Analysis
- user interaction
yes - max time kernel
1049s - max time network
1053s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
26/04/2026, 17:33
General
- Target AutoClicker.exe
- Size 850KB
- Sample260426-v41dsads41
- SHA256 e4a3b0ce536c0996082311077ac65a096d9e6bbf404c6e6a155ecefb32e864c5
Score
8/10
Malware Config
Signatures
- Downloads MZ/PE file 2 IoCs
- Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 12 IoCs
- Loads dropped DLL 36 IoCs
- Modifies system executable filetype association 2 TTPs 8 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Contacts third-party web service commonly abused for C2 1 TTPs 21 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Enumerates processes with tasklist 1 TTPs 40 IoCs
- Drops file in Program Files directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 19 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 2 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 6 IoCs
- Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
- Kills process with taskkill 49 IoCs
- Modifies data under HKEY_USERS 3 IoCs
- Modifies registry class 64 IoCs
- Suspicious behavior: EnumeratesProcesses 34 IoCs
- Suspicious behavior: GetForegroundWindowSpam 2 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 64 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 10 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\AutoClicker.exe"C:\Users\Admin\AppData\Local\Temp\AutoClicker.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffd8dc1c728,0x7ffd8dc1c734,0x7ffd8dc1c7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1752,i,1159852731762515960,17536083388756071842,262144 --field-trial-handle=2036,i,12343863107514661157,13082965246242160467,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2028 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1668,i,18329716970450006901,11402463047164176756,524288 --field-trial-handle=2036,i,12343863107514661157,13082965246242160467,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2312 /prefetch:32⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2404,i,4517833238502424718,9337557536083645632,524288 --field-trial-handle=2036,i,12343863107514661157,13082965246242160467,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2600 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3228,i,14346327407238816569,3644300112578015581,2097152 --field-trial-handle=2036,i,12343863107514661157,13082965246242160467,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3240 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3264,i,12013436424262166389,13064663201509876380,2097152 --field-trial-handle=2036,i,12343863107514661157,13082965246242160467,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3292 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4360,i,9366323621332593706,15267818479253078683,2097152 --field-trial-handle=2036,i,12343863107514661157,13082965246242160467,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4372 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4712,i,12081033911870962094,2601179346390177135,2097152 --field-trial-handle=2036,i,12343863107514661157,13082965246242160467,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4656 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5492,i,12130550948728205454,17686971584532454444,524288 --field-trial-handle=2036,i,12343863107514661157,13082965246242160467,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5444 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5896,i,16843216137399991400,15293949323920725789,2097152 --field-trial-handle=2036,i,12343863107514661157,13082965246242160467,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5744 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3272,i,8744311968202946965,11148785986382477190,2097152 --field-trial-handle=2036,i,12343863107514661157,13082965246242160467,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3488 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6084,i,158983811056185983,15705649570717915977,524288 --field-trial-handle=2036,i,12343863107514661157,13082965246242160467,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6080 /prefetch:82⤵
- Modifies registry class
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=6104,i,7995465977540959278,1971748983730467798,524288 --field-trial-handle=2036,i,12343863107514661157,13082965246242160467,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6092 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6192,i,1405154160325404807,5735799178699547188,524288 --field-trial-handle=2036,i,12343863107514661157,13082965246242160467,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6152 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6160,i,4664470029178296713,12799962132383983860,524288 --field-trial-handle=2036,i,12343863107514661157,13082965246242160467,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6176 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5512,i,3269601845298571235,18322701494530960802,524288 --field-trial-handle=2036,i,12343863107514661157,13082965246242160467,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3096 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6368,i,9072329318843081888,8446216987171260592,2097152 --field-trial-handle=2036,i,12343863107514661157,13082965246242160467,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6384 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6596,i,9833548814367315236,10937144234210434456,2097152 --field-trial-handle=2036,i,12343863107514661157,13082965246242160467,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6612 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6164,i,14013347386221693845,153880715147209188,2097152 --field-trial-handle=2036,i,12343863107514661157,13082965246242160467,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6188 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6360,i,16905570383521820192,12355894175152091816,2097152 --field-trial-handle=2036,i,12343863107514661157,13082965246242160467,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4772 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=3280,i,13946772299840132149,8335340678371599051,262144 --field-trial-handle=2036,i,12343863107514661157,13082965246242160467,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6324 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6624,i,10919149563197213097,6886657239304845964,2097152 --field-trial-handle=2036,i,12343863107514661157,13082965246242160467,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6568 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6280,i,3092752335868018759,15453420062454605675,2097152 --field-trial-handle=2036,i,12343863107514661157,13082965246242160467,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6608 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6812,i,2848301716334784428,6638315841107610180,2097152 --field-trial-handle=2036,i,12343863107514661157,13082965246242160467,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6880 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=6016,i,3124924480806280733,314674197657828216,2097152 --field-trial-handle=2036,i,12343863107514661157,13082965246242160467,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6048 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4668,i,12446958068527037146,12627590242546324410,524288 --field-trial-handle=2036,i,12343863107514661157,13082965246242160467,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6276 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=6536,i,6060604686921419739,8233458578391171398,2097152 --field-trial-handle=2036,i,12343863107514661157,13082965246242160467,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6544 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=7240,i,12120868695470450068,7869130008001145995,2097152 --field-trial-handle=2036,i,12343863107514661157,13082965246242160467,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=7200 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=7272,i,7045960244653811047,2212052248028074549,2097152 --field-trial-handle=2036,i,12343863107514661157,13082965246242160467,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=7276 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=7156,i,4458885775179590196,6360270470642911895,2097152 --field-trial-handle=2036,i,12343863107514661157,13082965246242160467,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=7368 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=7384,i,7526848808707418564,7785384634998605540,2097152 --field-trial-handle=2036,i,12343863107514661157,13082965246242160467,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=7528 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=7216,i,14977173745207117101,9134677271358989117,2097152 --field-trial-handle=2036,i,12343863107514661157,13082965246242160467,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=7196 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --metrics-shmem-handle=7484,i,12218130986911449354,1434039719726814845,2097152 --field-trial-handle=2036,i,12343863107514661157,13082965246242160467,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=7372 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --metrics-shmem-handle=7420,i,13522674844892003392,11267406647615526701,2097152 --field-trial-handle=2036,i,12343863107514661157,13082965246242160467,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=7232 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=7844,i,12922553511886364184,16855311322914207394,524288 --field-trial-handle=2036,i,12343863107514661157,13082965246242160467,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=7696 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --metrics-shmem-handle=7352,i,4365724906426124440,17669737529077725161,2097152 --field-trial-handle=2036,i,12343863107514661157,13082965246242160467,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=7212 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --metrics-shmem-handle=7268,i,1196042886289484930,4436988273270301570,2097152 --field-trial-handle=2036,i,12343863107514661157,13082965246242160467,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=7392 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --metrics-shmem-handle=7892,i,6186825736233473071,12241162487777679299,2097152 --field-trial-handle=2036,i,12343863107514661157,13082965246242160467,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=7900 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --metrics-shmem-handle=7292,i,14915983104268108738,10657068594877118711,2097152 --field-trial-handle=2036,i,12343863107514661157,13082965246242160467,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=7324 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --metrics-shmem-handle=6176,i,16762415691607173869,16292541973325874952,2097152 --field-trial-handle=2036,i,12343863107514661157,13082965246242160467,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=7240 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --metrics-shmem-handle=8212,i,1948926360163060133,1283782771507593616,2097152 --field-trial-handle=2036,i,12343863107514661157,13082965246242160467,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=8136 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --metrics-shmem-handle=8156,i,9731565351179761040,8234661136401116846,2097152 --field-trial-handle=2036,i,12343863107514661157,13082965246242160467,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=8316 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --metrics-shmem-handle=8256,i,10434659886826033601,17221901488265506806,2097152 --field-trial-handle=2036,i,12343863107514661157,13082965246242160467,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=8524 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --metrics-shmem-handle=8180,i,10500714368023824351,4361669942155965517,2097152 --field-trial-handle=2036,i,12343863107514661157,13082965246242160467,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=8600 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --metrics-shmem-handle=8712,i,6020667030057886797,7656974999763568977,2097152 --field-trial-handle=2036,i,12343863107514661157,13082965246242160467,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=8728 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --metrics-shmem-handle=8624,i,5553005374639059586,877578963880807936,2097152 --field-trial-handle=2036,i,12343863107514661157,13082965246242160467,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=8800 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --metrics-shmem-handle=8880,i,16699133426341335592,9069271156718587382,2097152 --field-trial-handle=2036,i,12343863107514661157,13082965246242160467,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=8860 