Analysis
- user interaction
yes - max time kernel
899s - max time network
899s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
26/06/2026, 04:35
General
- Target Auxie.zip
- Size 14KB
- Sample260626-e7s6wagy6y
- SHA256 faa221ad64a96bf6447f239be4c5129180972b85f6a3fc232c8c65cb1aee7369
Score
8/10
Malware Config
Signatures
- Badlisted process makes network request 3 IoCs
Network request originating from process or tool commonly abused by malware.
- Downloads MZ/PE file 2 IoCs
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 11 IoCs
- Loads dropped DLL 21 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 25 IoCs
- Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs
When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 3 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 12 IoCs
- Modifies data under HKEY_USERS 23 IoCs
- Modifies registry class 64 IoCs
- Modifies system certificate store 2 TTPs 2 IoCs
- NTFS ADS 3 IoCs
- Runs net.exe
- Suspicious behavior: AddClipboardFormatListener 3 IoCs
- Suspicious behavior: EnumeratesProcesses 24 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 43 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 54 IoCs
- Suspicious use of SetWindowsHookEx 27 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\Auxie.zip1⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff7814c728,0x7fff7814c734,0x7fff7814c7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1460,i,8641791678079968711,15697255796726275498,524288 --field-trial-handle=1960,i,18245305606931721331,7123925970874473072,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2016 /prefetch:112⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1652,i,17002524224276003117,9631337776593939061,262144 --field-trial-handle=1960,i,18245305606931721331,7123925970874473072,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1956 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2368,i,16309012601253754038,10483183661831745788,524288 --field-trial-handle=1960,i,18245305606931721331,7123925970874473072,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2336 /prefetch:132⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3216,i,8815365578735750831,375309176654471204,2097152 --field-trial-handle=1960,i,18245305606931721331,7123925970874473072,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3456 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3220,i,12959807197874881154,492259782110025775,2097152 --field-trial-handle=1960,i,18245305606931721331,7123925970874473072,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3476 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4300,i,16554952819033911064,2899338032723326759,2097152 --field-trial-handle=1960,i,18245305606931721331,7123925970874473072,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4316 /prefetch:92⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4696,i,12794675299186764646,15068977879603509163,2097152 --field-trial-handle=1960,i,18245305606931721331,7123925970874473072,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4680 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4900,i,17825624440009178888,12275116462769370933,524288 --field-trial-handle=1960,i,18245305606931721331,7123925970874473072,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4908 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5028,i,7923855716945225349,3626586668594353216,524288 --field-trial-handle=1960,i,18245305606931721331,7123925970874473072,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5044 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5560,i,5120455872948266348,13486027209478038491,524288 --field-trial-handle=1960,i,18245305606931721331,7123925970874473072,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5564 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5004,i,3492792214200205249,15989633457922026734,524288 --field-trial-handle=1960,i,18245305606931721331,7123925970874473072,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5816 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5576,i,10423915933348965098,8454743944896977852,524288 --field-trial-handle=1960,i,18245305606931721331,7123925970874473072,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5820 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5804,i,11031436539278458954,12404092604020794641,524288 --field-trial-handle=1960,i,18245305606931721331,7123925970874473072,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5864 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5836,i,13373249108482430197,7464621029639557620,2097152 --field-trial-handle=1960,i,18245305606931721331,7123925970874473072,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5820 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=4720,i,3469736797791300303,15579091667029936109,2097152 --field-trial-handle=1960,i,18245305606931721331,7123925970874473072,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6056 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=3680,i,12731910514127052448,11769987283332454758,2097152 --field-trial-handle=1960,i,18245305606931721331,7123925970874473072,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3656 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=3608,i,4477643998280903416,2853190178996826299,2097152 --field-trial-handle=1960,i,18245305606931721331,7123925970874473072,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3472 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=4784,i,6478148885369006374,10197630563855925727,2097152 --field-trial-handle=1960,i,18245305606931721331,7123925970874473072,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4348 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=3580,i,6152899092236165915,17761886875622945417,2097152 --field-trial-handle=1960,i,18245305606931721331,7123925970874473072,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5784 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=4808,i,5274675738482041785,6886523044086682998,2097152 --field-trial-handle=1960,i,18245305606931721331,7123925970874473072,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3624 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=3620,i,12374371810106474745,18110955639842987451,2097152 --field-trial-handle=1960,i,18245305606931721331,7123925970874473072,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4788 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=3192,i,4067679742795104710,2633555388564260447,2097152 --field-trial-handle=1960,i,18245305606931721331,7123925970874473072,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4264 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6172,i,10932381035244108729,5960307908931909024,2097152 --field-trial-handle=1960,i,18245305606931721331,7123925970874473072,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6296 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6432,i,11771960015619517729,10039810303376300751,2097152 --field-trial-handle=1960,i,18245305606931721331,7123925970874473072,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6456 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=3580,i,5820656919585999959,5625054236445608511,2097152 --field-trial-handle=1960,i,18245305606931721331,7123925970874473072,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4336 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=6688,i,14920276116294900336,12423510530937980374,2097152 --field-trial-handle=1960,i,18245305606931721331,7123925970874473072,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6648 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6836,i,7573496886900539745,15277083563904949030,524288 --field-trial-handle=1960,i,18245305606931721331,7123925970874473072,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4776 /prefetch:142⤵
- NTFS ADS
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6472,i,11528226956457204090,6149920761099996960,262144 --field-trial-handle=1960,i,18245305606931721331,7123925970874473072,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6428 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7fff7814c728,0x7fff7814c734,0x7fff7814c7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1856,i,12181312095818566732,10756238452211871784,524288 --field-trial-handle=2024,i,4220522886646422140,9595246894433623174,262144 --variations-seed-version=20260625-170100.783000-production --mojo-platform-channel-handle=2056 /prefetch:112⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1584,i,14351338432342221938,6694444186579912873,262144 --field-trial-handle=2024,i,4220522886646422140,9595246894433623174,262144 --variations-seed-version=20260625-170100.783000-production --mojo-platform-channel-handle=2020 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2348,i,1408006957995966144,14647674102857244783,524288 --field-trial-handle=2024,i,4220522886646422140,9595246894433623174,262144 --variations-seed-version=20260625-170100.783000-production --mojo-platform-channel-handle=1744 /prefetch:132⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3228,i,3359098498091541724,13931582857278761849,2097152 --field-trial-handle=2024,i,4220522886646422140,9595246894433623174,262144 --variations-seed-version=20260625-170100.783000-production --mojo-platform-channel-handle=3304 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3312,i,10657657708869419936,159398109098289224,2097152 --field-trial-handle=2024,i,4220522886646422140,9595246894433623174,262144 --variations-seed-version=20260625-170100.783000-production --mojo-platform-channel-handle=3324 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4564,i,13237355797843640418,2154083887422179048,524288 --field-trial-handle=2024,i,4220522886646422140,9595246894433623174,262144 --variations-seed-version=20260625-170100.783000-production --mojo-platform-channel-handle=4516 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4676,i,18202348095203279827,748142055263039520,2097152 --field-trial-handle=2024,i,4220522886646422140,9595246894433623174,262144 --variations-seed-version=20260625-170100.783000-production --mojo-platform-channel-handle=4692 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4836,i,16061199905671441647,7238287085625338003,524288 --field-trial-handle=2024,i,4220522886646422140,9595246894433623174,262144 --variations-seed-version=20260625-170100.783000-production --mojo-platform-channel-handle=4720 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5296,i,5994113306281368685,52707404786620565,524288 --field-trial-handle=2024,i,4220522886646422140,9595246894433623174,262144 --variations-seed-version=20260625-170100.783000-production --mojo-platform-channel-handle=5304 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5596,i,4644348149649459634,13552111832026125874,2097152 --field-trial-handle=2024,i,4220522886646422140,9595246894433623174,262144 --variations-seed-version=20260625-170100.783000-production --mojo-platform-channel-handle=5564 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5808,i,1513505269247261766,13129238683771684481,2097152 --field-trial-handle=2024,i,4220522886646422140,9595246894433623174,262144 --variations-seed-version=20260625-170100.783000-production --mojo-platform-channel-handle=5768 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5936,i,7416465528887075628,7831599822701936863,2097152 --field-trial-handle=2024,i,4220522886646422140,9595246894433623174,262144 --variations-seed-version=20260625-170100.783000-production --mojo-platform-channel-handle=5736 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6044,i,8504603262152402465,6320545089606409934,2097152 --field-trial-handle=2024,i,4220522886646422140,9595246894433623174,262144 --variations-seed-version=20260625-170100.783000-production --mojo-platform-channel-handle=5932 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=4752,i,15885983140115184875,4351006822816064522,2097152 --field-trial-handle=2024,i,4220522886646422140,9595246894433623174,262144 --variations-seed-version=20260625-170100.783000-production --mojo-platform-channel-handle=4804 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6284,i,17383574104411909562,12703665042356466858,2097152 --field-trial-handle=2024,i,4220522886646422140,9595246894433623174,262144 --variations-seed-version=20260625-170100.783000-production --mojo-platform-channel-handle=6308 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6360,i,12283372213193060498,17173117349072500884,2097152 --field-trial-handle=2024,i,4220522886646422140,9595246894433623174,262144 --variations-seed-version=20260625-170100.783000-production --mojo-platform-channel-handle=6396 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5828,i,16059041914894495720,1273442225287462531,2097152 --field-trial-handle=2024,i,4220522886646422140,9595246894433623174,262144 --variations-seed-version=20260625-170100.783000-production --mojo-platform-channel-handle=5848 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5812,i,802846573206130707,8118581833593004533,2097152 --field-trial-handle=2024,i,4220522886646422140,9595246894433623174,262144 --variations-seed-version=20260625-170100.783000-production --mojo-platform-channel-handle=5548 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6708,i,2350813355402368182,10859108552690540380,2097152 --field-trial-handle=2024,i,4220522886646422140,9595246894433623174,262144 --variations-seed-version=20260625-170100.783000-production --mojo-platform-channel-handle=6732 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6284,i,9449277604786056241,4565313099248344237,2097152 --field-trial-handle=2024,i,4220522886646422140,9595246894433623174,262144 --variations-seed-version=20260625-170100.783000-production --mojo-platform-channel-handle=6288 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=4692,i,2820957648431005136,5518234151513581451,2097152 --field-trial-handle=2024,i,4220522886646422140,9595246894433623174,262144 --variations-seed-version=20260625-170100.783000-production --mojo-platform-channel-handle=6924 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6136,i,502678412241080698,13540832720946692161,524288 --field-trial-handle=2024,i,4220522886646422140,9595246894433623174,262144 --variations-seed-version=20260625-170100.783000-production --mojo-platform-channel-handle=6124 /prefetch:142⤵
- NTFS ADS
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=7352,i,16945748381768641130,2607272824498881424,2097152 --field-trial-handle=2024,i,4220522886646422140,9595246894433623174,262144 --variations-seed-version=20260625-170100.783000-production --mojo-platform-channel-handle=7376 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of SendNotifyMessage
