mercurialgrabber | 890fd59af3370e2ce12e0d11916d1ad4ee9b9c267c434347dbed11e9572e8645

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	output.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	output.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	nnn.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	nnn.exe

Looks for VMWare Tools registry key 2 TTPs 4 IoCs

defense_evasion

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMWare, Inc.\VMWare Tools	output.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMWare, Inc.\VMWare Tools	output.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMWare, Inc.\VMWare Tools	nnn.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMWare, Inc.\VMWare Tools	nnn.exe

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	output.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	output.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	nnn.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	nnn.exe

Executes dropped EXE 16 IoCs

pid	Process
196	output.exe
2524	novm.exe
1584	output.exe
5444	novm.exe
5300	novm.exe
2076	nnn.exe
5052	nnn.exe
1864	n.exe
4972	n.exe
1396	n.exe
2328	n.exe
4748	n.exe
1108	n.exe
2736	n.exe
5740	n.exe
4480	n.exe

Obfuscated with Agile.Net obfuscator 12 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

resource	yara_rule
behavioral1/memory/4324-5-0x0000000006010000-0x000000000602C000-memory.dmp	agile_net
behavioral1/memory/4324-6-0x0000000006040000-0x0000000006060000-memory.dmp	agile_net
behavioral1/memory/4324-7-0x0000000006070000-0x0000000006090000-memory.dmp	agile_net
behavioral1/memory/4324-8-0x00000000060B0000-0x00000000060C0000-memory.dmp	agile_net
behavioral1/memory/4324-9-0x00000000060C0000-0x00000000060D4000-memory.dmp	agile_net
behavioral1/memory/4324-10-0x00000000060D0000-0x000000000613E000-memory.dmp	agile_net
behavioral1/memory/4324-11-0x0000000006150000-0x000000000616E000-memory.dmp	agile_net
behavioral1/memory/4324-12-0x0000000006190000-0x00000000061C6000-memory.dmp	agile_net
behavioral1/memory/4324-13-0x00000000061D0000-0x00000000061DE000-memory.dmp	agile_net
behavioral1/memory/4324-14-0x00000000061F0000-0x00000000061FE000-memory.dmp	agile_net
behavioral1/memory/4324-15-0x0000000006A60000-0x0000000006BAA000-memory.dmp	agile_net
behavioral1/memory/5032-1177-0x0000000005EE0000-0x0000000005EF4000-memory.dmp	agile_net

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Contacts third-party web service commonly abused for C2 1 TTPs 42 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
659	discord.com
660	discord.com
661	discord.com
667	discord.com
1	pastebin.com
652	discord.com
656	discord.com
666	discord.com
20	pastebin.com
459	pastebin.com
636	discord.com
648	discord.com
658	discord.com
541	discord.com
634	discord.com
641	discord.com
650	discord.com
665	discord.com
562	pastebin.com
637	discord.com
653	discord.com
655	discord.com
664	discord.com
460	pastebin.com
639	discord.com
645	discord.com
663	discord.com
65	discord.com
256	discord.com
258	discord.com
646	discord.com
668	discord.com
88	discord.com
257	discord.com
543	discord.com
622	discord.com
623	discord.com
651	discord.com
540	discord.com
542	discord.com
619	discord.com
643	discord.com

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
616	ip-api.com
617	ip4.seeip.org
618	ip-api.com

Maps connected drives based on registry 3 TTPs 8 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	nnn.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	output.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	output.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	nnn.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	nnn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	output.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	output.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	nnn.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mercurial.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mercurial.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mercurial.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe

System Time Discovery 1 TTPs 4 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4548	chrome.exe
6132	chrome.exe
6052	chrome.exe
5292	chrome.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_VMware_&Prod_VMware_Virtual_S	nnn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_VMware_&Prod_VMware_Virtual_S	nnn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_VMware_&Prod_VMware_Virtual_S	output.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_VMware_&Prod_VMware_Virtual_S	output.exe

Checks processor information in registry 2 TTPs 22 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	n.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	n.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	n.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	n.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	nnn.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	nnn.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	n.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	n.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	n.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	n.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	n.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	n.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	nnn.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	n.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	n.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	n.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	n.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	nnn.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	n.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	n.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	n.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	n.exe

Enumerates system info in registry 2 TTPs 28 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosInformation	nnn.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemManufacturer	nnn.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemManufacturer	output.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Logical Unit Id 0	output.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Logical Unit Id 0	output.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosInformation	output.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosInformation	output.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemManufacturer	output.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Logical Unit Id 0	nnn.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemProductName	nnn.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Logical Unit Id 0	nnn.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemProductName	output.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemProductName	output.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosInformation	nnn.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemManufacturer	nnn.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemProductName	nnn.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134173005081773146"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe

Suspicious behavior: EnumeratesProcesses 41 IoCs

pid	Process
4324	Mercurial.exe
4324	Mercurial.exe
4324	Mercurial.exe
4324	Mercurial.exe
4324	Mercurial.exe
4324	Mercurial.exe
4324	Mercurial.exe
4324	Mercurial.exe
6008	chrome.exe
6008	chrome.exe
6008	chrome.exe
6008	chrome.exe
880	Mercurial.exe
880	Mercurial.exe
880	Mercurial.exe
880	Mercurial.exe
880	Mercurial.exe
880	Mercurial.exe
880	Mercurial.exe
880	Mercurial.exe
880	Mercurial.exe
1040	chrome.exe
1040	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
2088	chrome.exe
2088	chrome.exe
5032	Mercurial.exe
5032	Mercurial.exe
5032	Mercurial.exe
5032	Mercurial.exe
5032	Mercurial.exe
5032	Mercurial.exe
5032	Mercurial.exe
5032	Mercurial.exe
1844	chrome.exe
1844	chrome.exe
5152	chrome.exe
5152	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 47 IoCs

pid	Process
6008	chrome.exe
6008	chrome.exe
6008	chrome.exe
6008	chrome.exe
6008	chrome.exe
6008	chrome.exe
6008	chrome.exe
6008	chrome.exe
6008	chrome.exe
6008	chrome.exe
6008	chrome.exe
6008	chrome.exe
6008	chrome.exe
6008	chrome.exe
6008	chrome.exe
6008	chrome.exe
6008	chrome.exe
6008	chrome.exe
6008	chrome.exe
6008	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
5152	chrome.exe
5152	chrome.exe
5152	chrome.exe
5152	chrome.exe
5152	chrome.exe
5152	chrome.exe
5152	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4324	Mercurial.exe
Token: SeShutdownPrivilege	6008	chrome.exe
Token: SeCreatePagefilePrivilege	6008	chrome.exe
Token: SeShutdownPrivilege	6008	chrome.exe
Token: SeCreatePagefilePrivilege	6008	chrome.exe
Token: SeShutdownPrivilege	6008	chrome.exe
Token: SeCreatePagefilePrivilege	6008	chrome.exe
Token: SeShutdownPrivilege	6008	chrome.exe
Token: SeCreatePagefilePrivilege	6008	chrome.exe
Token: SeShutdownPrivilege	6008	chrome.exe
Token: SeCreatePagefilePrivilege	6008	chrome.exe
Token: SeShutdownPrivilege	6008	chrome.exe
Token: SeCreatePagefilePrivilege	6008	chrome.exe
Token: SeShutdownPrivilege	6008	chrome.exe
Token: SeCreatePagefilePrivilege	6008	chrome.exe
Token: SeShutdownPrivilege	6008	chrome.exe
Token: SeCreatePagefilePrivilege	6008	chrome.exe
Token: SeShutdownPrivilege	6008	chrome.exe
Token: SeCreatePagefilePrivilege	6008	chrome.exe
Token: SeShutdownPrivilege	6008	chrome.exe
Token: SeCreatePagefilePrivilege	6008	chrome.exe
Token: SeShutdownPrivilege	6008	chrome.exe
Token: SeCreatePagefilePrivilege	6008	chrome.exe
Token: SeShutdownPrivilege	6008	chrome.exe
Token: SeCreatePagefilePrivilege	6008	chrome.exe
Token: SeShutdownPrivilege	6008	chrome.exe
Token: SeCreatePagefilePrivilege	6008	chrome.exe
Token: SeShutdownPrivilege	6008	chrome.exe
Token: SeCreatePagefilePrivilege	6008	chrome.exe
Token: SeShutdownPrivilege	6008	chrome.exe
Token: SeCreatePagefilePrivilege	6008	chrome.exe
Token: SeShutdownPrivilege	6008	chrome.exe
Token: SeCreatePagefilePrivilege	6008	chrome.exe
Token: SeShutdownPrivilege	6008	chrome.exe
Token: SeCreatePagefilePrivilege	6008	chrome.exe
Token: SeShutdownPrivilege	6008	chrome.exe
Token: SeCreatePagefilePrivilege	6008	chrome.exe
Token: SeShutdownPrivilege	6008	chrome.exe
Token: SeCreatePagefilePrivilege	6008	chrome.exe
Token: SeShutdownPrivilege	6008	chrome.exe
Token: SeCreatePagefilePrivilege	6008	chrome.exe
Token: SeShutdownPrivilege	6008	chrome.exe
Token: SeCreatePagefilePrivilege	6008	chrome.exe
Token: SeShutdownPrivilege	6008	chrome.exe
Token: SeCreatePagefilePrivilege	6008	chrome.exe
Token: SeShutdownPrivilege	6008	chrome.exe
Token: SeCreatePagefilePrivilege	6008	chrome.exe
Token: SeShutdownPrivilege	6008	chrome.exe
Token: SeCreatePagefilePrivilege	6008	chrome.exe
Token: SeShutdownPrivilege	6008	chrome.exe
Token: SeCreatePagefilePrivilege	6008	chrome.exe
Token: SeShutdownPrivilege	6008	chrome.exe
Token: SeCreatePagefilePrivilege	6008	chrome.exe
Token: SeShutdownPrivilege	6008	chrome.exe
Token: SeCreatePagefilePrivilege	6008	chrome.exe
Token: SeShutdownPrivilege	6008	chrome.exe
Token: SeCreatePagefilePrivilege	6008	chrome.exe
Token: SeShutdownPrivilege	6008	chrome.exe
Token: SeCreatePagefilePrivilege	6008	chrome.exe
Token: SeShutdownPrivilege	6008	chrome.exe
Token: SeCreatePagefilePrivilege	6008	chrome.exe
Token: SeShutdownPrivilege	6008	chrome.exe
Token: SeCreatePagefilePrivilege	6008	chrome.exe
Token: SeShutdownPrivilege	6008	chrome.exe

