Analysis
- user interaction
yes - max time kernel
1799s - max time network
1801s - platform
windows10-2004_x64 - resource
win10v2004-20260130-fr - resource tags
- submitted
09/05/2026, 23:20
General
- Target https://filecr.com/file-download/?id=041922314000
- Sample260509-3blnxset5v
Score
8/10
Malware Config
Signatures
- Downloads MZ/PE file 1 IoCs
- Checks computer location settings 2 TTPs 16 IoCs
Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 64 IoCs
- Loads dropped DLL 64 IoCs
- VMProtect packed file 3 IoCs
Detects executables packed with VMProtect commercial packer.
- Adds Run key to start application 2 TTPs 3 IoCs
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
- Writes to the Master Boot Record (MBR) 1 TTPs 5 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Drops file in System32 directory 51 IoCs
- Enumerates processes with tasklist 1 TTPs 1 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 8 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 24 IoCs
- Modifies Control Panel 2 IoCs
- Modifies Internet Explorer settings 1 TTPs 6 IoCs
- Modifies data under HKEY_USERS 24 IoCs
- Modifies registry class 64 IoCs
- Suspicious behavior: AddClipboardFormatListener 6 IoCs
- Suspicious behavior: EnumeratesProcesses 59 IoCs
- Suspicious behavior: GetForegroundWindowSpam 5 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 32 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 64 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://filecr.com/file-download/?id=0419223140001⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ff85afdc188,0x7ff85afdc194,0x7ff85afdc1a02⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=fr --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1844,i,2371488129117484160,5704209778252361177,524288 --field-trial-handle=2872,i,936411054864673397,6070415609859766434,262144 --variations-seed-version --mojo-platform-channel-handle=2936 /prefetch:32⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1716,i,12465968185964140798,1222875759277466352,262144 --field-trial-handle=2872,i,936411054864673397,6070415609859766434,262144 --variations-seed-version --mojo-platform-channel-handle=2864 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2324,i,1741005545035367989,11992359381834756915,524288 --field-trial-handle=2872,i,936411054864673397,6070415609859766434,262144 --variations-seed-version --mojo-platform-channel-handle=2944 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,4825269265103585373,2617936178692134087,2097152 --field-trial-handle=2872,i,936411054864673397,6070415609859766434,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,10943535780327275299,2449144378191887247,2097152 --field-trial-handle=2872,i,936411054864673397,6070415609859766434,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4980,i,7186556251058464054,11703502672487198403,2097152 --field-trial-handle=2872,i,936411054864673397,6070415609859766434,262144 --variations-seed-version --mojo-platform-channel-handle=4952 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4276,i,659199429406019432,14757110279354530322,2097152 --field-trial-handle=2872,i,936411054864673397,6070415609859766434,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=fr --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3652,i,11941348246224390970,10102345038894652161,524288 --field-trial-handle=2872,i,936411054864673397,6070415609859766434,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=fr --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3656,i,15744435478920545259,17676571463977743056,524288 --field-trial-handle=2872,i,936411054864673397,6070415609859766434,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5952,i,11440125431335992036,13718298496026418789,524288 --field-trial-handle=2872,i,936411054864673397,6070415609859766434,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5952,i,11440125431335992036,13718298496026418789,524288 --field-trial-handle=2872,i,936411054864673397,6070415609859766434,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6480,i,7372848460126165386,15933195906057336189,2097152 --field-trial-handle=2872,i,936411054864673397,6070415609859766434,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6748,i,14585701916701900902,12737483351491983684,2097152 --field-trial-handle=2872,i,936411054864673397,6070415609859766434,262144 --variations-seed-version --mojo-platform-channel-handle=6716 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=7004,i,14163530973114557109,4064215852912333305,2097152 --field-trial-handle=2872,i,936411054864673397,6070415609859766434,262144 --variations-seed-version --mojo-platform-channel-handle=7056 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=7232,i,9222611651679422395,17371181969212729889,2097152 --field-trial-handle=2872,i,936411054864673397,6070415609859766434,262144 --variations-seed-version --mojo-platform-channel-handle=7244 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=7140,i,12760574103189177279,16750034707224036750,2097152 --field-trial-handle=2872,i,936411054864673397,6070415609859766434,262144 --variations-seed-version --mojo-platform-channel-handle=7420 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=7068,i,4420271997510617954,208328051736631086,2097152 --field-trial-handle=2872,i,936411054864673397,6070415609859766434,262144 --variations-seed-version --mojo-platform-channel-handle=7264 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=fr --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7560,i,15763078202705457436,529638211980095458,524288 --field-trial-handle=2872,i,936411054864673397,6070415609859766434,262144 --variations-seed-version --mojo-platform-channel-handle=6580 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=fr --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6600,i,5383346819274206659,13500902643240619471,524288 --field-trial-handle=2872,i,936411054864673397,6070415609859766434,262144 --variations-seed-version --mojo-platform-channel-handle=6568 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=fr --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6588,i,12595458175844366010,14792182480391121900,524288 --field-trial-handle=2872,i,936411054864673397,6070415609859766434,262144 --variations-seed-version --mojo-platform-channel-handle=6956 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7140,i,1429466460526294674,4482635575525974266,2097152 --field-trial-handle=2872,i,936411054864673397,6070415609859766434,262144 --variations-seed-version --mojo-platform-channel-handle=7700 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=fr --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3644,i,6423902957384800296,1626439451996290443,524288 --field-trial-handle=2872,i,936411054864673397,6070415609859766434,262144 --variations-seed-version --mojo-platform-channel-handle=7672 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8132,i,18287266246906196729,153481553866916611,524288 --field-trial-handle=2872,i,936411054864673397,6070415609859766434,262144 --variations-seed-version --mojo-platform-channel-handle=8152 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=fr --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8000,i,16511958990256348069,8780743967913592692,524288 --field-trial-handle=2872,i,936411054864673397,6070415609859766434,262144 --variations-seed-version --mojo-platform-channel-handle=8328 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=8344,i,17897138221306971371,5836976613307989509,2097152 --field-trial-handle=2872,i,936411054864673397,6070415609859766434,262144 --variations-seed-version --mojo-platform-channel-handle=7268 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=7276,i,11921438537500929544,7477022540314944940,2097152 --field-trial-handle=2872,i,936411054864673397,6070415609859766434,262144 --variations-seed-version --mojo-platform-channel-handle=7488 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=fr --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3656,i,1072993298136181547,14654093456607478445,524288 --field-trial-handle=2872,i,936411054864673397,6070415609859766434,262144 --variations-seed-version --mojo-platform-channel-handle=8276 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=6456,i,17937855691394833225,18206761665098519627,2097152 --field-trial-handle=2872,i,936411054864673397,6070415609859766434,262144 --variations-seed-version --mojo-platform-channel-handle=8128 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7836,i,16954599845769117014,11258395640627349096,262144 --field-trial-handle=2872,i,936411054864673397,6070415609859766434,262144 --variations-seed-version --mojo-platform-channel-handle=7800 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6016,i,9638361702142743814,13390200927358653296,524288 --field-trial-handle=2872,i,936411054864673397,6070415609859766434,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=fr --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8160,i,17200911957462720735,15948934151294958574,524288 --field-trial-handle=2872,i,936411054864673397,6070415609859766434,262144 --variations-seed-version --mojo-platform-channel-handle=5712 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7928,i,7815164022883971185,16053423601420479784,524288 --field-trial-handle=2872,i,936411054864673397,6070415609859766434,262144 --variations-seed-version --mojo-platform-channel-handle=7716 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8340,i,16008113731931897948,7557706862934829660,524288 --field-trial-handle=2872,i,936411054864673397,6070415609859766434,262144 --variations-seed-version --mojo-platform-channel-handle=1552 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=fr --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5364,i,7025534388132093590,8269804193842546841,524288 --field-trial-handle=2872,i,936411054864673397,6070415609859766434,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=fr --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7868,i,8712412860902218530,3394008934743918452,524288 --field-trial-handle=2872,i,936411054864673397,6070415609859766434,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7656,i,2315596733789798580,1690690708834305002,524288 --field-trial-handle=2872,i,936411054864673397,6070415609859766434,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=8120,i,705251509315831115,15689854212994134250,2097152 --field-trial-handle=2872,i,936411054864673397,6070415609859766434,262144 --variations-seed-version --mojo-platform-channel-handle=3400 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=7792,i,10056334403050794482,5287932561434827820,2097152 --field-trial-handle=2872,i,936411054864673397,6070415609859766434,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=7184,i,7219499881644552893,6931343609220708052,2097152 --field-trial-handle=2872,i,936411054864673397,6070415609859766434,262144 --variations-seed-version --mojo-platform-channel-handle=7752 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=7784,i,15257971616264330112,7707123292631680502,2097152 --field-trial-handle=2872,i,936411054864673397,6070415609859766434,262144 --variations-seed-version --mojo-platform-channel-handle=8452 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7840,i,25240352297345369,16138187283435212263,524288 --field-trial-handle=2872,i,936411054864673397,6070415609859766434,262144 --variations-seed-version --mojo-platform-channel-handle=6456 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8468,i,1251733506921611834,4188110523816531576,524288 --field-trial-handle=2872,i,936411054864673397,6070415609859766434,262144 --variations-seed-version --mojo-platform-channel-handle=1532 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7332,i,10074473793562023481,13332064447889147257,524288 --field-trial-handle=2872,i,936411054864673397,6070415609859766434,262144 --variations-seed-version --mojo-platform-channel-handle=7752 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=fr --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8396,i,11859978707927942675,12292503167522555211,524288 --field-trial-handle=2872,i,936411054864673397,6070415609859766434,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7164,i,6687509169904681643,107280348604389069,524288 --field-trial-handle=2872,i,936411054864673397,6070415609859766434,262144 --variations-seed-version --mojo-platform-channel-handle=7140 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1336,i,16894634195028893931,3197010035128874498,524288 --field-trial-handle=2872,i,936411054864673397,6070415609859766434,262144 --variations-seed-version --mojo-platform-channel-handle=7460 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7888,i,8524982286206919182,15075838973311684864,524288 --field-trial-handle=2872,i,936411054864673397,6070415609859766434,262144 --variations-seed-version --mojo-platform-channel-handle=7264 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=fr --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7488,i,12433780827775134878,8865389870804397232,524288 --field-trial-handle=2872,i,936411054864673397,6070415609859766434,262144 --variations-seed-version --mojo-platform-channel-handle=8296 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=5548,i,3008886844917990437,7450607696860697270,2097152 --field-trial-handle=2872,i,936411054864673397,6070415609859766434,262144 --variations-seed-version --mojo-platform-channel-handle=6568 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --metrics-shmem-handle=6888,i,13426742878563401928,14666117150509762272,2097152 --field-trial-handle=2872,i,936411054864673397,6070415609859766434,262144 --variations-seed-version --mojo-platform-channel-handle=8352 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --always-read-main-dll --metrics-shmem-handle=3960,i,9012660585277781549,11732547306405577405,2097152 --field-trial-handle=2872,i,936411054864673397,6070415609859766434,262144 --variations-seed-version --mojo-platform-channel-handle=7868 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --always-read-main-dll --metrics-shmem-handle=3532,i,14655620591005978676,17404724318734186352,2097152 --field-trial-handle=2872,i,936411054864673397,6070415609859766434,262144 --variations-seed-version --mojo-platform-channel-handle=7636 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --always-read-main-dll --metrics-shmem-handle=7620,i,3580395722220672358,13800926013396422521,2097152 --field-trial-handle=2872,i,936411054864673397,6070415609859766434,262144 --variations-seed-version --mojo-platform-channel-handle=7896 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --always-read-main-dll --metrics-shmem-handle=8584,i,12401143279215788841,10495128475673219323,2097152 --field-trial-handle=2872,i,936411054864673397,6070415609859766434,262144 --variations-seed-version --mojo-platform-channel-handle=8560 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --always-read-main-dll --metrics-shmem-handle=8672,i,5822242466210783187,3902301718583325856,2097152 --field-trial-handle=2872,i,936411054864673397,6070415609859766434,262144 --variations-seed-version --mojo-platform-channel-handle=8652 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8236,i,16912454858626371624,5968484987650107569,524288 --field-trial-handle=2872,i,936411054864673397,6070415609859766434,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8408,i,566262910994134279,13817267770056034336,524288 --field-trial-handle=2872,i,936411054864673397,6070415609859766434,262144 --variations-seed-version --mojo-platform-channel-handle=8548 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --always-read-main-dll --metrics-shmem-handle=7980,i,17275308192489885322,8068239192074608735,2097152 --field-trial-handle=2872,i,936411054864673397,6070415609859766434,262144 --variations-seed-version --mojo-platform-channel-handle=7868 /prefetch:12⤵
-
-
C:\Users\Admin\Downloads\vray_72000_sketchup_studio_win.exe"C:\Users\Admin\Downloads\vray_72000_sketchup_studio_win.exe"2⤵
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --always-read-main-dll --metrics-shmem-handle=6684,i,11200284824132286815,16191091082132765097,2097152 --field-trial-handle=2872,i,936411054864673397,6070415609859766434,262144 --variations-seed-version --mojo-platform-channel-handle=8304 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --always-read-main-dll --metrics-shmem-handle=7732,i,12447260816370513062,17927132358513903885,2097152 --field-trial-handle=2872,i,936411054864673397,6070415609859766434,262144 --variations-seed-version --mojo-platform-channel-handle=7920 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --always-read-main-dll --metrics-shmem-handle=6876,i,7566515611541609574,9607835954804819821,2097152 --field-trial-handle=2872,i,936411054864673397,6070415609859766434,262144 --variations-seed-version --mojo-platform-channel-handle=7172 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --always-read-main-dll --metrics-shmem-handle=8792,i,3774003724501889435,8581227878778975973,2097152 --field-trial-handle=2872,i,936411054864673397,6070415609859766434,262144 --variations-seed-version --mojo-platform-channel-handle=7980 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8804,i,7811572378117315529,12475785224257885273,524288 --field-trial-handle=2872,i,936411054864673397,6070415609859766434,262144 --variations-seed-version --mojo-platform-channel-handle=8640 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8296,i,5086796406693188371,2251687892046514505,524288 --field-trial-handle=2872,i,936411054864673397,6070415609859766434,262144 --variations-seed-version --mojo-platform-channel-handle=8280 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8296,i,5086796406693188371,2251687892046514505,524288 --field-trial-handle=2872,i,936411054864673397,6070415609859766434,262144 --variations-seed-version --mojo-platform-channel-handle=8280 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --always-read-main-dll --metrics-shmem-handle=7664,i,1017039032463354430,6104644422014767502,2097152 --field-trial-handle=2872,i,936411054864673397,6070415609859766434,262144 --variations-seed-version --mojo-platform-channel-handle=8460 /prefetch:12⤵
-
-
C:\Users\Admin\Downloads\vray_72000_sketchup_studio_win.exe"C:\Users\Admin\Downloads\vray_72000_sketchup_studio_win.exe"2⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x240,0x244,0x248,0x23c,0x264,0x7ff85afdc188,0x7ff85afdc194,0x7ff85afdc1a03⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1984,i,3232684260152172013,7599593433277026005,524288 --field-trial-handle=2112,i,3116710102521548073,16356685853319320480,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:33⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1760,i,8390451367633875156,584505935431962566,262144 --field-trial-handle=2112,i,3116710102521548073,16356685853319320480,262144 --variations-seed-version --mojo-platform-channel-handle=2108 /prefetch:23⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2580,i,11562637725957045902,10453888853118244102,524288 --field-trial-handle=2112,i,3116710102521548073,16356685853319320480,262144 --variations-seed-version --mojo-platform-channel-handle=2588 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4196,i,14210749243502752789,10971949047172840048,524288 --field-trial-handle=2112,i,3116710102521548073,16356685853319320480,262144 --variations-seed-version --mojo-platform-channel-handle=3428 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4196,i,14210749243502752789,10971949047172840048,524288 --field-trial-handle=2112,i,3116710102521548073,16356685853319320480,262144 --variations-seed-version --mojo-platform-channel-handle=3428 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=fr --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4448,i,13800304357050505561,3055423424978764583,524288 --field-trial-handle=2112,i,3116710102521548073,16356685853319320480,262144 --variations-seed-version --mojo-platform-channel-handle=4808 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=fr --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4796,i,11120063984452319472,13572133948306597454,524288 --field-trial-handle=2112,i,3116710102521548073,16356685853319320480,262144 --variations-seed-version --mojo-platform-channel-handle=4804 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=fr --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4456,i,4994747472557019622,142181832136339598,524288 --field-trial-handle=2112,i,3116710102521548073,16356685853319320480,262144 --variations-seed-version --mojo-platform-channel-handle=4800 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2212,i,12855492979039461129,3368345275560586979,524288 --field-trial-handle=2112,i,3116710102521548073,16356685853319320480,262144 --variations-seed-version --mojo-platform-channel-handle=4936 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5080,i,2028804793101220951,6055291070440431669,524288 --field-trial-handle=2112,i,3116710102521548073,16356685853319320480,262144 --variations-seed-version --mojo-platform-channel-handle=4624 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5080,i,6591516533818231492,5312849078016026890,262144 --field-trial-handle=2112,i,3116710102521548073,16356685853319320480,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3932,i,8802343131977057529,12309761518745680033,524288 --field-trial-handle=2112,i,3116710102521548073,16356685853319320480,262144 --variations-seed-version --mojo-platform-channel-handle=3940 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=fr --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5068,i,10947174058746901451,17049149806069415192,524288 --field-trial-handle=2112,i,3116710102521548073,16356685853319320480,262144 --variations-seed-version --mojo-platform-channel-handle=4172 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5108,i,1753188073399839005,3524274352482531402,524288 --field-trial-handle=2112,i,3116710102521548073,16356685853319320480,262144 --variations-seed-version --mojo-platform-channel-handle=4152 /prefetch:83⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap25116:172:7zEvent143361⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Downloads\SketchUp Pro 2026 v26.1.256 (x64) Multilingual\SketchUpFull-2026-1-256-82.exe"C:\Users\Admin\Downloads\SketchUp Pro 2026 v26.1.256 (x64) Multilingual\SketchUpFull-2026-1-256-82.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\{D2D8BE28-6425-46D9-A458-6A5EB4181EC4}\_isAC1.exe"C:\Users\Admin\AppData\Local\Temp\{D2D8BE28-6425-46D9-A458-6A5EB4181EC4}\_isAC1.exe" -IS_temp ORIGINALSETUPEXEDIR="C:\Users\Admin\Downloads\SketchUp Pro 2026 v26.1.256 (x64) Multilingual" ORIGINALSETUPEXENAME="SketchUpFull-2026-1-256-82.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\{D2D8BE28-6425-46D9-A458-6A5EB4181EC4}\{4D6A1F87}\setup64.exe"C:\Users\Admin\AppData\Local\Temp\{D2D8BE28-6425-46D9-A458-6A5EB4181EC4}\{4D6A1F87}\setup64.exe" -embedded:EB4506B7-4057-4504-9F2A-72FF24781EB3 -IS_temp3⤵
