Resubmissions
20/06/2026, 04:41
260620-fbkejaet9y820/06/2026, 04:32
260620-e51g6sc19l1020/06/2026, 04:31
260620-e5qmzac19k120/06/2026, 04:17
260620-ewtchac17j920/06/2026, 04:17
260620-ewd8kset6s320/06/2026, 04:13
260620-etkmksc16m4Analysis
- user interaction
yes - max time kernel
723s - max time network
724s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
20/06/2026, 04:17
General
- Target ReShade Pro 2k-4k Forza Horizon 6.ini
- Size 21KB
- Sample260620-ewtchac17j
- SHA256 7229e2ea9915c41c2d6a3f42129c63774845a9c6ec2763e76f24b3d1cf7fb108
Score
9/10
Malware Config
Signatures
- Enumerates VirtualBox registry keys 2 TTPs 2 IoCs
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 7 IoCs
- Downloads MZ/PE file 3 IoCs
- Looks for VMWare Tools registry key 2 TTPs 2 IoCs
- Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 4 IoCs
- Loads dropped DLL 2 IoCs
- Themida packer 10 IoCs
Detects Themida, an advanced Windows software protection system.
- Checks whether UAC is enabled 1 TTPs 2 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 18 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Network Share Discovery 1 TTPs
Attempt to gather information on host network.
- Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
- Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 2 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Embeds OpenSSL 1 IoCs
Embeds OpenSSL, may be used to circumvent TLS interception.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Time Discovery 1 TTPs 2 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 12 IoCs
- Modifies data under HKEY_USERS 5 IoCs
- Modifies registry class 10 IoCs
- Modifies system certificate store 2 TTPs 5 IoCs
- Suspicious behavior: EnumeratesProcesses 48 IoCs
- Suspicious behavior: LoadsDriver 3 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 59 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 40 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Windows\system32\NOTEPAD.EXEC:\Windows\system32\NOTEPAD.EXE "C:\Users\Admin\AppData\Local\Temp\ReShade Pro 2k-4k Forza Horizon 6.ini"1⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x11c,0x120,0x124,0x118,0xf4,0x7ffb5ff2c728,0x7ffb5ff2c734,0x7ffb5ff2c7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1700,i,16547268978639143045,8413378742450336479,262144 --field-trial-handle=1820,i,1949925334691091426,6543439072864371480,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1812 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1932,i,3324360762459404481,16930212773886168977,524288 --field-trial-handle=1820,i,1949925334691091426,6543439072864371480,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2056 /prefetch:32⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2416,i,9468125738894054709,17615402759993773190,524288 --field-trial-handle=1820,i,1949925334691091426,6543439072864371480,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2584 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3248,i,11761256645369515129,7520502833739467742,2097152 --field-trial-handle=1820,i,1949925334691091426,6543439072864371480,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3104 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3456,i,9847989563377907931,6646495281275787855,2097152 --field-trial-handle=1820,i,1949925334691091426,6543439072864371480,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3480 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4276,i,15608260284013837366,7804616652655916975,2097152 --field-trial-handle=1820,i,1949925334691091426,6543439072864371480,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4304 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3868,i,11232475191855635,16780230463176397988,2097152 --field-trial-handle=1820,i,1949925334691091426,6543439072864371480,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4664 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4216,i,7013577688439833683,15569510881518811025,524288 --field-trial-handle=1820,i,1949925334691091426,6543439072864371480,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4780 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4844,i,9114647163635968255,16688680937979056010,524288 --field-trial-handle=1820,i,1949925334691091426,6543439072864371480,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4976 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5504,i,1041893751252333397,1126748439094357049,524288 --field-trial-handle=1820,i,1949925334691091426,6543439072864371480,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4936 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5724,i,8542021861258413573,13983401868582001501,2097152 --field-trial-handle=1820,i,1949925334691091426,6543439072864371480,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5916 