Suspicious use of FindShellTrayWindow 57 IoCs

pid	Process
6008	chrome.exe
6008	chrome.exe
6008	chrome.exe
6008	chrome.exe
6008	chrome.exe
6008	chrome.exe
6008	chrome.exe
6008	chrome.exe
6008	chrome.exe
6008	chrome.exe
6008	chrome.exe
6008	chrome.exe
6008	chrome.exe
6008	chrome.exe
6008	chrome.exe
6008	chrome.exe
6008	chrome.exe
6008	chrome.exe
6008	chrome.exe
6008	chrome.exe
6008	chrome.exe
6008	chrome.exe
6008	chrome.exe
6008	chrome.exe
6008	chrome.exe
6008	chrome.exe
6008	chrome.exe
6008	chrome.exe
6008	chrome.exe
6008	chrome.exe
6008	chrome.exe
6008	chrome.exe
6008	chrome.exe
6008	chrome.exe
6008	chrome.exe
6008	chrome.exe
6008	chrome.exe
6008	chrome.exe
6008	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
1844	chrome.exe
1844	chrome.exe
1844	chrome.exe
5152	chrome.exe
5152	chrome.exe
5152	chrome.exe

Suspicious use of SendNotifyMessage 22 IoCs

pid	Process
6008	chrome.exe
6008	chrome.exe
6008	chrome.exe
6008	chrome.exe
6008	chrome.exe
6008	chrome.exe
6008	chrome.exe
6008	chrome.exe
6008	chrome.exe
6008	chrome.exe
6008	chrome.exe
6008	chrome.exe
6008	chrome.exe
6008	chrome.exe
6008	chrome.exe
6008	chrome.exe
6008	chrome.exe
6008	chrome.exe
6008	chrome.exe
6008	chrome.exe
4704	chrome.exe
4704	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 6008 wrote to memory of 5256	6008	chrome.exe	80
PID 6008 wrote to memory of 652	6008	chrome.exe	81
PID 6008 wrote to memory of 652	6008	chrome.exe	81
PID 6008 wrote to memory of 4548	6008	chrome.exe	82
PID 6008 wrote to memory of 3720	6008	chrome.exe	83
PID 6008 wrote to memory of 3720	6008	chrome.exe	83
PID 6008 wrote to memory of 5196	6008	chrome.exe	84
PID 6008 wrote to memory of 5196	6008	chrome.exe	84
PID 6008 wrote to memory of 1708	6008	chrome.exe	85
PID 6008 wrote to memory of 1708	6008	chrome.exe	85
PID 6008 wrote to memory of 2188	6008	chrome.exe	86
PID 6008 wrote to memory of 2188	6008	chrome.exe	86
PID 6008 wrote to memory of 4224	6008	chrome.exe	89
PID 6008 wrote to memory of 4224	6008	chrome.exe	89
PID 6008 wrote to memory of 924	6008	chrome.exe	90
PID 6008 wrote to memory of 924	6008	chrome.exe	90
PID 6008 wrote to memory of 1572	6008	chrome.exe	91
PID 6008 wrote to memory of 1572	6008	chrome.exe	91
PID 6008 wrote to memory of 5640	6008	chrome.exe	92
PID 6008 wrote to memory of 5756	6008	chrome.exe	94
PID 6008 wrote to memory of 5756	6008	chrome.exe	94
PID 6008 wrote to memory of 560	6008	chrome.exe	95
PID 6008 wrote to memory of 560	6008	chrome.exe	95
PID 6008 wrote to memory of 3168	6008	chrome.exe	96
PID 6008 wrote to memory of 5956	6008	chrome.exe	97
PID 6008 wrote to memory of 1696	6008	chrome.exe	98
PID 6008 wrote to memory of 5976	6008	chrome.exe	99
PID 6008 wrote to memory of 5976	6008	chrome.exe	99
PID 6008 wrote to memory of 5096	6008	chrome.exe	100
PID 6008 wrote to memory of 5096	6008	chrome.exe	100
PID 6008 wrote to memory of 5360	6008	chrome.exe	101
PID 6008 wrote to memory of 5360	6008	chrome.exe	101
PID 6008 wrote to memory of 4948	6008	chrome.exe	103
PID 6008 wrote to memory of 4948	6008	chrome.exe	103
PID 6008 wrote to memory of 1116	6008	chrome.exe	104
PID 6008 wrote to memory of 1116	6008	chrome.exe	104
PID 6008 wrote to memory of 1724	6008	chrome.exe	102
PID 6008 wrote to memory of 1724	6008	chrome.exe	102
PID 6008 wrote to memory of 3128	6008	chrome.exe	105
PID 6008 wrote to memory of 3128	6008	chrome.exe	105
PID 6008 wrote to memory of 4944	6008	chrome.exe	106
PID 6008 wrote to memory of 4944	6008	chrome.exe	106
PID 6008 wrote to memory of 876	6008	chrome.exe	109
PID 6008 wrote to memory of 876	6008	chrome.exe	109
PID 6008 wrote to memory of 2092	6008	chrome.exe	107
PID 6008 wrote to memory of 2092	6008	chrome.exe	107
PID 6008 wrote to memory of 1144	6008	chrome.exe	108
PID 6008 wrote to memory of 1144	6008	chrome.exe	108
PID 4324 wrote to memory of 4888	4324	Mercurial.exe	110
PID 4888 wrote to memory of 4688	4888	csc.exe	112
PID 4324 wrote to memory of 2812	4324	Mercurial.exe	113
PID 2812 wrote to memory of 5304	2812	csc.exe	115
PID 6008 wrote to memory of 4920	6008	chrome.exe	116
PID 6008 wrote to memory of 4920	6008	chrome.exe	116
PID 6008 wrote to memory of 1688	6008	chrome.exe	117
PID 6008 wrote to memory of 1688	6008	chrome.exe	117
PID 6008 wrote to memory of 2588	6008	chrome.exe	122
PID 6008 wrote to memory of 2588	6008	chrome.exe	122
PID 6008 wrote to memory of 1040	6008	chrome.exe	123
PID 880 wrote to memory of 2988	880	Mercurial.exe	124
PID 2988 wrote to memory of 5720	2988	csc.exe	126
PID 880 wrote to memory of 6056	880	Mercurial.exe	127
PID 6056 wrote to memory of 4396	6056	csc.exe	129
PID 6008 wrote to memory of 1268	6008	chrome.exe	131