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7fff7814c728,0x7fff7814c734,0x7fff7814c7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1624,i,16582774840827264768,3025979165253226953,262144 --field-trial-handle=2060,i,5543857002506919237,12699444305213528706,262144 --variations-seed-version=20260625-170100.783000-production --mojo-platform-channel-handle=2056 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1796,i,6260062769483180560,14551462529673141280,524288 --field-trial-handle=2060,i,5543857002506919237,12699444305213528706,262144 --variations-seed-version=20260625-170100.783000-production --mojo-platform-channel-handle=2104 /prefetch:112⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2364,i,898576040337546350,10098347034861130869,524288 --field-trial-handle=2060,i,5543857002506919237,12699444305213528706,262144 --variations-seed-version=20260625-170100.783000-production --mojo-platform-channel-handle=2396 /prefetch:132⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3244,i,818316899506977476,758365159494826457,2097152 --field-trial-handle=2060,i,5543857002506919237,12699444305213528706,262144 --variations-seed-version=20260625-170100.783000-production --mojo-platform-channel-handle=3304 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3312,i,1369999992262574459,3392946214115956090,2097152 --field-trial-handle=2060,i,5543857002506919237,12699444305213528706,262144 --variations-seed-version=20260625-170100.783000-production --mojo-platform-channel-handle=3348 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4556,i,16185016679487166525,11234522059118917217,524288 --field-trial-handle=2060,i,5543857002506919237,12699444305213528706,262144 --variations-seed-version=20260625-170100.783000-production --mojo-platform-channel-handle=4532 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4688,i,13385886776187585651,1581121208722305152,2097152 --field-trial-handle=2060,i,5543857002506919237,12699444305213528706,262144 --variations-seed-version=20260625-170100.783000-production --mojo-platform-channel-handle=4692 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4820,i,7023224550293400621,10661212222276375116,524288 --field-trial-handle=2060,i,5543857002506919237,12699444305213528706,262144 --variations-seed-version=20260625-170100.783000-production --mojo-platform-channel-handle=4840 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5276,i,6084382224695863243,12541300217325040191,524288 --field-trial-handle=2060,i,5543857002506919237,12699444305213528706,262144 --variations-seed-version=20260625-170100.783000-production --mojo-platform-channel-handle=5344 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5644,i,9830933299751797900,5524755068028428812,2097152 --field-trial-handle=2060,i,5543857002506919237,12699444305213528706,262144 --variations-seed-version=20260625-170100.783000-production --mojo-platform-channel-handle=5656 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5788,i,4467162095250607868,7338462080913152528,2097152 --field-trial-handle=2060,i,5543857002506919237,12699444305213528706,262144 --variations-seed-version=20260625-170100.783000-production --mojo-platform-channel-handle=5736 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5792,i,15946885971724063824,13980774808192745442,2097152 --field-trial-handle=2060,i,5543857002506919237,12699444305213528706,262144 --variations-seed-version=20260625-170100.783000-production --mojo-platform-channel-handle=3496 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5952,i,271815953642189153,2995655146834651485,524288 --field-trial-handle=2060,i,5543857002506919237,12699444305213528706,262144 --variations-seed-version=20260625-170100.783000-production --mojo-platform-channel-handle=6016 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3476,i,12947957020897303682,13694730436182528933,524288 --field-trial-handle=2060,i,5543857002506919237,12699444305213528706,262144 --variations-seed-version=20260625-170100.783000-production --mojo-platform-channel-handle=5932 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6052,i,6548709666643121453,13891735136480548225,524288 --field-trial-handle=2060,i,5543857002506919237,12699444305213528706,262144 --variations-seed-version=20260625-170100.783000-production --mojo-platform-channel-handle=6040 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5952,i,7983415808698432114,13770219623107271010,2097152 --field-trial-handle=2060,i,5543857002506919237,12699444305213528706,262144 --variations-seed-version=20260625-170100.783000-production --mojo-platform-channel-handle=6040 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=3384,i,5462397051018787636,10103029582731365025,2097152 --field-trial-handle=2060,i,5543857002506919237,12699444305213528706,262144 --variations-seed-version=20260625-170100.783000-production --mojo-platform-channel-handle=3460 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5960,i,8262851168204409425,9311412806529898564,2097152 --field-trial-handle=2060,i,5543857002506919237,12699444305213528706,262144 --variations-seed-version=20260625-170100.783000-production --mojo-platform-channel-handle=3936 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6328,i,10620085466913703345,66823766050554720,2097152 --field-trial-handle=2060,i,5543857002506919237,12699444305213528706,262144 --variations-seed-version=20260625-170100.783000-production --mojo-platform-channel-handle=6448 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6536,i,7417461264434197863,3574226387262985924,524288 --field-trial-handle=2060,i,5543857002506919237,12699444305213528706,262144 --variations-seed-version=20260625-170100.783000-production --mojo-platform-channel-handle=6576 /prefetch:142⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
-
-
C:\Users\Admin\Downloads\npp.8.9.6.4.Installer.exe"C:\Users\Admin\Downloads\npp.8.9.6.4.Installer.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\SysWOW64\regsvr32.exe" /s "C:\Program Files (x86)\Notepad++\contextMenu\NppShell.dll"3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Notepad++\contextMenu\NppShell.dll"4⤵
- Loads dropped DLL
- Modifies registry class
-
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe" "C:\Program Files (x86)\Notepad++\notepad++.exe"3⤵
-
-
C:\Program Files (x86)\Notepad++\notepad++.exe"C:\Program Files (x86)\Notepad++\notepad++.exe" "C:\Program Files (x86)\Notepad++\change.log"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6324,i,16369852650383968494,14158745076372931235,262144 --field-trial-handle=2060,i,5543857002506919237,12699444305213528706,262144 --variations-seed-version=20260625-170100.783000-production --mojo-platform-channel-handle=5508 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=7184,i,14390527014129772022,9969555460711530193,524288 --field-trial-handle=2060,i,5543857002506919237,12699444305213528706,262144 --variations-seed-version=20260625-170100.783000-production --mojo-platform-channel-handle=7220 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Program Files (x86)\Notepad++\notepad++.exe"C:\Program Files (x86)\Notepad++\notepad++.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Notepad++\updater\gup.exe"C:\Program Files (x86)\Notepad++\updater\gup.exe" -v8.964 -infoUrl=https://notepad-plus-plus.org/update/getDownloadUrl.php -forceDomain=https://github.com/notepad-plus-plus/notepad-plus-plus/ -chkCert4InfoXML -chkCertKeyId4XML=CC0D94922CDA3A18A7D286138525AF9C3942E9E7 -chkCertSig=yes -chkCertRevoc -chkCertTrustChain -chkCertName=NOTEPAD++ -chkCertSubject="C=FR, S=Île-de-France, L=Paris, O={QUOTE}NOTEPAD++{QUOTE}, CN={QUOTE}NOTEPAD++{QUOTE}, [email protected]" -chkCertKeyId=CC0D94922CDA3A18A7D286138525AF9C3942E9E7 -errLogPath="%LOCALAPPDATA%\Notepad++\log\securityError.log"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\Auxie (1)\Auxie\run.bat" "1⤵
-
C:\Windows\system32\net.exenet session2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 session3⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\Downloads\Auxie (1)\Auxie\Setup-Auxie.ps1" -EnableChat2⤵
- Badlisted process makes network request
- Downloads MZ/PE file
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\wireguard-installer.exe"C:\Users\Admin\AppData\Local\Temp\wireguard-installer.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files\WireGuard\wg.exe"C:\Program Files\WireGuard\wg.exe" genkey3⤵
- Executes dropped EXE
-
-
C:\Program Files\WireGuard\wg.exe"C:\Program Files\WireGuard\wg.exe" pubkey3⤵
- Executes dropped EXE
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 00E9F1A735BE75B9379607983B9B3C472⤵
- Loads dropped DLL
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 595A70C1574E62478D7512FE9F71DF0D E Global\MSI00002⤵
- Loads dropped DLL
-
-
C:\Program Files\WireGuard\wireguard.exe"C:\Program Files\WireGuard\wireguard.exe"2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
-
C:\Program Files\WireGuard\wireguard.exe"C:\Program Files\WireGuard\wireguard.exe" /installmanagerservice3⤵
- Executes dropped EXE
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
-
C:\Program Files\WireGuard\wireguard.exe"C:\Program Files\WireGuard\wireguard.exe" /managerservice1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\WireGuard\wireguard.exe"C:\Program Files\WireGuard\wireguard.exe" /ui 1032 1028 1040 10482⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SendNotifyMessage
-
Network
MITRE ATT&CK Enterprise v16
Defense Evasion
Modify Registry
1Subvert Trust Controls
2Install Root Certificate
1SIP and Trust Provider Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
e64ec38.rbs
e64ec3a.rbs
CrashpadMetrics-active.pma
settings.dat
BookmarkMergedSurfaceOrdering
BrowsingTopicsState
f_00008d
f_0000a1