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=3668,i,1583289980896243151,1559567236221403178,2097152 --field-trial-handle=1820,i,1949925334691091426,6543439072864371480,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3612 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5804,i,1189500601390219030,17556442523266007054,2097152 --field-trial-handle=1820,i,1949925334691091426,6543439072864371480,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3492 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4676,i,2603801593812030255,18190826242425293274,524288 --field-trial-handle=1820,i,1949925334691091426,6543439072864371480,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4680 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4668,i,14219052891489980842,5800139755371590891,524288 --field-trial-handle=1820,i,1949925334691091426,6543439072864371480,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5868 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3236,i,13531972020925818219,15422783679059435523,524288 --field-trial-handle=1820,i,1949925334691091426,6543439072864371480,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4700 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=240,i,1664237694541463640,15766883070984553073,2097152 --field-trial-handle=1820,i,1949925334691091426,6543439072864371480,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3508 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=4408,i,13774065548726889569,16506462163075288259,2097152 --field-trial-handle=1820,i,1949925334691091426,6543439072864371480,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3872 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=4360,i,1049247347273922248,6087238684165005006,2097152 --field-trial-handle=1820,i,1949925334691091426,6543439072864371480,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4680 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5872,i,4863925131953555253,12549108674219686286,2097152 --field-trial-handle=1820,i,1949925334691091426,6543439072864371480,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3520 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=4332,i,15347123424129264616,15118320056717132871,2097152 --field-trial-handle=1820,i,1949925334691091426,6543439072864371480,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3604 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=5968,i,3818601584764029142,17733941157785044076,524288 --field-trial-handle=1820,i,1949925334691091426,6543439072864371480,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5824 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3544,i,14976702630187480193,14175436034933056762,524288 --field-trial-handle=1820,i,1949925334691091426,6543439072864371480,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5868 /prefetch:82⤵
- Modifies registry class
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5880,i,15952906242288371229,12300112332727054526,524288 --field-trial-handle=1820,i,1949925334691091426,6543439072864371480,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3536 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4668,i,7838444297217065054,12119934257946607620,262144 --field-trial-handle=1820,i,1949925334691091426,6543439072864371480,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5752 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=1264,i,16161740540286982829,10918652681749020411,2097152 --field-trial-handle=1820,i,1949925334691091426,6543439072864371480,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3136 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4636,i,10692769339543094962,8053717525981704113,524288 --field-trial-handle=1820,i,1949925334691091426,6543439072864371480,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3644 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=6196,i,16755711834450092470,3772717514807064277,2097152 --field-trial-handle=1820,i,1949925334691091426,6543439072864371480,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6192 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6352,i,1318152985579308559,586018205856241174,524288 --field-trial-handle=1820,i,1949925334691091426,6543439072864371480,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6332 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=3868,i,13935773416561597666,11814133461501128929,2097152 --field-trial-handle=1820,i,1949925334691091426,6543439072864371480,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5964 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=6228,i,10225142579104081941,17870690934216158724,2097152 --field-trial-handle=1820,i,1949925334691091426,6543439072864371480,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6524 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --metrics-shmem-handle=6320,i,15912292258875645324,12951350768801592539,2097152 --field-trial-handle=1820,i,1949925334691091426,6543439072864371480,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6256 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --metrics-shmem-handle=6696,i,1335299726402708165,9502721879810906878,2097152 --field-trial-handle=1820,i,1949925334691091426,6543439072864371480,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6584 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --metrics-shmem-handle=6552,i,16574330587467697168,661135379201104004,2097152 --field-trial-handle=1820,i,1949925334691091426,6543439072864371480,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6748 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --metrics-shmem-handle=6780,i,5014323176604134173,4873836790225555207,2097152 --field-trial-handle=1820,i,1949925334691091426,6543439072864371480,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6792 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --metrics-shmem-handle=6816,i,16601222525719048388,1159455726830442608,2097152 --field-trial-handle=1820,i,1949925334691091426,6543439072864371480,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4668 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --metrics-shmem-handle=7124,i,700059829948054956,6260538809594470331,2097152 --field-trial-handle=1820,i,1949925334691091426,6543439072864371480,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7160 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3648,i,12818369519843956295,17496810025792527071,524288 --field-trial-handle=1820,i,1949925334691091426,6543439072864371480,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3588 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --metrics-shmem-handle=3628,i,15431105533383831534,9895428267029916372,2097152 --field-trial-handle=1820,i,1949925334691091426,6543439072864371480,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3656 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=7304,i,11518446149729050167,10048238906608372641,524288 --field-trial-handle=1820,i,1949925334691091426,6543439072864371480,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7312 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=7320,i,1825248162168795232,18266577169597434854,524288 --field-trial-handle=1820,i,1949925334691091426,6543439072864371480,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3740 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --metrics-shmem-handle=6480,i,5551190779356545396,18321766771699573025,2097152 --field-trial-handle=1820,i,1949925334691091426,6543439072864371480,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5844 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --metrics-shmem-handle=7284,i,14315572552069370697,10335305909800564629,2097152 --field-trial-handle=1820,i,1949925334691091426,6543439072864371480,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7380 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --metrics-shmem-handle=7176,i,16347801393132501033,16837468094561544012,2097152 --field-trial-handle=1820,i,1949925334691091426,6543439072864371480,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3580 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=7284,i,4791597518963826174,7187691558174378964,524288 --field-trial-handle=1820,i,1949925334691091426,6543439072864371480,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7728 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --metrics-shmem-handle=7648,i,1161843946373971433,3977190612120406131,2097152 --field-trial-handle=1820,i,1949925334691091426,6543439072864371480,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7348 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --metrics-shmem-handle=6560,i,17837987839823374708,8133978846140000721,2097152 --field-trial-handle=1820,i,1949925334691091426,6543439072864371480,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7276 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --metrics-shmem-handle=6664,i,9030632399902000455,5443791041085729113,2097152 --field-trial-handle=1820,i,1949925334691091426,6543439072864371480,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6276 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --metrics-shmem-handle=6864,i,17099688505730438151,4182130338146225316,2097152 --field-trial-handle=1820,i,1949925334691091426,6543439072864371480,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6676 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --metrics-shmem-handle=8120,i,16002660697485937398,9960834539541234298,2097152 --field-trial-handle=1820,i,1949925334691091426,6543439072864371480,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6704 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --metrics-shmem-handle=8180,i,10790040777687117788,871533748517055803,2097152 --field-trial-handle=1820,i,1949925334691091426,6543439072864371480,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8052 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=7620,i,2054757523522599064,7285727157237615385,524288 --field-trial-handle=1820,i,1949925334691091426,6543439072864371480,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6508 /prefetch:82⤵