C:\Users\Admin\AppData\Local\Temp\Mercurial.exe
"C:\Users\Admin\AppData\Local\Temp\Mercurial.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4324
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\yv33tnbe\yv33tnbe.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4888
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES69BC.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC27D075C49C704674ACEC6D721BF6BEE1.TMP"
    3⤵
    PID:4688
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\z3lzm4ud\z3lzm4ud.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2812
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8F07.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC2B4EBD5D18E04A1485D38BF3A377475.TMP"
    3⤵
    PID:5304

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:6008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff80f06c728,0x7ff80f06c734,0x7ff80f06c740
  2⤵
  PID:5256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1608,i,11950701782181737836,13243510827251897392,262144 --field-trial-handle=1924,i,819369443359955624,1974490017357284439,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1920 /prefetch:2
  2⤵
  PID:652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2268,i,873711898312101260,16551573736322030143,524288 --field-trial-handle=1924,i,819369443359955624,1974490017357284439,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2296 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2304,i,2619395573308792613,4684740363402903601,524288 --field-trial-handle=1924,i,819369443359955624,1974490017357284439,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2400 /prefetch:13
  2⤵
  PID:3720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3224,i,2091537434608212659,17770338292882175019,2097152 --field-trial-handle=1924,i,819369443359955624,1974490017357284439,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:5196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3296,i,190603060791842458,8253267235463801237,2097152 --field-trial-handle=1924,i,819369443359955624,1974490017357284439,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:1708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4212,i,17148883394956477280,12329140499161627501,2097152 --field-trial-handle=1924,i,819369443359955624,1974490017357284439,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4216 /prefetch:9
  2⤵
  PID:2188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4580,i,2966425792892094313,17915768116003765868,2097152 --field-trial-handle=1924,i,819369443359955624,1974490017357284439,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4600 /prefetch:1
  2⤵
  PID:4224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4196,i,10668637784403384647,11385775963871116402,524288 --field-trial-handle=1924,i,819369443359955624,1974490017357284439,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4204 /prefetch:14
  2⤵
  PID:924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4188,i,13546940642273016148,3260330537748544605,524288 --field-trial-handle=1924,i,819369443359955624,1974490017357284439,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4940 /prefetch:14
  2⤵
  PID:1572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5428,i,17489367273265178138,16751843204338336046,524288 --field-trial-handle=1924,i,819369443359955624,1974490017357284439,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5368 /prefetch:14
  2⤵
  PID:5640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5840,i,2443450019578168148,1401357094280477597,2097152 --field-trial-handle=1924,i,819369443359955624,1974490017357284439,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5808 /prefetch:1
  2⤵
  PID:5756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=4572,i,9898511230353918809,1248456183789989799,2097152 --field-trial-handle=1924,i,819369443359955624,1974490017357284439,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5428 /prefetch:1
  2⤵
  PID:560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5940,i,456347029118047102,5593143340512721981,524288 --field-trial-handle=1924,i,819369443359955624,1974490017357284439,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5960 /prefetch:14
  2⤵
  PID:3168
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5952,i,11135448561081272377,13045378244780529782,524288 --field-trial-handle=1924,i,819369443359955624,1974490017357284439,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6028 /prefetch:14
  2⤵
  PID:5956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5968,i,4485077842711545063,3442770543134569645,524288 --field-trial-handle=1924,i,819369443359955624,1974490017357284439,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6060 /prefetch:14
  2⤵
  PID:1696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=4228,i,11420862155068189307,3536607842657659496,2097152 --field-trial-handle=1924,i,819369443359955624,1974490017357284439,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4320 /prefetch:1
  2⤵
  PID:5976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=4308,i,1177204391842250416,11899236838037247119,2097152 --field-trial-handle=1924,i,819369443359955624,1974490017357284439,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1756 /prefetch:1
  2⤵
  PID:5096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=4284,i,7679841471956468900,7165276745943137197,2097152 --field-trial-handle=1924,i,819369443359955624,1974490017357284439,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4268 /prefetch:1
  2⤵
  PID:5360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=3676,i,9771514527395635141,17139980522168800076,2097152 --field-trial-handle=1924,i,819369443359955624,1974490017357284439,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:1724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=3604,i,10194787283242632699,1482161614717836539,2097152 --field-trial-handle=1924,i,819369443359955624,1974490017357284439,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:4948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=3224,i,18107920178059033361,11348608260953021528,2097152 --field-trial-handle=1924,i,819369443359955624,1974490017357284439,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:1116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=3652,i,16261984715053238618,17768253578838756409,2097152 --field-trial-handle=1924,i,819369443359955624,1974490017357284439,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6036 /prefetch:1
  2⤵
  PID:3128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=4332,i,14238993683745622006,14971194511794064572,2097152 --field-trial-handle=1924,i,819369443359955624,1974490017357284439,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6488 /prefetch:1
  2⤵
  PID:4944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6540,i,1298499597996934415,9542476171744122233,2097152 --field-trial-handle=1924,i,819369443359955624,1974490017357284439,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6496 /prefetch:1
  2⤵
  PID:2092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=4752,i,7947141229271072813,5869462276014589983,2097152 --field-trial-handle=1924,i,819369443359955624,1974490017357284439,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6440 /prefetch:1
  2⤵
  PID:1144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=6108,i,13079704467395019051,7031636278388915522,2097152 --field-trial-handle=1924,i,819369443359955624,1974490017357284439,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6100 /prefetch:1
  2⤵
  PID:876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=4808,i,13576728298010573850,2590967864308586039,2097152 --field-trial-handle=1924,i,819369443359955624,1974490017357284439,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4320 /prefetch:1
  2⤵
  PID:4920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=5892,i,1840454491223153628,8209812162392189091,2097152 --field-trial-handle=1924,i,819369443359955624,1974490017357284439,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5772 /prefetch:1
  2⤵
  PID:1688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=6968,i,6887845759104968495,13653222666516058803,2097152 --field-trial-handle=1924,i,819369443359955624,1974490017357284439,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6756 /prefetch:1
  2⤵
  PID:2588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=7044,i,5705869880273543775,1107904502139035609,262144 --field-trial-handle=1924,i,819369443359955624,1974490017357284439,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6536 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5592,i,501265712405102758,296559653728022541,524288 --field-trial-handle=1924,i,819369443359955624,1974490017357284439,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3828 /prefetch:14
  2⤵
  PID:1268

