Resubmissions
20/07/2026, 16:48
260720-vbjwbsgw3q1007/07/2026, 22:38
260707-2kndfaf13j807/07/2026, 22:38
260707-2km3nsf12r27/06/2026, 18:29
260627-w4ww2acx2w1027/06/2026, 17:09
260627-vn7sxscv5m827/06/2026, 10:22
260627-mefn3say2q927/06/2026, 08:46
260627-kn9meahw9x827/06/2026, 01:27
260627-bt8smagz6r826/06/2026, 14:29
260626-rt2x3sb19s826/06/2026, 13:41
260626-qy8ezsby218Analysis
- user interaction
yes - max time kernel
1800s - max time network
1803s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
21/04/2026, 18:17
General
- Target 82a9f04020f80b10bce7d17d1591c241d62aa982b375851d7e809c444f2023b6.exe
- Size 7.5MB
- Sample260421-wxap8adz21
- SHA256 d2a7b55fd4a1114751f1fcd2b55366d37e5dab9621f2c5428ec95997e57878a1
Score
8/10
Malware Config
Signatures
- Badlisted process makes network request 4 IoCs
Network request originating from process or tool commonly abused by malware.
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 14 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs
Using powershell.exe command.
- Contacts third-party web service commonly abused for C2 1 TTPs 14 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Drops Chrome extension 3 IoCs
- Drops desktop.ini file(s) 2 IoCs
- Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory 30 IoCs
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Sets desktop wallpaper using registry 2 TTPs 2 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 64 IoCs
- Executes dropped EXE 64 IoCs
- Launches sc.exe 38 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Loads dropped DLL 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Checks whether UAC is enabled 1 TTPs 13 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- System Location Discovery: System Language Discovery 1 TTPs 32 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 16 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- System Time Discovery 1 TTPs 3 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 11 IoCs
- Modifies Internet Explorer settings 1 TTPs 8 IoCs
- Modifies data under HKEY_USERS 6 IoCs
- Modifies registry class 64 IoCs
- Modifies registry key 1 TTPs 53 IoCs
- Runs ping.exe 1 TTPs 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 3 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 2 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 45 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 45 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\82a9f04020f80b10bce7d17d1591c241d62aa982b375851d7e809c444f2023b6.exe"C:\Users\Admin\AppData\Local\Temp\82a9f04020f80b10bce7d17d1591c241d62aa982b375851d7e809c444f2023b6.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\82a9f04020f80b10bce7d17d1591c241d62aa982b375851d7e809c444f2023b6.exe"C:\Users\Admin\AppData\Local\Temp\82a9f04020f80b10bce7d17d1591c241d62aa982b375851d7e809c444f2023b6.exe" --local-service2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\82a9f04020f80b10bce7d17d1591c241d62aa982b375851d7e809c444f2023b6.exe"C:\Users\Admin\AppData\Local\Temp\82a9f04020f80b10bce7d17d1591c241d62aa982b375851d7e809c444f2023b6.exe" --backend3⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Users\Admin\AppData\Local\Temp\82a9f04020f80b10bce7d17d1591c241d62aa982b375851d7e809c444f2023b6.exe"C:\Users\Admin\AppData\Local\Temp\82a9f04020f80b10bce7d17d1591c241d62aa982b375851d7e809c444f2023b6.exe" --local-control2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004DC 0x00000000000004741⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "-Command" "if((Get-ExecutionPolicy ) -ne 'AllSigned') { Set-ExecutionPolicy -Scope Process Bypass }; & 'C:\Users\Admin\Desktop\Setup.ps1'"1⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\0pr2jdaf\0pr2jdaf.cmdline"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC1B0.tmp" "c:\Users\Admin\AppData\Local\Temp\0pr2jdaf\CSC202A88FDD02D454288798AB1237CD5B4.TMP"3⤵
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo CMD is working"2⤵
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c ""C:\Windows\Temp\MAS_09efec6c-9121-4c07-8156-96825b5395ff.cmd" -el "2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\sc.exesc query Null3⤵
- Launches sc.exe
-
-
C:\Windows\System32\find.exefind /i "RUNNING"3⤵
-
-
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\wt.exe"C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\wt.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\WindowsTerminal.exewt.exe3⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wsl.exeC:\Windows\system32\wsl.exe --list4⤵
-
-
C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\OpenConsole.exe"C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\OpenConsole.exe" --headless --win32input --resizeQuirk --width 120 --height 27 --signal 0xa1c --server 0xa184⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe4⤵
- Badlisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo CMD is working"5⤵
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c ""C:\Windows\Temp\MAS_f16faa9c-e4d3-479a-a87b-fc3c3c63bddb.cmd" -el "5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\sc.exesc query Null6⤵
- Launches sc.exe
-
-
C:\Windows\System32\find.exefind /i "RUNNING"6⤵
-
-
C:\Windows\System32\findstr.exefindstr /v "$" "MAS_f16faa9c-e4d3-479a-a87b-fc3c3c63bddb.cmd"6⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "-el" "6⤵
-
-
C:\Windows\System32\find.exefind /i "/"6⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c ver6⤵
-
-
C:\Windows\System32\reg.exereg query "HKCU\Console" /v ForceV26⤵
-
-
C:\Windows\System32\find.exefind /i "0x0"6⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "AMD64 " "6⤵
-
-
C:\Windows\System32\find.exefind /i "ARM64"6⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c echo prompt $E | cmd6⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo prompt $E "7⤵
-
-
C:\Windows\System32\cmd.execmd7⤵
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "C:\Windows\Temp\MAS_f16faa9c-e4d3-479a-a87b-fc3c3c63bddb.cmd" "6⤵
-
-
C:\Windows\System32\find.exefind /i "C:\Users\Admin\AppData\Local\Temp"6⤵
-
-
C:\Windows\System32\fltMC.exefltmc6⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "if ($PSVersionTable.PSEdition -ne 'Core') {$f=[System.IO.File]::ReadAllText('C:\Windows\Temp\MAS_f16faa9c-e4d3-479a-a87b-fc3c3c63bddb.cmd') -split ':pstst';. ([scriptblock]::Create($f[1]))}" 2>nul6⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "if ($PSVersionTable.PSEdition -ne 'Core') {$f=[System.IO.File]::ReadAllText('C:\Windows\Temp\MAS_f16faa9c-e4d3-479a-a87b-fc3c3c63bddb.cmd') -split ':pstst';. ([scriptblock]::Create($f[1]))}"7⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c mode con6⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\mode.commode con7⤵
-
-
-
C:\Windows\System32\reg.exereg query HKCU\Console /v QuickEdit6⤵
- Modifies registry key
-
-
C:\Windows\System32\find.exefind /i "0x0"6⤵
-
-
C:\Windows\System32\reg.exereg add HKCU\Console /v QuickEdit /t REG_DWORD /d 0 /f6⤵
- Modifies registry key
-
-
C:\Windows\System32\cmd.execmd.exe /c ""C:\Windows\Temp\MAS_f16faa9c-e4d3-479a-a87b-fc3c3c63bddb.cmd" -el -qedit"6⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\sc.exesc query Null7⤵
- Launches sc.exe
-
-
C:\Windows\System32\find.exefind /i "RUNNING"7⤵
-
-
C:\Windows\System32\findstr.exefindstr /v "$" "MAS_f16faa9c-e4d3-479a-a87b-fc3c3c63bddb.cmd"7⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "-el -qedit" "7⤵
-
-
C:\Windows\System32\find.exefind /i "/"7⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c ver7⤵
-
-
C:\Windows\System32\reg.exereg query "HKCU\Console" /v ForceV27⤵
-
-
C:\Windows\System32\find.exefind /i "0x0"7⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "AMD64 " "7⤵
-
-
C:\Windows\System32\find.exefind /i "ARM64"7⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c echo prompt $E | cmd7⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo prompt $E "8⤵
-
-
C:\Windows\System32\cmd.execmd8⤵
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "C:\Windows\Temp\MAS_f16faa9c-e4d3-479a-a87b-fc3c3c63bddb.cmd" "7⤵
-
-
C:\Windows\System32\find.exefind /i "C:\Users\Admin\AppData\Local\Temp"7⤵
-
-
C:\Windows\System32\fltMC.exefltmc7⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "if ($PSVersionTable.PSEdition -ne 'Core') {$f=[System.IO.File]::ReadAllText('C:\Windows\Temp\MAS_f16faa9c-e4d3-479a-a87b-fc3c3c63bddb.cmd') -split ':pstst';. ([scriptblock]::Create($f[1]))}" 2>nul7⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "if ($PSVersionTable.PSEdition -ne 'Core') {$f=[System.IO.File]::ReadAllText('C:\Windows\Temp\MAS_f16faa9c-e4d3-479a-a87b-fc3c3c63bddb.cmd') -split ':pstst';. ([scriptblock]::Create($f[1]))}"8⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c mode con7⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\mode.commode con8⤵
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c ping -n 1 activated.win7⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\PING.EXEping -n 1 activated.win8⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c ping -n 1 updatecheck310.activated.win7⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\PING.EXEping -n 1 updatecheck310.activated.win8⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "-el -qedit" "7⤵
-
-
C:\Windows\System32\find.exefind /i "/S"7⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "-el -qedit" "7⤵
-
-
C:\Windows\System32\find.exefind /i "/"7⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop7⤵
-
C:\Windows\System32\reg.exereg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop8⤵
-
-
-
C:\Windows\System32\mode.commode 76, 347⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration /v ProductReleaseIds7⤵
- Modifies registry key
-
-
C:\Windows\System32\find.exefind /i "O365"7⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Office\ClickToRun\Configuration /v ProductReleaseIds7⤵
- Modifies registry key
-
-
C:\Windows\System32\find.exefind /i "O365"7⤵
-
-
C:\Windows\System32\choice.exechoice /C:12345678EH0 /N7⤵
-
-
C:\Windows\System32\mode.commode 110, 347⤵
-
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\taskcache\tasks" /f Path /s7⤵
-
-
C:\Windows\System32\find.exefind /i "AutoPico"7⤵
-
-
C:\Windows\System32\find.exefind /i "avira.com" C:\Windows\System32\drivers\etc\hosts7⤵
-
-
C:\Windows\System32\find.exefind /i "kaspersky.com" C:\Windows\System32\drivers\etc\hosts7⤵
-
-
C:\Windows\System32\find.exefind /i "virustotal.com" C:\Windows\System32\drivers\etc\hosts7⤵
-
-
C:\Windows\System32\find.exefind /i "mcafee.com" C:\Windows\System32\drivers\etc\hosts7⤵
-
-
C:\Windows\System32\sc.exesc start sppsvc7⤵
- Launches sc.exe
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "1056" "7⤵
-
-
C:\Windows\System32\findstr.exefindstr "577 225"7⤵
-
-
C:\Windows\System32\cmd.execmd /c "wmic path Win32_ComputerSystem get CreationClassName /value"7⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic path Win32_ComputerSystem get CreationClassName /value8⤵
-
-
-
C:\Windows\System32\find.exefind /i "computersystem"7⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); [void]$TypeBuilder.DefinePInvokeMethod('SLGetWindowsInformationDWORD', 'slc.dll', 'Public, Static', 1, [int], @([String], [int].MakeByRefType()), 1, 3); $Sku = 0; [void]$TypeBuilder.CreateType()::SLGetWindowsInformationDWORD('Kernel-BrandingInfo', [ref]$Sku); $Sku"7⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); [void]$TypeBuilder.DefinePInvokeMethod('SLGetWindowsInformationDWORD', 'slc.dll', 'Public, Static', 1, [int], @([String], [int].MakeByRefType()), 1, 3); $Sku = 0; [void]$TypeBuilder.CreateType()::SLGetWindowsInformationDWORD('Kernel-BrandingInfo', [ref]$Sku); $Sku8⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\ProductOptions" /v OSProductPfn 2>nul7⤵
-
C:\Windows\System32\reg.exereg query "HKLM\SYSTEM\CurrentControlSet\Control\ProductOptions" /v OSProductPfn8⤵
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c "wmic Path Win32_OperatingSystem Get OperatingSystemSKU /format:LIST" 2>nul7⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic Path Win32_OperatingSystem Get OperatingSystemSKU /format:LIST8⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$f=[System.IO.File]::ReadAllText('C:\Windows\Temp\MAS_f16faa9c-e4d3-479a-a87b-fc3c3c63bddb.cmd') -split ':winsubstatus\:.*';. ([scriptblock]::Create($f[1]))"7⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\find.exefind /i "Subscription_is_activated"7⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); $meth = $TypeBuilder.DefinePInvokeMethod('BrandingFormatString', 'winbrand.dll', 'Public, Static', 1, [String], @([String]), 1, 3); $meth.SetImplementationFlags(128); $TypeBuilder.CreateType()::BrandingFormatString('%WINDOWS_LONG%') -replace [string][char]0xa9, '' -replace [string][char]0xae, '' -replace [string][char]0x2122, ''"7⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); $meth = $TypeBuilder.DefinePInvokeMethod('BrandingFormatString', 'winbrand.dll', 'Public, Static', 1, [String], @([String]), 1, 3); $meth.SetImplementationFlags(128); $TypeBuilder.CreateType()::BrandingFormatString('%WINDOWS_LONG%') -replace [string][char]0xa9, '' -replace [string][char]0xae, '' -replace [string][char]0x2122, ''8⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "Windows 11 Pro" "7⤵
-
-
C:\Windows\System32\find.exefind /i "Windows"7⤵
-
-
C:\Windows\System32\sc.exesc start sppsvc7⤵
- Launches sc.exe
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$job = Start-Job { (Get-WmiObject -Query 'SELECT * FROM SoftwareLicensingService').Version }; if (-not (Wait-Job $job -Timeout 30)) {write-host 'sppsvc is not working correctly. Check this webpage for help - https://massgrave.dev/troubleshoot'}"7⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile8⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\System32\Wbem\WMIC.exewmic path SoftwareLicensingProduct where (LicenseStatus='1' and GracePeriodRemaining='0' and PartialProductKey is not NULL AND LicenseDependsOn is NULL) get Name /value7⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "Windows"7⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v PROCESSOR_ARCHITECTURE7⤵
-
C:\Windows\System32\reg.exereg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v PROCESSOR_ARCHITECTURE8⤵
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c ver7⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c ping -n 1 l.root-servers.net7⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\System32\PING.EXEping -n 1 l.root-servers.net8⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\taskcache\tasks" /f Path /s7⤵