- Executes dropped EXE
- Enumerates connected drives
-
-
C:\Users\Admin\AppData\Local\Temp\{D2D8BE28-6425-46D9-A458-6A5EB4181EC4}\_isAC1.exe"C:\Users\Admin\AppData\Local\Temp\{D2D8BE28-6425-46D9-A458-6A5EB4181EC4}\_isAC1.exe" -embedded:2984FEA8-05F6-489A-AAAD-5F55E1D3BE81 -IS_temp3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\{D2D8BE28-6425-46D9-A458-6A5EB4181EC4}\{4D6A1F87}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{D2D8BE28-6425-46D9-A458-6A5EB4181EC4}\{4D6A1F87}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{45E9A558-3A7A-4FAA-927B-04DD6775EC46}4⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /C tasklist > "C:\Users\Admin\AppData\Local\Temp\sketchup.running"4⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\tasklist.exetasklist5⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\{D2D8BE28-6425-46D9-A458-6A5EB4181EC4}\{4D6A1F87}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{D2D8BE28-6425-46D9-A458-6A5EB4181EC4}\{4D6A1F87}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{0E3543B9-1699-4DA9-A620-2B36FF15B543}4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\{D2D8BE28-6425-46D9-A458-6A5EB4181EC4}\{4D6A1F87}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{D2D8BE28-6425-46D9-A458-6A5EB4181EC4}\{4D6A1F87}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A9B8430E-4884-4CA3-87F7-FF14108E2A0B}4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\{D2D8BE28-6425-46D9-A458-6A5EB4181EC4}\{4D6A1F87}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{D2D8BE28-6425-46D9-A458-6A5EB4181EC4}\{4D6A1F87}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{25D7CE73-4ADB-49FF-80F5-57A6DE72E038}4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\{D2D8BE28-6425-46D9-A458-6A5EB4181EC4}\{4D6A1F87}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{D2D8BE28-6425-46D9-A458-6A5EB4181EC4}\{4D6A1F87}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{92785EAA-3B93-4087-879A-7B7CD7FD7B58}4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\{D2D8BE28-6425-46D9-A458-6A5EB4181EC4}\{4D6A1F87}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{D2D8BE28-6425-46D9-A458-6A5EB4181EC4}\{4D6A1F87}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{8C5F0BCC-5E5B-4D4E-B083-5071A63E246E}4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\{D2D8BE28-6425-46D9-A458-6A5EB4181EC4}\{4D6A1F87}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{D2D8BE28-6425-46D9-A458-6A5EB4181EC4}\{4D6A1F87}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{C1D82E41-C21F-4982-8850-B3F93437B8A9}4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\{D2D8BE28-6425-46D9-A458-6A5EB4181EC4}\{4D6A1F87}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{D2D8BE28-6425-46D9-A458-6A5EB4181EC4}\{4D6A1F87}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{0C7E8E6F-6A8E-49B7-A86C-25AB3E531217}4⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\System32\regsvr32.exe /s /uninstall "C:\Program Files\SketchUp\SketchUp 2026\SketchUp\ThumbsUp.dll"4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\regsvr32.exe/s /uninstall "C:\Program Files\SketchUp\SketchUp 2026\SketchUp\ThumbsUp.dll"5⤵
- Loads dropped DLL
-
-
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\System32\regsvr32.exe /s "C:\Program Files\SketchUp\SketchUp 2026\SketchUp\ThumbsUp.dll"4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files\SketchUp\SketchUp 2026\SketchUp\ThumbsUp.dll"5⤵
- Loads dropped DLL
- Modifies registry class
-
-
-
C:\Users\Admin\AppData\Local\Temp\{D2D8BE28-6425-46D9-A458-6A5EB4181EC4}\{4D6A1F87}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{D2D8BE28-6425-46D9-A458-6A5EB4181EC4}\{4D6A1F87}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{6AFF19B1-05CF-43C1-B1F9-7DC65D7CD7DE}4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\{D2D8BE28-6425-46D9-A458-6A5EB4181EC4}\{4D6A1F87}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{D2D8BE28-6425-46D9-A458-6A5EB4181EC4}\{4D6A1F87}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E99F5AE0-FD2F-4E2F-BE72-B0E534F1E743}4⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.sketchup.com/en/v-ray-for-sketchup?version=sketchup_2026.14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://www.sketchup.com/en/v-ray-for-sketchup?version=sketchup_2026.15⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\{D2D8BE28-6425-46D9-A458-6A5EB4181EC4}\{4D6A1F87}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{D2D8BE28-6425-46D9-A458-6A5EB4181EC4}\{4D6A1F87}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E254EE87-B875-4427-A201-C708C3AB6547}4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Downloaded Installations\{41FA0AF7-12CD-4C4D-9F99-7A16B18AAEE4}\VC_redist.x64.exe"C:\Users\Admin\AppData\Local\Downloaded Installations\{41FA0AF7-12CD-4C4D-9F99-7A16B18AAEE4}\VC_redist.x64.exe" /quiet /norestart3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\Temp\{8A083A6C-F016-4D62-87E1-1DDCC9C42C5B}\.cr\VC_redist.x64.exe"C:\Windows\Temp\{8A083A6C-F016-4D62-87E1-1DDCC9C42C5B}\.cr\VC_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Downloaded Installations\{41FA0AF7-12CD-4C4D-9F99-7A16B18AAEE4}\VC_redist.x64.exe" -burn.filehandle.attached=564 -burn.filehandle.self=752 /quiet /norestart4⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Windows\Temp\{6F98DB4B-8200-461C-967B-217923341E37}\.be\VC_redist.x64.exe"C:\Windows\Temp\{6F98DB4B-8200-461C-967B-217923341E37}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{6D0155AC-E481-46FB-9F8C-1B10FF510D19} {01635A1D-6FE7-45CE-8115-2C3FC6050DE4} 37925⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={b49c10dd-4d54-45f8-ad13-fa25704456a4} -burn.filehandle.self=1088 -burn.embedded BurnPipe.{679CE2E6-39E7-4CE5-BBFD-62EF08FFCFC3} {1FF88DFA-C532-4DC0-BCD7-F81250BDA7A6} 50926⤵
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=544 -burn.filehandle.self=564 -uninstall -quiet -burn.related.upgrade -burn.ancestors={b49c10dd-4d54-45f8-ad13-fa25704456a4} -burn.filehandle.self=1088 -burn.embedded BurnPipe.{679CE2E6-39E7-4CE5-BBFD-62EF08FFCFC3} {1FF88DFA-C532-4DC0-BCD7-F81250BDA7A6} 50927⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{7FD7C5AA-9288-4A8E-BE12-C1768B27AFFC} {36618856-C710-444C-AAE8-742BF31A48A8} 56608⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\{D2D8BE28-6425-46D9-A458-6A5EB4181EC4}\_isAC1.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\SketchUp Pro 2026 v26.1.256 (x64) Multilingual\Readme.txt1⤵
-
C:\Users\Admin\Downloads\SketchUp Pro 2026 v26.1.256 (x64) Multilingual\SketchUpFull-2026-1-256-82.exe"C:\Users\Admin\Downloads\SketchUp Pro 2026 v26.1.256 (x64) Multilingual\SketchUpFull-2026-1-256-82.exe" /debuglog"C:\Users\Admin\Downloads\SketchUp Pro 2026 v26.1.256 (x64) Multilingual\InstallShield.log"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\{F033A845-FE3E-4A39-A238-B55301D28E16}\_isC825.exe"C:\Users\Admin\AppData\Local\Temp\{F033A845-FE3E-4A39-A238-B55301D28E16}\_isC825.exe" -IS_temp ORIGINALSETUPEXEDIR="C:\Users\Admin\Downloads\SketchUp Pro 2026 v26.1.256 (x64) Multilingual" ORIGINALSETUPEXENAME="SketchUpFull-2026-1-256-82.exe" /debuglog"C:\Users\Admin\Downloads\SketchUp Pro 2026 v26.1.256 (x64) Multilingual\InstallShield.log"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\{F033A845-FE3E-4A39-A238-B55301D28E16}\_isC825.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:21⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 29B4356906628E501858040681CACD8E2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 1F4CD24DE26B06DB85D5EB0A9FE82D7F E Global\MSI00002⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\ProgramData\Package Cache\{b49c10dd-4d54-45f8-ad13-fa25704456a4}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{b49c10dd-4d54-45f8-ad13-fa25704456a4}\VC_redist.x64.exe" /burn.runonce1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{b49c10dd-4d54-45f8-ad13-fa25704456a4}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{b49c10dd-4d54-45f8-ad13-fa25704456a4}\VC_redist.x64.exe" /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260510002627.log"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{b49c10dd-4d54-45f8-ad13-fa25704456a4}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{b49c10dd-4d54-45f8-ad13-fa25704456a4}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{b49c10dd-4d54-45f8-ad13-fa25704456a4}\VC_redist.x64.exe" -burn.filehandle.attached=520 -burn.filehandle.self=540 /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260510002627.log"3⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{b49c10dd-4d54-45f8-ad13-fa25704456a4}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{b49c10dd-4d54-45f8-ad13-fa25704456a4}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{F07BF6B2-5E9F-49DB-9352-5CABDD3FA968} {800EDE43-BAAD-4899-8AF5-E0AE5C0FA349} 51604⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
-
-
C:\Users\Admin\Downloads\SketchUp Pro 2026 v26.1.256 (x64) Multilingual\Crack\LayOut.exe"C:\Users\Admin\Downloads\SketchUp Pro 2026 v26.1.256 (x64) Multilingual\Crack\LayOut.exe"1⤵
- Executes dropped EXE
-
C:\Program Files\SketchUp\SketchUp 2026\SketchUp\SketchUp.exe"C:\Program Files\SketchUp\SketchUp 2026\SketchUp\SketchUp.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_webhelper.exe"C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_webhelper.exe" --type=gpu-process --no-sandbox --user-data-dir="C:/Users/Admin/AppData/Roaming/SketchUp/SketchUp 2026/WebCache-137.0.7151.121/Cache0/SkpUserData" --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Roaming\SketchUp\SketchUp 2026\WebCache-137.0.7151.121\Cache0" --locales-dir-path="C:\Program Files\SketchUp\SketchUp 2026\SketchUp\cef\locales" --user-agent-product="Chrome/137.0.7151.121 SketchUp Pro/26.1 (PC)" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2076,i,6913076617076506376,17422742710727173067,262144 --variations-seed-version --enable-logging=handle --log-file=2108 --mojo-platform-channel-handle=2068 /prefetch:22⤵
- Executes dropped EXE
-
-