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4952

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5596

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4028

C:\Users\Admin\AppData\Local\Temp\Mercurial.exe
"C:\Users\Admin\AppData\Local\Temp\Mercurial.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:880
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\0i0afyi5\0i0afyi5.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2988
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC5F1.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC841F3754A2B44FC8A850612AD4BF2960.TMP"
    3⤵
    PID:5720
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\02mnwums\02mnwums.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6056
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF9B3.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC70F583F755DC4E96B46EE8FA9997AB2.TMP"
    3⤵
    PID:4396

C:\Users\Admin\Desktop\output.exe
"C:\Users\Admin\Desktop\output.exe"
1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Executes dropped EXE
- Maps connected drives based on registry
- Checks SCSI registry key(s)
- Enumerates system info in registry
PID:196

C:\Users\Admin\Desktop\novm.exe
"C:\Users\Admin\Desktop\novm.exe"
1⤵
- Executes dropped EXE
PID:2524

C:\Users\Admin\Desktop\output.exe
"C:\Users\Admin\Desktop\output.exe"
1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Executes dropped EXE
- Maps connected drives based on registry
- Checks SCSI registry key(s)
- Enumerates system info in registry
PID:1584

C:\Users\Admin\Desktop\novm.exe
"C:\Users\Admin\Desktop\novm.exe"
1⤵
- Executes dropped EXE
PID:5444