-
-
C:\Windows\System32\find.exefind /i "AutoPico"7⤵
-
-
C:\Windows\System32\find.exefind /i "avira.com" C:\Windows\System32\drivers\etc\hosts7⤵
-
-
C:\Windows\System32\find.exefind /i "kaspersky.com" C:\Windows\System32\drivers\etc\hosts7⤵
-
-
C:\Windows\System32\find.exefind /i "virustotal.com" C:\Windows\System32\drivers\etc\hosts7⤵
-
-
C:\Windows\System32\find.exefind /i "mcafee.com" C:\Windows\System32\drivers\etc\hosts7⤵
-
-
C:\Windows\System32\sc.exesc start sppsvc7⤵
- Launches sc.exe
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "1056" "7⤵
-
-
C:\Windows\System32\findstr.exefindstr "577 225"7⤵
-
-
C:\Windows\System32\sc.exesc query Null7⤵
- Launches sc.exe
-
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinPE" /v InstRoot7⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\State" /v ImageState7⤵
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\State" /v ImageState8⤵
-
-
-
C:\Windows\System32\sc.exesc start ClipSVC7⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc query ClipSVC7⤵
- Launches sc.exe
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v DependOnService7⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v Description7⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v DisplayName7⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v ErrorControl7⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v ImagePath7⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v ObjectName7⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v Start7⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v Type7⤵
- Modifies registry key
-
-
C:\Windows\System32\sc.exesc start wlidsvc7⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc query wlidsvc7⤵
- Launches sc.exe
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v DependOnService7⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v Description7⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v DisplayName7⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v ErrorControl7⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v ImagePath7⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v ObjectName7⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v Start7⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v Type7⤵
- Modifies registry key
-
-
C:\Windows\System32\sc.exesc start sppsvc7⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc query sppsvc7⤵
- Launches sc.exe
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v DependOnService7⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v Description7⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v DisplayName7⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v ErrorControl7⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v ImagePath7⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v ObjectName7⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v Start7⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v Type7⤵
- Modifies registry key
-
-
C:\Windows\System32\sc.exesc start KeyIso7⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc query KeyIso7⤵
- Launches sc.exe
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v DependOnService7⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v Description7⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v DisplayName7⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v ErrorControl7⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v ImagePath7⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v ObjectName7⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v Start7⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v Type7⤵
- Modifies registry key
-
-
C:\Windows\System32\sc.exesc start LicenseManager7⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc query LicenseManager7⤵
- Launches sc.exe
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v DependOnService7⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v Description7⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v DisplayName7⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v ErrorControl7⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v ImagePath7⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v ObjectName7⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v Start7⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v Type7⤵
- Modifies registry key
-
-
C:\Windows\System32\sc.exesc start Winmgmt7⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc query Winmgmt7⤵
- Launches sc.exe
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v DependOnService7⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v Description7⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v DisplayName7⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v ErrorControl7⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v ImagePath7⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v ObjectName7⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v Start7⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v Type7⤵
- Modifies registry key
-
-
C:\Windows\System32\sc.exesc start ClipSVC7⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc start wlidsvc7⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc start sppsvc7⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc start KeyIso7⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc start LicenseManager7⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc start Winmgmt7⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc query ClipSVC7⤵
- Launches sc.exe
-
-
C:\Windows\System32\find.exefind /i "RUNNING"7⤵
-
-
C:\Windows\System32\sc.exesc start ClipSVC7⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc query wlidsvc7⤵
- Launches sc.exe
-
-
C:\Windows\System32\find.exefind /i "RUNNING"7⤵
-
-
C:\Windows\System32\sc.exesc start wlidsvc7⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc query sppsvc7⤵
- Launches sc.exe
-
-
C:\Windows\System32\find.exefind /i "RUNNING"7⤵
-
-
C:\Windows\System32\sc.exesc start sppsvc7⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc query KeyIso7⤵
- Launches sc.exe
-
-
C:\Windows\System32\find.exefind /i "RUNNING"7⤵
-
-
C:\Windows\System32\sc.exesc start KeyIso7⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc query LicenseManager7⤵
- Launches sc.exe
-
-
C:\Windows\System32\find.exefind /i "RUNNING"7⤵
-
-
C:\Windows\System32\sc.exesc start LicenseManager7⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc query Winmgmt7⤵
- Launches sc.exe
-
-
C:\Windows\System32\find.exefind /i "RUNNING"7⤵
-
-
C:\Windows\System32\sc.exesc start Winmgmt7⤵
- Launches sc.exe
-
-
C:\Windows\System32\Wbem\WMIC.exewmic path Win32_ComputerSystem get CreationClassName /value7⤵
-
-
C:\Windows\System32\find.exefind /i "computersystem"7⤵
-
-
C:\Windows\System32\Wbem\WMIC.exewmic path SoftwareLicensingService get Version7⤵
-
-
C:\Windows\System32\cmd.execmd /c exit /b 07⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "0" "7⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "0x800410 0x800440 0x80131501"7⤵
-
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\Plugins\Objects\msft:rm/algorithm/hwid/4.0" /f ba02fed39662 /d7⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /v TokenStore 2>nul7⤵
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /v TokenStore8⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$acl = (Get-Acl 'C:\Windows\System32\spp\store\2.0' | fl | Out-String); if (-not ($acl -match 'NT SERVICE\\sppsvc Allow FullControl') -or ($acl -match 'NT SERVICE\\sppsvc Deny')) {Exit 2}"7⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$acl = (Get-Acl 'HKLM:\SYSTEM\WPA' | fl | Out-String); if (-not ($acl -match 'NT SERVICE\\sppsvc Allow QueryValues, EnumerateSubKeys, WriteKey') -or ($acl -match 'NT SERVICE\\sppsvc Deny')) {Exit 2}"7⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$acl = (Get-Acl 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' | fl | Out-String); if (-not ($acl -match 'NT SERVICE\\sppsvc Allow SetValue') -or ($acl -match 'NT SERVICE\\sppsvc Deny')) {Exit 2}"7⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\reg.exereg query "HKU\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion"7⤵
-
-
C:\Windows\System32\reg.exereg query "HKU\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\Policies"7⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$netServ = (New-Object Security.Principal.SecurityIdentifier('S-1-5-20')).Translate([Security.Principal.NTAccount]).Value; $aclString = Get-Acl 'Registry::HKU\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\Policies' | Format-List | Out-String; if (-not ($aclString.Contains($netServ + ' Allow FullControl') -or $aclString.Contains('NT SERVICE\sppsvc Allow FullControl')) -or ($aclString.Contains('Deny'))) {Exit 3}"7⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$f=[System.IO.File]::ReadAllText('C:\Windows\Temp\MAS_f16faa9c-e4d3-479a-a87b-fc3c3c63bddb.cmd') -split ':wpatest\:.*';. ([scriptblock]::Create($f[1]))" 2>nul7⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$f=[System.IO.File]::ReadAllText('C:\Windows\Temp\MAS_f16faa9c-e4d3-479a-a87b-fc3c3c63bddb.cmd') -split ':wpatest\:.*';. ([scriptblock]::Create($f[1]))"8⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\System32\reg.exereg query "HKU\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\PersistedTSReArmed"7⤵
-
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ClipSVC\Volatile\PersistedSystemState"7⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c "wmic path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' and PartialProductKey is not null) get ID /VALUE" 2>nul7⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' and PartialProductKey is not null) get ID /VALUE8⤵
-
-
-
C:\Windows\System32\reg.exereg query "HKU\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion"7⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c "wmic path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' AND LicenseDependsOn is NULL AND PartialProductKey IS NOT NULL) get LicenseFamily /VALUE" 2>nul7⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' AND LicenseDependsOn is NULL AND PartialProductKey IS NOT NULL) get LicenseFamily /VALUE8⤵
-
-
-
C:\Windows\System32\sc.exesc query wlms7⤵
- Launches sc.exe
-
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.exe"7⤵
-
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SLsvc.exe"7⤵
-
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sppsvc.exe"7⤵
-
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sppsvc.exe\PerfOptions"7⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /v "SkipRearm" 2>nul7⤵
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /v "SkipRearm"8⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "Get-WmiObject -Query 'SELECT Description FROM SoftwareLicensingProduct WHERE PartialProductKey IS NOT NULL AND LicenseDependsOn IS NULL' | Select-Object -Property Description"7⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\findstr.exefindstr /i "KMS_"7⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$s=New-Object -ComObject 'Schedule.Service'; $s.Connect(); $state=$s.GetFolder('\Microsoft\Windows\SoftwareProtectionPlatform').GetTask('SvcRestartTask').State; @{0='Unknown';1='Disabled';2='Queued';3='Ready';4='Running'}[$state]" 2>nul7⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$s=New-Object -ComObject 'Schedule.Service'; $s.Connect(); $state=$s.GetFolder('\Microsoft\Windows\SoftwareProtectionPlatform').GetTask('SvcRestartTask').State; @{0='Unknown';1='Disabled';2='Queued';3='Ready';4='Running'}[$state]"8⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "7⤵
-
-
C:\Windows\System32\find.exefind /i "Ready"7⤵
-
-
C:\Windows\System32\reg.exereg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /v "actionlist" /f7⤵
-
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask"7⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "Removed" "7⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "Removed Not Found"7⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c "wmic path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f') get ID /VALUE" 2>nul7⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f') get ID /VALUE8⤵
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "040fa323-92b1-4baf-97a2-5b67feaefddb 0724cb7d-3437-4cb7-93cb-830375d0079d 0ad2ac98-7bb9-4201-8d92-312299201369 1a9a717a-cf13-4ba5-83c3-0fe25fa868d5 221a02da-e2a1-4b75-864c-0a4410a33fdf 291ece0e-9c38-40ca-a9e1-32cc7ec19507 2936d1d2-913a-4542-b54e-ce5a602a2a38 2c293c26-a45a-4a2a-a350-c69a67097529 2de67392-b7a7-462a-b1ca-108dd189f588 2ffd8952-423e-4903-b993-72a1aa44cf82 30a42c86-b7a0-4a34-8c90-ff177cb2acb7 345a5db0-d94f-4e3b-a0c0-7c42f7bc3ebf 3502365a-f88a-4ba4-822a-5769d3073b65 377333b1-8b5d-48d6-9679-1225c872d37c 3df374ef-d444-4494-a5a1-4b0d9fd0e203 3f1afc82-f8ac-4f6c-8005-1d233e606eee 49cd895b-53b2-4dc4-a5f7-b18aa019ad37 4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c 4f3da0d2-271d-4508-ae81-626b60809a38 5d78c4e9-aeb3-4b40-8ac2-6a6005e0ad6d 60b3ec1b-9545-4921-821f-311b129dd6f6 613d217f-7f13-4268-9907-1662339531cd 62f0c100-9c53-4e02-b886-a3528ddfe7f6 6365275e-368d-46ca-a0ef-fc0404119333 721f9237-9341-4453-a661-09e8baa6cca5 73111121-5638-40f6-bc11-f1d7b0d64300 7a802526-4c94-4bd1-ba14-835a1aca2120 7cb546c0-c7d5-44d8-9a5c-69ecdd782b69 82bbc092-bc50-4e16-8e18-b74fc486aec3 8ab9bdd1-1f67-4997-82d9-8878520837d9 8b351c9c-f398-4515-9900-09df49427262 90da7373-1c51-430b-bf26-c97e9c5cdc31 92fb8726-92a8-4ffc-94ce-f82e07444653 95dca82f-385d-4d39-b85b-5c73fa285d6f a48938aa-62fa-4966-9d44-9f04da3f72f2 b0773a15-df3a-4312-9ad2-83d69648e356 b4bfe195-541e-4e64-ad23-6177f19e395e b68e61d2-68ca-4757-be45-0cc2f3e68eee bd3762d7-270d-4760-8fb3-d829ca45278a c86d5194-4840-4dae-9c1c-0301003a5ab0 ca7df2e3-5ea0-47b8-9ac1-b1be4d8edd69 d552befb-48cc-4327-8f39-47d2d94f987c d6eadb3b-5ca8-4a6b-986e-35b550756111 df96023b-dcd9-4be2-afa0-c6c871159ebe e0c42288-980c-4788-a014-c080d2e1926e e4db50ea-bda1-4566-b047-0ca50abc6f07 e558417a-5123-4f6f-91e7-385c1c7ca9d4 e7a950a2-e548-4f10-bf16-02ec848e0643 eb6d346f-1c60-4643-b960-40ec31596c45 ec868e65-fadf-4759-b23e-93fe37f2cc29 ef51e000-2659-4f25-8345-3de70a9cf4c4 f7af7d09-40e4-419c-a49b-eae366689ebd fa755fe6-6739-40b9-8d84-6d0ea3b6d1ab fe74f55b-0338-41d6-b267-4a201abe7285 " "7⤵
-
-
C:\Windows\System32\find.exefind /i "4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c"7⤵
-
-
C:\Windows\System32\Wbem\WMIC.exewmic path SoftwareLicensingService where __CLASS='SoftwareLicensingService' call InstallProductKey ProductKey="VK7JG-NPHTM-C97JM-9MPGT-3V66T"7⤵