C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_webhelper.exe"C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_webhelper.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:/Users/Admin/AppData/Roaming/SketchUp/SketchUp 2026/WebCache-137.0.7151.121/Cache0/SkpUserData" --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Roaming\SketchUp\SketchUp 2026\WebCache-137.0.7151.121\Cache0" --locales-dir-path="C:\Program Files\SketchUp\SketchUp 2026\SketchUp\cef\locales" --user-agent-product="Chrome/137.0.7151.121 SketchUp Pro/26.1 (PC)" --field-trial-handle=2076,i,6913076617076506376,17422742710727173067,262144 --variations-seed-version --enable-logging=handle --log-file=2248 --mojo-platform-channel-handle=2244 /prefetch:32⤵
- Executes dropped EXE
- System Time Discovery
-
-
C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_webhelper.exe"C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_webhelper.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --user-data-dir="C:/Users/Admin/AppData/Roaming/SketchUp/SketchUp 2026/WebCache-137.0.7151.121/Cache0/SkpUserData" --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Roaming\SketchUp\SketchUp 2026\WebCache-137.0.7151.121\Cache0" --locales-dir-path="C:\Program Files\SketchUp\SketchUp 2026\SketchUp\cef\locales" --user-agent-product="Chrome/137.0.7151.121 SketchUp Pro/26.1 (PC)" --field-trial-handle=2076,i,6913076617076506376,17422742710727173067,262144 --variations-seed-version --enable-logging=handle --log-file=2432 --mojo-platform-channel-handle=2428 /prefetch:82⤵
- Checks computer location settings
- Executes dropped EXE
-
-
C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_webhelper.exe"C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_webhelper.exe" --type=gpu-process --no-sandbox --user-data-dir="C:/Users/Admin/AppData/Roaming/SketchUp/SketchUp 2026/WebCache-137.0.7151.121/Cache0/SkpUserData" --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Roaming\SketchUp\SketchUp 2026\WebCache-137.0.7151.121\Cache0" --locales-dir-path="C:\Program Files\SketchUp\SketchUp 2026\SketchUp\cef\locales" --user-agent-product="Chrome/137.0.7151.121 SketchUp Pro/26.1 (PC)" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2076,i,6913076617076506376,17422742710727173067,262144 --variations-seed-version --enable-logging=handle --log-file=2128 --mojo-platform-channel-handle=2208 /prefetch:22⤵
- Executes dropped EXE
-
-
C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_webhelper.exe"C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_webhelper.exe" --type=gpu-process --no-sandbox --user-data-dir="C:/Users/Admin/AppData/Roaming/SketchUp/SketchUp 2026/WebCache-137.0.7151.121/Cache0/SkpUserData" --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Roaming\SketchUp\SketchUp 2026\WebCache-137.0.7151.121\Cache0" --locales-dir-path="C:\Program Files\SketchUp\SketchUp 2026\SketchUp\cef\locales" --user-agent-product="Chrome/137.0.7151.121 SketchUp Pro/26.1 (PC)" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=2076,i,6913076617076506376,17422742710727173067,262144 --variations-seed-version --enable-logging=handle --log-file=3588 --mojo-platform-channel-handle=3612 /prefetch:22⤵
- Executes dropped EXE
-
-
C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_webhelper.exe"C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_webhelper.exe" --type=gpu-process --no-sandbox --user-data-dir="C:/Users/Admin/AppData/Roaming/SketchUp/SketchUp 2026/WebCache-137.0.7151.121/Cache0/SkpUserData" --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Roaming\SketchUp\SketchUp 2026\WebCache-137.0.7151.121\Cache0" --locales-dir-path="C:\Program Files\SketchUp\SketchUp 2026\SketchUp\cef\locales" --user-agent-product="Chrome/137.0.7151.121 SketchUp Pro/26.1 (PC)" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=disabled --field-trial-handle=2076,i,6913076617076506376,17422742710727173067,262144 --variations-seed-version --enable-logging=handle --log-file=3172 --mojo-platform-channel-handle=3604 /prefetch:22⤵
- Executes dropped EXE
-
-
C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_metadata_extractor.exe"C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_metadata_extractor.exe" "C:\Program Files\SketchUp\SketchUp 2026\SketchUp\Resources\fr\Templates\Temp01a - Simple.skp" "C:\Users\Admin\AppData\Local\SketchUp\SketchUp 2026\SketchUp\5348-5780.json"2⤵
- Executes dropped EXE
-
-
C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_metadata_extractor.exe"C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_metadata_extractor.exe" "C:\Program Files\SketchUp\SketchUp 2026\SketchUp\Resources\fr\Templates\Temp01b - Simple.skp" "C:\Users\Admin\AppData\Local\SketchUp\SketchUp 2026\SketchUp\5348-5780.json"2⤵
- Executes dropped EXE
-
-
C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_metadata_extractor.exe"C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_metadata_extractor.exe" "C:\Program Files\SketchUp\SketchUp 2026\SketchUp\Resources\fr\Templates\Temp02a - Vis.skp" "C:\Users\Admin\AppData\Local\SketchUp\SketchUp 2026\SketchUp\5348-5780.json"2⤵
- Executes dropped EXE
-
-
C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_metadata_extractor.exe"C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_metadata_extractor.exe" "C:\Program Files\SketchUp\SketchUp 2026\SketchUp\Resources\fr\Templates\Temp02b - Vis.skp" "C:\Users\Admin\AppData\Local\SketchUp\SketchUp 2026\SketchUp\5348-5780.json"2⤵
- Executes dropped EXE
-
-
C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_metadata_extractor.exe"C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_metadata_extractor.exe" "C:\Program Files\SketchUp\SketchUp 2026\SketchUp\Resources\fr\Templates\Temp03a - Arch.skp" "C:\Users\Admin\AppData\Local\SketchUp\SketchUp 2026\SketchUp\5348-5780.json"2⤵
- Executes dropped EXE
-
-
C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_metadata_extractor.exe"C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_metadata_extractor.exe" "C:\Program Files\SketchUp\SketchUp 2026\SketchUp\Resources\fr\Templates\Temp03b - Arch.skp" "C:\Users\Admin\AppData\Local\SketchUp\SketchUp 2026\SketchUp\5348-5780.json"2⤵
- Executes dropped EXE
-
-
C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_metadata_extractor.exe"C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_metadata_extractor.exe" "C:\Program Files\SketchUp\SketchUp 2026\SketchUp\Resources\fr\Templates\Temp03c - Arch.skp" "C:\Users\Admin\AppData\Local\SketchUp\SketchUp 2026\SketchUp\5348-5780.json"2⤵
- Executes dropped EXE
-
-
C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_metadata_extractor.exe"C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_metadata_extractor.exe" "C:\Program Files\SketchUp\SketchUp 2026\SketchUp\Resources\fr\Templates\Temp03d - Arch.skp" "C:\Users\Admin\AppData\Local\SketchUp\SketchUp 2026\SketchUp\5348-5780.json"2⤵
- Executes dropped EXE
-
-
C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_metadata_extractor.exe"C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_metadata_extractor.exe" "C:\Program Files\SketchUp\SketchUp 2026\SketchUp\Resources\fr\Templates\Temp04a - AEC.skp" "C:\Users\Admin\AppData\Local\SketchUp\SketchUp 2026\SketchUp\5348-5780.json"2⤵
- Executes dropped EXE
-
-
C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_metadata_extractor.exe"C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_metadata_extractor.exe" "C:\Program Files\SketchUp\SketchUp 2026\SketchUp\Resources\fr\Templates\Temp04b - AEC.skp" "C:\Users\Admin\AppData\Local\SketchUp\SketchUp 2026\SketchUp\5348-5780.json"2⤵
- Executes dropped EXE
-
-
C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_metadata_extractor.exe"C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_metadata_extractor.exe" "C:\Program Files\SketchUp\SketchUp 2026\SketchUp\Resources\fr\Templates\Temp04c - AEC.skp" "C:\Users\Admin\AppData\Local\SketchUp\SketchUp 2026\SketchUp\5348-5780.json"2⤵
- Executes dropped EXE
-
-
C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_metadata_extractor.exe"C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_metadata_extractor.exe" "C:\Program Files\SketchUp\SketchUp 2026\SketchUp\Resources\fr\Templates\Temp05a - Urban.skp" "C:\Users\Admin\AppData\Local\SketchUp\SketchUp 2026\SketchUp\5348-5780.json"2⤵
- Executes dropped EXE
-
-
C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_metadata_extractor.exe"C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_metadata_extractor.exe" "C:\Program Files\SketchUp\SketchUp 2026\SketchUp\Resources\fr\Templates\Temp05b - Urban.skp" "C:\Users\Admin\AppData\Local\SketchUp\SketchUp 2026\SketchUp\5348-5780.json"2⤵
- Executes dropped EXE
-
-
C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_metadata_extractor.exe"C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_metadata_extractor.exe" "C:\Program Files\SketchUp\SketchUp 2026\SketchUp\Resources\fr\Templates\Temp06a - Landscape.skp" "C:\Users\Admin\AppData\Local\SketchUp\SketchUp 2026\SketchUp\5348-5780.json"2⤵
- Executes dropped EXE
-
-
C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_metadata_extractor.exe"C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_metadata_extractor.exe" "C:\Program Files\SketchUp\SketchUp 2026\SketchUp\Resources\fr\Templates\Temp06b - Landscape.skp" "C:\Users\Admin\AppData\Local\SketchUp\SketchUp 2026\SketchUp\5348-5780.json"2⤵
- Executes dropped EXE
-
-
C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_metadata_extractor.exe"C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_metadata_extractor.exe" "C:\Program Files\SketchUp\SketchUp 2026\SketchUp\Resources\fr\Templates\Temp07a - Woodworking.skp" "C:\Users\Admin\AppData\Local\SketchUp\SketchUp 2026\SketchUp\5348-5780.json"2⤵
- Executes dropped EXE
-
-
C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_metadata_extractor.exe"C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_metadata_extractor.exe" "C:\Program Files\SketchUp\SketchUp 2026\SketchUp\Resources\fr\Templates\Temp07b - Woodworking.skp" "C:\Users\Admin\AppData\Local\SketchUp\SketchUp 2026\SketchUp\5348-5780.json"2⤵
- Executes dropped EXE
-
-
C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_metadata_extractor.exe"C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_metadata_extractor.exe" "C:\Program Files\SketchUp\SketchUp 2026\SketchUp\Resources\fr\Templates\Temp08a - Interiors.skp" "C:\Users\Admin\AppData\Local\SketchUp\SketchUp 2026\SketchUp\5348-5780.json"2⤵
- Executes dropped EXE
-
-
C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_metadata_extractor.exe"C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_metadata_extractor.exe" "C:\Program Files\SketchUp\SketchUp 2026\SketchUp\Resources\fr\Templates\Temp08b - Interiors.skp" "C:\Users\Admin\AppData\Local\SketchUp\SketchUp 2026\SketchUp\5348-5780.json"2⤵
- Executes dropped EXE
-
-
C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_metadata_extractor.exe"C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_metadata_extractor.exe" "C:\Program Files\SketchUp\SketchUp 2026\SketchUp\Resources\fr\Templates\Temp09a - 3D Printing.skp" "C:\Users\Admin\AppData\Local\SketchUp\SketchUp 2026\SketchUp\5348-5780.json"2⤵
- Executes dropped EXE
-
-
C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_metadata_extractor.exe"C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_metadata_extractor.exe" "C:\Program Files\SketchUp\SketchUp 2026\SketchUp\Resources\fr\Templates\Temp09b - 3D Printing.skp" "C:\Users\Admin\AppData\Local\SketchUp\SketchUp 2026\SketchUp\5348-5780.json"2⤵