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff80f06c728,0x7ff80f06c734,0x7ff80f06c740
  2⤵
  PID:4164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1580,i,10377098768140225434,9275339150232702505,262144 --field-trial-handle=1928,i,694865314608827448,6194779345896189257,262144 --variations-seed-version=20260306-090033.708000-production --mojo-platform-channel-handle=1924 /prefetch:2
  2⤵
  PID:3948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2236,i,15915301325877861311,8870114912189048026,524288 --field-trial-handle=1928,i,694865314608827448,6194779345896189257,262144 --variations-seed-version=20260306-090033.708000-production --mojo-platform-channel-handle=2244 /prefetch:11
  2⤵
  - System Time Discovery
  PID:6132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2380,i,12912358948262189089,11255887970022990565,524288 --field-trial-handle=1928,i,694865314608827448,6194779345896189257,262144 --variations-seed-version=20260306-090033.708000-production --mojo-platform-channel-handle=1780 /prefetch:13
  2⤵
  PID:3876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3184,i,8441066818883219074,8327472485133597293,2097152 --field-trial-handle=1928,i,694865314608827448,6194779345896189257,262144 --variations-seed-version=20260306-090033.708000-production --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:2852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3288,i,7551821984903775488,14597868880005151782,2097152 --field-trial-handle=1928,i,694865314608827448,6194779345896189257,262144 --variations-seed-version=20260306-090033.708000-production --mojo-platform-channel-handle=3420 /prefetch:1
  2⤵
  PID:2348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4428,i,4274911862167095050,17275829929300493726,524288 --field-trial-handle=1928,i,694865314608827448,6194779345896189257,262144 --variations-seed-version=20260306-090033.708000-production --mojo-platform-channel-handle=4440 /prefetch:14
  2⤵
  PID:3084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4568,i,16391265693260548901,6046270953126445719,2097152 --field-trial-handle=1928,i,694865314608827448,6194779345896189257,262144 --variations-seed-version=20260306-090033.708000-production --mojo-platform-channel-handle=4596 /prefetch:1
  2⤵
  PID:4680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4724,i,17223038087422468618,6022632792840947618,524288 --field-trial-handle=1928,i,694865314608827448,6194779345896189257,262144 --variations-seed-version=20260306-090033.708000-production --mojo-platform-channel-handle=4732 /prefetch:14
  2⤵
  PID:5504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5208,i,17372117587915893516,13999671623741549188,524288 --field-trial-handle=1928,i,694865314608827448,6194779345896189257,262144 --variations-seed-version=20260306-090033.708000-production --mojo-platform-channel-handle=5212 /prefetch:14
  2⤵
  PID:3108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5584,i,11197255848677792163,2157716403616643953,2097152 --field-trial-handle=1928,i,694865314608827448,6194779345896189257,262144 --variations-seed-version=20260306-090033.708000-production --mojo-platform-channel-handle=5576 /prefetch:1
  2⤵
  PID:3252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=3432,i,2084873011712364042,13348030359693710270,2097152 --field-trial-handle=1928,i,694865314608827448,6194779345896189257,262144 --variations-seed-version=20260306-090033.708000-production --mojo-platform-channel-handle=4388 /prefetch:1
  2⤵
  PID:2124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5928,i,15697022196387297635,3743499719253506830,2097152 --field-trial-handle=1928,i,694865314608827448,6194779345896189257,262144 --variations-seed-version=20260306-090033.708000-production --mojo-platform-channel-handle=5888 /prefetch:1
  2⤵
  PID:3420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5704,i,2877603655265021931,12422613441568258322,2097152 --field-trial-handle=1928,i,694865314608827448,6194779345896189257,262144 --variations-seed-version=20260306-090033.708000-production --mojo-platform-channel-handle=5664 /prefetch:1
  2⤵
  PID:3924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5812,i,9424100787413755214,8786652541948487083,2097152 --field-trial-handle=1928,i,694865314608827448,6194779345896189257,262144 --variations-seed-version=20260306-090033.708000-production --mojo-platform-channel-handle=5828 /prefetch:1
  2⤵
  PID:3720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6008,i,16948428716808286516,295425412693519275,2097152 --field-trial-handle=1928,i,694865314608827448,6194779345896189257,262144 --variations-seed-version=20260306-090033.708000-production --mojo-platform-channel-handle=6120 /prefetch:1
  2⤵
  PID:5636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=3536,i,9317441097854095966,16372513774829230148,2097152 --field-trial-handle=1928,i,694865314608827448,6194779345896189257,262144 --variations-seed-version=20260306-090033.708000-production --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:2524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=3488,i,15421859171360191498,6905099620144367078,2097152 --field-trial-handle=1928,i,694865314608827448,6194779345896189257,262144 --variations-seed-version=20260306-090033.708000-production --mojo-platform-channel-handle=5512 /prefetch:1
  2⤵
  PID:1040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5368,i,18067760075946805585,9094893309427324967,2097152 --field-trial-handle=1928,i,694865314608827448,6194779345896189257,262144 --variations-seed-version=20260306-090033.708000-production --mojo-platform-channel-handle=6204 /prefetch:1
  2⤵
  PID:5960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6368,i,10491738546657696540,2217690422713110623,2097152 --field-trial-handle=1928,i,694865314608827448,6194779345896189257,262144 --variations-seed-version=20260306-090033.708000-production --mojo-platform-channel-handle=6356 /prefetch:1
  2⤵
  PID:3256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5472,i,1991963732354466497,6151206703384369884,524288 --field-trial-handle=1928,i,694865314608827448,6194779345896189257,262144 --variations-seed-version=20260306-090033.708000-production --mojo-platform-channel-handle=212 /prefetch:14
  2⤵
  PID:1556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6716,i,12042785687157448843,801152885279319298,524288 --field-trial-handle=1928,i,694865314608827448,6194779345896189257,262144 --variations-seed-version=20260306-090033.708000-production --mojo-platform-channel-handle=5456 /prefetch:14
  2⤵
  PID:5972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6712,i,10250737350489445339,12879338095228759642,524288 --field-trial-handle=1928,i,694865314608827448,6194779345896189257,262144 --variations-seed-version=20260306-090033.708000-production --mojo-platform-channel-handle=5480 /prefetch:14
  2⤵
  PID:2388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6880,i,18027957782891588269,3930564579441807064,262144 --field-trial-handle=1928,i,694865314608827448,6194779345896189257,262144 --variations-seed-version=20260306-090033.708000-production --mojo-platform-channel-handle=6820 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2088

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4468

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5240

C:\Users\Admin\Desktop\novm.exe
"C:\Users\Admin\Desktop\novm.exe"
1⤵
- Executes dropped EXE
PID:5300