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --metrics-shmem-handle=8496,i,3349049721891083264,4537876405216996209,2097152 --field-trial-handle=2036,i,12343863107514661157,13082965246242160467,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=8928 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --metrics-shmem-handle=9116,i,6304744071155588334,13730005699743502837,2097152 --field-trial-handle=2036,i,12343863107514661157,13082965246242160467,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=9168 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --metrics-shmem-handle=8852,i,8981779384779740166,1281894661031152972,2097152 --field-trial-handle=2036,i,12343863107514661157,13082965246242160467,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=8824 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --metrics-shmem-handle=9032,i,15300946973299417878,8064367932566790675,2097152 --field-trial-handle=2036,i,12343863107514661157,13082965246242160467,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=8764 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --metrics-shmem-handle=8884,i,5135254014074940545,3655761868218155587,2097152 --field-trial-handle=2036,i,12343863107514661157,13082965246242160467,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=8696 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --metrics-shmem-handle=8808,i,12290643100678832433,4406045660618179401,2097152 --field-trial-handle=2036,i,12343863107514661157,13082965246242160467,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=8492 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --metrics-shmem-handle=8916,i,11737835790995320383,2104830838372846576,2097152 --field-trial-handle=2036,i,12343863107514661157,13082965246242160467,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=8740 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --metrics-shmem-handle=9428,i,18391409219382011425,475129835648778502,2097152 --field-trial-handle=2036,i,12343863107514661157,13082965246242160467,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=9440 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --metrics-shmem-handle=9000,i,13718890580432876522,17059688654449992901,2097152 --field-trial-handle=2036,i,12343863107514661157,13082965246242160467,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=8940 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=9816,i,7787110648081768683,18384073015752975637,524288 --field-trial-handle=2036,i,12343863107514661157,13082965246242160467,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=8952 /prefetch:82⤵
-
-
C:\Program Files\WinRAR\WinRAR.exe"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\Admin\Downloads\delta.rar"2⤵
- Executes dropped EXE
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\Downloads\winrar-x64-720am.exe"C:\Users\Admin\Downloads\winrar-x64-720am.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\WinRAR\uninstall.exe"C:\Program Files\WinRAR\uninstall.exe" /setup2⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\Downloads\winrar-x64-720am.exe"C:\Users\Admin\Downloads\winrar-x64-720am.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\WinRAR\WinRAR.exe"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\Admin\Downloads\delta.rar"1⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Rar$EXa4820.45092.rartemp\delta\delta.exe"C:\Users\Admin\AppData\Local\Temp\Rar$EXa4820.45092.rartemp\delta\delta.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq Loader.exe" /FO csv | "C:\Windows\system32\find.exe" "Loader.exe"3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "USERNAME eq Admin" /FI "IMAGENAME eq Loader.exe" /FO csv4⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\SysWOW64\find.exe"C:\Windows\system32\find.exe" "Loader.exe"4⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Rar$EXa4820.46654.rartemp\delta\delta.exe"C:\Users\Admin\AppData\Local\Temp\Rar$EXa4820.46654.rartemp\delta\delta.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq Loader.exe" /FO csv | "C:\Windows\system32\find.exe" "Loader.exe"3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "USERNAME eq Admin" /FI "IMAGENAME eq Loader.exe" /FO csv4⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\SysWOW64\find.exe"C:\Windows\system32\find.exe" "Loader.exe"4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c taskkill /im "Loader.exe" /fi "PID ne 7004" /fi "USERNAME eq %USERNAME%"3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "Loader.exe" /fi "PID ne 7004" /fi "USERNAME eq Admin"4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq Loader.exe" /FO csv | "C:\Windows\system32\find.exe" "Loader.exe"3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "USERNAME eq Admin" /FI "IMAGENAME eq Loader.exe" /FO csv4⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\SysWOW64\find.exe"C:\Windows\system32\find.exe" "Loader.exe"4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\nsoF297.tmp\old-uninstaller.exe"C:\Users\Admin\AppData\Local\Temp\nsoF297.tmp\old-uninstaller.exe" /S /KEEP_APP_DATA /currentuser --keep-shortcuts --updated _?=C:\Users\Admin\AppData\Local\Programs\Aleykum3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq Loader.exe" /FO csv | "C:\Windows\system32\find.exe" "Loader.exe"4⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "USERNAME eq Admin" /FI "IMAGENAME eq Loader.exe" /FO csv5⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\SysWOW64\find.exe"C:\Windows\system32\find.exe" "Loader.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Users\Admin\AppData\Local\Programs\Aleykum\Loader.exe"C:\Users\Admin\AppData\Local\Programs\Aleykum\Loader.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\java\jre\bin\micro.exeC:\Users\Admin\AppData\Local\java\jre\bin\micro.exe -jar C:\Users\Admin\AppData\Local\sikko.jar2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\Wbem\WMIC.exeWMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List3⤵
-
-
C:\Windows\SYSTEM32\tasklist.exetasklist.exe3⤵
- Enumerates processes with tasklist
-
-
C:\Windows\System32\Wbem\WMIC.exeWMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List3⤵
-
-
C:\Windows\System32\Wbem\WMIC.exeWMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_Processor Get Name /Format:List3⤵
-
-
C:\Windows\SYSTEM32\tasklist.exetasklist.exe3⤵
- Enumerates processes with tasklist