2866ab5f8204f987_0
841708d66b81b344_0
the-real-index
the-real-index
the-real-index
data_1
Favicons
History
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
TransportSecurity
TransportSecurity
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
000003.log
LOG
the-real-index
the-real-index~RFe586433.TMP
Tabs_13426922301068231
b9ef080a73b89b04_0
the-real-index
the-real-index
000003.log
LOG
LOG
QuotaManager
000003.log
LOG
Last Version
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
data_1
Variations
metadata.json
ukm_db
powershell.exe.log
ModuleAnalysisCache
StartupProfileData-Interactive
__PSScriptPolicyTest_1cxd0qi4.gva.ps1
InstallOptions.dll
ioSpecial.ini
ioSpecial.ini
wireguard-installer.exe
ConsoleHost_history.txt
590aee7bdd69b59b.customDestinations-ms
590aee7bdd69b59b.customDestinations-ms
converter.ini
session.xml.inCaseOfCorruption.bak
Auxie.zip:Zone.Identifier
Unconfirmed 390983.crdownload
MSIEFE1.tmp
e64ec35.msi
memory/548-1103-0x00007FFF478F0000-0x00007FFF47900000-memory.dmp
memory/548-1104-0x00007FFF478F0000-0x00007FFF47900000-memory.dmp
memory/548-1105-0x00007FFF478F0000-0x00007FFF47900000-memory.dmp
memory/548-1102-0x00007FFF478F0000-0x00007FFF47900000-memory.dmp
memory/548-1076-0x00007FFF478F0000-0x00007FFF47900000-memory.dmp
memory/548-1082-0x00007FFF45120000-0x00007FFF45130000-memory.dmp
memory/548-1081-0x00007FFF45120000-0x00007FFF45130000-memory.dmp
memory/548-1080-0x00007FFF478F0000-0x00007FFF47900000-memory.dmp
memory/548-1079-0x00007FFF478F0000-0x00007FFF47900000-memory.dmp
memory/548-1077-0x00007FFF478F0000-0x00007FFF47900000-memory.dmp
memory/548-1078-0x00007FFF478F0000-0x00007FFF47900000-memory.dmp
memory/972-651-0x000001A93A2A0000-0x000001A93A2BA000-memory.dmp
memory/972-635-0x000001A920D10000-0x000001A9217D2000-memory.dmp
memory/972-1072-0x000001A920D10000-0x000001A9217D2000-memory.dmp
memory/972-1069-0x000001A920D10000-0x000001A9217D2000-memory.dmp
memory/972-653-0x000001A93A140000-0x000001A93A148000-memory.dmp
memory/972-654-0x000001A93A260000-0x000001A93A266000-memory.dmp
memory/972-655-0x000001A93A270000-0x000001A93A27A000-memory.dmp
memory/972-656-0x000001A920D10000-0x000001A9217D2000-memory.dmp
memory/972-659-0x000001A920D10000-0x000001A9217D2000-memory.dmp
memory/972-660-0x000001A920D10000-0x000001A9217D2000-memory.dmp
memory/972-661-0x000001A920D10000-0x000001A9217D2000-memory.dmp
memory/972-736-0x000001A920D10000-0x000001A9217D2000-memory.dmp
memory/972-1107-0x000001A920D10000-0x000001A9217D2000-memory.dmp
memory/972-1145-0x000001A920D10000-0x000001A9217D2000-memory.dmp
memory/972-652-0x000001A920D10000-0x000001A9217D2000-memory.dmp
memory/972-684-0x000001A920D10000-0x000001A9217D2000-memory.dmp
memory/972-650-0x000001A93A110000-0x000001A93A11A000-memory.dmp
memory/972-1296-0x000001A920D10000-0x000001A9217D2000-memory.dmp
memory/972-649-0x000001A93A280000-0x000001A93A29C000-memory.dmp
memory/972-648-0x000001A93A100000-0x000001A93A10A000-memory.dmp
memory/972-662-0x000001A920D10000-0x000001A9217D2000-memory.dmp
memory/972-647-0x000001A93A1A0000-0x000001A93A253000-memory.dmp
memory/972-1414-0x000001A920D10000-0x000001A9217D2000-memory.dmp
memory/972-646-0x000001A93A120000-0x000001A93A13C000-memory.dmp
memory/972-637-0x000001A920D10000-0x000001A9217D2000-memory.dmp
memory/972-1074-0x000001A920D10000-0x000001A9217D2000-memory.dmp
memory/972-633-0x000001A920D10000-0x000001A9217D2000-memory.dmp
memory/972-665-0x000001A920D10000-0x000001A9217D2000-memory.dmp
memory/972-668-0x000001A920D10000-0x000001A9217D2000-memory.dmp
memory/972-2164-0x000001A920D10000-0x000001A9217D2000-memory.dmp
memory/972-681-0x000001A920D10000-0x000001A9217D2000-memory.dmp
memory/972-2174-0x000001A920D10000-0x000001A9217D2000-memory.dmp
memory/972-2181-0x000001A920D10000-0x000001A9217D2000-memory.dmp
memory/972-670-0x000001A920D10000-0x000001A9217D2000-memory.dmp
memory/972-2200-0x000001A920D10000-0x000001A9217D2000-memory.dmp
memory/972-2313-0x000001A920D10000-0x000001A9217D2000-memory.dmp
memory/972-678-0x000001A920D10000-0x000001A9217D2000-memory.dmp
memory/972-2299-0x000001A920D10000-0x000001A9217D2000-memory.dmp
memory/972-673-0x000001A920D10000-0x000001A9217D2000-memory.dmp
memory/972-676-0x000001A920D10000-0x000001A9217D2000-memory.dmp
memory/1048-2295-0x0000020033C70000-0x0000020033E32000-memory.dmp
memory/1048-2296-0x0000020034370000-0x0000020034898000-memory.dmp
memory/1048-2298-0x000002001A670000-0x000002001B132000-memory.dmp
memory/1048-2236-0x000002001A670000-0x000002001B132000-memory.dmp
memory/1848-609-0x0000021B45090000-0x0000021B450D6000-memory.dmp
memory/1848-608-0x0000021B44BA0000-0x0000021B44BC2000-memory.dmp
memory/1848-611-0x0000021B2BC80000-0x0000021B2C742000-memory.dmp
memory/1848-613-0x0000021B2BC80000-0x0000021B2C742000-memory.dmp
memory/1848-616-0x0000021B2BC80000-0x0000021B2C742000-memory.dmp
memory/5136-2308-0x00000204C9D60000-0x00000204CA822000-memory.dmp