- Executes dropped EXE
-
-
C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_webhelper.exe"C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_webhelper.exe" --type=renderer --user-data-dir="C:/Users/Admin/AppData/Roaming/SketchUp/SketchUp 2026/WebCache-137.0.7151.121/Cache0/SkpUserData" --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Roaming\SketchUp\SketchUp 2026\WebCache-137.0.7151.121\Cache0" --locales-dir-path="C:\Program Files\SketchUp\SketchUp 2026\SketchUp\cef\locales" --user-agent-product="Chrome/137.0.7151.121 SketchUp Pro/26.1 (PC)" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=2076,i,6913076617076506376,17422742710727173067,262144 --variations-seed-version --enable-logging=handle --log-file=4172 --mojo-platform-channel-handle=4168 /prefetch:12⤵
- Checks computer location settings
- Executes dropped EXE
-
-
C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_webhelper.exe"C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_webhelper.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:/Users/Admin/AppData/Roaming/SketchUp/SketchUp 2026/WebCache-137.0.7151.121/Cache0/SkpUserData" --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Roaming\SketchUp\SketchUp 2026\WebCache-137.0.7151.121\Cache0" --locales-dir-path="C:\Program Files\SketchUp\SketchUp 2026\SketchUp\cef\locales" --user-agent-product="Chrome/137.0.7151.121 SketchUp Pro/26.1 (PC)" --field-trial-handle=2076,i,6913076617076506376,17422742710727173067,262144 --variations-seed-version --enable-logging=handle --log-file=5028 --mojo-platform-channel-handle=5024 /prefetch:82⤵
- Executes dropped EXE
-
-
C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_webhelper.exe"C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_webhelper.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --user-data-dir="C:/Users/Admin/AppData/Roaming/SketchUp/SketchUp 2026/WebCache-137.0.7151.121/Cache0/SkpUserData" --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Roaming\SketchUp\SketchUp 2026\WebCache-137.0.7151.121\Cache0" --locales-dir-path="C:\Program Files\SketchUp\SketchUp 2026\SketchUp\cef\locales" --user-agent-product="Chrome/137.0.7151.121 SketchUp Pro/26.1 (PC)" --field-trial-handle=2076,i,6913076617076506376,17422742710727173067,262144 --variations-seed-version --enable-logging=handle --log-file=5060 --mojo-platform-channel-handle=5020 /prefetch:82⤵
- Executes dropped EXE
-
-
C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_webhelper.exe"C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_webhelper.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --user-data-dir="C:/Users/Admin/AppData/Roaming/SketchUp/SketchUp 2026/WebCache-137.0.7151.121/Cache0/SkpUserData" --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Roaming\SketchUp\SketchUp 2026\WebCache-137.0.7151.121\Cache0" --locales-dir-path="C:\Program Files\SketchUp\SketchUp 2026\SketchUp\cef\locales" --user-agent-product="Chrome/137.0.7151.121 SketchUp Pro/26.1 (PC)" --field-trial-handle=2076,i,6913076617076506376,17422742710727173067,262144 --variations-seed-version --enable-logging=handle --log-file=5088 --mojo-platform-channel-handle=4056 /prefetch:82⤵
- Executes dropped EXE
-
-
C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_webhelper.exe"C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_webhelper.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --user-data-dir="C:/Users/Admin/AppData/Roaming/SketchUp/SketchUp 2026/WebCache-137.0.7151.121/Cache0/SkpUserData" --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Roaming\SketchUp\SketchUp 2026\WebCache-137.0.7151.121\Cache0" --locales-dir-path="C:\Program Files\SketchUp\SketchUp 2026\SketchUp\cef\locales" --user-agent-product="Chrome/137.0.7151.121 SketchUp Pro/26.1 (PC)" --field-trial-handle=2076,i,6913076617076506376,17422742710727173067,262144 --variations-seed-version --enable-logging=handle --log-file=5144 --mojo-platform-channel-handle=5200 /prefetch:82⤵
- Executes dropped EXE
-
-
C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_webhelper.exe"C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_webhelper.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --user-data-dir="C:/Users/Admin/AppData/Roaming/SketchUp/SketchUp 2026/WebCache-137.0.7151.121/Cache0/SkpUserData" --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Roaming\SketchUp\SketchUp 2026\WebCache-137.0.7151.121\Cache0" --locales-dir-path="C:\Program Files\SketchUp\SketchUp 2026\SketchUp\cef\locales" --user-agent-product="Chrome/137.0.7151.121 SketchUp Pro/26.1 (PC)" --field-trial-handle=2076,i,6913076617076506376,17422742710727173067,262144 --variations-seed-version --enable-logging=handle --log-file=5016 --mojo-platform-channel-handle=5228 /prefetch:82⤵
- Executes dropped EXE
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵
-
C:\Windows\system32\osk.exe"C:\Windows\system32\osk.exe"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x40c 0x4b01⤵
-
C:\Program Files\SketchUp\SketchUp 2026\SketchUp\SketchUp.exe"C:\Program Files\SketchUp\SketchUp 2026\SketchUp\SketchUp.exe" "C:\Users\Admin\Downloads\oliverie moins.skp"1⤵
- Checks computer location settings
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_webhelper.exe"C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_webhelper.exe" --type=gpu-process --no-sandbox --user-data-dir="C:/Users/Admin/AppData/Roaming/SketchUp/SketchUp 2026/WebCache-137.0.7151.121/Cache0/SkpUserData" --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --user-data-dir="C:\Users\Admin\AppData\Roaming\SketchUp\SketchUp 2026\WebCache-137.0.7151.121\Cache0" --locales-dir-path="C:\Program Files\SketchUp\SketchUp 2026\SketchUp\cef\locales" --user-agent-product="Chrome/137.0.7151.121 SketchUp Pro/26.1 (PC)" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2068,i,10293673161500876970,2473199455106022312,262144 --variations-seed-version --enable-logging=handle --log-file=1912 --mojo-platform-channel-handle=2064 /prefetch:22⤵
- Executes dropped EXE
-
-
C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_webhelper.exe"C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_webhelper.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:/Users/Admin/AppData/Roaming/SketchUp/SketchUp 2026/WebCache-137.0.7151.121/Cache0/SkpUserData" --force-high-res-timeticks=disabled --subproc-heap-profiling --user-data-dir="C:\Users\Admin\AppData\Roaming\SketchUp\SketchUp 2026\WebCache-137.0.7151.121\Cache0" --locales-dir-path="C:\Program Files\SketchUp\SketchUp 2026\SketchUp\cef\locales" --user-agent-product="Chrome/137.0.7151.121 SketchUp Pro/26.1 (PC)" --field-trial-handle=2068,i,10293673161500876970,2473199455106022312,262144 --variations-seed-version --enable-logging=handle --log-file=2224 --mojo-platform-channel-handle=2220 /prefetch:32⤵
- Executes dropped EXE
- System Time Discovery
-
-
C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_webhelper.exe"C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_webhelper.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --user-data-dir="C:/Users/Admin/AppData/Roaming/SketchUp/SketchUp 2026/WebCache-137.0.7151.121/Cache0/SkpUserData" --force-high-res-timeticks=disabled --subproc-heap-profiling --user-data-dir="C:\Users\Admin\AppData\Roaming\SketchUp\SketchUp 2026\WebCache-137.0.7151.121\Cache0" --locales-dir-path="C:\Program Files\SketchUp\SketchUp 2026\SketchUp\cef\locales" --user-agent-product="Chrome/137.0.7151.121 SketchUp Pro/26.1 (PC)" --field-trial-handle=2068,i,10293673161500876970,2473199455106022312,262144 --variations-seed-version --enable-logging=handle --log-file=2388 --mojo-platform-channel-handle=2384 /prefetch:82⤵
- Checks computer location settings
- Executes dropped EXE
-
-
C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_webhelper.exe"C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_webhelper.exe" --type=gpu-process --no-sandbox --user-data-dir="C:/Users/Admin/AppData/Roaming/SketchUp/SketchUp 2026/WebCache-137.0.7151.121/Cache0/SkpUserData" --force-high-res-timeticks=disabled --subproc-heap-profiling --user-data-dir="C:\Users\Admin\AppData\Roaming\SketchUp\SketchUp 2026\WebCache-137.0.7151.121\Cache0" --locales-dir-path="C:\Program Files\SketchUp\SketchUp 2026\SketchUp\cef\locales" --user-agent-product="Chrome/137.0.7151.121 SketchUp Pro/26.1 (PC)" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2068,i,10293673161500876970,2473199455106022312,262144 --variations-seed-version --enable-logging=handle --log-file=2152 --mojo-platform-channel-handle=2148 /prefetch:22⤵
- Executes dropped EXE
-
-
C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_webhelper.exe"C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_webhelper.exe" --type=gpu-process --no-sandbox --user-data-dir="C:/Users/Admin/AppData/Roaming/SketchUp/SketchUp 2026/WebCache-137.0.7151.121/Cache0/SkpUserData" --force-high-res-timeticks=disabled --subproc-heap-profiling --user-data-dir="C:\Users\Admin\AppData\Roaming\SketchUp\SketchUp 2026\WebCache-137.0.7151.121\Cache0" --locales-dir-path="C:\Program Files\SketchUp\SketchUp 2026\SketchUp\cef\locales" --user-agent-product="Chrome/137.0.7151.121 SketchUp Pro/26.1 (PC)" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2068,i,10293673161500876970,2473199455106022312,262144 --variations-seed-version --enable-logging=handle --log-file=3268 --mojo-platform-channel-handle=3272 /prefetch:22⤵
-
-
C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_webhelper.exe"C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_webhelper.exe" --type=gpu-process --no-sandbox --user-data-dir="C:/Users/Admin/AppData/Roaming/SketchUp/SketchUp 2026/WebCache-137.0.7151.121/Cache0/SkpUserData" --force-high-res-timeticks=disabled --subproc-heap-profiling --user-data-dir="C:\Users\Admin\AppData\Roaming\SketchUp\SketchUp 2026\WebCache-137.0.7151.121\Cache0" --locales-dir-path="C:\Program Files\SketchUp\SketchUp 2026\SketchUp\cef\locales" --user-agent-product="Chrome/137.0.7151.121 SketchUp Pro/26.1 (PC)" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2068,i,10293673161500876970,2473199455106022312,262144 --variations-seed-version --enable-logging=handle --log-file=3376 --mojo-platform-channel-handle=3372 /prefetch:22⤵
-
-
C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_webhelper.exe"C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_webhelper.exe" --type=gpu-process --no-sandbox --user-data-dir="C:/Users/Admin/AppData/Roaming/SketchUp/SketchUp 2026/WebCache-137.0.7151.121/Cache0/SkpUserData" --force-high-res-timeticks=disabled --subproc-heap-profiling --user-data-dir="C:\Users\Admin\AppData\Roaming\SketchUp\SketchUp 2026\WebCache-137.0.7151.121\Cache0" --locales-dir-path="C:\Program Files\SketchUp\SketchUp 2026\SketchUp\cef\locales" --user-agent-product="Chrome/137.0.7151.121 SketchUp Pro/26.1 (PC)" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=2068,i,10293673161500876970,2473199455106022312,262144 --variations-seed-version --enable-logging=handle --log-file=3524 --mojo-platform-channel-handle=3268 /prefetch:22⤵
-
-