-
-
C:\Windows\System32\Wbem\WMIC.exeWMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_VideoController Get Name /Format:List3⤵
-
-
C:\Windows\System32\Wbem\WMIC.exeWMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List3⤵
-
-
C:\Windows\SYSTEM32\CMD.exeCMD /C SYSTEMINFO | FINDSTR /B /C:"OS Name:"3⤵
-
C:\Windows\system32\systeminfo.exeSYSTEMINFO4⤵
- Gathers system information
-
-
C:\Windows\system32\findstr.exeFINDSTR /B /C:"OS Name:"4⤵
-
-
-
C:\Windows\System32\Wbem\WMIC.exeWMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List3⤵
-
-
C:\Windows\SYSTEM32\tasklist.exetasklist.exe3⤵
- Enumerates processes with tasklist
-
-
C:\Windows\System32\Wbem\WMIC.exeWMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List3⤵
-
-
C:\Windows\SYSTEM32\tasklist.exetasklist.exe3⤵
- Enumerates processes with tasklist
-
-
C:\Windows\System32\Wbem\WMIC.exeWMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List3⤵
-
-
C:\Windows\SYSTEM32\tasklist.exetasklist.exe3⤵
- Enumerates processes with tasklist
-
-
C:\Windows\System32\Wbem\WMIC.exeWMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List3⤵
-
-
C:\Windows\SYSTEM32\tasklist.exetasklist.exe3⤵
- Enumerates processes with tasklist
-
-
C:\Windows\System32\Wbem\WMIC.exeWMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List3⤵
-
-
C:\Windows\SYSTEM32\tasklist.exetasklist.exe3⤵
- Enumerates processes with tasklist
-
-
C:\Windows\System32\Wbem\WMIC.exeWMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List3⤵
-
-
C:\Windows\SYSTEM32\tasklist.exetasklist.exe3⤵
- Enumerates processes with tasklist
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM brave.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\System32\Wbem\WMIC.exeWMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List3⤵
-
-
C:\Windows\SYSTEM32\tasklist.exetasklist.exe3⤵
- Enumerates processes with tasklist
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM brave.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\System32\Wbem\WMIC.exeWMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List3⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM vivaldi.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\tasklist.exetasklist.exe3⤵
- Enumerates processes with tasklist
-
-
C:\Windows\System32\Wbem\WMIC.exeWMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List3⤵
-
-
C:\Windows\SYSTEM32\tasklist.exetasklist.exe3⤵
- Enumerates processes with tasklist
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM browser.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\System32\Wbem\WMIC.exeWMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List3⤵
-
-
C:\Windows\SYSTEM32\tasklist.exetasklist.exe3⤵
- Enumerates processes with tasklist
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM opera.exe3⤵
- Kills process with taskkill
-
-
C:\Windows\System32\Wbem\WMIC.exeWMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List3⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM chrome.exe3⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM msedge.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM brave.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM firefox.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM opera.exe3⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM chrome.exe3⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM msedge.exe3⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM brave.exe3⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM firefox.exe3⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM opera.exe3⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM kometa.exe3⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM orbitum.exe3⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM centbrowser.exe3⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM 7star.exe3⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM sputnik.exe3⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM vivaldi.exe3⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM epicprivacybrowser.exe3⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM uran.exe3⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM browser.exe3⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM iridium.exe3⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM amigo.exe3⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM torch.exe3⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM waterfox.exe3⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM palemoon.exe3⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM librewolf.exe3⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM tor.exe3⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM chromium.exe3⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM maxthon.exe3⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM slimjet.exe3⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM dcbrowser.exe3⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM chedot.exe3⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM elements.exe3⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM fenrir.exe3⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM catalina.exe3⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM coowon.exe3⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM liebao.exe3⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM qipsurf.exe3⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM 360browser.exe3⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM comodo.exe3⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM qip.exe3⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM sleipnir.exe3⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM chrome.exe3⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\tasklist.exetasklist.exe3⤵
- Enumerates processes with tasklist
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM chrome.exe3⤵
- Kills process with taskkill
-
-
C:\Windows\System32\Wbem\WMIC.exeWMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List3⤵
-
-
C:\Windows\SYSTEM32\tasklist.exetasklist.exe3⤵
- Enumerates processes with tasklist
-
-
C:\Windows\System32\Wbem\WMIC.exeWMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List3⤵
-
-
C:\Windows\SYSTEM32\tasklist.exetasklist.exe3⤵
- Enumerates processes with tasklist
-
-
C:\Windows\System32\Wbem\WMIC.exeWMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List3⤵
