zs
Ft_FloorUGC_Party03_Moc.bntx.zs
Ft_FloorUGC_SF03_Moc.bntx.zs
Ft_FloorUGC_Star03_Moc.bntx.zs
Ft_FloorUGC_Stuffed03_Moc.bntx.zs
Ft_FloorUGC_Wedding03_Moc.bntx.zs
Ft_WallPRM_Antique03_Moc.bntx.zs
Ft_WallPRM_Bathroom04_Moc.bntx.zs
Ft_WallPRM_Camouflage03_Moc.bntx.zs
Ft_WallPRM_Cat03_Moc.bntx.zs
Ft_WallPRM_ColorBox06_Moc.bntx.zs
Ft_WallPRM_ColorBox07_Moc.bntx.zs
Ft_WallPRM_Country03_Moc.bntx.zs
Ft_WallPRM_Garage03_Moc.bntx.zs
Ft_WallPRM_Heart04_Moc.bntx.zs
Ft_WallPRM_Honeycomb03_Moc.bntx.zs
Ft_WallPRM_Kitchen03_Moc.bntx.zs
Ft_WallPRM_LightStick03_Moc.bntx.zs
Ft_WallPRM_Lovely03_Moc.bntx.zs
Ft_WallPRM_Minimul06_Moc.bntx.zs
Ft_WallPRM_Natural03_Moc.bntx.zs
Ft_WallPRM_Newlife06_Moc.bntx.zs
Ft_WallPRM_Party03_Moc.bntx.zs
Ft_WallPRM_SF03_Moc.bntx.zs
Ft_WallPRM_Star03_Moc.bntx.zs
Ft_WallPRM_Wedding03_Moc.bntx.zs
Ft_WallUGC_Antique03_Moc.bntx.zs
Ft_WallUGC_Cat03_Moc.bntx.zs
Ft_WallUGC_ColorBox03_Moc.bntx.zs
Ft_WallUGC_Country04_Moc.bntx.zs
Ft_WallUGC_Garage05_Moc.bntx.zs
Ft_WallUGC_Honeycomb03_Moc.bntx.zs
Ft_WallUGC_LightStick03_Moc.bntx.zs
Ft_WallUGC_Lovely03_Moc.bntx.zs
Ft_WallUGC_Minimul03_Moc.bntx.zs
Ft_WallUGC_Newlife03_Moc.bntx.zs
Ft_WallUGC_Party03_Moc.bntx.zs
Ft_WallUGC_SF04_Moc.bntx.zs
Ft_WallUGC_Star03_Moc.bntx.zs
Ft_WallUGC_Wedding03_Moc.bntx.zs
LDK_HallwayBicycle_Body_Nrm.07.bntx.zs
LDK_KitchenPlant_Body_Nrm.13.bntx.zs
LDK_KitchenWallTool_Body_Nrm.13.bntx.zs
LDK_LivingPlant_Body_Nrm.09.bntx.zs
LightStick00_FloorLight_Body_Nrm.07.bntx.zs
RoomTextures.FloorLDK_Damask05.bntx.zs
RoomTextures.FloorLDK_Garage06.bntx.zs
RoomTextures.FloorLDK_NaturalFloor04.bntx.zs
RoomTextures.FloorLDK_PaintedWood06.bntx.zs
RoomTextures.FloorPRM_Candy02.bntx.zs
RoomTextures.FloorPRM_Chinese01.bntx.zs
RoomTextures.FloorPRM_Damask05.bntx.zs
RoomTextures.FloorPRM_Dinosaur01.bntx.zs
RoomTextures.FloorPRM_Japanese03.bntx.zs
RoomTextures.FloorPRM_NaturalFloor07.bntx.zs
RoomTextures.FloorPRM_PaintedWood05.bntx.zs
RoomTextures.FloorPRM_StarPrint04.bntx.zs
Newlife00_Table_Body_Nrm.07.bntx.zs
OneRoomIntSF04_PRMWall_Mix.00.bntx.zs
Rt_CarpetLDK_Camouflage03_Mix.bntx.zs
Rt_CarpetLDK_Camouflage03_Nrm.bntx.zs
Rt_CarpetLDK_Damask03_Mix.bntx.zs
Rt_CarpetLDK_Damask03_Nrm.bntx.zs
Rt_CarpetLDK_Lace04_Nrm.bntx.zs