-
-
C:\Windows\System32\cmd.execmd /c exit /b 07⤵
-
-
C:\Windows\System32\Wbem\WMIC.exewmic path SoftwareLicensingService where __CLASS='SoftwareLicensingService' call RefreshLicenseStatus7⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c reg query "HKCU\Control Panel\International\Geo" /v Name 2>nul7⤵
-
C:\Windows\System32\reg.exereg query "HKCU\Control Panel\International\Geo" /v Name8⤵
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c reg query "HKCU\Control Panel\International\Geo" /v Nation 2>nul7⤵
-
C:\Windows\System32\reg.exereg query "HKCU\Control Panel\International\Geo" /v Nation8⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$f=[System.IO.File]::ReadAllText('C:\Windows\Temp\MAS_f16faa9c-e4d3-479a-a87b-fc3c3c63bddb.cmd') -split ':sign\:.*';. ([scriptblock]::Create($f[1]))"7⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "Start-Job { Restart-Service ClipSVC } | Wait-Job -Timeout 20 | Out-Null"7⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile8⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\System32\ClipUp.execlipup -v -o7⤵
-
C:\Windows\System32\clipup.execlipup -v -o -ppl C:\Users\Admin\AppData\Local\Temp\tem4D90.tmp8⤵
- Checks SCSI registry key(s)
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); $meth = $TypeBuilder.DefinePInvokeMethod('BrandingFormatString', 'winbrand.dll', 'Public, Static', 1, [String], @([String]), 1, 3); $meth.SetImplementationFlags(128); $TypeBuilder.CreateType()::BrandingFormatString('%WINDOWS_LONG%') -replace [string][char]0xa9, '' -replace [string][char]0xae, '' -replace [string][char]0x2122, ''"7⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); $meth = $TypeBuilder.DefinePInvokeMethod('BrandingFormatString', 'winbrand.dll', 'Public, Static', 1, [String], @([String]), 1, 3); $meth.SetImplementationFlags(128); $TypeBuilder.CreateType()::BrandingFormatString('%WINDOWS_LONG%') -replace [string][char]0xa9, '' -replace [string][char]0xae, '' -replace [string][char]0x2122, ''8⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "Windows 11 Pro" "7⤵
-
-
C:\Windows\System32\find.exefind /i "Windows"7⤵
-
-
C:\Windows\System32\Wbem\WMIC.exewmic path SoftwareLicensingProduct where "ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' AND PartialProductKey IS NOT NULL AND LicenseDependsOn is NULL" call Activate7⤵
-
-
C:\Windows\System32\cmd.execmd /c exit /b 07⤵
-
-
C:\Windows\System32\Wbem\WMIC.exewmic path SoftwareLicensingProduct where (LicenseStatus='1' and GracePeriodRemaining='0' and PartialProductKey is not NULL AND LicenseDependsOn is NULL) get Name /value7⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "Windows"7⤵
-
-
C:\Windows\System32\reg.exereg delete "HKU\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\PersistedSystemState" /v "State" /f7⤵
-
-
C:\Windows\System32\reg.exereg delete "HKU\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\PersistedSystemState" /v "SuppressRulesEngine" /f7⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "Start-Job { Stop-Service sppsvc -force } | Wait-Job -Timeout 20 | Out-Null; $TB = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1).DefineDynamicModule(2, $False).DefineType(0); [void]$TB.DefinePInvokeMethod('SLpTriggerServiceWorker', 'sppc.dll', 22, 1, [Int32], @([UInt32], [IntPtr], [String], [UInt32]), 1, 3); [void]$TB.CreateType()::SLpTriggerServiceWorker(0, 0, 'reeval', 0)"7⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile8⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV19⤵
-
-
-
-
C:\Windows\System32\choice.exechoice /C:10 /N7⤵
-
-
-
C:\Windows\System32\reg.exereg add HKCU\Console /v QuickEdit /t REG_DWORD /d 1 /f6⤵
- Modifies registry key
-
-
-
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"2⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffa18e0c728,0x7ffa18e0c734,0x7ffa18e0c7403⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1828,i,579890073823839747,651194808571908977,524288 --field-trial-handle=2120,i,12966024732243286206,7774543678169167810,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2152 /prefetch:113⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1596,i,8759976877166388843,13992484013255486908,262144 --field-trial-handle=2120,i,12966024732243286206,7774543678169167810,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2104 /prefetch:23⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=1808,i,1328558423870146015,239957133559658931,524288 --field-trial-handle=2120,i,12966024732243286206,7774543678169167810,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2412 /prefetch:133⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3236,i,3656795876040013958,3137506552894508129,2097152 --field-trial-handle=2120,i,12966024732243286206,7774543678169167810,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3296 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3240,i,2212732305546670,14988329188610393104,2097152 --field-trial-handle=2120,i,12966024732243286206,7774543678169167810,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3332 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4240,i,15666838159491963142,11854276142008487074,2097152 --field-trial-handle=2120,i,12966024732243286206,7774543678169167810,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4248 /prefetch:93⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4512,i,2537288591895814497,1576857005503645548,2097152 --field-trial-handle=2120,i,12966024732243286206,7774543678169167810,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4544 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4804,i,5810587611899675513,8266197395296852814,2097152 --field-trial-handle=2120,i,12966024732243286206,7774543678169167810,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4676 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5044,i,16712523719149790902,15237820418841863433,2097152 --field-trial-handle=2120,i,12966024732243286206,7774543678169167810,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5048 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5236,i,16559109103821368844,11748466282511002970,2097152 --field-trial-handle=2120,i,12966024732243286206,7774543678169167810,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5220 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5976,i,6828965816206721166,16803147069455953860,524288 --field-trial-handle=2120,i,12966024732243286206,7774543678169167810,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5980 /prefetch:143⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6196,i,18114843223305230272,10725581073397605450,524288 --field-trial-handle=2120,i,12966024732243286206,7774543678169167810,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6404 /prefetch:143⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6460,i,596172790678130933,12302789066933848048,524288 --field-trial-handle=2120,i,12966024732243286206,7774543678169167810,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6444 /prefetch:143⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6496,i,10207530886907306611,10599271520514467350,524288 --field-trial-handle=2120,i,12966024732243286206,7774543678169167810,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6308 /prefetch:143⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6612,i,8105131242546212857,2737360344646844242,524288 --field-trial-handle=2120,i,12966024732243286206,7774543678169167810,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6628 /prefetch:143⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6628,i,15559809440270852526,5794638456457376700,524288 --field-trial-handle=2120,i,12966024732243286206,7774543678169167810,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6624 /prefetch:143⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6732,i,1581545401479100363,5411148879903710185,524288 --field-trial-handle=2120,i,12966024732243286206,7774543678169167810,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6716 /prefetch:143⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6760,i,12534106621960779586,8218382584710111901,524288 --field-trial-handle=2120,i,12966024732243286206,7774543678169167810,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6728 /prefetch:143⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6572,i,13564417400636839320,16223956158892503676,524288 --field-trial-handle=2120,i,12966024732243286206,7774543678169167810,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6480 /prefetch:143⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6728,i,18371716701512841761,7165324051546735070,524288 --field-trial-handle=2120,i,12966024732243286206,7774543678169167810,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6760 /prefetch:143⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6672,i,5187780525033607339,1011106156881100939,524288 --field-trial-handle=2120,i,12966024732243286206,7774543678169167810,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6668 /prefetch:143⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6440,i,2212535899550271697,8240243600422623062,524288 --field-trial-handle=2120,i,12966024732243286206,7774543678169167810,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6408 /prefetch:143⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6780,i,13008816025253681504,10243408972735216200,524288 --field-trial-handle=2120,i,12966024732243286206,7774543678169167810,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6792 /prefetch:143⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6732,i,13645529390703278352,11950594072295130928,524288 --field-trial-handle=2120,i,12966024732243286206,7774543678169167810,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6852 /prefetch:143⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6996,i,4480800601120180923,8892997283504587280,524288 --field-trial-handle=2120,i,12966024732243286206,7774543678169167810,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=7012 /prefetch:143⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6784,i,15070163077698987017,11849119269864687985,524288 --field-trial-handle=2120,i,12966024732243286206,7774543678169167810,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=7164 /prefetch:143⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6428,i,12230438742176815772,646041238855030483,524288 --field-trial-handle=2120,i,12966024732243286206,7774543678169167810,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6788 /prefetch:143⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6772,i,11241882655179911542,1637497185934545792,524288 --field-trial-handle=2120,i,12966024732243286206,7774543678169167810,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6632 /prefetch:143⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6576,i,7218330099743414722,17086377092880751346,524288 --field-trial-handle=2120,i,12966024732243286206,7774543678169167810,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6708 /prefetch:143⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6468,i,3178466129998565993,2364370525922554411,524288 --field-trial-handle=2120,i,12966024732243286206,7774543678169167810,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6596 /prefetch:143⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6616,i,2996812498171934515,17591488091329941682,524288 --field-trial-handle=2120,i,12966024732243286206,7774543678169167810,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6476 /prefetch:143⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6560,i,3814082386612719308,5926105181297770049,524288 --field-trial-handle=2120,i,12966024732243286206,7774543678169167810,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6340 /prefetch:143⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6260,i,5214413636260262881,12010291862030617858,524288 --field-trial-handle=2120,i,12966024732243286206,7774543678169167810,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6312 /prefetch:143⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --metrics-shmem-handle=4704,i,4276416362307784618,4292572496486076001,2097152 --field-trial-handle=2120,i,12966024732243286206,7774543678169167810,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4700 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --metrics-shmem-handle=7028,i,13920535700258892695,9778967189324983770,2097152 --field-trial-handle=2120,i,12966024732243286206,7774543678169167810,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4240 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6252,i,15814477178051740269,11854512629471404226,524288 --field-trial-handle=2120,i,12966024732243286206,7774543678169167810,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5020 /prefetch:143⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --metrics-shmem-handle=6524,i,14960492422005356818,12842157458448839206,524288 --field-trial-handle=2120,i,12966024732243286206,7774543678169167810,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6548 /prefetch:143⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --metrics-shmem-handle=5108,i,11091711684529423052,8060639554106782708,524288 --field-trial-handle=2120,i,12966024732243286206,7774543678169167810,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5040 /prefetch:143⤵
-
-
C:\Users\Admin\Downloads\ChromeSetup.exe"C:\Users\Admin\Downloads\ChromeSetup.exe"3⤵
- Drops file in Windows directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SystemTemp\Google3932_894316119\bin\updater.exe"C:\Windows\SystemTemp\Google3932_894316119\bin\updater.exe" --install=appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={1076DA50-13DD-17A8-3E1E-4C8E890B14CD}&lang=en&browser=4&usagestats=1&appname=Google%20Chrome&needsadmin=prefers&ap=-arch_x64-statsdef_1&installdataindex=empty --enable-logging --vmodule=*/components/winhttp/*=1,*/components/update_client/*=2,*/chrome/enterprise_companion/*=2,*/chrome/updater/*=24⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Windows\SystemTemp\Google3932_894316119\bin\updater.exeC:\Windows\SystemTemp\Google3932_894316119\bin\updater.exe --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=148.0.7730.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl" --initial-client-data=0x2a0,0x2a4,0x2a8,0x29c,0x2ac,0x128c4ac,0x128c4b8,0x128c4c45⤵