-
-
C:\Users\Admin\Downloads\BootstrapperNew (1).exe"C:\Users\Admin\Downloads\BootstrapperNew (1).exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Solara\Solara.exe"C:\Users\Admin\AppData\Local\Solara\Solara.exe" --bootstrapperPath "C:\Users\Admin\Downloads" --bootstrapperExe "C:\Users\Admin\Downloads\BootstrapperNew (1).exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Solara.exe --webview-exe-version=3.0.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --mojo-named-platform-channel-pipe=1672.1736.159682780835491266944⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x17c,0x180,0x184,0x158,0x1b8,0x7ffb533fb078,0x7ffb533fb084,0x7ffb533fb0905⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView" --webview-exe-name=Solara.exe --webview-exe-version=3.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1764,i,1738106553084092905,2136557758309350878,262144 --variations-seed-version --mojo-platform-channel-handle=1760 /prefetch:25⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView" --webview-exe-name=Solara.exe --webview-exe-version=3.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=2080,i,1738106553084092905,2136557758309350878,262144 --variations-seed-version --mojo-platform-channel-handle=2092 /prefetch:35⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView" --webview-exe-name=Solara.exe --webview-exe-version=3.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=2420,i,1738106553084092905,2136557758309350878,262144 --variations-seed-version --mojo-platform-channel-handle=2432 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\SolaraWebView2\EBWebView" --webview-exe-name=Solara.exe --webview-exe-version=3.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3740,i,1738106553084092905,2136557758309350878,262144 --variations-seed-version --mojo-platform-channel-handle=3752 /prefetch:15⤵
-
-
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --metrics-shmem-handle=6676,i,1783547898356181890,12961107673212037009,2097152 --field-trial-handle=1820,i,1949925334691091426,6543439072864371480,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6216 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --metrics-shmem-handle=6948,i,1977848159150453266,13034733770294885465,2097152 --field-trial-handle=1820,i,1949925334691091426,6543439072864371480,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6920 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --metrics-shmem-handle=7240,i,18113956957703104605,13796048200171563351,2097152 --field-trial-handle=1820,i,1949925334691091426,6543439072864371480,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6512 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --metrics-shmem-handle=7200,i,3411053940029855464,733796633198241654,2097152 --field-trial-handle=1820,i,1949925334691091426,6543439072864371480,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3860 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --metrics-shmem-handle=6540,i,11378488849970308743,14428713902827919441,2097152 --field-trial-handle=1820,i,1949925334691091426,6543439072864371480,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8028 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --metrics-shmem-handle=6612,i,2603153139954078734,13732084105760733539,2097152 --field-trial-handle=1820,i,1949925334691091426,6543439072864371480,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7196 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --metrics-shmem-handle=6452,i,1971371851503601794,9525219913825521167,2097152 --field-trial-handle=1820,i,1949925334691091426,6543439072864371480,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6436 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6392,i,12124354134985363293,3549099345201818838,524288 --field-trial-handle=1820,i,1949925334691091426,6543439072864371480,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6440 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --metrics-shmem-handle=7216,i,9238423257394831997,16668419441319634009,2097152 --field-trial-handle=1820,i,1949925334691091426,6543439072864371480,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6628 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6600,i,13475924986146713756,14022692353800516620,524288 --field-trial-handle=1820,i,1949925334691091426,6543439072864371480,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6892 