Rt_FloorLDK_Damask03_Mix.bntx.zs
Rt_FloorLDK_European03_Nrm.bntx.zs
Rt_FloorLDK_Garage06_Mix.bntx.zs
Rt_FloorLDK_Heart03_Nrm.bntx.zs
Rt_FloorLDK_NaturalFloor03_Nrm.bntx.zs
Rt_FloorLDK_PaintedWood03_Mix.bntx.zs
Rt_FloorLDK_PaintedWood03_Nrm.bntx.zs
Rt_FloorLDK_StarPrint04_Mix.bntx.zs
Rt_FloorLDK_StarPrint04_Nrm.bntx.zs
Rt_FloorPRM_Baby00_Mix.bntx.zs
Rt_FloorPRM_Candy00_Nrm.bntx.zs
Rt_FloorPRM_Chinese01_Nrm.bntx.zs
Rt_FloorPRM_Damask03_Mix.bntx.zs
Rt_FloorPRM_Damask04_Nrm.bntx.zs
Rt_FloorPRM_Dinosaur01_Mix.bntx.zs
Rt_FloorPRM_Dinosaur01_Nrm.bntx.zs
Rt_FloorPRM_European03_Nrm.bntx.zs
Rt_FloorPRM_Garage03_Mix.bntx.zs
Rt_FloorPRM_Garage04_Nrm.bntx.zs
Rt_FloorPRM_Heart03_Nrm.bntx.zs
Rt_FloorPRM_Japanese03_Nrm.bntx.zs
Rt_FloorPRM_MultiDot00_Nrm.bntx.zs
Rt_FloorPRM_MultiDot02_Mix.bntx.zs
Rt_FloorPRM_PaintedWood03_Mix.bntx.zs
Rt_FloorPRM_StarPrint03_Nrm.bntx.zs
Rt_FloorPRM_WoodFloor02_Mix.bntx.zs
Rt_Wall_DefMeramera_Nrm.bntx.zs
Rt_Wall_European03_Mix.bntx.zs
Rt_Wall_European03_Nrm.bntx.zs
Rt_Wall_Fruit03_Nrm.bntx.zs
Rt_Wall_Garage04_Mix.bntx.zs
Rt_Wall_HoneycombTile04_Nrm.bntx.zs
Rt_Wall_Minimul03_Nrm.bntx.zs
Rt_Wall_Otaku04_Nrm.bntx.zs
Rt_Wall_WoodBoard03_Nrm.bntx.zs
MiiLevelUp.ui__Parts3DLayoutParam.bgyml
CompareWatch.asf
ExpandBackup.m4v
MergeExport.pub
MergeRepair.3gp
OptimizeMerge.search-ms
ReceiveResolve.cmd
RepairDebug.zip
RequestResolve.pptm
ResolveUnpublish.M2TS
SetClear.emz
SplitDisconnect.ADTS
SuspendRead.potx
Tomodachi goon Living the bean:Zone.Identifier
UpdateCopy.eprtx
UseUnlock.ps1
cd24b291-bc00-4ad2-bc35-378db2b863be.tmp
dfddc01a-32c5-4064-b1e2-5085de9842dd.tmp
Acrobat Reader DC.lnk
Firefox.lnk
Google Chrome.lnk
Microsoft Edge.lnk
VLC media player.lnk
memory/2144-68105-0x000002DC61AF0000-0x000002DC61BF0000-memory.dmp
memory/2144-68141-0x000002DC73510000-0x000002DC73610000-memory.dmp
memory/2144-68145-0x000002DD75640000-0x000002DD75660000-memory.dmp
memory/2144-68157-0x000002DD75580000-0x000002DD755A0000-memory.dmp
memory/2144-68214-0x000002DD76E50000-0x000002DD76F50000-memory.dmp
memory/3704-0-0x0000000000260000-0x0000000000272000-memory.dmp
memory/3704-36-0x0000000004DD0000-0x0000000004DE0000-memory.dmp
memory/3704-371-0x0000000004DD0000-0x0000000004DE0000-memory.dmp