-
-
C:\Windows\SYSTEM32\tasklist.exetasklist.exe3⤵
- Enumerates processes with tasklist
-
-
C:\Windows\System32\Wbem\WMIC.exeWMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List3⤵
-
-
C:\Windows\SYSTEM32\tasklist.exetasklist.exe3⤵
- Enumerates processes with tasklist
-
-
C:\Windows\System32\Wbem\WMIC.exeWMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List3⤵
-
-
C:\Windows\SYSTEM32\tasklist.exetasklist.exe3⤵
- Enumerates processes with tasklist
-
-
C:\Windows\System32\Wbem\WMIC.exeWMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List3⤵
-
-
C:\Windows\SYSTEM32\tasklist.exetasklist.exe3⤵
- Enumerates processes with tasklist
-
-
C:\Windows\System32\Wbem\WMIC.exeWMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List3⤵
-
-
C:\Windows\SYSTEM32\tasklist.exetasklist.exe3⤵
- Enumerates processes with tasklist
-
-
C:\Windows\System32\Wbem\WMIC.exeWMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List3⤵
-
-
C:\Windows\SYSTEM32\tasklist.exetasklist.exe3⤵
- Enumerates processes with tasklist
-
-
C:\Windows\System32\Wbem\WMIC.exeWMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List3⤵
-
-
C:\Windows\SYSTEM32\tasklist.exetasklist.exe3⤵
- Enumerates processes with tasklist
-
-
C:\Windows\System32\Wbem\WMIC.exeWMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List3⤵
-
-
C:\Windows\SYSTEM32\tasklist.exetasklist.exe3⤵
- Enumerates processes with tasklist
-
-
C:\Windows\System32\Wbem\WMIC.exeWMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List3⤵
-
-
C:\Windows\SYSTEM32\tasklist.exetasklist.exe3⤵
- Enumerates processes with tasklist
-
-
C:\Windows\System32\Wbem\WMIC.exeWMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List3⤵
-
-
C:\Windows\SYSTEM32\tasklist.exetasklist.exe3⤵
- Enumerates processes with tasklist
-
-
C:\Windows\System32\Wbem\WMIC.exeWMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List3⤵
-
-
C:\Windows\SYSTEM32\tasklist.exetasklist.exe3⤵
- Enumerates processes with tasklist
-
-
C:\Windows\System32\Wbem\WMIC.exeWMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List3⤵
-
-
C:\Windows\SYSTEM32\tasklist.exetasklist.exe3⤵
- Enumerates processes with tasklist
-
-
C:\Windows\System32\Wbem\WMIC.exeWMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List3⤵
-
-
C:\Windows\SYSTEM32\tasklist.exetasklist.exe3⤵
- Enumerates processes with tasklist
-
-
C:\Windows\System32\Wbem\WMIC.exeWMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List3⤵
-
-
C:\Windows\SYSTEM32\tasklist.exetasklist.exe3⤵
- Enumerates processes with tasklist
-
-
C:\Windows\System32\Wbem\WMIC.exeWMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List3⤵
-
-
C:\Windows\SYSTEM32\tasklist.exetasklist.exe3⤵
- Enumerates processes with tasklist
-
-
C:\Windows\System32\Wbem\WMIC.exeWMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List3⤵
-
-
C:\Windows\SYSTEM32\tasklist.exetasklist.exe3⤵
- Enumerates processes with tasklist
-
-
C:\Windows\System32\Wbem\WMIC.exeWMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List3⤵
-
-
C:\Windows\SYSTEM32\tasklist.exetasklist.exe3⤵
- Enumerates processes with tasklist
-
-
C:\Windows\System32\Wbem\WMIC.exeWMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List3⤵
-
-
C:\Windows\SYSTEM32\tasklist.exetasklist.exe3⤵
- Enumerates processes with tasklist
-
-
C:\Windows\System32\Wbem\WMIC.exeWMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List3⤵
-
-
C:\Windows\SYSTEM32\tasklist.exetasklist.exe3⤵
- Enumerates processes with tasklist
-
-
C:\Windows\System32\Wbem\WMIC.exeWMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List3⤵
-
-
C:\Windows\SYSTEM32\tasklist.exetasklist.exe3⤵
- Enumerates processes with tasklist
-
-
C:\Windows\System32\Wbem\WMIC.exeWMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List3⤵
-
-
C:\Windows\SYSTEM32\tasklist.exetasklist.exe3⤵
- Enumerates processes with tasklist
-
-
-
C:\Users\Admin\AppData\Local\Programs\Aleykum\Loader.exe"C:\Users\Admin\AppData\Local\Programs\Aleykum\Loader.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of SendNotifyMessage
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffd8e1ac728,0x7ffd8e1ac734,0x7ffd8e1ac7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1576,i,16906358434592037728,5822984034468319914,524288 --field-trial-handle=1996,i,9321256334952151083,2098745114370795856,262144 --variations-seed-version=20260426-030031.675000-production --mojo-platform-channel-handle=2024 /prefetch:32⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1724,i,11149160183106221277,4846559511969815038,262144 --field-trial-handle=1996,i,9321256334952151083,2098745114370795856,262144 --variations-seed-version=20260426-030031.675000-production --mojo-platform-channel-handle=1992 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2376,i,17834483342990297856,14703975183358143379,524288 --field-trial-handle=1996,i,9321256334952151083,2098745114370795856,262144 --variations-seed-version=20260426-030031.675000-production --mojo-platform-channel-handle=2544 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3240,i,6924701641705474706,8906879981293852961,2097152 --field-trial-handle=1996,i,9321256334952151083,2098745114370795856,262144 --variations-seed-version=20260426-030031.675000-production --mojo-platform-channel-handle=3276 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3244,i,6063992554181277739,6737527027936032781,2097152 --field-trial-handle=1996,i,9321256334952151083,2098745114370795856,262144 --variations-seed-version=20260426-030031.675000-production --mojo-platform-channel-handle=3308 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4556,i,10379272060931095012,15513022241300806563,2097152 --field-trial-handle=1996,i,9321256334952151083,2098745114370795856,262144 --variations-seed-version=20260426-030031.675000-production --mojo-platform-channel-handle=4572 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5340,i,7432847280855928384,15972780106166341072,524288 --field-trial-handle=1996,i,9321256334952151083,2098745114370795856,262144 --variations-seed-version=20260426-030031.675000-production --mojo-platform-channel-handle=5348 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5380,i,4389110222044790892,7444240170700853596,2097152 --field-trial-handle=1996,i,9321256334952151083,2098745114370795856,262144 --variations-seed-version=20260426-030031.675000-production --mojo-platform-channel-handle=5588 