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --metrics-shmem-handle=7920,i,17941159723824715675,16685590844316471152,2097152 --field-trial-handle=1820,i,1949925334691091426,6543439072864371480,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7840 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --metrics-shmem-handle=6624,i,18022915110484178047,3464200634854827719,2097152 --field-trial-handle=1820,i,1949925334691091426,6543439072864371480,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7844 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --metrics-shmem-handle=7640,i,12478249118926269814,13466482631323182127,2097152 --field-trial-handle=1820,i,1949925334691091426,6543439072864371480,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6392 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --metrics-shmem-handle=8088,i,5700200000577393053,3017202886628125487,2097152 --field-trial-handle=1820,i,1949925334691091426,6543439072864371480,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6660 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --metrics-shmem-handle=5940,i,16623330637259505390,1940786223730653833,2097152 --field-trial-handle=1820,i,1949925334691091426,6543439072864371480,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7952 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --metrics-shmem-handle=7992,i,10170489355111537744,11065655395146061687,2097152 --field-trial-handle=1820,i,1949925334691091426,6543439072864371480,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7264 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --metrics-shmem-handle=3912,i,3169814589985222906,2110559832253605050,2097152 --field-trial-handle=1820,i,1949925334691091426,6543439072864371480,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6792 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --metrics-shmem-handle=8068,i,8470937571686892139,2856522437439021351,2097152 --field-trial-handle=1820,i,1949925334691091426,6543439072864371480,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7952 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6552,i,16710246553980181784,6097463174319340788,524288 --field-trial-handle=1820,i,1949925334691091426,6543439072864371480,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6816 /prefetch:82⤵
-
-
C:\Users\Admin\Downloads\CheatHub.exe"C:\Users\Admin\Downloads\CheatHub.exe"2⤵
- Executes dropped EXE
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --metrics-shmem-handle=6588,i,11489614252755967466,17800542003462458332,2097152 --field-trial-handle=1820,i,1949925334691091426,6543439072864371480,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6164 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --metrics-shmem-handle=4564,i,4733508981962283065,7196386434588076158,2097152 --field-trial-handle=1820,i,1949925334691091426,6543439072864371480,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6816 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --metrics-shmem-handle=3912,i,11116297825919367249,10534058571628492600,2097152 --field-trial-handle=1820,i,1949925334691091426,6543439072864371480,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5956 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5756,i,4054436209274678419,10319198396714351694,524288 --field-trial-handle=1820,i,1949925334691091426,6543439072864371480,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5812 /prefetch:82⤵
-
-
C:\Users\Admin\Downloads\Ronix-Installer.exe"C:\Users\Admin\Downloads\Ronix-Installer.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --metrics-shmem-handle=6628,i,3175379747490643371,10781587244595218411,2097152 --field-trial-handle=1820,i,1949925334691091426,6543439072864371480,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6360 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6448,i,11108678371755179453,14875374945167642466,524288 --field-trial-handle=1820,i,1949925334691091426,6543439072864371480,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7060 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\Downloads\Release1.3.22 (1)\Drift.exe"C:\Users\Admin\Downloads\Release1.3.22 (1)\Drift.exe"1⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks for VirtualBox DLLs, possible anti-VM trick
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\Downloads\Release1.3.22 (1)\Drift.exe"C:\Users\Admin\Downloads\Release1.3.22 (1)\Drift.exe"1⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks for VirtualBox DLLs, possible anti-VM trick