C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_webhelper.exe"C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_webhelper.exe" --type=gpu-process --no-sandbox --user-data-dir="C:/Users/Admin/AppData/Roaming/SketchUp/SketchUp 2026/WebCache-137.0.7151.121/Cache0/SkpUserData" --force-high-res-timeticks=disabled --subproc-heap-profiling --user-data-dir="C:\Users\Admin\AppData\Roaming\SketchUp\SketchUp 2026\WebCache-137.0.7151.121\Cache0" --locales-dir-path="C:\Program Files\SketchUp\SketchUp 2026\SketchUp\cef\locales" --user-agent-product="Chrome/137.0.7151.121 SketchUp Pro/26.1 (PC)" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=disabled --field-trial-handle=2068,i,10293673161500876970,2473199455106022312,262144 --variations-seed-version --enable-logging=handle --log-file=3568 --mojo-platform-channel-handle=3364 /prefetch:22⤵
-
-
C:\Program Files\SketchUp\SketchUp 2026\SketchUp\BsSndRpt64.exe"BsSndRpt64.exe" -i "C:\Users\Admin\AppData\Local\Temp\BsSndRpt_RD8H7NT5.ini" -f2⤵
- Modifies Control Panel
-
-
C:\Program Files\SketchUp\SketchUp 2026\SketchUp\SketchUp.exe"C:\Program Files\SketchUp\SketchUp 2026\SketchUp\SketchUp.exe" "C:\Users\Admin\Downloads\oliverie moins.skp"1⤵
- Checks computer location settings
- Writes to the Master Boot Record (MBR)
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_webhelper.exe"C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_webhelper.exe" --type=gpu-process --no-sandbox --user-data-dir="C:/Users/Admin/AppData/Roaming/SketchUp/SketchUp 2026/WebCache-137.0.7151.121/Cache0/SkpUserData" --no-pre-read-main-dll --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Roaming\SketchUp\SketchUp 2026\WebCache-137.0.7151.121\Cache0" --locales-dir-path="C:\Program Files\SketchUp\SketchUp 2026\SketchUp\cef\locales" --user-agent-product="Chrome/137.0.7151.121 SketchUp Pro/26.1 (PC)" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2176,i,1005301841424700995,3583596881044563579,262144 --variations-seed-version --enable-logging=handle --log-file=2200 --mojo-platform-channel-handle=2172 /prefetch:22⤵
-
-
C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_webhelper.exe"C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_webhelper.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:/Users/Admin/AppData/Roaming/SketchUp/SketchUp 2026/WebCache-137.0.7151.121/Cache0/SkpUserData" --no-pre-read-main-dll --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Roaming\SketchUp\SketchUp 2026\WebCache-137.0.7151.121\Cache0" --locales-dir-path="C:\Program Files\SketchUp\SketchUp 2026\SketchUp\cef\locales" --user-agent-product="Chrome/137.0.7151.121 SketchUp Pro/26.1 (PC)" --field-trial-handle=2176,i,1005301841424700995,3583596881044563579,262144 --variations-seed-version --enable-logging=handle --log-file=2292 --mojo-platform-channel-handle=2288 /prefetch:32⤵
- System Time Discovery
-
-
C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_webhelper.exe"C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_webhelper.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --user-data-dir="C:/Users/Admin/AppData/Roaming/SketchUp/SketchUp 2026/WebCache-137.0.7151.121/Cache0/SkpUserData" --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Roaming\SketchUp\SketchUp 2026\WebCache-137.0.7151.121\Cache0" --locales-dir-path="C:\Program Files\SketchUp\SketchUp 2026\SketchUp\cef\locales" --user-agent-product="Chrome/137.0.7151.121 SketchUp Pro/26.1 (PC)" --field-trial-handle=2176,i,1005301841424700995,3583596881044563579,262144 --variations-seed-version --enable-logging=handle --log-file=1828 --mojo-platform-channel-handle=1840 /prefetch:82⤵
- Checks computer location settings
-
-
C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_webhelper.exe"C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_webhelper.exe" --type=gpu-process --no-sandbox --user-data-dir="C:/Users/Admin/AppData/Roaming/SketchUp/SketchUp 2026/WebCache-137.0.7151.121/Cache0/SkpUserData" --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Roaming\SketchUp\SketchUp 2026\WebCache-137.0.7151.121\Cache0" --locales-dir-path="C:\Program Files\SketchUp\SketchUp 2026\SketchUp\cef\locales" --user-agent-product="Chrome/137.0.7151.121 SketchUp Pro/26.1 (PC)" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=2176,i,1005301841424700995,3583596881044563579,262144 --variations-seed-version --enable-logging=handle --log-file=3400 --mojo-platform-channel-handle=3396 /prefetch:22⤵
-
-
C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_webhelper.exe"C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_webhelper.exe" --type=gpu-process --no-sandbox --user-data-dir="C:/Users/Admin/AppData/Roaming/SketchUp/SketchUp 2026/WebCache-137.0.7151.121/Cache0/SkpUserData" --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Roaming\SketchUp\SketchUp 2026\WebCache-137.0.7151.121\Cache0" --locales-dir-path="C:\Program Files\SketchUp\SketchUp 2026\SketchUp\cef\locales" --user-agent-product="Chrome/137.0.7151.121 SketchUp Pro/26.1 (PC)" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=2176,i,1005301841424700995,3583596881044563579,262144 --variations-seed-version --enable-logging=handle --log-file=3640 --mojo-platform-channel-handle=3644 /prefetch:22⤵
-
-
C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_webhelper.exe"C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_webhelper.exe" --type=gpu-process --no-sandbox --user-data-dir="C:/Users/Admin/AppData/Roaming/SketchUp/SketchUp 2026/WebCache-137.0.7151.121/Cache0/SkpUserData" --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Roaming\SketchUp\SketchUp 2026\WebCache-137.0.7151.121\Cache0" --locales-dir-path="C:\Program Files\SketchUp\SketchUp 2026\SketchUp\cef\locales" --user-agent-product="Chrome/137.0.7151.121 SketchUp Pro/26.1 (PC)" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=disabled --field-trial-handle=2176,i,1005301841424700995,3583596881044563579,262144 --variations-seed-version --enable-logging=handle --log-file=3460 --mojo-platform-channel-handle=3456 /prefetch:22⤵
-
-
C:\Program Files\SketchUp\SketchUp 2026\SketchUp\SketchUp.exe"C:\Program Files\SketchUp\SketchUp 2026\SketchUp\SketchUp.exe"1⤵
- Checks computer location settings
- Writes to the Master Boot Record (MBR)
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_webhelper.exe"C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_webhelper.exe" --type=gpu-process --no-sandbox --user-data-dir="C:/Users/Admin/AppData/Roaming/SketchUp/SketchUp 2026/WebCache-137.0.7151.121/Cache0/SkpUserData" --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Roaming\SketchUp\SketchUp 2026\WebCache-137.0.7151.121\Cache0" --locales-dir-path="C:\Program Files\SketchUp\SketchUp 2026\SketchUp\cef\locales" --user-agent-product="Chrome/137.0.7151.121 SketchUp Pro/26.1 (PC)" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2068,i,5351601798788984667,6263275752174711731,262144 --variations-seed-version --enable-logging=handle --log-file=1528 --mojo-platform-channel-handle=2060 /prefetch:22⤵
-
-
C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_webhelper.exe"C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_webhelper.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:/Users/Admin/AppData/Roaming/SketchUp/SketchUp 2026/WebCache-137.0.7151.121/Cache0/SkpUserData" --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Roaming\SketchUp\SketchUp 2026\WebCache-137.0.7151.121\Cache0" --locales-dir-path="C:\Program Files\SketchUp\SketchUp 2026\SketchUp\cef\locales" --user-agent-product="Chrome/137.0.7151.121 SketchUp Pro/26.1 (PC)" --field-trial-handle=2068,i,5351601798788984667,6263275752174711731,262144 --variations-seed-version --enable-logging=handle --log-file=2260 --mojo-platform-channel-handle=2256 /prefetch:32⤵
- System Time Discovery
-
-
C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_webhelper.exe"C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_webhelper.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --user-data-dir="C:/Users/Admin/AppData/Roaming/SketchUp/SketchUp 2026/WebCache-137.0.7151.121/Cache0/SkpUserData" --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Roaming\SketchUp\SketchUp 2026\WebCache-137.0.7151.121\Cache0" --locales-dir-path="C:\Program Files\SketchUp\SketchUp 2026\SketchUp\cef\locales" --user-agent-product="Chrome/137.0.7151.121 SketchUp Pro/26.1 (PC)" --field-trial-handle=2068,i,5351601798788984667,6263275752174711731,262144 --variations-seed-version --enable-logging=handle --log-file=2392 --mojo-platform-channel-handle=2080 /prefetch:82⤵
- Checks computer location settings
-
-
C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_webhelper.exe"C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_webhelper.exe" --type=gpu-process --no-sandbox --user-data-dir="C:/Users/Admin/AppData/Roaming/SketchUp/SketchUp 2026/WebCache-137.0.7151.121/Cache0/SkpUserData" --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Roaming\SketchUp\SketchUp 2026\WebCache-137.0.7151.121\Cache0" --locales-dir-path="C:\Program Files\SketchUp\SketchUp 2026\SketchUp\cef\locales" --user-agent-product="Chrome/137.0.7151.121 SketchUp Pro/26.1 (PC)" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2068,i,5351601798788984667,6263275752174711731,262144 --variations-seed-version --enable-logging=handle --log-file=3252 --mojo-platform-channel-handle=3248 /prefetch:22⤵
-
-
C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_webhelper.exe"C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_webhelper.exe" --type=gpu-process --no-sandbox --user-data-dir="C:/Users/Admin/AppData/Roaming/SketchUp/SketchUp 2026/WebCache-137.0.7151.121/Cache0/SkpUserData" --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Roaming\SketchUp\SketchUp 2026\WebCache-137.0.7151.121\Cache0" --locales-dir-path="C:\Program Files\SketchUp\SketchUp 2026\SketchUp\cef\locales" --user-agent-product="Chrome/137.0.7151.121 SketchUp Pro/26.1 (PC)" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=2068,i,5351601798788984667,6263275752174711731,262144 --variations-seed-version --enable-logging=handle --log-file=3372 --mojo-platform-channel-handle=3356 /prefetch:22⤵
-
-
C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_webhelper.exe"C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_webhelper.exe" --type=gpu-process --no-sandbox --user-data-dir="C:/Users/Admin/AppData/Roaming/SketchUp/SketchUp 2026/WebCache-137.0.7151.121/Cache0/SkpUserData" --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Roaming\SketchUp\SketchUp 2026\WebCache-137.0.7151.121\Cache0" --locales-dir-path="C:\Program Files\SketchUp\SketchUp 2026\SketchUp\cef\locales" --user-agent-product="Chrome/137.0.7151.121 SketchUp Pro/26.1 (PC)" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=2068,i,5351601798788984667,6263275752174711731,262144 --variations-seed-version --enable-logging=handle --log-file=3392 --mojo-platform-channel-handle=3388 /prefetch:22⤵
-
-