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=3460,i,5128288624986883942,2579177572930590111,2097152 --field-trial-handle=1996,i,9321256334952151083,2098745114370795856,262144 --variations-seed-version=20260426-030031.675000-production --mojo-platform-channel-handle=3508 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4396,i,3574703394700812673,1481671677223961421,524288 --field-trial-handle=1996,i,9321256334952151083,2098745114370795856,262144 --variations-seed-version=20260426-030031.675000-production --mojo-platform-channel-handle=3384 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=3340,i,5470822220420628759,384830923578747229,524288 --field-trial-handle=1996,i,9321256334952151083,2098745114370795856,262144 --variations-seed-version=20260426-030031.675000-production --mojo-platform-channel-handle=3296 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6064,i,7045196902446247707,3985312710094471074,524288 --field-trial-handle=1996,i,9321256334952151083,2098745114370795856,262144 --variations-seed-version=20260426-030031.675000-production --mojo-platform-channel-handle=6044 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6076,i,7689941356167885340,16071090617131879660,524288 --field-trial-handle=1996,i,9321256334952151083,2098745114370795856,262144 --variations-seed-version=20260426-030031.675000-production --mojo-platform-channel-handle=6116 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6080,i,11645452740028269933,8560836589395829001,524288 --field-trial-handle=1996,i,9321256334952151083,2098745114370795856,262144 --variations-seed-version=20260426-030031.675000-production --mojo-platform-channel-handle=6056 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6064,i,10795715583013759336,13043335250362604207,2097152 --field-trial-handle=1996,i,9321256334952151083,2098745114370795856,262144 --variations-seed-version=20260426-030031.675000-production --mojo-platform-channel-handle=6084 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6208,i,8765545565651438289,2406476386097485139,2097152 --field-trial-handle=1996,i,9321256334952151083,2098745114370795856,262144 --variations-seed-version=20260426-030031.675000-production --mojo-platform-channel-handle=6232 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6384,i,15748974996882497295,15444849910737371398,2097152 --field-trial-handle=1996,i,9321256334952151083,2098745114370795856,262144 --variations-seed-version=20260426-030031.675000-production --mojo-platform-channel-handle=6416 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6348,i,17823242024917598551,6555299196870349748,2097152 --field-trial-handle=1996,i,9321256334952151083,2098745114370795856,262144 --variations-seed-version=20260426-030031.675000-production --mojo-platform-channel-handle=6584 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6160,i,6765382318008450452,7632256803830501806,2097152 --field-trial-handle=1996,i,9321256334952151083,2098745114370795856,262144 --variations-seed-version=20260426-030031.675000-production --mojo-platform-channel-handle=5856 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6936,i,11685842352251717369,11775342923806423596,524288 --field-trial-handle=1996,i,9321256334952151083,2098745114370795856,262144 --variations-seed-version=20260426-030031.675000-production --mojo-platform-channel-handle=6032 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6032,i,8058000588559931049,3919996397942772803,262144 --field-trial-handle=1996,i,9321256334952151083,2098745114370795856,262144 --variations-seed-version=20260426-030031.675000-production --mojo-platform-channel-handle=6928 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6872,i,7087461049659765000,7661153005676562424,2097152 --field-trial-handle=1996,i,9321256334952151083,2098745114370795856,262144 --variations-seed-version=20260426-030031.675000-production --mojo-platform-channel-handle=5380 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6284,i,17799856818051639626,10467702978016878154,2097152 --field-trial-handle=1996,i,9321256334952151083,2098745114370795856,262144 --variations-seed-version=20260426-030031.675000-production --mojo-platform-channel-handle=6340 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=6452,i,14478881023373027354,8916329023919925242,2097152 --field-trial-handle=1996,i,9321256334952151083,2098745114370795856,262144 --variations-seed-version=20260426-030031.675000-production --mojo-platform-channel-handle=6324 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=5704,i,7889246218810468168,7741973374752931772,2097152 --field-trial-handle=1996,i,9321256334952151083,2098745114370795856,262144 --variations-seed-version=20260426-030031.675000-production --mojo-platform-channel-handle=6748 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=4416,i,4262304591111962664,11952236750048013575,2097152 --field-trial-handle=1996,i,9321256334952151083,2098745114370795856,262144 --variations-seed-version=20260426-030031.675000-production --mojo-platform-channel-handle=6736 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=6808,i,11671726944715908372,9854846303848897974,2097152 --field-trial-handle=1996,i,9321256334952151083,2098745114370795856,262144 --variations-seed-version=20260426-030031.675000-production --mojo-platform-channel-handle=6236 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=6756,i,4698011050535807858,2224385653260925289,2097152 --field-trial-handle=1996,i,9321256334952151083,2098745114370795856,262144 --variations-seed-version=20260426-030031.675000-production --mojo-platform-channel-handle=6884 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=6844,i,9663325694034654650,14149456351962585025,2097152 --field-trial-handle=1996,i,9321256334952151083,2098745114370795856,262144 --variations-seed-version=20260426-030031.675000-production --mojo-platform-channel-handle=5924 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=6440,i,313502940013048835,10109595056360495484,2097152 --field-trial-handle=1996,i,9321256334952151083,2098745114370795856,262144 --variations-seed-version=20260426-030031.675000-production --mojo-platform-channel-handle=6376 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=6364,i,14394960248454851211,15477003415916847922,2097152 --field-trial-handle=1996,i,9321256334952151083,2098745114370795856,262144 --variations-seed-version=20260426-030031.675000-production --mojo-platform-channel-handle=4416 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --metrics-shmem-handle=5644,i,7247611782839026349,10296652008027709469,2097152 --field-trial-handle=1996,i,9321256334952151083,2098745114370795856,262144 --variations-seed-version=20260426-030031.675000-production --mojo-platform-channel-handle=5484 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --metrics-shmem-handle=6776,i,7327844523122943064,4530791226890297471,2097152 --field-trial-handle=1996,i,9321256334952151083,2098745114370795856,262144 --variations-seed-version=20260426-030031.675000-production --mojo-platform-channel-handle=5664 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --metrics-shmem-handle=7204,i,3396139360560747182,15759566460156783946,2097152 --field-trial-handle=1996,i,9321256334952151083,2098745114370795856,262144 --variations-seed-version=20260426-030031.675000-production --mojo-platform-channel-handle=7212 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --metrics-shmem-handle=3052,i,5965553156440216423,11769530654867617250,2097152 --field-trial-handle=1996,i,9321256334952151083,2098745114370795856,262144 --variations-seed-version=20260426-030031.675000-production --mojo-platform-channel-handle=7436 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --metrics-shmem-handle=8108,i,11218486008790708095,8185866978850044040,2097152 --field-trial-handle=1996,i,9321256334952151083,2098745114370795856,262144 --variations-seed-version=20260426-030031.675000-production --mojo-platform-channel-handle=8112 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --metrics-shmem-handle=7780,i,3253738530555865286,6719045779332775110,2097152 --field-trial-handle=1996,i,9321256334952151083,2098745114370795856,262144 --variations-seed-version=20260426-030031.675000-production --mojo-platform-channel-handle=7836 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --metrics-shmem-handle=7924,i,8299884749538788554,4645653625011579252,2097152 --field-trial-handle=1996,i,9321256334952151083,2098745114370795856,262144 --variations-seed-version=20260426-030031.675000-production --mojo-platform-channel-handle=7668 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --metrics-shmem-handle=5856,i,2199283654982620518,6750891219628932147,2097152 --field-trial-handle=1996,i,9321256334952151083,2098745114370795856,262144 --variations-seed-version=20260426-030031.675000-production --mojo-platform-channel-handle=5880 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --metrics-shmem-handle=6392,i,5481059050386217059,15616390390408457203,2097152 --field-trial-handle=1996,i,9321256334952151083,2098745114370795856,262144 --variations-seed-version=20260426-030031.675000-production --mojo-platform-channel-handle=6504 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --metrics-shmem-handle=7460,i,2004887686876767730,12484198294010798899,2097152 --field-trial-handle=1996,i,9321256334952151083,2098745114370795856,262144 --variations-seed-version=20260426-030031.675000-production --mojo-platform-channel-handle=7192 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --metrics-shmem-handle=7844,i,9909848627865174500,892282783475021241,2097152 --field-trial-handle=1996,i,9321256334952151083,2098745114370795856,262144 --variations-seed-version=20260426-030031.675000-production --mojo-platform-channel-handle=5908 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --metrics-shmem-handle=8072,i,2954333964597831753,1024485192328934014,2097152 --field-trial-handle=1996,i,9321256334952151083,2098745114370795856,262144 --variations-seed-version=20260426-030031.675000-production --mojo-platform-channel-handle=7892 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --metrics-shmem-handle=7700,i,7558992984343268085,1770732858416597385,2097152 --field-trial-handle=1996,i,9321256334952151083,2098745114370795856,262144 --variations-seed-version=20260426-030031.675000-production --mojo-platform-channel-handle=8068 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --metrics-shmem-handle=7228,i,5185321204978356198,11230837537609176299,2097152 --field-trial-handle=1996,i,9321256334952151083,2098745114370795856,262144 --variations-seed-version=20260426-030031.675000-production --mojo-platform-channel-handle=6012 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --metrics-shmem-handle=8064,i,4356591454767642259,4880309089603479607,2097152 --field-trial-handle=1996,i,9321256334952151083,2098745114370795856,262144 --variations-seed-version=20260426-030031.675000-production --mojo-platform-channel-handle=6100 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --metrics-shmem-handle=7864,i,8235583718136643457,16798466527315999674,2097152 --field-trial-handle=1996,i,9321256334952151083,2098745114370795856,262144 --variations-seed-version=20260426-030031.675000-production --mojo-platform-channel-handle=7324 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵
-
C:\Users\Admin\Downloads\WinNuke.98.exe"C:\Users\Admin\Downloads\WinNuke.98.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v16
Persistence
Event Triggered Execution
2Change Default File Association
1Component Object Model Hijacking
1Privilege Escalation
Event Triggered Execution
2Change Default File Association
1Component Object Model Hijacking
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
Rar.txt
Uninstall.exe
WhatsNew.txt
WinRAR.chm
WinRAR.exe
uninstall.lng
temp_cookies_2_1050590496110.sqlite
settings.dat
3cb1a24a-2bd8-43f8-9d7d-fa9c74fd6ed6.tmp
BookmarkMergedSurfaceOrdering
BrowsingTopicsState
f_000006
f_000009
f_00000a
f_00000b
f_00000f
f_00003c
f_00003d
f_00003e
f_00003f
f_000041
f_0000ac
f_0000ad
f_0000ae
f_0000af
f_0000c6
f_0000ce
f_0000d7
f_0000df
f_0000e0
f_0000e5
f_0000e6
f_0000e7
f_0000e8
f_0000e9
f_0000ea
f_0000eb
f_0000ec
f_0000ed
f_0000ee
f_0000ef
f_0000f1
f_0001be
f_0001bf
f_0001c0
f_0001c5
2b50dfc0179aa00f_0
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
000001.dbtmp
MANIFEST-000001
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
a6d9560b-81b7-4bf2-88a3-e955b9b70009.tmp
d401b8dc-d55b-4b66-9789-b88647f78912.tmp
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
index.txt
index.txt
index.txt~RFe588fe7.TMP
the-real-index
the-real-index~RFe5887d8.TMP
the-real-index
index.txt
index.txt~RFe5d7b7c.TMP
000003.log
LOG
LOG
LOG
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Uninstall Loader.exe