- Drops file in Program Files directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --metrics-shmem-handle=6728,i,8400164980382447734,15717622270517825564,2097152 --field-trial-handle=2120,i,12966024732243286206,7774543678169167810,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6408 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=7156,i,14073858085886417847,11363473577266868007,524288 --field-trial-handle=2120,i,12966024732243286206,7774543678169167810,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5292 /prefetch:143⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5260,i,14275449746053010430,6249980099132572003,524288 --field-trial-handle=2120,i,12966024732243286206,7774543678169167810,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6252 /prefetch:143⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5092,i,14775986619493865056,8224799167883009389,262144 --field-trial-handle=2120,i,12966024732243286206,7774543678169167810,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=7192 /prefetch:103⤵
-
-
-
C:\Users\Admin\Downloads\Lithium-Nuker-v2-main\Lithium-Nuker-v2-main\LithiumNukerV2\LithiumNukerV2.exe"C:\Users\Admin\Downloads\Lithium-Nuker-v2-main\Lithium-Nuker-v2-main\LithiumNukerV2\LithiumNukerV2.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"2⤵
- Drops Chrome extension
- Drops file in Windows directory
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=147.0.7727.102 --initial-client-data=0xfc,0x100,0x104,0x94,0x108,0x7ffa171367e8,0x7ffa171367f4,0x7ffa171368003⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1708,i,2453422154337654425,254255264632156949,262144 --field-trial-handle=1888,i,4539948997206449441,6488674296570019999,262144 --variations-seed-version=20260421-010045.266000-production --pseudonymization-salt-handle=1896,i,3513562377202145198,6181459751785414915,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1880 /prefetch:23⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2180,i,1360252033715005095,3749472892718681845,524288 --field-trial-handle=1888,i,4539948997206449441,6488674296570019999,262144 --variations-seed-version=20260421-010045.266000-production --pseudonymization-salt-handle=1896,i,3513562377202145198,6181459751785414915,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2176 /prefetch:113⤵
- Executes dropped EXE
- Loads dropped DLL
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2344,i,896659099921419162,16021707245133267283,524288 --field-trial-handle=1888,i,4539948997206449441,6488674296570019999,262144 --variations-seed-version=20260421-010045.266000-production --pseudonymization-salt-handle=1896,i,3513562377202145198,6181459751785414915,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2364 /prefetch:133⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3256,i,4332027166254203574,2053721267508982213,2097152 --field-trial-handle=1888,i,4539948997206449441,6488674296570019999,262144 --variations-seed-version=20260421-010045.266000-production --pseudonymization-salt-handle=1896,i,3513562377202145198,6181459751785414915,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3328 /prefetch:13⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3460,i,6005458029256417887,11430439004712158032,2097152 --field-trial-handle=1888,i,4539948997206449441,6488674296570019999,262144 --variations-seed-version=20260421-010045.266000-production --pseudonymization-salt-handle=1896,i,3513562377202145198,6181459751785414915,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3468 /prefetch:13⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3756,i,6473937127774944013,18265992232618897418,2097152 --field-trial-handle=1888,i,4539948997206449441,6488674296570019999,262144 --variations-seed-version=20260421-010045.266000-production --pseudonymization-salt-handle=1896,i,3513562377202145198,6181459751785414915,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=3776 /prefetch:93⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3792,i,9439878053255963572,7229350818392175943,2097152 --field-trial-handle=1888,i,4539948997206449441,6488674296570019999,262144 --variations-seed-version=20260421-010045.266000-production --pseudonymization-salt-handle=1896,i,3513562377202145198,6181459751785414915,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=3816 /prefetch:93⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3920,i,9163589871571841848,2745596434878779714,2097152 --field-trial-handle=1888,i,4539948997206449441,6488674296570019999,262144 --variations-seed-version=20260421-010045.266000-production --pseudonymization-salt-handle=1896,i,3513562377202145198,6181459751785414915,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=4044 /prefetch:13⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=3952,i,10682750471224238413,9690105265178067935,2097152 --field-trial-handle=1888,i,4539948997206449441,6488674296570019999,262144 --variations-seed-version=20260421-010045.266000-production --pseudonymization-salt-handle=1896,i,3513562377202145198,6181459751785414915,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=4280 /prefetch:93⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5104,i,17301863701624802118,6306828505220592334,2097152 --field-trial-handle=1888,i,4539948997206449441,6488674296570019999,262144 --variations-seed-version=20260421-010045.266000-production --pseudonymization-salt-handle=1896,i,3513562377202145198,6181459751785414915,4 --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=5080 /prefetch:13⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5936,i,17672496769968667097,12740630182681837669,524288 --field-trial-handle=1888,i,4539948997206449441,6488674296570019999,262144 --variations-seed-version=20260421-010045.266000-production --pseudonymization-salt-handle=1896,i,3513562377202145198,6181459751785414915,4 --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=5888 /prefetch:143⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6160,i,1914091775779654044,11406133143434691825,524288 --field-trial-handle=1888,i,4539948997206449441,6488674296570019999,262144 --variations-seed-version=20260421-010045.266000-production --pseudonymization-salt-handle=1896,i,3513562377202145198,6181459751785414915,4 --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=6176 /prefetch:143⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5964,i,1715988725092531249,13237396811425851953,524288 --field-trial-handle=1888,i,4539948997206449441,6488674296570019999,262144 --variations-seed-version=20260421-010045.266000-production --pseudonymization-salt-handle=1896,i,3513562377202145198,6181459751785414915,4 --trace-process-track-uuid=3190708999430457380 --mojo-platform-channel-handle=6176 /prefetch:143⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5964,i,3328963697474732294,8978261776424121093,2097152 --field-trial-handle=1888,i,4539948997206449441,6488674296570019999,262144 --variations-seed-version=20260421-010045.266000-production --pseudonymization-salt-handle=1896,i,3513562377202145198,6181459751785414915,4 --trace-process-track-uuid=3190709000367499229 --mojo-platform-channel-handle=6332 /prefetch:13⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=4276,i,17863055803426304912,12896339189111723506,2097152 --field-trial-handle=1888,i,4539948997206449441,6488674296570019999,262144 --variations-seed-version=20260421-010045.266000-production --pseudonymization-salt-handle=1896,i,3513562377202145198,6181459751785414915,4 --trace-process-track-uuid=3190709001304541078 --mojo-platform-channel-handle=3536 /prefetch:13⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=4360,i,11476974139029868822,7999393114778244573,524288 --field-trial-handle=1888,i,4539948997206449441,6488674296570019999,262144 --variations-seed-version=20260421-010045.266000-production --pseudonymization-salt-handle=1896,i,3513562377202145198,6181459751785414915,4 --trace-process-track-uuid=3190709002241582927 --mojo-platform-channel-handle=4324 /prefetch:123⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4328,i,13649823177799692492,1117446082224330451,524288 --field-trial-handle=1888,i,4539948997206449441,6488674296570019999,262144 --variations-seed-version=20260421-010045.266000-production --pseudonymization-salt-handle=1896,i,3513562377202145198,6181459751785414915,4 --trace-process-track-uuid=3190709003178624776 --mojo-platform-channel-handle=5944 /prefetch:143⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4284,i,15591952971194671179,2441764077901703165,524288 --field-trial-handle=1888,i,4539948997206449441,6488674296570019999,262144 --variations-seed-version=20260421-010045.266000-production --pseudonymization-salt-handle=1896,i,3513562377202145198,6181459751785414915,4 --trace-process-track-uuid=3190709005052708474 --mojo-platform-channel-handle=4300 /prefetch:143⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6520,i,2622202842040701708,13808770313559079119,524288 --field-trial-handle=1888,i,4539948997206449441,6488674296570019999,262144 --variations-seed-version=20260421-010045.266000-production --pseudonymization-salt-handle=1896,i,3513562377202145198,6181459751785414915,4 --trace-process-track-uuid=3190709005989750323 --mojo-platform-channel-handle=5892 /prefetch:143⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4484,i,14044328398463944709,12572354377734105908,524288 --field-trial-handle=1888,i,4539948997206449441,6488674296570019999,262144 --variations-seed-version=20260421-010045.266000-production --pseudonymization-salt-handle=1896,i,3513562377202145198,6181459751785414915,4 --trace-process-track-uuid=3190709006926792172 --mojo-platform-channel-handle=4416 /prefetch:143⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6580,i,13451207346316857474,8399150389398590493,2097152 --field-trial-handle=1888,i,4539948997206449441,6488674296570019999,262144 --variations-seed-version=20260421-010045.266000-production --pseudonymization-salt-handle=1896,i,3513562377202145198,6181459751785414915,4 --trace-process-track-uuid=3190709007863834021 --mojo-platform-channel-handle=4436 /prefetch:13⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6520,i,620496564860715956,9975690608856921505,2097152 --field-trial-handle=1888,i,4539948997206449441,6488674296570019999,262144 --variations-seed-version=20260421-010045.266000-production --pseudonymization-salt-handle=1896,i,3513562377202145198,6181459751785414915,4 --trace-process-track-uuid=3190709008800875870 --mojo-platform-channel-handle=6596 /prefetch:13⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=3256,i,1450715779718950688,4967442325264613232,2097152 --field-trial-handle=1888,i,4539948997206449441,6488674296570019999,262144 --variations-seed-version=20260421-010045.266000-production --pseudonymization-salt-handle=1896,i,3513562377202145198,6181459751785414915,4 --trace-process-track-uuid=3190709009737917719 --mojo-platform-channel-handle=4408 /prefetch:13⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=5128,i,18010276680486531289,2886760022896172384,2097152 --field-trial-handle=1888,i,4539948997206449441,6488674296570019999,262144 --variations-seed-version=20260421-010045.266000-production --pseudonymization-salt-handle=1896,i,3513562377202145198,6181459751785414915,4 --trace-process-track-uuid=3190709010674959568 --mojo-platform-channel-handle=6160 /prefetch:13⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6304,i,6559441009983517361,5275767839559516546,524288 --field-trial-handle=1888,i,4539948997206449441,6488674296570019999,262144 --variations-seed-version=20260421-010045.266000-production --pseudonymization-salt-handle=1896,i,3513562377202145198,6181459751785414915,4 --trace-process-track-uuid=3190709011612001417 --mojo-platform-channel-handle=5088 /prefetch:143⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5108,i,15685186103026645947,14033777137792755603,524288 --field-trial-handle=1888,i,4539948997206449441,6488674296570019999,262144 --variations-seed-version=20260421-010045.266000-production --pseudonymization-salt-handle=1896,i,3513562377202145198,6181459751785414915,4 --trace-process-track-uuid=3190709012549043266 --mojo-platform-channel-handle=3336 /prefetch:143⤵
- Executes dropped EXE
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5080,i,8599231263578154678,5650757333326073910,524288 --field-trial-handle=1888,i,4539948997206449441,6488674296570019999,262144 --variations-seed-version=20260421-010045.266000-production --pseudonymization-salt-handle=1896,i,3513562377202145198,6181459751785414915,4 --trace-process-track-uuid=3190709013486085115 --mojo-platform-channel-handle=6860 /prefetch:143⤵
- Executes dropped EXE
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5000,i,2599753415657883912,3663080252094149705,524288 --field-trial-handle=1888,i,4539948997206449441,6488674296570019999,262144 --variations-seed-version=20260421-010045.266000-production --pseudonymization-salt-handle=1896,i,3513562377202145198,6181459751785414915,4 --trace-process-track-uuid=3190709014423126964 --mojo-platform-channel-handle=4416 /prefetch:143⤵
- Executes dropped EXE
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=6636,i,1210172862974041394,15217747544445476242,2097152 --field-trial-handle=1888,i,4539948997206449441,6488674296570019999,262144 --variations-seed-version=20260421-010045.266000-production --pseudonymization-salt-handle=1896,i,3513562377202145198,6181459751785414915,4 --trace-process-track-uuid=3190709015360168813 --mojo-platform-channel-handle=4444 /prefetch:13⤵
- Executes dropped EXE
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4556,i,4185067882787095502,10530305180012013753,524288 --field-trial-handle=1888,i,4539948997206449441,6488674296570019999,262144 --variations-seed-version=20260421-010045.266000-production --pseudonymization-salt-handle=1896,i,3513562377202145198,6181459751785414915,4 --trace-process-track-uuid=3190709016297210662 --mojo-platform-channel-handle=4140 /prefetch:143⤵
- Executes dropped EXE
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3948,i,1866338274249883669,5985974136989079389,524288 --field-trial-handle=1888,i,4539948997206449441,6488674296570019999,262144 --variations-seed-version=20260421-010045.266000-production --pseudonymization-salt-handle=1896,i,3513562377202145198,6181459751785414915,4 --trace-process-track-uuid=3190709017234252511 --mojo-platform-channel-handle=3812 /prefetch:143⤵
- Executes dropped EXE
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --metrics-shmem-handle=6228,i,4820277594824007511,5151997476660609931,2097152 --field-trial-handle=1888,i,4539948997206449441,6488674296570019999,262144 --variations-seed-version=20260421-010045.266000-production --pseudonymization-salt-handle=1896,i,3513562377202145198,6181459751785414915,4 --trace-process-track-uuid=3190709018171294360 --mojo-platform-channel-handle=6420 /prefetch:93⤵