C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_webhelper.exe"C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_webhelper.exe" --type=gpu-process --no-sandbox --user-data-dir="C:/Users/Admin/AppData/Roaming/SketchUp/SketchUp 2026/WebCache-137.0.7151.121/Cache0/SkpUserData" --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Roaming\SketchUp\SketchUp 2026\WebCache-137.0.7151.121\Cache0" --locales-dir-path="C:\Program Files\SketchUp\SketchUp 2026\SketchUp\cef\locales" --user-agent-product="Chrome/137.0.7151.121 SketchUp Pro/26.1 (PC)" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=disabled --field-trial-handle=2068,i,5351601798788984667,6263275752174711731,262144 --variations-seed-version --enable-logging=handle --log-file=3412 --mojo-platform-channel-handle=3408 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://c,d/1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://c,d/2⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"1⤵
-
C:\Program Files\SketchUp\SketchUp 2026\SketchUp\SketchUp.exesketchUp.exe -DisableGraphicAcceleration2⤵
- Checks computer location settings
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_webhelper.exe"C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_webhelper.exe" --type=gpu-process --no-sandbox --user-data-dir="C:/Users/Admin/AppData/Roaming/SketchUp/SketchUp 2026/WebCache-137.0.7151.121/Cache0/SkpUserData" --no-pre-read-main-dll --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Roaming\SketchUp\SketchUp 2026\WebCache-137.0.7151.121\Cache0" --locales-dir-path="C:\Program Files\SketchUp\SketchUp 2026\SketchUp\cef\locales" --user-agent-product="Chrome/137.0.7151.121 SketchUp Pro/26.1 (PC)" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2164,i,15007708403148431469,13285212993458549967,262144 --variations-seed-version --enable-logging=handle --log-file=2180 --mojo-platform-channel-handle=2160 /prefetch:23⤵
-
-
C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_webhelper.exe"C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_webhelper.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:/Users/Admin/AppData/Roaming/SketchUp/SketchUp 2026/WebCache-137.0.7151.121/Cache0/SkpUserData" --no-pre-read-main-dll --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Roaming\SketchUp\SketchUp 2026\WebCache-137.0.7151.121\Cache0" --locales-dir-path="C:\Program Files\SketchUp\SketchUp 2026\SketchUp\cef\locales" --user-agent-product="Chrome/137.0.7151.121 SketchUp Pro/26.1 (PC)" --field-trial-handle=2164,i,15007708403148431469,13285212993458549967,262144 --variations-seed-version --enable-logging=handle --log-file=2192 --mojo-platform-channel-handle=2184 /prefetch:33⤵
- System Time Discovery
-
-
C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_webhelper.exe"C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_webhelper.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --user-data-dir="C:/Users/Admin/AppData/Roaming/SketchUp/SketchUp 2026/WebCache-137.0.7151.121/Cache0/SkpUserData" --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Roaming\SketchUp\SketchUp 2026\WebCache-137.0.7151.121\Cache0" --locales-dir-path="C:\Program Files\SketchUp\SketchUp 2026\SketchUp\cef\locales" --user-agent-product="Chrome/137.0.7151.121 SketchUp Pro/26.1 (PC)" --field-trial-handle=2164,i,15007708403148431469,13285212993458549967,262144 --variations-seed-version --enable-logging=handle --log-file=2568 --mojo-platform-channel-handle=2560 /prefetch:83⤵
- Checks computer location settings
-
-
C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_webhelper.exe"C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_webhelper.exe" --type=gpu-process --no-sandbox --user-data-dir="C:/Users/Admin/AppData/Roaming/SketchUp/SketchUp 2026/WebCache-137.0.7151.121/Cache0/SkpUserData" --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Roaming\SketchUp\SketchUp 2026\WebCache-137.0.7151.121\Cache0" --locales-dir-path="C:\Program Files\SketchUp\SketchUp 2026\SketchUp\cef\locales" --user-agent-product="Chrome/137.0.7151.121 SketchUp Pro/26.1 (PC)" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=2164,i,15007708403148431469,13285212993458549967,262144 --variations-seed-version --enable-logging=handle --log-file=2236 --mojo-platform-channel-handle=2232 /prefetch:23⤵
-
-
C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_webhelper.exe"C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_webhelper.exe" --type=gpu-process --no-sandbox --user-data-dir="C:/Users/Admin/AppData/Roaming/SketchUp/SketchUp 2026/WebCache-137.0.7151.121/Cache0/SkpUserData" --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Roaming\SketchUp\SketchUp 2026\WebCache-137.0.7151.121\Cache0" --locales-dir-path="C:\Program Files\SketchUp\SketchUp 2026\SketchUp\cef\locales" --user-agent-product="Chrome/137.0.7151.121 SketchUp Pro/26.1 (PC)" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=disabled --field-trial-handle=2164,i,15007708403148431469,13285212993458549967,262144 --variations-seed-version --enable-logging=handle --log-file=2952 --mojo-platform-channel-handle=2956 /prefetch:23⤵
-
-
-
C:\Program Files\SketchUp\SketchUp 2026\SketchUp\SketchUp.exesketchUp.exe -DisableGraphicsAcceleration2⤵
-
-
C:\Program Files\SketchUp\SketchUp 2026\SketchUp\SketchUp.exe"C:\Program Files\SketchUp\SketchUp 2026\SketchUp\SketchUp.exe"1⤵
- Checks computer location settings
- Writes to the Master Boot Record (MBR)
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_webhelper.exe"C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_webhelper.exe" --type=gpu-process --no-sandbox --user-data-dir="C:/Users/Admin/AppData/Roaming/SketchUp/SketchUp 2026/WebCache-137.0.7151.121/Cache0/SkpUserData" --no-pre-read-main-dll --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Roaming\SketchUp\SketchUp 2026\WebCache-137.0.7151.121\Cache0" --locales-dir-path="C:\Program Files\SketchUp\SketchUp 2026\SketchUp\cef\locales" --user-agent-product="Chrome/137.0.7151.121 SketchUp Pro/26.1 (PC)" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2160,i,14458226113681589660,2806142134124202657,262144 --variations-seed-version --enable-logging=handle --log-file=1536 --mojo-platform-channel-handle=2156 /prefetch:22⤵
-
-
C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_webhelper.exe"C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_webhelper.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:/Users/Admin/AppData/Roaming/SketchUp/SketchUp 2026/WebCache-137.0.7151.121/Cache0/SkpUserData" --no-pre-read-main-dll --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Roaming\SketchUp\SketchUp 2026\WebCache-137.0.7151.121\Cache0" --locales-dir-path="C:\Program Files\SketchUp\SketchUp 2026\SketchUp\cef\locales" --user-agent-product="Chrome/137.0.7151.121 SketchUp Pro/26.1 (PC)" --field-trial-handle=2160,i,14458226113681589660,2806142134124202657,262144 --variations-seed-version --enable-logging=handle --log-file=2288 --mojo-platform-channel-handle=2280 /prefetch:32⤵
- System Time Discovery
-
-
C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_webhelper.exe"C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_webhelper.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --user-data-dir="C:/Users/Admin/AppData/Roaming/SketchUp/SketchUp 2026/WebCache-137.0.7151.121/Cache0/SkpUserData" --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Roaming\SketchUp\SketchUp 2026\WebCache-137.0.7151.121\Cache0" --locales-dir-path="C:\Program Files\SketchUp\SketchUp 2026\SketchUp\cef\locales" --user-agent-product="Chrome/137.0.7151.121 SketchUp Pro/26.1 (PC)" --field-trial-handle=2160,i,14458226113681589660,2806142134124202657,262144 --variations-seed-version --enable-logging=handle --log-file=2424 --mojo-platform-channel-handle=2420 /prefetch:82⤵
- Checks computer location settings
-
-
C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_webhelper.exe"C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_webhelper.exe" --type=gpu-process --no-sandbox --user-data-dir="C:/Users/Admin/AppData/Roaming/SketchUp/SketchUp 2026/WebCache-137.0.7151.121/Cache0/SkpUserData" --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Roaming\SketchUp\SketchUp 2026\WebCache-137.0.7151.121\Cache0" --locales-dir-path="C:\Program Files\SketchUp\SketchUp 2026\SketchUp\cef\locales" --user-agent-product="Chrome/137.0.7151.121 SketchUp Pro/26.1 (PC)" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=2160,i,14458226113681589660,2806142134124202657,262144 --variations-seed-version --enable-logging=handle --log-file=2204 --mojo-platform-channel-handle=2196 /prefetch:22⤵
-
-
C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_webhelper.exe"C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_webhelper.exe" --type=gpu-process --no-sandbox --user-data-dir="C:/Users/Admin/AppData/Roaming/SketchUp/SketchUp 2026/WebCache-137.0.7151.121/Cache0/SkpUserData" --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Roaming\SketchUp\SketchUp 2026\WebCache-137.0.7151.121\Cache0" --locales-dir-path="C:\Program Files\SketchUp\SketchUp 2026\SketchUp\cef\locales" --user-agent-product="Chrome/137.0.7151.121 SketchUp Pro/26.1 (PC)" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=2160,i,14458226113681589660,2806142134124202657,262144 --variations-seed-version --enable-logging=handle --log-file=3012 --mojo-platform-channel-handle=1920 /prefetch:22⤵
-
-
C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_webhelper.exe"C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_webhelper.exe" --type=gpu-process --no-sandbox --user-data-dir="C:/Users/Admin/AppData/Roaming/SketchUp/SketchUp 2026/WebCache-137.0.7151.121/Cache0/SkpUserData" --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Roaming\SketchUp\SketchUp 2026\WebCache-137.0.7151.121\Cache0" --locales-dir-path="C:\Program Files\SketchUp\SketchUp 2026\SketchUp\cef\locales" --user-agent-product="Chrome/137.0.7151.121 SketchUp Pro/26.1 (PC)" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=2160,i,14458226113681589660,2806142134124202657,262144 --variations-seed-version --enable-logging=handle --log-file=2972 --mojo-platform-channel-handle=3004 /prefetch:22⤵
-
-
C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_webhelper.exe"C:\Program Files\SketchUp\SketchUp 2026\SketchUp\sketchup_webhelper.exe" --type=gpu-process --no-sandbox --user-data-dir="C:/Users/Admin/AppData/Roaming/SketchUp/SketchUp 2026/WebCache-137.0.7151.121/Cache0/SkpUserData" --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Roaming\SketchUp\SketchUp 2026\WebCache-137.0.7151.121\Cache0" --locales-dir-path="C:\Program Files\SketchUp\SketchUp 2026\SketchUp\cef\locales" --user-agent-product="Chrome/137.0.7151.121 SketchUp Pro/26.1 (PC)" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=disabled --field-trial-handle=2160,i,14458226113681589660,2806142134124202657,262144 --variations-seed-version --enable-logging=handle --log-file=3608 --mojo-platform-channel-handle=3008 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
2Accessibility Features
1Component Object Model Hijacking
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
2Accessibility Features
1Component Object Model Hijacking
1Defense Evasion
Indicator Removal
1File Deletion
1Modify Registry
2Pre-OS Boot
1Bootkit
1Replay Monitor
Loading Replay Monitor...