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\Downloads\Xeno-v1.3.55\Xeno-v1.3.55\Xeno.exe"C:\Users\Admin\Downloads\Xeno-v1.3.55\Xeno-v1.3.55\Xeno.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/xe-no2⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://discord.gg/xe-no3⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x208,0x7ffb50b2c188,0x7ffb50b2c194,0x7ffb50b2c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1808,i,16930070001122689835,5616521840773695295,524288 --field-trial-handle=2268,i,2474108145974150966,7711619672393191659,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:34⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,6927814194709080938,17238947888985312287,262144 --field-trial-handle=2268,i,2474108145974150966,7711619672393191659,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2012,i,5148951350814052817,12250952289400623790,524288 --field-trial-handle=2268,i,2474108145974150966,7711619672393191659,262144 --variations-seed-version --mojo-platform-channel-handle=2584 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3476,i,14171215569480155271,9035099309128166638,2097152 --field-trial-handle=2268,i,2474108145974150966,7711619672393191659,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3480,i,15206450102877493685,13447493607028979924,2097152 --field-trial-handle=2268,i,2474108145974150966,7711619672393191659,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4200,i,6379545719314663728,15390554264724319790,2097152 --field-trial-handle=2268,i,2474108145974150966,7711619672393191659,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4228,i,15416060688580651497,6218086144980730493,2097152 --field-trial-handle=2268,i,2474108145974150966,7711619672393191659,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5164,i,10125065223111722302,8313158829487688198,524288 --field-trial-handle=2268,i,2474108145974150966,7711619672393191659,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5172,i,11624789380445550577,13568944952557684989,524288 --field-trial-handle=2268,i,2474108145974150966,7711619672393191659,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,3464058867428308127,5890895744091414275,524288 --field-trial-handle=2268,i,2474108145974150966,7711619672393191659,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,3464058867428308127,5890895744091414275,524288 --field-trial-handle=2268,i,2474108145974150966,7711619672393191659,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5968,i,13489025403501962507,5816858087596031613,524288 --field-trial-handle=2268,i,2474108145974150966,7711619672393191659,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6164,i,17090942511258649258,8133314361380964239,2097152 --field-trial-handle=2268,i,2474108145974150966,7711619672393191659,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3604,i,4683160267445283830,7130598177388748825,524288 --field-trial-handle=2268,i,2474108145974150966,7711619672393191659,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:84⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Xeno.exe --webview-exe-version=1.3.55+87ae4f96f8a0927052c1120167982fb069afd1b4 --user-data-dir="C:\Users\Admin\Downloads\Xeno-v1.3.55\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --mojo-named-platform-channel-pipe=2132.4580.130717914587712479462⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\Downloads\Xeno-v1.3.55\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\Downloads\Xeno-v1.3.55\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x184,0x188,0x18c,0x158,0x1bc,0x7ffb533fb078,0x7ffb533fb084,0x7ffb533fb0903⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\Downloads\Xeno-v1.3.55\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView" --webview-exe-name=Xeno.exe --webview-exe-version=1.3.55+87ae4f96f8a0927052c1120167982fb069afd1b4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1836,i,6320043923329997701,12163121464251237613,262144 --variations-seed-version --mojo-platform-channel-handle=1832 /prefetch:23⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\Downloads\Xeno-v1.3.55\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView" --webview-exe-name=Xeno.exe --webview-exe-version=1.3.55+87ae4f96f8a0927052c1120167982fb069afd1b4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=1904,i,6320043923329997701,12163121464251237613,262144 --variations-seed-version --mojo-platform-channel-handle=2000 /prefetch:33⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\Downloads\Xeno-v1.3.55\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView" --webview-exe-name=Xeno.exe --webview-exe-version=1.3.55+87ae4f96f8a0927052c1120167982fb069afd1b4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=2320,i,6320043923329997701,12163121464251237613,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\Downloads\Xeno-v1.3.55\Xeno-v1.3.55\Xeno.exe.WebView2\EBWebView" --webview-exe-name=Xeno.exe --webview-exe-version=1.3.55+87ae4f96f8a0927052c1120167982fb069afd1b4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3536,i,6320043923329997701,12163121464251237613,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:13⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Defense Evasion