- Executes dropped EXE
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4200,i,13275780229440041567,18274216500740659099,524288 --field-trial-handle=1888,i,4539948997206449441,6488674296570019999,262144 --variations-seed-version=20260421-010045.266000-production --pseudonymization-salt-handle=1896,i,3513562377202145198,6181459751785414915,4 --trace-process-track-uuid=3190709019108336209 --mojo-platform-channel-handle=6976 /prefetch:143⤵
- Executes dropped EXE
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4104,i,9986049929884540526,1985147042735005948,524288 --field-trial-handle=1888,i,4539948997206449441,6488674296570019999,262144 --variations-seed-version=20260421-010045.266000-production --pseudonymization-salt-handle=1896,i,3513562377202145198,6181459751785414915,4 --trace-process-track-uuid=3190709020045378058 --mojo-platform-channel-handle=7132 /prefetch:143⤵
- Executes dropped EXE
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=7284,i,1214662908762563206,9991225206620877352,524288 --field-trial-handle=1888,i,4539948997206449441,6488674296570019999,262144 --variations-seed-version=20260421-010045.266000-production --pseudonymization-salt-handle=1896,i,3513562377202145198,6181459751785414915,4 --trace-process-track-uuid=3190709020982419907 --mojo-platform-channel-handle=5240 /prefetch:143⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=7276,i,16015493031783932687,5442048701467672399,524288 --field-trial-handle=1888,i,4539948997206449441,6488674296570019999,262144 --variations-seed-version=20260421-010045.266000-production --pseudonymization-salt-handle=1896,i,3513562377202145198,6181459751785414915,4 --trace-process-track-uuid=3190709021919461756 --mojo-platform-channel-handle=7316 /prefetch:143⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5260,i,2573952540057520348,15390084967483725685,524288 --field-trial-handle=1888,i,4539948997206449441,6488674296570019999,262144 --variations-seed-version=20260421-010045.266000-production --pseudonymization-salt-handle=1896,i,3513562377202145198,6181459751785414915,4 --trace-process-track-uuid=3190709022856503605 --mojo-platform-channel-handle=5088 /prefetch:143⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6372,i,4172646745155879281,10684022655574572634,524288 --field-trial-handle=1888,i,4539948997206449441,6488674296570019999,262144 --variations-seed-version=20260421-010045.266000-production --pseudonymization-salt-handle=1896,i,3513562377202145198,6181459751785414915,4 --trace-process-track-uuid=3190709023793545454 --mojo-platform-channel-handle=7740 /prefetch:143⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=7872,i,7967222672223396223,13337699803832738724,524288 --field-trial-handle=1888,i,4539948997206449441,6488674296570019999,262144 --variations-seed-version=20260421-010045.266000-production --pseudonymization-salt-handle=1896,i,3513562377202145198,6181459751785414915,4 --trace-process-track-uuid=3190709024730587303 --mojo-platform-channel-handle=7732 /prefetch:143⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=7324,i,5518125458900774506,12738808778519198411,524288 --field-trial-handle=1888,i,4539948997206449441,6488674296570019999,262144 --variations-seed-version=20260421-010045.266000-production --pseudonymization-salt-handle=1896,i,3513562377202145198,6181459751785414915,4 --trace-process-track-uuid=3190709025667629152 --mojo-platform-channel-handle=8028 /prefetch:143⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --metrics-shmem-handle=6224,i,13398040782930968660,16806028716135798411,2097152 --field-trial-handle=1888,i,4539948997206449441,6488674296570019999,262144 --variations-seed-version=20260421-010045.266000-production --pseudonymization-salt-handle=1896,i,3513562377202145198,6181459751785414915,4 --trace-process-track-uuid=3190709026604671001 --mojo-platform-channel-handle=8152 /prefetch:93⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --metrics-shmem-handle=8008,i,4437452851148157288,6306691138600866588,2097152 --field-trial-handle=1888,i,4539948997206449441,6488674296570019999,262144 --variations-seed-version=20260421-010045.266000-production --pseudonymization-salt-handle=1896,i,3513562377202145198,6181459751785414915,4 --trace-process-track-uuid=3190709028478754699 --mojo-platform-channel-handle=3576 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --metrics-shmem-handle=8112,i,10710796017728888935,6727085853061135453,2097152 --field-trial-handle=1888,i,4539948997206449441,6488674296570019999,262144 --variations-seed-version=20260421-010045.266000-production --pseudonymization-salt-handle=1896,i,3513562377202145198,6181459751785414915,4 --trace-process-track-uuid=3190709027541712850 --mojo-platform-channel-handle=8116 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5932,i,16951080507999098662,3889885200422441000,524288 --field-trial-handle=1888,i,4539948997206449441,6488674296570019999,262144 --variations-seed-version=20260421-010045.266000-production --pseudonymization-salt-handle=1896,i,3513562377202145198,6181459751785414915,4 --trace-process-track-uuid=3190709029415796548 --mojo-platform-channel-handle=8376 /prefetch:143⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --metrics-shmem-handle=8384,i,8916564863030744493,11722451821214765176,2097152 --field-trial-handle=1888,i,4539948997206449441,6488674296570019999,262144 --variations-seed-version=20260421-010045.266000-production --pseudonymization-salt-handle=1896,i,3513562377202145198,6181459751785414915,4 --trace-process-track-uuid=3190709030352838397 --mojo-platform-channel-handle=8472 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=8344,i,8996459914605978318,1539522929092790785,524288 --field-trial-handle=1888,i,4539948997206449441,6488674296570019999,262144 --variations-seed-version=20260421-010045.266000-production --pseudonymization-salt-handle=1896,i,3513562377202145198,6181459751785414915,4 --trace-process-track-uuid=3190709031289880246 --mojo-platform-channel-handle=8452 /prefetch:143⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=8124,i,1266532737357756211,2796813902521350835,524288 --field-trial-handle=1888,i,4539948997206449441,6488674296570019999,262144 --variations-seed-version=20260421-010045.266000-production --pseudonymization-salt-handle=1896,i,3513562377202145198,6181459751785414915,4 --trace-process-track-uuid=3190709032226922095 --mojo-platform-channel-handle=8684 /prefetch:143⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=8956,i,10836665199908674280,13193711006104023892,524288 --field-trial-handle=1888,i,4539948997206449441,6488674296570019999,262144 --variations-seed-version=20260421-010045.266000-production --pseudonymization-salt-handle=1896,i,3513562377202145198,6181459751785414915,4 --trace-process-track-uuid=3190709033163963944 --mojo-platform-channel-handle=8684 /prefetch:143⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAEIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=8964,i,7610535154018428426,2413725303097718508,262144 --field-trial-handle=1888,i,4539948997206449441,6488674296570019999,262144 --variations-seed-version=20260421-010045.266000-production --pseudonymization-salt-handle=1896,i,3513562377202145198,6181459751785414915,4 --trace-process-track-uuid=3190709034101005793 --mojo-platform-channel-handle=4148 /prefetch:103⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6088,i,7474773722863767755,1210731017311940175,524288 --field-trial-handle=1888,i,4539948997206449441,6488674296570019999,262144 --variations-seed-version=20260421-010045.266000-production --pseudonymization-salt-handle=1896,i,3513562377202145198,6181459751785414915,4 --trace-process-track-uuid=3190709035038047642 --mojo-platform-channel-handle=8888 /prefetch:143⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=1496,i,9095338307505497551,6867711736884354526,524288 --field-trial-handle=1888,i,4539948997206449441,6488674296570019999,262144 --variations-seed-version=20260421-010045.266000-production --pseudonymization-salt-handle=1896,i,3513562377202145198,6181459751785414915,4 --trace-process-track-uuid=3190709035975089491 --mojo-platform-channel-handle=9024 /prefetch:143⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4148,i,6229061268551960570,4714674564342397696,524288 --field-trial-handle=1888,i,4539948997206449441,6488674296570019999,262144 --variations-seed-version=20260421-010045.266000-production --pseudonymization-salt-handle=1896,i,3513562377202145198,6181459751785414915,4 --trace-process-track-uuid=3190709036912131340 --mojo-platform-channel-handle=9172 /prefetch:143⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5004,i,501718296157525501,7687217812883701748,524288 --field-trial-handle=1888,i,4539948997206449441,6488674296570019999,262144 --variations-seed-version=20260421-010045.266000-production --pseudonymization-salt-handle=1896,i,3513562377202145198,6181459751785414915,4 --trace-process-track-uuid=3190709037849173189 --mojo-platform-channel-handle=9116 /prefetch:143⤵
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=147.0.7727.102 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffa171367e8,0x7ffa171367f4,0x7ffa171368003⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1728,i,18200887212833881740,3562878709974349455,524288 --field-trial-handle=2000,i,13623119876865164655,12934524548779536702,262144 --variations-seed-version=20260421-010045.266000-production --pseudonymization-salt-handle=2004,i,12944480529250441603,14240803245373751818,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2008 /prefetch:113⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1540,i,14574119841244081417,4972406566288195307,262144 --field-trial-handle=2000,i,13623119876865164655,12934524548779536702,262144 --variations-seed-version=20260421-010045.266000-production --pseudonymization-salt-handle=2004,i,12944480529250441603,14240803245373751818,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1996 /prefetch:23⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2352,i,13090127509464376329,2053828528886218026,524288 --field-trial-handle=2000,i,13623119876865164655,12934524548779536702,262144 --variations-seed-version=20260421-010045.266000-production --pseudonymization-salt-handle=2004,i,12944480529250441603,14240803245373751818,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2376 /prefetch:133⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3292,i,5706670501936077731,14450130504804473072,2097152 --field-trial-handle=2000,i,13623119876865164655,12934524548779536702,262144 --variations-seed-version=20260421-010045.266000-production --pseudonymization-salt-handle=2004,i,12944480529250441603,14240803245373751818,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3332 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3300,i,8394755335965821234,11484389277406225082,2097152 --field-trial-handle=2000,i,13623119876865164655,12934524548779536702,262144 --variations-seed-version=20260421-010045.266000-production --pseudonymization-salt-handle=2004,i,12944480529250441603,14240803245373751818,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3384 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3808,i,13114120347482108444,16240481172627733346,2097152 --field-trial-handle=2000,i,13623119876865164655,12934524548779536702,262144 --variations-seed-version=20260421-010045.266000-production --pseudonymization-salt-handle=2004,i,12944480529250441603,14240803245373751818,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=4456 /prefetch:93⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3956,i,15720318139709827537,14089572967419951637,2097152 --field-trial-handle=2000,i,13623119876865164655,12934524548779536702,262144 --variations-seed-version=20260421-010045.266000-production --pseudonymization-salt-handle=2004,i,12944480529250441603,14240803245373751818,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=3908 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4936,i,3439635812100544618,6197028798567071627,2097152 --field-trial-handle=2000,i,13623119876865164655,12934524548779536702,262144 --variations-seed-version=20260421-010045.266000-production --pseudonymization-salt-handle=2004,i,12944480529250441603,14240803245373751818,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=5024 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=3388,i,1286484040683913545,4840280612581604205,2097152 --field-trial-handle=2000,i,13623119876865164655,12934524548779536702,262144 --variations-seed-version=20260421-010045.266000-production --pseudonymization-salt-handle=2004,i,12944480529250441603,14240803245373751818,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=5600 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5628,i,2178068889813019762,13828572501734490322,2097152 --field-trial-handle=2000,i,13623119876865164655,12934524548779536702,262144 --variations-seed-version=20260421-010045.266000-production --pseudonymization-salt-handle=2004,i,12944480529250441603,14240803245373751818,4 --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=5644 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6424,i,5054668617026679201,12800288921775157607,524288 --field-trial-handle=2000,i,13623119876865164655,12934524548779536702,262144 --variations-seed-version=20260421-010045.266000-production --pseudonymization-salt-handle=2004,i,12944480529250441603,14240803245373751818,4 --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=6448 /prefetch:143⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6400,i,9863793664061902832,3091902595494320712,524288 --field-trial-handle=2000,i,13623119876865164655,12934524548779536702,262144 --variations-seed-version=20260421-010045.266000-production --pseudonymization-salt-handle=2004,i,12944480529250441603,14240803245373751818,4 --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=6608 /prefetch:143⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6452,i,10959423512582230135,17847619880964782524,524288 --field-trial-handle=2000,i,13623119876865164655,12934524548779536702,262144 --variations-seed-version=20260421-010045.266000-production --pseudonymization-salt-handle=2004,i,12944480529250441603,14240803245373751818,4 --trace-process-track-uuid=3190708999430457380 --mojo-platform-channel-handle=6744 /prefetch:143⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6472,i,12509018419865358870,9086171549167040747,524288 --field-trial-handle=2000,i,13623119876865164655,12934524548779536702,262144 --variations-seed-version=20260421-010045.266000-production --pseudonymization-salt-handle=2004,i,12944480529250441603,14240803245373751818,4 --trace-process-track-uuid=3190709000367499229 --mojo-platform-channel-handle=6768 /prefetch:143⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6476,i,18367730149014675512,15052449135181757112,524288 --field-trial-handle=2000,i,13623119876865164655,12934524548779536702,262144 --variations-seed-version=20260421-010045.266000-production --pseudonymization-salt-handle=2004,i,12944480529250441603,14240803245373751818,4 --trace-process-track-uuid=3190709001304541078 --mojo-platform-channel-handle=6788 /prefetch:143⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6816,i,17777708318202493286,6116182349754337122,524288 --field-trial-handle=2000,i,13623119876865164655,12934524548779536702,262144 --variations-seed-version=20260421-010045.266000-production --pseudonymization-salt-handle=2004,i,12944480529250441603,14240803245373751818,4 --trace-process-track-uuid=3190709002241582927 --mojo-platform-channel-handle=7164 /prefetch:143⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=7176,i,11892370608155612566,5851782989870669083,524288 --field-trial-handle=2000,i,13623119876865164655,12934524548779536702,262144 --variations-seed-version=20260421-010045.266000-production --pseudonymization-salt-handle=2004,i,12944480529250441603,14240803245373751818,4 --trace-process-track-uuid=3190709003178624776 --mojo-platform-channel-handle=7312 /prefetch:143⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=7460,i,15188610759222403471,13191351331881708195,524288 --field-trial-handle=2000,i,13623119876865164655,12934524548779536702,262144 --variations-seed-version=20260421-010045.266000-production --pseudonymization-salt-handle=2004,i,12944480529250441603,14240803245373751818,4 --trace-process-track-uuid=3190709004115666625 --mojo-platform-channel-handle=7468 /prefetch:143⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=7484,i,16889163448631573614,5819710452205958346,524288 --field-trial-handle=2000,i,13623119876865164655,12934524548779536702,262144 --variations-seed-version=20260421-010045.266000-production --pseudonymization-salt-handle=2004,i,12944480529250441603,14240803245373751818,4 --trace-process-track-uuid=3190709005052708474 --mojo-platform-channel-handle=7496 /prefetch:143⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=7744,i,3367639501097329217,15698631376599760260,524288 --field-trial-handle=2000,i,13623119876865164655,12934524548779536702,262144 --variations-seed-version=20260421-010045.266000-production --pseudonymization-salt-handle=2004,i,12944480529250441603,14240803245373751818,4 --trace-process-track-uuid=3190709005989750323 --mojo-platform-channel-handle=7756 /prefetch:143⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=7904,i,1231148944608104349,13126399405019362710,524288 --field-trial-handle=2000,i,13623119876865164655,12934524548779536702,262144 --variations-seed-version=20260421-010045.266000-production --pseudonymization-salt-handle=2004,i,12944480529250441603,14240803245373751818,4 --trace-process-track-uuid=3190709006926792172 --mojo-platform-channel-handle=7912 /prefetch:143⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=7920,i,16997184174460265017,4368415290316922310,524288 --field-trial-handle=2000,i,13623119876865164655,12934524548779536702,262144 --variations-seed-version=20260421-010045.266000-production --pseudonymization-salt-handle=2004,i,12944480529250441603,14240803245373751818,4 --trace-process-track-uuid=3190709007863834021 --mojo-platform-channel-handle=7940 /prefetch:143⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=7976,i,16570923900864877869,5610591263450562412,524288 --field-trial-handle=2000,i,13623119876865164655,12934524548779536702,262144 --variations-seed-version=20260421-010045.266000-production --pseudonymization-salt-handle=2004,i,12944480529250441603,14240803245373751818,4 --trace-process-track-uuid=3190709008800875870 --mojo-platform-channel-handle=8204 /prefetch:143⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=8376,i,6822721338720278694,5809101357290661155,524288 --field-trial-handle=2000,i,13623119876865164655,12934524548779536702,262144 --variations-seed-version=20260421-010045.266000-production --pseudonymization-salt-handle=2004,i,12944480529250441603,14240803245373751818,4 --trace-process-track-uuid=3190709010674959568 --mojo-platform-channel-handle=8400 /prefetch:143⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=8352,i,1176725350287919339,7433391188136674014,524288 --field-trial-handle=2000,i,13623119876865164655,12934524548779536702,262144 --variations-seed-version=20260421-010045.266000-production --pseudonymization-salt-handle=2004,i,12944480529250441603,14240803245373751818,4 --trace-process-track-uuid=3190709009737917719 --mojo-platform-channel-handle=8380 /prefetch:123⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6264,i,6325125513758518006,11643734395995483407,524288 --field-trial-handle=2000,i,13623119876865164655,12934524548779536702,262144 --variations-seed-version=20260421-010045.266000-production --pseudonymization-salt-handle=2004,i,12944480529250441603,14240803245373751818,4 --trace-process-track-uuid=3190709012549043266 --mojo-platform-channel-handle=6284 /prefetch:143⤵
-
-
C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe"C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --wake-all --system3⤵
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe"C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=148.0.7730.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl" --initial-client-data=0x298,0x29c,0x2a0,0x294,0x2a4,0xc3c4ac,0xc3c4b8,0xc3c4c44⤵
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe"C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --wake --system4⤵
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe"C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=148.0.7730.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl" --initial-client-data=0x298,0x29c,0x2a0,0x294,0x2a4,0xc3c4ac,0xc3c4b8,0xc3c4c45⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=216,i,6047138962326905360,3493742774013987030,524288 --field-trial-handle=2000,i,13623119876865164655,12934524548779536702,262144 --variations-seed-version=20260421-010045.266000-production --pseudonymization-salt-handle=2004,i,12944480529250441603,14240803245373751818,4 --trace-process-track-uuid=3190709013486085115 --mojo-platform-channel-handle=7528 /prefetch:143⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=7552,i,15281299917323056003,17788358943274698934,524288 --field-trial-handle=2000,i,13623119876865164655,12934524548779536702,262144 --variations-seed-version=20260421-010045.266000-production --pseudonymization-salt-handle=2004,i,12944480529250441603,14240803245373751818,4 --trace-process-track-uuid=3190709014423126964 --mojo-platform-channel-handle=7576 /prefetch:143⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6252,i,10687250384698106107,10979824016010148376,524288 --field-trial-handle=2000,i,13623119876865164655,12934524548779536702,262144 --variations-seed-version=20260421-010045.266000-production --pseudonymization-salt-handle=2004,i,12944480529250441603,14240803245373751818,4 --trace-process-track-uuid=3190709015360168813 --mojo-platform-channel-handle=7612 /prefetch:143⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=8312,i,15445635219245090136,12540500753629045854,524288 --field-trial-handle=2000,i,13623119876865164655,12934524548779536702,262144 --variations-seed-version=20260421-010045.266000-production --pseudonymization-salt-handle=2004,i,12944480529250441603,14240803245373751818,4 --trace-process-track-uuid=3190709016297210662 --mojo-platform-channel-handle=7976 /prefetch:143⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=7748,i,8542247638698028715,732913103047449118,524288 --field-trial-handle=2000,i,13623119876865164655,12934524548779536702,262144 --variations-seed-version=20260421-010045.266000-production --pseudonymization-salt-handle=2004,i,12944480529250441603,14240803245373751818,4 --trace-process-track-uuid=3190709017234252511 --mojo-platform-channel-handle=6040 /prefetch:143⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=8224,i,6376775114555279665,2948884162449518507,524288 --field-trial-handle=2000,i,13623119876865164655,12934524548779536702,262144 --variations-seed-version=20260421-010045.266000-production --pseudonymization-salt-handle=2004,i,12944480529250441603,14240803245373751818,4 --trace-process-track-uuid=3190709018171294360 --mojo-platform-channel-handle=7784 /prefetch:143⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=8560,i,6174908668553370247,4815312902645897831,524288 --field-trial-handle=2000,i,13623119876865164655,12934524548779536702,262144 --variations-seed-version=20260421-010045.266000-production --pseudonymization-salt-handle=2004,i,12944480529250441603,14240803245373751818,4 --trace-process-track-uuid=3190709019108336209 --mojo-platform-channel-handle=7896 /prefetch:143⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=7384,i,311488647987240008,1358222930551495902,524288 --field-trial-handle=2000,i,13623119876865164655,12934524548779536702,262144 --variations-seed-version=20260421-010045.266000-production --pseudonymization-salt-handle=2004,i,12944480529250441603,14240803245373751818,4 --trace-process-track-uuid=3190709020045378058 --mojo-platform-channel-handle=6040 /prefetch:143⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=7780,i,10652874875399662380,3546373739480743892,524288 --field-trial-handle=2000,i,13623119876865164655,12934524548779536702,262144 --variations-seed-version=20260421-010045.266000-production --pseudonymization-salt-handle=2004,i,12944480529250441603,14240803245373751818,4 --trace-process-track-uuid=3190709020982419907 --mojo-platform-channel-handle=7396 /prefetch:143⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=7400,i,9150873234300024825,12640722858502359753,524288 --field-trial-handle=2000,i,13623119876865164655,12934524548779536702,262144 --variations-seed-version=20260421-010045.266000-production --pseudonymization-salt-handle=2004,i,12944480529250441603,14240803245373751818,4 --trace-process-track-uuid=3190709021919461756 --mojo-platform-channel-handle=7920 /prefetch:143⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=7436,i,9399478902266092776,7941364204345987504,524288 --field-trial-handle=2000,i,13623119876865164655,12934524548779536702,262144 --variations-seed-version=20260421-010045.266000-production --pseudonymization-salt-handle=2004,i,12944480529250441603,14240803245373751818,4 --trace-process-track-uuid=3190709022856503605 --mojo-platform-channel-handle=7428 /prefetch:143⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6528,i,15133682160027452678,2835254119507337266,524288 --field-trial-handle=2000,i,13623119876865164655,12934524548779536702,262144 --variations-seed-version=20260421-010045.266000-production --pseudonymization-salt-handle=2004,i,12944480529250441603,14240803245373751818,4 --trace-process-track-uuid=3190709023793545454 --mojo-platform-channel-handle=6788 /prefetch:143⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAEIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=7816,i,15195682093080854261,9598630646401625813,262144 --field-trial-handle=2000,i,13623119876865164655,12934524548779536702,262144 --variations-seed-version=20260421-010045.266000-production --pseudonymization-salt-handle=2004,i,12944480529250441603,14240803245373751818,4 --trace-process-track-uuid=3190709024730587303 --mojo-platform-channel-handle=6776 /prefetch:103⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=7816,i,644012152199003637,6794680807118456530,524288 --field-trial-handle=2000,i,13623119876865164655,12934524548779536702,262144 --variations-seed-version=20260421-010045.266000-production --pseudonymization-salt-handle=2004,i,12944480529250441603,14240803245373751818,4 --trace-process-track-uuid=3190709025667629152 --mojo-platform-channel-handle=8320 /prefetch:143⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6512,i,12864224065579878561,15648451419879888866,524288 --field-trial-handle=2000,i,13623119876865164655,12934524548779536702,262144 --variations-seed-version=20260421-010045.266000-production --pseudonymization-salt-handle=2004,i,12944480529250441603,14240803245373751818,4 --trace-process-track-uuid=3190709026604671001 --mojo-platform-channel-handle=8188 /prefetch:143⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=7040,i,6396003985621827772,13446314213041004442,524288 --field-trial-handle=2000,i,13623119876865164655,12934524548779536702,262144 --variations-seed-version=20260421-010045.266000-production --pseudonymization-salt-handle=2004,i,12944480529250441603,14240803245373751818,4 --trace-process-track-uuid=3190709027541712850 --mojo-platform-channel-handle=6512 /prefetch:143⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2888,i,16450907311211538395,4600010693514111302,524288 --field-trial-handle=2000,i,13623119876865164655,12934524548779536702,262144 --variations-seed-version=20260421-010045.266000-production --pseudonymization-salt-handle=2004,i,12944480529250441603,14240803245373751818,4 --trace-process-track-uuid=3190709028478754699 --mojo-platform-channel-handle=7732 /prefetch:143⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6964,i,10659225991692581737,12776943236467220717,524288 --field-trial-handle=2000,i,13623119876865164655,12934524548779536702,262144 --variations-seed-version=20260421-010045.266000-production --pseudonymization-salt-handle=2004,i,12944480529250441603,14240803245373751818,4 --trace-process-track-uuid=3190709029415796548 --mojo-platform-channel-handle=7316 /prefetch:143⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6968,i,17575010183096836310,9066558519646844073,524288 --field-trial-handle=2000,i,13623119876865164655,12934524548779536702,262144 --variations-seed-version=20260421-010045.266000-production --pseudonymization-salt-handle=2004,i,12944480529250441603,14240803245373751818,4 --trace-process-track-uuid=3190709030352838397 --mojo-platform-channel-handle=7056 /prefetch:143⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=8072,i,18314824496716782983,12854796067240925197,524288 --field-trial-handle=2000,i,13623119876865164655,12934524548779536702,262144 --variations-seed-version=20260421-010045.266000-production --pseudonymization-salt-handle=2004,i,12944480529250441603,14240803245373751818,4 --trace-process-track-uuid=3190709031289880246 --mojo-platform-channel-handle=7144 /prefetch:143⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=7152,i,1609145956227290524,11511861285699873198,524288 --field-trial-handle=2000,i,13623119876865164655,12934524548779536702,262144 --variations-seed-version=20260421-010045.266000-production --pseudonymization-salt-handle=2004,i,12944480529250441603,14240803245373751818,4 --trace-process-track-uuid=3190709032226922095 --mojo-platform-channel-handle=7904 /prefetch:143⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6988,i,10387814096818895653,3864611181555087950,524288 --field-trial-handle=2000,i,13623119876865164655,12934524548779536702,262144 --variations-seed-version=20260421-010045.266000-production --pseudonymization-salt-handle=2004,i,12944480529250441603,14240803245373751818,4 --trace-process-track-uuid=3190709033163963944 --mojo-platform-channel-handle=4340 /prefetch:143⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6988,i,189652182209776391,3433595270262415496,524288 --field-trial-handle=2000,i,13623119876865164655,12934524548779536702,262144 --variations-seed-version=20260421-010045.266000-production --pseudonymization-salt-handle=2004,i,12944480529250441603,14240803245373751818,4 --trace-process-track-uuid=3190709034101005793 --mojo-platform-channel-handle=8072 /prefetch:143⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --metrics-shmem-handle=3528,i,3584610135619200383,5343550788160703620,2097152 --field-trial-handle=2000,i,13623119876865164655,12934524548779536702,262144 --variations-seed-version=20260421-010045.266000-production --pseudonymization-salt-handle=2004,i,12944480529250441603,14240803245373751818,4 --trace-process-track-uuid=3190709035038047642 --mojo-platform-channel-handle=7024 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6884,i,3133575904272655272,14747478171593212632,524288 --field-trial-handle=2000,i,13623119876865164655,12934524548779536702,262144 --variations-seed-version=20260421-010045.266000-production --pseudonymization-salt-handle=2004,i,12944480529250441603,14240803245373751818,4 --trace-process-track-uuid=3190709035975089491 --mojo-platform-channel-handle=7780 /prefetch:143⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --metrics-shmem-handle=5848,i,2029897965986751930,13066930396242970979,2097152 --field-trial-handle=2000,i,13623119876865164655,12934524548779536702,262144 --variations-seed-version=20260421-010045.266000-production --pseudonymization-salt-handle=2004,i,12944480529250441603,14240803245373751818,4 --trace-process-track-uuid=3190709036912131340 --mojo-platform-channel-handle=5856 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --metrics-shmem-handle=5788,i,1662061234026116873,2434512797191694459,2097152 --field-trial-handle=2000,i,13623119876865164655,12934524548779536702,262144 --variations-seed-version=20260421-010045.266000-production --pseudonymization-salt-handle=2004,i,12944480529250441603,14240803245373751818,4 --trace-process-track-uuid=3190709037849173189 --mojo-platform-channel-handle=6928 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --metrics-shmem-handle=6348,i,1687262414599855257,16517584604257465851,2097152 --field-trial-handle=2000,i,13623119876865164655,12934524548779536702,262144 --variations-seed-version=20260421-010045.266000-production --pseudonymization-salt-handle=2004,i,12944480529250441603,14240803245373751818,4 --trace-process-track-uuid=3190709038786215038 --mojo-platform-channel-handle=7476 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --metrics-shmem-handle=808,i,14066312190303804009,15810281257515149073,2097152 --field-trial-handle=2000,i,13623119876865164655,12934524548779536702,262144 --variations-seed-version=20260421-010045.266000-production --pseudonymization-salt-handle=2004,i,12944480529250441603,14240803245373751818,4 --trace-process-track-uuid=3190709039723256887 --mojo-platform-channel-handle=6252 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --metrics-shmem-handle=5088,i,13755733547923609044,13062820261030931739,2097152 --field-trial-handle=2000,i,13623119876865164655,12934524548779536702,262144 --variations-seed-version=20260421-010045.266000-production --pseudonymization-salt-handle=2004,i,12944480529250441603,14240803245373751818,4 --trace-process-track-uuid=3190709040660298736 --mojo-platform-channel-handle=5112 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --metrics-shmem-handle=6512,i,4230835727410365487,2785925255734599847,2097152 --field-trial-handle=2000,i,13623119876865164655,12934524548779536702,262144 --variations-seed-version=20260421-010045.266000-production --pseudonymization-salt-handle=2004,i,12944480529250441603,14240803245373751818,4 --trace-process-track-uuid=3190709041597340585 --mojo-platform-channel-handle=6772 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --metrics-shmem-handle=6800,i,5329825097770226880,8554832557770104835,2097152 --field-trial-handle=2000,i,13623119876865164655,12934524548779536702,262144 --variations-seed-version=20260421-010045.266000-production --pseudonymization-salt-handle=2004,i,12944480529250441603,14240803245373751818,4 --trace-process-track-uuid=3190709042534382434 --mojo-platform-channel-handle=8212 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --metrics-shmem-handle=4864,i,9617934546832120142,17402539975052237182,2097152 --field-trial-handle=2000,i,13623119876865164655,12934524548779536702,262144 --variations-seed-version=20260421-010045.266000-production --pseudonymization-salt-handle=2004,i,12944480529250441603,14240803245373751818,4 --trace-process-track-uuid=3190709043471424283 --mojo-platform-channel-handle=6828 /prefetch:13⤵
-
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\Clipup.exe"C:\Windows\system32\Clipup.exe" -o1⤵
-
C:\Windows\system32\Clipup.exe"C:\Windows\system32\Clipup.exe" -o -ppl C:\Windows\SystemTemp\tem4C86.tmp2⤵
- Checks SCSI registry key(s)
-
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc1⤵
-
C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe"C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --system --windows-service --service=update-internal1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe"C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=148.0.7730.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl" --initial-client-data=0x298,0x29c,0x2a0,0x294,0x2a4,0xc3c4ac,0xc3c4b8,0xc3c4c42⤵
- Drops file in Program Files directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe"C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --system --windows-service --service=update1⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe"C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=148.0.7730.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl" --initial-client-data=0x2a0,0x2a4,0x2a8,0x29c,0x294,0xc3c4ac,0xc3c4b8,0xc3c4c42⤵
- Drops file in Program Files directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe"C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --unzip-worker --system --mojo-platform-channel-handle=18882⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe"C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=148.0.7730.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl" --initial-client-data=0x29c,0x2a0,0x2a4,0x298,0x2a8,0xc3c4ac,0xc3c4b8,0xc3c4c43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SystemTemp\GoogleUpdater_chrome_Unpacker_BeginUnzipping4948_789860434\147.0.7727.102_chrome_installer_uncompressed.exe"C:\Windows\SystemTemp\GoogleUpdater_chrome_Unpacker_BeginUnzipping4948_789860434\147.0.7727.102_chrome_installer_uncompressed.exe" --verbose-logging --do-not-launch-chrome --channel=stable --installerdata="C:\Windows\SystemTemp\GoogleUpdater_chrome_Unpacker_BeginUnzipping4948_789860434\ac48b592-818e-4996-8bce-a0dc4eabdb73.tmp"2⤵
- Drops file in Windows directory
- Executes dropped EXE
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\SystemTemp\GoogleUpdater_chrome_Unpacker_BeginUnzipping4948_789860434\CR_23B04.tmp\setup.exe"C:\Windows\SystemTemp\GoogleUpdater_chrome_Unpacker_BeginUnzipping4948_789860434\CR_23B04.tmp\setup.exe" --uncompressed-archive="C:\Windows\SystemTemp\GoogleUpdater_chrome_Unpacker_BeginUnzipping4948_789860434\CR_23B04.tmp\CHROME.7Z" --verbose-logging --do-not-launch-chrome --channel=stable --installerdata="C:\Windows\SystemTemp\GoogleUpdater_chrome_Unpacker_BeginUnzipping4948_789860434\ac48b592-818e-4996-8bce-a0dc4eabdb73.tmp"3⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Program Files directory
- Executes dropped EXE
- System Network Configuration Discovery: Internet Connection Discovery
- Modifies registry class
-
C:\Windows\SystemTemp\GoogleUpdater_chrome_Unpacker_BeginUnzipping4948_789860434\CR_23B04.tmp\setup.exeC:\Windows\SystemTemp\GoogleUpdater_chrome_Unpacker_BeginUnzipping4948_789860434\CR_23B04.tmp\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=147.0.7727.102 --attachment=C:\Windows\SystemTemp\chrome_installer.log --initial-client-data=0x238,0x23c,0x240,0x214,0x244,0x7ff67172b840,0x7ff67172b84c,0x7ff67172b8584⤵
- Executes dropped EXE
-
-
C:\Windows\SystemTemp\GoogleUpdater_chrome_Unpacker_BeginUnzipping4948_789860434\CR_23B04.tmp\setup.exe"C:\Windows\SystemTemp\GoogleUpdater_chrome_Unpacker_BeginUnzipping4948_789860434\CR_23B04.tmp\setup.exe" --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=14⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Executes dropped EXE
- Modifies data under HKEY_USERS
-
C:\Windows\SystemTemp\GoogleUpdater_chrome_Unpacker_BeginUnzipping4948_789860434\CR_23B04.tmp\setup.exeC:\Windows\SystemTemp\GoogleUpdater_chrome_Unpacker_BeginUnzipping4948_789860434\CR_23B04.tmp\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=147.0.7727.102 --attachment=C:\Windows\SystemTemp\chrome_installer.log --initial-client-data=0x240,0x244,0x248,0x21c,0x24c,0x7ff67172b840,0x7ff67172b84c,0x7ff67172b8585⤵
- Executes dropped EXE
-
-
-
-
-
C:\Program Files\Google\Chrome\Application\147.0.7727.102\Installer\setup.exe"C:\Program Files\Google\Chrome\Application\147.0.7727.102\Installer\setup.exe" --rename-chrome-exe --system-level --verbose-logging --channel=stable2⤵
- Executes dropped EXE
-
C:\Program Files\Google\Chrome\Application\147.0.7727.102\Installer\setup.exe"C:\Program Files\Google\Chrome\Application\147.0.7727.102\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=147.0.7727.102 --attachment=C:\Windows\SystemTemp\chrome_installer.log --initial-client-data=0x244,0x248,0x24c,0x220,0x250,0x7ff78421b840,0x7ff78421b84c,0x7ff78421b8583⤵
- Executes dropped EXE
-
-
C:\Program Files\Google\Chrome\Application\147.0.7727.102\Installer\setup.exe"C:\Program Files\Google\Chrome\Application\147.0.7727.102\Installer\setup.exe" --channel=stable --delete-old-versions --system-level --verbose-logging3⤵
- Executes dropped EXE
-
C:\Program Files\Google\Chrome\Application\147.0.7727.102\Installer\setup.exe"C:\Program Files\Google\Chrome\Application\147.0.7727.102\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=147.0.7727.102 --attachment=C:\Windows\SystemTemp\chrome_installer.log --initial-client-data=0x238,0x23c,0x240,0x214,0x244,0x7ff78421b840,0x7ff78421b84c,0x7ff78421b8584⤵
- Drops file in Windows directory
- Executes dropped EXE
-
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files\Google\Chrome\Application\147.0.7727.102\elevation_service.exe"C:\Program Files\Google\Chrome\Application\147.0.7727.102\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe"C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --system --windows-service --service=update1⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe"C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=148.0.7730.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl" --initial-client-data=0x2a0,0x2a4,0x2a8,0x29c,0x2ac,0xc3c4ac,0xc3c4b8,0xc3c4c42⤵
- Drops file in Program Files directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files\Google\Chrome\Application\147.0.7727.102\os_update_handler.exe"C:\Program Files\Google\Chrome\Application\147.0.7727.102\os_update_handler.exe" --channel=stable --force-install --system-level2⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe"C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --unzip-worker --system --mojo-platform-channel-handle=18682⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe"C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=148.0.7730.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl" --initial-client-data=0x2a0,0x2a4,0x2a8,0x29c,0x2ac,0xc3c4ac,0xc3c4b8,0xc3c4c43⤵
- Drops file in Program Files directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SystemTemp\GoogleUpdater_chrome_Unpacker_BeginUnzipping4420_542957786\platform_experience_helper.exe"C:\Windows\SystemTemp\GoogleUpdater_chrome_Unpacker_BeginUnzipping4420_542957786\platform_experience_helper.exe" --install2⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in System32 directory
- Executes dropped EXE
-
-
C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe"C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --system --windows-service --service=update1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe"C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=148.0.7730.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl" --initial-client-data=0x298,0x29c,0x2a0,0x294,0x2a4,0xc3c4ac,0xc3c4b8,0xc3c4c42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files\Google\Chrome\Application\147.0.7727.102\elevation_service.exe"C:\Program Files\Google\Chrome\Application\147.0.7727.102\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe"C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --system --windows-service --service=update1⤵
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe"C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=148.0.7730.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl" --initial-client-data=0x29c,0x2a0,0x2a4,0x298,0x2a8,0xc3c4ac,0xc3c4b8,0xc3c4c42⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe"C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --wake --system1⤵
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe"C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=148.0.7730.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl" --initial-client-data=0x298,0x29c,0x2a0,0x294,0x2a4,0xc3c4ac,0xc3c4b8,0xc3c4c42⤵
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe"C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --system --windows-service --service=update-internal1⤵
- Drops file in Program Files directory