Downloads
e5def88.rbs
e5def94.rbs
e5def9b.rbs
e5defaa.rbs
e5defb0.rbs
e5defb6.rbs
e5defbc.rbs
e5defc1.rbs
e5defc6.rbs
BugSplatRc64.dll
LayOut.exe
cursor_no_move.svg
combobox-indicator-open-pressed.png
slider-handle-disabled.png
slider-handle.png
spinbox-background-down-hovered.png
spinbox-indicator-down-icon-up-hovered.png
spinbox-indicator-up-background-disabled.png
spinbox-indicator-up-icon-down-hovered.png
combobox-indicator-hovered.png
slider-handle-disabled.png
slider-handle.png
spinbox-background-down-hovered.png
spinbox-indicator-down-icon-up-hovered.png
spinbox-indicator-up-icon-down-hovered.png
QuickControls2ImagineStyleImpl.qmltypes
LICENSE.txt
manifest.json
keys.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
LICENSE
manifest.json
auto_open_controller.js
edge_checkout_page_validator.js
manifest.json
notification_fast.bundle.js.LICENSE.txt
tokenized-card.bundle.js.LICENSE.txt
strings.json
manifest.json
manifest.json
VC_redist.x64.exe
autofill_bypass_cache_forms.json
edge_autofill_global_block_list.json
v1FieldTypes.json
settings.dat
settings.dat
settings.dat
settings.dat
LOG.old
LOG.old
LOG.old
MANIFEST-000001
BookmarkMergedSurfaceOrdering
BrowsingTopicsState
f_000071
f_000072
f_000073
f_000074
f_000077
f_000078
f_000079
f_00007e
f_00007f
f_000080
f_000083
f_000085
f_000088
f_00008a
f_00008b
f_0000a7
f_0000b1
f_0000b2
f_0000b3
f_0000b4
f_0000b5
f_000122
temp-index
the-real-index
the-real-index
the-real-index
the-real-index
SiteList-Enterprise.json
HubApps
000003.log
LOG.old
MANIFEST-000001
29f38b56-05b8-44fc-8f8b-334f81c8872e.tmp
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Sdch Dictionaries
Sdch Dictionaries
TransportSecurity
TransportSecurity~RFe6cec6d.TMP
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
the-real-index
the-real-index
the-real-index
the-real-index
211d2fafe8c75831_0
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index~RFe58c5fb.TMP
index.txt
index.txt
ba23d8ecda68de77_0
the-real-index
the-real-index~RFe591bfa.TMP
sync_diagnostic.log
CURRENT
MANIFEST-000001
5
domain_actions.dll
data.txt
wallet-checkout-eligible-sites.json
wallet-notification-config.json
wallet-stable.json
wallet-tokenization-config.json
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
crs.pb
ct_config.pb
kp_pinslist.pb
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter~RFe58d25e.TMP
Filtering Rules
Part-FR
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
d3254c6e-8af0-4997-8d88-ca817508e335.tmp
3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
metadata.json
5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
model_storage.log
model_storage.log
model_storage.log
PrivatePreferences.json
PrivatePreferences.json
PrivatePreferences.json
BsSndRpt_RD8H7NT5.ini
SketchUpLog-2026-05-10-00_29_38.log
SketchUpLog-2026-05-10-00_29_38.log
SketchUpLog-2026-05-10-00_41_57.log
SketchUpLog-2026-05-10-00_41_57.log
SketchUpLog-2026-05-10-00_42_33.log
bugsplat_JOQ53380.log
bugsplat_JOQ53380.log
bugsplat_JOQ53380.log
sketchup.running
SuiteSetup.ini
ISBEW64.exe
ISRT.dll
ISSetup.dll
SU-App-Logo.png
Setup_UI.dll
SketchUp.exe
SketchUp_Install.ico
V-RAY-Horizontal-RGB.png
_is14D3
_is14D3
_is14D3
_is14D3
_is14D3
_is14D3
1029.mst
1031.mst
1028.mst
1038.mst
1045.mst
1033.mst
setup.inx
setup64.exe
setup.xml
default.dic
5f7b5f1e01b83767.automaticDestinations-ms
6824f4a902c78fbd.automaticDestinations-ms
9b9cdc69c1c24e2b.automaticDestinations-ms
b8ab77100df80ab2.automaticDestinations-ms
f01b4d95cf55d32a.automaticDestinations-ms
fb3b0dbfee58fac8.automaticDestinations-ms
SharedPreferences.json
4b500041-39ac-4856-95c8-f178d83301f6.tmp
85a27795-2fd5-49de-b470-33e13726af0d.tmp
data_0
data_1
data_2
data_3
the-real-index
the-real-index
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State~RFe61ce7b.TMP
TransportSecurity
TransportSecurity
TransportSecurity
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences~RFe611666.TMP
Local State
Local State
Local State
Local State
Local State
Local State
Local State~RFe60ef27.TMP
manifest.json
privacy-sandbox-attestations.dat
data_0
data_1
data_2
data_3
Filtering Rules
ranked_dicts
ccc924ef-4eb0-42fd-8121-f85aecab744a.tmp
metadata.json
metadata.json
metadata.json
metadata.json
debug.log
debug.log
debug.log
debug.log
debug.log
InstallShield.log
Readme.txt
MSIBBC6.tmp
e5defac.msi
_163C40A2_F973_4EE8_A8B8_7863F7EF59E3
_67B7EBD5_E2EA_44DA_B39D_BE3130FF0EC5
_E1547DA6_6F5D_4AC3_95E9_CE822F735DCB
_FC6A9B68_DFAE_41E5_8447_4A3B6CCF0A73
license.rtf
thm.wxl
thm.xml
logo.png
VC_redist.x64.exe
wixstdba.dll
memory/1192-13304-0x0000018F82080000-0x0000018F820D5000-memory.dmp
memory/1192-12183-0x0000018F82080000-0x0000018F820D5000-memory.dmp
memory/1192-3521-0x0000018F82080000-0x0000018F820D5000-memory.dmp
memory/1492-13593-0x00000000018D0000-0x0000000001945000-memory.dmp
memory/1492-3509-0x00000000018D0000-0x0000000001945000-memory.dmp
memory/1532-4637-0x0000000001590000-0x000000000160B000-memory.dmp
memory/1532-4636-0x0000000000D00000-0x0000000000D77000-memory.dmp
memory/1716-5023-0x0000000001130000-0x00000000011AB000-memory.dmp
memory/1856-12949-0x0000000000B70000-0x0000000000BC5000-memory.dmp
memory/2124-13305-0x0000000000C20000-0x0000000000C95000-memory.dmp
memory/2124-13048-0x0000000000C20000-0x0000000000C95000-memory.dmp
memory/2124-3522-0x0000000000C20000-0x0000000000C95000-memory.dmp
memory/2248-4642-0x0000000001170000-0x00000000011EB000-memory.dmp
memory/2248-4448-0x0000000001170000-0x00000000011EB000-memory.dmp
memory/2584-5027-0x0000000000960000-0x00000000009DB000-memory.dmp
memory/2864-4556-0x00000000018B0000-0x0000000001925000-memory.dmp
memory/2864-4627-0x00000000018B0000-0x0000000001925000-memory.dmp
memory/2988-12947-0x00000000010E0000-0x0000000001155000-memory.dmp
memory/3284-12914-0x0000000000F00000-0x0000000000F75000-memory.dmp
memory/3284-5213-0x0000000000F00000-0x0000000000F75000-memory.dmp
memory/3304-4628-0x0000000001710000-0x0000000001785000-memory.dmp
memory/3304-4450-0x0000000001710000-0x0000000001785000-memory.dmp
memory/3792-4449-0x0000000001380000-0x00000000013FB000-memory.dmp
memory/3792-4641-0x0000000001380000-0x00000000013FB000-memory.dmp
memory/4012-12946-0x00000000007A0000-0x00000000007F5000-memory.dmp
memory/4068-1825-0x000002AF02AE0000-0x000002AF02B35000-memory.dmp
memory/4220-12376-0x0000000002CA0000-0x0000000002D15000-memory.dmp
memory/4220-12913-0x0000000002CA0000-0x0000000002D15000-memory.dmp
memory/4716-288-0x0000011A838B0000-0x0000011A83905000-memory.dmp
memory/4824-3519-0x00000000014B0000-0x0000000001525000-memory.dmp
memory/4824-13592-0x00000000014B0000-0x0000000001525000-memory.dmp
memory/4932-5133-0x0000021388760000-0x000002138876C000-memory.dmp
memory/4932-5132-0x0000021387E10000-0x0000021387E65000-memory.dmp
memory/4932-11800-0x0000021387E10000-0x0000021387E65000-memory.dmp
memory/4932-14524-0x0000021387E10000-0x0000021387E65000-memory.dmp
memory/5024-1860-0x00000206EAE10000-0x00000206EAE65000-memory.dmp
memory/5088-1886-0x000001B0781F0000-0x000001B078245000-memory.dmp
memory/5092-4486-0x00000000004F0000-0x000000000056B000-memory.dmp
memory/5092-4639-0x00000000004F0000-0x000000000056B000-memory.dmp
memory/5160-5024-0x0000000000BA0000-0x0000000000C1B000-memory.dmp
memory/5280-4452-0x00000000013B0000-0x000000000142B000-memory.dmp
memory/5348-13878-0x0000017A50AE0000-0x0000017A50AE1000-memory.dmp
memory/5348-13880-0x0000017A50AE0000-0x0000017A50AE1000-memory.dmp
memory/5348-13693-0x00007FF7AF7C0000-0x00007FF7B3C70000-memory.dmp
memory/5348-13689-0x00007FF7AF7C0000-0x00007FF7B3C70000-memory.dmp
memory/5348-13879-0x0000017A50AE0000-0x0000017A50AE1000-memory.dmp
memory/5348-13882-0x0000017A50AE0000-0x0000017A50AE1000-memory.dmp
memory/5348-13884-0x0000017A50AE0000-0x0000017A50AE1000-memory.dmp
memory/5348-13688-0x00007FF8342C0000-0x00007FF8348E7000-memory.dmp
memory/5348-13883-0x0000017A50AE0000-0x0000017A50AE1000-memory.dmp
memory/5348-13691-0x00007FF7AF7C0000-0x00007FF7B3C70000-memory.dmp
memory/5348-13872-0x0000017A50AE0000-0x0000017A50AE1000-memory.dmp
memory/5348-13687-0x00007FF838CC0000-0x00007FF8392F4000-memory.dmp
memory/5348-13690-0x00007FF8342C0000-0x00007FF8348E7000-memory.dmp
memory/5348-13881-0x0000017A50AE0000-0x0000017A50AE1000-memory.dmp
memory/5348-13873-0x0000017A50AE0000-0x0000017A50AE1000-memory.dmp
memory/5348-13871-0x0000017A50AE0000-0x0000017A50AE1000-memory.dmp
memory/5456-4631-0x00000000010A0000-0x000000000111B000-memory.dmp
memory/5456-4630-0x0000000000D00000-0x0000000000D77000-memory.dmp
memory/5660-4634-0x0000000000D00000-0x0000000000D77000-memory.dmp
memory/5660-4635-0x0000000001270000-0x00000000012EB000-memory.dmp
memory/5756-3520-0x00000273D4A00000-0x00000273D4A55000-memory.dmp
memory/5824-12950-0x0000000000940000-0x00000000009B5000-memory.dmp
memory/5888-3236-0x0000000000B40000-0x0000000000BBB000-memory.dmp