C:\Users\Admin\Desktop\Mercurial.exe
"C:\Users\Admin\Desktop\Mercurial.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:5032
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\uxehpcj3\uxehpcj3.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4676
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC671.tmp" "c:\Users\Admin\Desktop\CSC5F1DF3497F44403AAEB350C7D0B7CE87.TMP"
    3⤵
    PID:4736
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\e0qzeb0t\e0qzeb0t.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:920
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF7E1.tmp" "c:\Users\Admin\Desktop\CSC418522871B3A471EBF2CC41515D7A3E.TMP"
    3⤵
    PID:848
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\2r3tumsv\2r3tumsv.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5404
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFF34.tmp" "c:\Users\Admin\Desktop\CSC16D73D347EE2412ABCFCF7D7D2F39326.TMP"
    3⤵
    PID:4912
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\zstlw2wi\zstlw2wi.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1524
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3B8.tmp" "c:\Users\Admin\Desktop\CSC77737677E5154E969DEA6CD76C49DEE5.TMP"
    3⤵
    PID:2124
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\po4lphym\po4lphym.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4452
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES490E.tmp" "c:\Users\Admin\Desktop\CSC6873510DB0184F578C6EB433C145792.TMP"
    3⤵
    PID:2860

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
PID:1844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff80f06c728,0x7ff80f06c734,0x7ff80f06c740
  2⤵
  PID:772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1648,i,7515615215777533269,5426103161622647849,262144 --field-trial-handle=1940,i,15174896333303078022,6993102319813261377,262144 --variations-seed-version=20260306-090033.708000-production --mojo-platform-channel-handle=1932 /prefetch:2
  2⤵
  PID:4836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2228,i,15025072457675242007,2929283858984652417,524288 --field-trial-handle=1940,i,15174896333303078022,6993102319813261377,262144 --variations-seed-version=20260306-090033.708000-production --mojo-platform-channel-handle=2232 /prefetch:11
  2⤵
  - System Time Discovery
  PID:6052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2372,i,4159810135331292997,5812086984423343367,524288 --field-trial-handle=1940,i,15174896333303078022,6993102319813261377,262144 --variations-seed-version=20260306-090033.708000-production --mojo-platform-channel-handle=2416 /prefetch:13
  2⤵
  PID:3692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3232,i,11944983378490954670,15224275699659995026,2097152 --field-trial-handle=1940,i,15174896333303078022,6993102319813261377,262144 --variations-seed-version=20260306-090033.708000-production --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:4392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3364,i,14177375655857677615,10001624358042520611,2097152 --field-trial-handle=1940,i,15174896333303078022,6993102319813261377,262144 --variations-seed-version=20260306-090033.708000-production --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:1644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4308,i,15973192776745694775,9132172834716872884,524288 --field-trial-handle=1940,i,15174896333303078022,6993102319813261377,262144 --variations-seed-version=20260306-090033.708000-production --mojo-platform-channel-handle=4400 /prefetch:14
  2⤵
  PID:2632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4612,i,16770850151208302095,6534775783577001639,2097152 --field-trial-handle=1940,i,15174896333303078022,6993102319813261377,262144 --variations-seed-version=20260306-090033.708000-production --mojo-platform-channel-handle=4628 /prefetch:1
  2⤵
  PID:5240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3844,i,13126943696170894256,6251370340307674780,524288 --field-trial-handle=1940,i,15174896333303078022,6993102319813261377,262144 --variations-seed-version=20260306-090033.708000-production --mojo-platform-channel-handle=4768 /prefetch:14
  2⤵
  PID:5236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5196,i,17991343553590563442,13202645770533700743,524288 --field-trial-handle=1940,i,15174896333303078022,6993102319813261377,262144 --variations-seed-version=20260306-090033.708000-production --mojo-platform-channel-handle=5204 /prefetch:14
  2⤵
  PID:672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5564,i,2761093480071348125,17793049517575995479,2097152 --field-trial-handle=1940,i,15174896333303078022,6993102319813261377,262144 --variations-seed-version=20260306-090033.708000-production --mojo-platform-channel-handle=5572 /prefetch:1
  2⤵
  PID:3532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=3420,i,17911262476998909477,15160663716371015508,2097152 --field-trial-handle=1940,i,15174896333303078022,6993102319813261377,262144 --variations-seed-version=20260306-090033.708000-production --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:6064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=3508,i,9228186808215398310,8045927213718070953,2097152 --field-trial-handle=1940,i,15174896333303078022,6993102319813261377,262144 --variations-seed-version=20260306-090033.708000-production --mojo-platform-channel-handle=4636 /prefetch:1
  2⤵
  PID:2328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=4752,i,6459910195945446883,14159825730740566066,2097152 --field-trial-handle=1940,i,15174896333303078022,6993102319813261377,262144 --variations-seed-version=20260306-090033.708000-production --mojo-platform-channel-handle=4652 /prefetch:1
  2⤵
  PID:2144