d3dcompiler_47.dll
ta.pak
resources.pak
sikko.jar
jna3255270104056291020.dll
LICENSE.electron.txt
LICENSES.chromium.html
chrome_100_percent.pak
chrome_200_percent.pak
ffmpeg.dll
icudtl.dat
libEGL.dll
libGLESv2.dll
af.pak
am.pak
ar.pak
bg.pak
bn.pak
ca.pak
cs.pak
da.pak
de.pak
el.pak
en-GB.pak
en-US.pak
es-419.pak
es.pak
et.pak
fa.pak
fi.pak
fil.pak
fr.pak
gu.pak
he.pak
hi.pak
hr.pak
hu.pak
id.pak
it.pak
ja.pak
kn.pak
ko.pak
lt.pak
lv.pak
ml.pak
mr.pak
ms.pak
nb.pak
nl.pak
pl.pak
pt-BR.pak
pt-PT.pak
ro.pak
ru.pak
sk.pak
sl.pak
sr.pak
sv.pak
sw.pak
te.pak
th.pak
tr.pak
uk.pak
ur.pak
vi.pak
zh-CN.pak
zh-TW.pak
app.asar
jre.zip
elevate.exe
snapshot_blob.bin
v8_context_snapshot.bin
vk_swiftshader.dll
vk_swiftshader_icd.json
vulkan-1.dll
SpiderBanner.dll
StdUtils.dll
System.dll
WinShell.dll
nsExec.dll
nsis7z.dll
sqlite-3.36.0.3-bd2a4ff1-db90-4f50-9d44-05b23b9408f7-sqlitejdbc.dll
api-ms-win-core-console-l1-1-0.dll
api-ms-win-core-console-l1-2-0.dll
api-ms-win-core-datetime-l1-1-0.dll
api-ms-win-core-debug-l1-1-0.dll
api-ms-win-core-errorhandling-l1-1-0.dll
api-ms-win-core-fibers-l1-1-0.dll
api-ms-win-core-file-l1-1-0.dll
api-ms-win-core-file-l1-2-0.dll
api-ms-win-core-file-l2-1-0.dll
api-ms-win-core-handle-l1-1-0.dll
api-ms-win-core-heap-l1-1-0.dll
api-ms-win-core-interlocked-l1-1-0.dll
api-ms-win-core-libraryloader-l1-1-0.dll
api-ms-win-core-localization-l1-2-0.dll
api-ms-win-core-memory-l1-1-0.dll
api-ms-win-core-namedpipe-l1-1-0.dll
api-ms-win-core-processenvironment-l1-1-0.dll
api-ms-win-core-processthreads-l1-1-0.dll
api-ms-win-core-processthreads-l1-1-1.dll
api-ms-win-core-profile-l1-1-0.dll
api-ms-win-core-rtlsupport-l1-1-0.dll
api-ms-win-core-string-l1-1-0.dll
api-ms-win-core-synch-l1-1-0.dll
api-ms-win-core-synch-l1-2-0.dll
api-ms-win-core-sysinfo-l1-1-0.dll
api-ms-win-core-timezone-l1-1-0.dll
api-ms-win-core-util-l1-1-0.dll
api-ms-win-crt-conio-l1-1-0.dll
api-ms-win-crt-convert-l1-1-0.dll
api-ms-win-crt-environment-l1-1-0.dll
api-ms-win-crt-filesystem-l1-1-0.dll
api-ms-win-crt-heap-l1-1-0.dll
api-ms-win-crt-locale-l1-1-0.dll
api-ms-win-crt-math-l1-1-0.dll
api-ms-win-crt-multibyte-l1-1-0.dll
api-ms-win-crt-private-l1-1-0.dll
api-ms-win-crt-process-l1-1-0.dll
api-ms-win-crt-runtime-l1-1-0.dll
api-ms-win-crt-stdio-l1-1-0.dll
api-ms-win-crt-string-l1-1-0.dll
api-ms-win-crt-time-l1-1-0.dll
api-ms-win-crt-utility-l1-1-0.dll
micro.exe
US_export_policy.jar
default.dic
5d696d521de238c3.customDestinations-ms
5d696d521de238c3.customDestinations-ms
Unconfirmed 269341.crdownload
Unconfirmed 571548.crdownload
memory/756-1332-0x0000012B9BDA0000-0x0000012B9BE4C000-memory.dmp
memory/2168-1317-0x0000026515630000-0x00000265156DC000-memory.dmp
memory/2284-1335-0x00000202CB390000-0x00000202CB43C000-memory.dmp
memory/3016-2340-0x000001A791300000-0x000001A7913AC000-memory.dmp
memory/3936-106-0x00000218E7680000-0x00000218E772C000-memory.dmp
memory/4820-2524-0x000002293EA80000-0x000002293EB2C000-memory.dmp
memory/5596-4329-0x0000019E6C100000-0x0000019E6C1AC000-memory.dmp
memory/6708-3537-0x0000025D9AAE0000-0x0000025D9AB8C000-memory.dmp
memory/7480-4845-0x000001E45F400000-0x000001E45F4AC000-memory.dmp
memory/7860-4647-0x0000000070BC0000-0x0000000070C9C000-memory.dmp
memory/7860-3868-0x000002EE27010000-0x000002EE27018000-memory.dmp
memory/7860-4603-0x000002EE26F90000-0x000002EE26F91000-memory.dmp
memory/7860-4593-0x000002EE26F90000-0x000002EE26F91000-memory.dmp
memory/7860-4590-0x0000000070BC0000-0x0000000070C9C000-memory.dmp
memory/7860-4568-0x000002EE26F90000-0x000002EE26F91000-memory.dmp
memory/7860-4570-0x000002EE26F90000-0x000002EE26F91000-memory.dmp
memory/7860-4569-0x000002EE26F90000-0x000002EE26F91000-memory.dmp
memory/7860-4539-0x000002EE26F90000-0x000002EE26F91000-memory.dmp
memory/7860-4529-0x000002EE26F90000-0x000002EE26F91000-memory.dmp
memory/7860-4504-0x000002EE26F90000-0x000002EE26F91000-memory.dmp
memory/7860-4469-0x000002EE26F90000-0x000002EE26F91000-memory.dmp
memory/7860-4475-0x000002EE26F90000-0x000002EE26F91000-memory.dmp
memory/7860-4476-0x000002EE26F90000-0x000002EE26F91000-memory.dmp
memory/7860-4485-0x000002EE26F90000-0x000002EE26F91000-memory.dmp
memory/7860-4465-0x000002EE26F90000-0x000002EE26F91000-memory.dmp
memory/7860-4428-0x000002EE26F90000-0x000002EE26F91000-memory.dmp
memory/7860-4429-0x000002EE26F90000-0x000002EE26F91000-memory.dmp
memory/7860-4437-0x000002EE26F90000-0x000002EE26F91000-memory.dmp
memory/7860-4455-0x000002EE26F90000-0x000002EE26F91000-memory.dmp
memory/7860-4419-0x000002EE26F90000-0x000002EE26F91000-memory.dmp
memory/7860-4432-0x000002EE26F90000-0x000002EE26F91000-memory.dmp
memory/7860-4434-0x000002EE26F90000-0x000002EE26F91000-memory.dmp
memory/7860-4435-0x000002EE26F90000-0x000002EE26F91000-memory.dmp
memory/7860-4655-0x000002EE26F90000-0x000002EE26F91000-memory.dmp
memory/7860-4708-0x0000000070BC0000-0x0000000070C9C000-memory.dmp
memory/7860-3807-0x000002EE26F90000-0x000002EE26F91000-memory.dmp
memory/7860-3798-0x000002EE26F90000-0x000002EE26F91000-memory.dmp
memory/7860-3799-0x000002EE26F90000-0x000002EE26F91000-memory.dmp
memory/7860-3802-0x000002EE26F90000-0x000002EE26F91000-memory.dmp
memory/7860-3794-0x000002EE26F90000-0x000002EE26F91000-memory.dmp
memory/7860-3765-0x000002EE26F90000-0x000002EE26F91000-memory.dmp
memory/7860-3766-0x000002EE26F90000-0x000002EE26F91000-memory.dmp
memory/7860-4660-0x000002EE26F90000-0x000002EE26F91000-memory.dmp
memory/7860-4663-0x000002EE26F90000-0x000002EE26F91000-memory.dmp
memory/7860-3762-0x000002EE26F90000-0x000002EE26F91000-memory.dmp
memory/7860-3584-0x000002EE26F90000-0x000002EE26F91000-memory.dmp
memory/7860-3547-0x000002EE26F90000-0x000002EE26F91000-memory.dmp
memory/7860-3545-0x000002EE26F90000-0x000002EE26F91000-memory.dmp
memory/7860-4664-0x000002EE26F90000-0x000002EE26F91000-memory.dmp
memory/7860-4675-0x000002EE26F90000-0x000002EE26F91000-memory.dmp
memory/7860-4676-0x000002EE26F90000-0x000002EE26F91000-memory.dmp
memory/7860-4683-0x000002EE26F90000-0x000002EE26F91000-memory.dmp
memory/7860-4690-0x000002EE26F90000-0x000002EE26F91000-memory.dmp
memory/7860-4688-0x000002EE26F90000-0x000002EE26F91000-memory.dmp
memory/7860-4684-0x000002EE26F90000-0x000002EE26F91000-memory.dmp
memory/7860-4706-0x000002EE26F90000-0x000002EE26F91000-memory.dmp
memory/7860-4707-0x000002EE27010000-0x000002EE27018000-memory.dmp
memory/8228-4846-0x0000022286660000-0x000002228670C000-memory.dmp