Modify Registry
1Subvert Trust Controls
1Install Root Certificate
1Virtualization/Sandbox Evasion
3Replay Monitor
Loading Replay Monitor...
Downloads
54C62B182F5BF07FA8427C07B0A3AAF8_4DBBCB40FA282C06F1543D887F4F4DCC
A71F9E6AF1EDB5F61A1EABEAC6EE27B2_D62B1A6E7A25E8AED631F57A5AAB219E
54C62B182F5BF07FA8427C07B0A3AAF8_4DBBCB40FA282C06F1543D887F4F4DCC
A71F9E6AF1EDB5F61A1EABEAC6EE27B2_D62B1A6E7A25E8AED631F57A5AAB219E
user.config
user.config
BookmarkMergedSurfaceOrdering
BrowsingTopicsState
f_000006
f_000007
f_000009
f_000010
f_000029
f_000037
f_00003e
f_000040
f_000041
f_000042
f_000043
f_000044
f_000052
f_000057
f_00005a
f_00005d
f_000063
f_000068
f_00007c
f_000091
f_0000bf
f_000109
temp-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
000003.log
CURRENT
LOG
MANIFEST-000001
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
TransportSecurity
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
temp-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index~RFe5a8965.TMP
the-real-index
the-real-index~RFe5a595c.TMP
index.txt
index.txt
index.txt
index.txt
index.txt
index.txt
index.txt
index.txt
index.txt
index.txt
index.txt~RFe59fae1.TMP
b6c28cea6ed9dfc1_0
b6c28cea6ed9dfc1_1
fa813c9ad67834ac_0
fa813c9ad67834ac_1
the-real-index
the-real-index
the-real-index
the-real-index~RFe599a04.TMP
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
blocklist
settings.dat
settings.dat
settings.dat
the-real-index
the-real-index~RFe634982.TMP
2434c942-b354-4cee-9c6c-894288fe9c04.tmp
Edge Profile.ico
HubApps
Network Persistent State
Preferences
Secure Preferences
sync_diagnostic.log
Local State
Local State
Local State
6b3b9b3b-aefc-4033-b967-b98c84762356.tmp
settings.dat
index
the-real-index
the-real-index~RFe5f6a0d.TMP
data_0
data_1
data_2
data_3
MANIFEST-000001
Network Persistent State
Network Persistent State~RFe5f6a3c.TMP
Preferences
Preferences~RFe5f6a0d.TMP
Local State
Local State
Local State
Local State
Local State~RFe5f026a.TMP
Microsoft.Web.WebView2.Core.dll
Microsoft.Web.WebView2.Wpf.dll
Solara.exe
SolaraV3.dll
Wpf.Ui.dll
DEBUG.txt
DEBUG.txt
DEBUG.txt
DEBUG.txt
XENO_CACHE.bin
settings.json
5d696d521de238c3.customDestinations-ms
5d696d521de238c3.customDestinations-ms
CheatHub.exe
Release1.3.22.zip.crdownload
Unconfirmed 552436.crdownload
Xeno-v1.3.55.zip
settings.dat
Network Action Predictor
6ef264f4-1b36-4ea9-8a0d-0d0543977fe5.tmp
Local State
Local State
Local State
Local State
Local State~RFe63301e.TMP
memory/1672-1950-0x00000200263F0000-0x0000020026492000-memory.dmp
memory/1672-2716-0x00007FFB39EF0000-0x00007FFB3AD0A000-memory.dmp
memory/1672-1952-0x0000020027E30000-0x0000020027EE2000-memory.dmp
memory/1672-1917-0x00007FFB39EF0000-0x00007FFB3AD0A000-memory.dmp
memory/1672-1900-0x00000200260E0000-0x000002002619A000-memory.dmp
memory/1672-1945-0x0000020026020000-0x0000020026038000-memory.dmp
memory/1672-1899-0x00000200264F0000-0x0000020026AA4000-memory.dmp
memory/1672-1897-0x000002000B780000-0x000002000B8C2000-memory.dmp
memory/2096-1441-0x00000177A3950000-0x00000177A395E000-memory.dmp
memory/2096-1478-0x00000177C32D0000-0x00000177C32E2000-memory.dmp
memory/2096-1479-0x00000177C32C0000-0x00000177C32CA000-memory.dmp
memory/2096-1475-0x00000177C7790000-0x00000177C77B2000-memory.dmp
memory/2096-1466-0x00000177C75A0000-0x00000177C7652000-memory.dmp
memory/2096-1440-0x00000177A3980000-0x00000177A39B8000-memory.dmp
memory/2096-1439-0x00000177A3900000-0x00000177A3908000-memory.dmp
memory/2096-1438-0x00000177851B0000-0x00000177851C0000-memory.dmp
memory/2096-1437-0x00000177845A0000-0x0000017784DE6000-memory.dmp
memory/3824-3386-0x00007FF654150000-0x00007FF654FC9000-memory.dmp
memory/3824-3387-0x00007FF654150000-0x00007FF654FC9000-memory.dmp
memory/3824-1295-0x00007FFB7D200000-0x00007FFB7D202000-memory.dmp
memory/3824-1294-0x00007FFB7D1F0000-0x00007FFB7D1F2000-memory.dmp
memory/3824-3419-0x00007FF654150000-0x00007FF654FC9000-memory.dmp
memory/3824-1296-0x00007FF640060000-0x00007FF6425DC000-memory.dmp
memory/3824-3390-0x00007FF654150000-0x00007FF654FC9000-memory.dmp
memory/3824-3393-0x00007FF654150000-0x00007FF654FC9000-memory.dmp
memory/3824-3389-0x00007FF654150000-0x00007FF654FC9000-memory.dmp
memory/3824-3388-0x00007FF654150000-0x00007FF654FC9000-memory.dmp
memory/3824-3391-0x00007FF654150000-0x00007FF654FC9000-memory.dmp
memory/3824-3392-0x00007FF654150000-0x00007FF654FC9000-memory.dmp
memory/3988-2057-0x00007FFB7CB10000-0x00007FFB7CB11000-memory.dmp
memory/3988-2056-0x00007FFB7C2D0000-0x00007FFB7C2D1000-memory.dmp
memory/4176-1987-0x00007FFB7C2D0000-0x00007FFB7C2D1000-memory.dmp
memory/5348-2097-0x00007FFB7C2D0000-0x00007FFB7C2D1000-memory.dmp
memory/5780-2999-0x00007FF640060000-0x00007FF6425DC000-memory.dmp