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe"C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=148.0.7730.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl" --initial-client-data=0x298,0x29c,0x2a0,0x294,0x2a4,0xc3c4ac,0xc3c4b8,0xc3c4c42⤵
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe"C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --system --windows-service --service=update1⤵
- Drops file in Program Files directory
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe"C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=148.0.7730.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl" --initial-client-data=0x298,0x29c,0x2a0,0x294,0x2a4,0xc3c4ac,0xc3c4b8,0xc3c4c42⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\ScreenClippingHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\ScreenClippingHost.exe" -ServerName:ScreenClipping.AppX6726kd2wrry6c6n8nc57a1zn08dmzmbt.mca1⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s CaptureService1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s DsSvc1⤵
- Drops file in System32 directory
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\ScreenClippingHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\ScreenClippingHost.exe" -ServerName:ScreenClipping.AppX6726kd2wrry6c6n8nc57a1zn08dmzmbt.mca1⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\ScreenClippingHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\ScreenClippingHost.exe" -ServerName:ScreenClipping.AppX6726kd2wrry6c6n8nc57a1zn08dmzmbt.mca1⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\ScreenClippingHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\ScreenClippingHost.exe" -ServerName:ScreenClipping.AppX6726kd2wrry6c6n8nc57a1zn08dmzmbt.mca1⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\ScreenClippingHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\ScreenClippingHost.exe" -ServerName:ScreenClipping.AppX6726kd2wrry6c6n8nc57a1zn08dmzmbt.mca1⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.2104.12721.0_x64__8wekyb3d8bbwe\LocalBridge.exe"C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.2104.12721.0_x64__8wekyb3d8bbwe\LocalBridge.exe" /InvokerPRAID: Microsoft.MicrosoftOfficeHub notifications1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\ScreenClippingHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\ScreenClippingHost.exe" -ServerName:ScreenClipping.AppX6726kd2wrry6c6n8nc57a1zn08dmzmbt.mca1⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\ScreenClippingHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\ScreenClippingHost.exe" -ServerName:ScreenClipping.AppX6726kd2wrry6c6n8nc57a1zn08dmzmbt.mca1⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\ScreenClippingHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\ScreenClippingHost.exe" -ServerName:ScreenClipping.AppX6726kd2wrry6c6n8nc57a1zn08dmzmbt.mca1⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
1Component Object Model Hijacking
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Discovery
Browser Information Discovery
1Peripheral Device Discovery
2Query Registry
6Remote System Discovery
1System Information Discovery
6System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1System Time Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
settings.dat
updater.exe
metadata.json
metadata.json
prefs.json
prefs.json
prefs.json
prefs.json
prefs.json
prefs.json
prefs.json
prefs.json
prefs.json
prefs.json
prefs.json
chrmstp.exe
platform_experience_helper.exe
e5effeb2-0ce2-431e-9f38-a113bdeb9640.tmp
new_chrome.exe
am_MASCULINE.pak
GenuineTicket
listdata.json
heuristic_regexes.binarypb
captcha_providers.json
crl-set
settings.dat
Preload Data
BookmarkMergedSurfaceOrdering
Bookmarks
Bookmarks
Bookmarks
Bookmarks
Bookmarks
Bookmarks
Bookmarks
Bookmarks
Bookmarks
Bookmarks
Bookmarks
Bookmarks
Bookmarks
Bookmarks
Bookmarks
Bookmarks
Bookmarks
Bookmarks
Bookmarks
Bookmarks
Bookmarks
Bookmarks~RFe5ef868.TMP
BrowsingTopicsState
BrowsingTopicsState
f_000030
f_00003c
f_00003d
f_000044
f_000057
f_000063
f_000065
f_00008b
f_000095
f_000096
f_00009a
f_00009b
f_00009c
f_00009d
f_00009e
f_00009f
f_0000a0
f_0000a1
f_0000a2
f_0000a3
f_0000a4
f_0000a5
f_0000a6
f_0000a7
f_0000a8
f_0000a9
f_0000aa
f_0000ab
f_0000ac
f_0000ad
f_0000ae
f_0000af
f_0000b0
f_0000b1
f_0000b2
f_0000b3
f_0000b4
f_0000b5
f_0000b8
f_0000c1
f_0000c4
f_0000c5
f_0000c6
f_0000c7
f_0000c8
f_0000c9
f_0000ca
f_0000cb
f_0000cc
f_0000cd
f_0000cf
f_0000d8
f_0000dd
f_0000ee
f_0000ef
f_0000f0
f_0000f1
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
68a24f92-ac26-487e-96e8-209d93d80b1e
cc72476c-758f-4bfc-88d4-5c8cad21cd1c
fd2174df-d28d-4db1-bf4a-2c74db11ef39
DownloadMetadata
DownloadMetadata
DownloadMetadata
DownloadMetadata~RFe5ce4f9.TMP
LICENSE
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
verified_contents.json
IconDonate.png
IconEmail.png
IconFacebook.png
IconGuide.png
IconQQ.png
IconShare.png
IconStar.png
IconTwitter.png
IconVkontakte.png
IconWeibo.png
IconWhatsApp.png
IconYouTube.png
browser-preview-dark.png
browser-preview.png
browser_star.png
default.png
email.png
facebook.png
facebook.webp
favicon-dark.png
favicon-light.png
icon128.png
icon16.png
icon24.png
icon32.png
icon48.png
icon96.png
iconstick16.png
iconstick19.png
iconstick19safari.png
iconstick20.png
iconstick32.png
iconstick38.png
iconstick38safari.png
iconstick40.png
iconstick64.png
options.png
star.svg
style1.png
style2.png
style3.png
style4.png
style5.png
twitter.png
twitter.webp
youtube-blog.png
youtube-blog.webp
youtube.png
youtube.webp
popup.html
constants.js
content.js
options.js
popup.js
translate.js
zoom.js
options.css
popup.css
verified_contents.json
icon128.png
icon16.png
icon48.png
theme_button_background.png
theme_frame.png
theme_tab_background.png
theme_toolbar.png
manifest.json
_ruleset1
verified_contents.json
content.js
Vencord.css
Vencord.js
icon.png
modifyResponseHeaders.json
codicon-SJ6KF3NM.ttf
index.css
index.js
editor.worker.js
css.worker.js
dasherSettingSchema.json
service_worker_bin_prod.js
introduce.svg
Google Profile.ico
000003.log
LOG
LOG
MANIFEST-000001
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
TransportSecurity
TransportSecurity
TransportSecurity
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
Secure Preferences
Secure Preferences
Secure Preferences
Secure Preferences
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index~RFe5f9592.TMP
the-real-index
the-real-index~RFe5fb196.TMP
index.txt
index.txt
index.txt
index.txt~RFe5ef57a.TMP
the-real-index
the-real-index
the-real-index
the-real-index~RFe5bf029.TMP
Nigori.bin
Nigori.bin
Nigori.bin
Nigori.bin
Nigori.bin
Nigori.bin
Nigori.bin
Nigori.bin
Nigori.bin
Nigori.bin
Nigori.bin~RFe5ec36d.TMP
CURRENT
MANIFEST-000001
16.png
32.png
48.png
64.png
32.png
48.png
64.png
32.png
48.png
64.png
16.png
32.png
48.png
64.png
128.png
16.png
24.png
256.png
32.png
48.png
64.png
96.png
trusted_vault.pb
trusted_vault.pb
trusted_vault.pb
trusted_vault.pb
download_file_types.pb
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
preloaded_data.pb
optimization-hints.pb
crs.pb
ct_config.pb
kp_pinslist.pb
ssl_error_assistant.pb
safety_tips.pb
data_1
Filtering Rules
keys.json
ranked_dicts
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
metadata.json
model.tflite
model.tflite
powershell.exe.log
iconcache_idx.db
iconcache_idx.db
ModuleAnalysisCache
ModuleAnalysisCache
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
www.bing[1].xml
www.bing[1].xml
046c43af-afb5-43ea-af2e-eddc00517963.tmp
0pr2jdaf.dll
15f4d2ca-1fef-4912-b90a-d704a033c930.tmp
RESC1B0.tmp
__PSScriptPolicyTest_3unzez5j.hap.ps1
b36d435a-2068-47df-9396-9b6442fa6cdf.tmp
gcapi.dll
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
manifest.json
options.html
background.js
4cd8419c-8828-4373-89e5-d08566d8c56b.tmp
manifest.json
ad.trace
ad.trace
ad.trace
service.conf
service.conf
service.conf
service.conf
system.conf
system.conf
system.conf
system.conf
system.conf
system.conf
system.conf
system.conf
system.conf
system.conf
system.conf
system.conf
system.conf
system.conf
system.conf
system.conf
system.conf
system.conf
system.conf
system.conf
system.conf
system.conf
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
default.dic
f01b4d95cf55d32a.automaticDestinations-ms
f01b4d95cf55d32a.automaticDestinations-ms
5d696d521de238c3.customDestinations-ms
5d696d521de238c3.customDestinations-ms
CachedImage_1920_1080_POS4.jpg
Setup.ps1
Lithium-Nuker-v2-main.zip
LithiumNukerV2.exe
Unconfirmed 828453.crdownload
DSS.chk
manifest.json
manifest.json
manifest.json
manifest.json
LICENSE
manifest.json
manifest.json
manifest.json
manifest.json
hyph-as.hyb
hyph-hi.hyb
hyph-nb.hyb
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
MAS_09efec6c-9121-4c07-8156-96825b5395ff.cmd
MAS_f16faa9c-e4d3-479a-a87b-fc3c3c63bddb.cmd
0pr2jdaf.0.cs
0pr2jdaf.cmdline
CSC202A88FDD02D454288798AB1237CD5B4.TMP
memory/236-456-0x0000000000DD0000-0x00000000030C3000-memory.dmp
memory/236-509-0x0000000000DD0000-0x00000000030C3000-memory.dmp
memory/236-413-0x0000000004DD0000-0x0000000004E59000-memory.dmp
memory/236-871-0x0000000000DD0000-0x00000000030C3000-memory.dmp
memory/236-489-0x0000000000DD0000-0x00000000030C3000-memory.dmp
memory/236-473-0x0000000000DD0000-0x00000000030C3000-memory.dmp
memory/236-423-0x0000000000D40000-0x0000000000D65000-memory.dmp
memory/236-900-0x0000000000DD0000-0x00000000030C3000-memory.dmp
memory/236-465-0x0000000000DD0000-0x00000000030C3000-memory.dmp
memory/236-422-0x0000000000DD0000-0x00000000030C3000-memory.dmp
memory/236-850-0x0000000000DD0000-0x00000000030C3000-memory.dmp
memory/236-801-0x0000000000DD0000-0x00000000030C3000-memory.dmp
memory/236-437-0x0000000000DD0000-0x00000000030C3000-memory.dmp
memory/236-411-0x0000000000DD0000-0x00000000030C3000-memory.dmp
memory/236-885-0x0000000000DD0000-0x00000000030C3000-memory.dmp
memory/416-505-0x0000000000DD0000-0x00000000030C3000-memory.dmp
memory/416-418-0x0000000000DD0000-0x00000000030C3000-memory.dmp
memory/416-835-0x0000000000DD0000-0x00000000030C3000-memory.dmp
memory/416-28-0x0000000000DD0000-0x00000000030C3000-memory.dmp
memory/416-441-0x0000000000DD0000-0x00000000030C3000-memory.dmp
memory/416-30-0x00000000053E0000-0x0000000005469000-memory.dmp
memory/416-449-0x0000000000DD0000-0x00000000030C3000-memory.dmp
memory/416-426-0x0000000000DD0000-0x00000000030C3000-memory.dmp
memory/416-406-0x0000000003620000-0x0000000003645000-memory.dmp
memory/416-477-0x0000000000DD0000-0x00000000030C3000-memory.dmp
memory/416-405-0x0000000000DD0000-0x00000000030C3000-memory.dmp
memory/416-711-0x0000000000DD0000-0x00000000030C3000-memory.dmp
memory/416-155-0x00000000052B0000-0x00000000052CB000-memory.dmp
memory/416-461-0x0000000000DD0000-0x00000000030C3000-memory.dmp
memory/416-156-0x00000000052B0000-0x00000000052CB000-memory.dmp
memory/416-152-0x00000000052B0000-0x00000000052CB000-memory.dmp
memory/1324-874-0x000001A2C6800000-0x000001A2C6920000-memory.dmp
memory/1644-995-0x000001C3FCDA0000-0x000001C3FCF16000-memory.dmp
memory/1644-996-0x000001C3FD130000-0x000001C3FD33A000-memory.dmp
memory/2760-891-0x000001E076960000-0x000001E0769CF000-memory.dmp
memory/2760-876-0x000001E076960000-0x000001E0769CF000-memory.dmp
memory/2760-862-0x000001E076A80000-0x000001E076AC6000-memory.dmp
memory/2760-875-0x000001E076300000-0x000001E076312000-memory.dmp
memory/2828-27-0x0000000000DD0000-0x00000000030C3000-memory.dmp
memory/2828-3-0x0000000004BD0000-0x0000000004C59000-memory.dmp
memory/2828-410-0x0000000000DD0000-0x00000000030C3000-memory.dmp
memory/2828-409-0x0000000000DD4000-0x000000000293C000-memory.dmp
memory/2828-503-0x0000000000DD0000-0x00000000030C3000-memory.dmp
memory/2828-458-0x0000000000DD0000-0x00000000030C3000-memory.dmp
memory/2828-2-0x0000000000DD4000-0x000000000293C000-memory.dmp
memory/2828-0-0x0000000000DD0000-0x00000000030C3000-memory.dmp
memory/2828-594-0x0000000000DD0000-0x00000000030C3000-memory.dmp
memory/2828-403-0x0000000000DD0000-0x00000000030C3000-memory.dmp
memory/2828-404-0x0000000000A80000-0x0000000000AA5000-memory.dmp
memory/3248-407-0x0000000000DD0000-0x00000000030C3000-memory.dmp
memory/3248-443-0x0000000000DD0000-0x00000000030C3000-memory.dmp
memory/3248-34-0x00000000053B0000-0x0000000005439000-memory.dmp
memory/3248-451-0x0000000000DD0000-0x00000000030C3000-memory.dmp
memory/3248-463-0x0000000000DD0000-0x00000000030C3000-memory.dmp
memory/3248-33-0x0000000000DD0000-0x00000000030C3000-memory.dmp
memory/3248-408-0x00000000038F0000-0x0000000003915000-memory.dmp
memory/3248-713-0x0000000000DD0000-0x00000000030C3000-memory.dmp
memory/4132-818-0x0000028E22810000-0x0000028E2287F000-memory.dmp
memory/4132-674-0x0000029656300000-0x0000029656400000-memory.dmp
memory/4132-664-0x0000029757340000-0x0000029757360000-memory.dmp
memory/4132-663-0x0000029757780000-0x0000029757880000-memory.dmp
memory/4132-641-0x0000029656800000-0x0000029656820000-memory.dmp
memory/4132-640-0x0000029756B20000-0x0000029756B40000-memory.dmp
memory/4132-598-0x0000029622900000-0x0000029622A00000-memory.dmp
memory/4132-577-0x0000029622AC0000-0x0000029622BC0000-memory.dmp
memory/4776-873-0x0000026EBDED0000-0x0000026EBDFF0000-memory.dmp
memory/4776-902-0x0000026EBDED0000-0x0000026EBDFF0000-memory.dmp
memory/4776-887-0x0000026EBDED0000-0x0000026EBDFF0000-memory.dmp
memory/5472-1037-0x0000015FEF3B0000-0x0000015FEF463000-memory.dmp
memory/5932-534-0x00000226CE900000-0x00000226CE91C000-memory.dmp
memory/5932-527-0x00000226CE560000-0x00000226CE582000-memory.dmp
memory/5932-816-0x00000226B5DC0000-0x00000226B5DD2000-memory.dmp
memory/5932-552-0x00000226CED10000-0x00000226CEED2000-memory.dmp
memory/5932-817-0x00000226CE590000-0x00000226CE5FF000-memory.dmp
memory/5932-831-0x00000226CE590000-0x00000226CE5FF000-memory.dmp
memory/5932-536-0x00000226CE9E0000-0x00000226CE9EA000-memory.dmp
memory/5932-535-0x00000226CE920000-0x00000226CE9D3000-memory.dmp
memory/5932-537-0x00000226CEB60000-0x00000226CEB7C000-memory.dmp
memory/5932-551-0x00000226CE550000-0x00000226CE558000-memory.dmp
memory/6160-11377-0x000002A4FF7E0000-0x000002A4FF7F4000-memory.dmp
memory/6160-11376-0x000002A4FFE00000-0x000002A4FFEA8000-memory.dmp
memory/6160-11374-0x000002A4FF780000-0x000002A4FF788000-memory.dmp
memory/6160-11372-0x000002A4FD1A0000-0x000002A4FD1CC000-memory.dmp
memory/6160-11373-0x000002A4FF750000-0x000002A4FF75A000-memory.dmp
memory/7148-3792-0x0000000004AA0000-0x0000000004AB0000-memory.dmp
memory/7148-3791-0x0000000004AD0000-0x0000000004B62000-memory.dmp
memory/7148-3790-0x0000000004A10000-0x0000000004A28000-memory.dmp
memory/7148-3789-0x0000000000010000-0x000000000001A000-memory.dmp