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1388

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5284

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
PID:5152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff80f06c728,0x7ff80f06c734,0x7ff80f06c740
  2⤵
  PID:5960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1788,i,2918141642840049219,17813141326450588547,524288 --field-trial-handle=2032,i,18363277426522425352,9121271255399477021,262144 --variations-seed-version=20260306-090033.708000-production --mojo-platform-channel-handle=2056 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1612,i,10220066959950076151,15248705471506968885,262144 --field-trial-handle=2032,i,18363277426522425352,9121271255399477021,262144 --variations-seed-version=20260306-090033.708000-production --mojo-platform-channel-handle=2024 /prefetch:2
  2⤵
  PID:2524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2368,i,7691114272766784665,17391411720586762473,524288 --field-trial-handle=2032,i,18363277426522425352,9121271255399477021,262144 --variations-seed-version=20260306-090033.708000-production --mojo-platform-channel-handle=1952 /prefetch:13
  2⤵
  PID:1628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3216,i,14806362011345998317,5686449704480796015,2097152 --field-trial-handle=2032,i,18363277426522425352,9121271255399477021,262144 --variations-seed-version=20260306-090033.708000-production --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:2692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3364,i,18351455665254091149,14122245347055179374,2097152 --field-trial-handle=2032,i,18363277426522425352,9121271255399477021,262144 --variations-seed-version=20260306-090033.708000-production --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:4312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4464,i,8175290607418059104,15508165352044782336,524288 --field-trial-handle=2032,i,18363277426522425352,9121271255399477021,262144 --variations-seed-version=20260306-090033.708000-production --mojo-platform-channel-handle=3860 /prefetch:14
  2⤵
  PID:3996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4612,i,1495396108461875807,9486712487509640817,2097152 --field-trial-handle=2032,i,18363277426522425352,9121271255399477021,262144 --variations-seed-version=20260306-090033.708000-production --mojo-platform-channel-handle=4580 /prefetch:1
  2⤵
  PID:1376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4784,i,3220578986393158586,8358264048126147510,524288 --field-trial-handle=2032,i,18363277426522425352,9121271255399477021,262144 --variations-seed-version=20260306-090033.708000-production --mojo-platform-channel-handle=4764 /prefetch:14
  2⤵
  PID:1620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5232,i,9849978619698719941,5547727093826333821,524288 --field-trial-handle=2032,i,18363277426522425352,9121271255399477021,262144 --variations-seed-version=20260306-090033.708000-production --mojo-platform-channel-handle=5228 /prefetch:14
  2⤵
  PID:5052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5356,i,2737506071844636743,3234808079284511419,2097152 --field-trial-handle=2032,i,18363277426522425352,9121271255399477021,262144 --variations-seed-version=20260306-090033.708000-production --mojo-platform-channel-handle=5208 /prefetch:1
  2⤵
  PID:5240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=4608,i,1004154473870359651,9224409687165838578,2097152 --field-trial-handle=2032,i,18363277426522425352,9121271255399477021,262144 --variations-seed-version=20260306-090033.708000-production --mojo-platform-channel-handle=5612 /prefetch:1
  2⤵
  PID:196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=3536,i,10975626211604781386,9345157383755277144,2097152 --field-trial-handle=2032,i,18363277426522425352,9121271255399477021,262144 --variations-seed-version=20260306-090033.708000-production --mojo-platform-channel-handle=5400 /prefetch:1
  2⤵
  PID:1400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5792,i,4938223136379856437,433577012715211777,2097152 --field-trial-handle=2032,i,18363277426522425352,9121271255399477021,262144 --variations-seed-version=20260306-090033.708000-production --mojo-platform-channel-handle=3632 /prefetch:1
  2⤵
  PID:3228

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2672

C:\Users\Admin\Desktop\nnn.exe
"C:\Users\Admin\Desktop\nnn.exe"
1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Executes dropped EXE
- Maps connected drives based on registry
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
PID:2076

C:\Users\Admin\Desktop\nnn.exe
"C:\Users\Admin\Desktop\nnn.exe"
1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Executes dropped EXE
- Maps connected drives based on registry
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
PID:5052

C:\Users\Admin\Desktop\n.exe
"C:\Users\Admin\Desktop\n.exe"
1⤵
- Executes dropped EXE
- Checks processor information in registry
PID:1864

C:\Users\Admin\Desktop\n.exe
"C:\Users\Admin\Desktop\n.exe"
1⤵
- Executes dropped EXE
- Checks processor information in registry
PID:4972

C:\Users\Admin\Desktop\n.exe
"C:\Users\Admin\Desktop\n.exe"
1⤵
- Executes dropped EXE
- Checks processor information in registry
PID:1396

C:\Users\Admin\Desktop\n.exe
"C:\Users\Admin\Desktop\n.exe"
1⤵
- Executes dropped EXE
- Checks processor information in registry
PID:2328

C:\Users\Admin\Desktop\n.exe
"C:\Users\Admin\Desktop\n.exe"
1⤵
- Executes dropped EXE
- Checks processor information in registry
PID:4748

C:\Users\Admin\Desktop\n.exe
"C:\Users\Admin\Desktop\n.exe"
1⤵
- Executes dropped EXE
- Checks processor information in registry
PID:1108

C:\Users\Admin\Desktop\n.exe
"C:\Users\Admin\Desktop\n.exe"
1⤵
- Executes dropped EXE
- Checks processor information in registry
PID:2736

C:\Users\Admin\Desktop\n.exe
"C:\Users\Admin\Desktop\n.exe"
1⤵
- Executes dropped EXE
- Checks processor information in registry
PID:5740

C:\Users\Admin\Desktop\n.exe
"C:\Users\Admin\Desktop\n.exe"
1⤵
- Executes dropped EXE
- Checks processor information in registry
PID:4480

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Virtualization/Sandbox Evasion