Analysis
- user interaction
yes - max time kernel
815s - max time network
819s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
04/08/2026, 12:56
General
- Target ProjectFree.exe
- Size 15.8MB
- Sample260804-p6l2aabc36
- SHA256 a0e3ff50114f4de82b7550f5cf616cf0ad26c8e0075a42c03b1f877fc0747115
Score
8/10
Malware Config
Signatures
- Downloads MZ/PE file 3 IoCs
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 20 IoCs
- Loads dropped DLL 64 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Badlisted process makes network request 3 IoCs
Network request originating from process or tool commonly abused by malware.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 54 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 6 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
- Checks processor information in registry 2 TTPs 12 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 18 IoCs
- Modifies data under HKEY_USERS 7 IoCs
- Modifies registry class 64 IoCs
- Modifies system certificate store 2 TTPs 5 IoCs
- Suspicious behavior: EnumeratesProcesses 43 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 44 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 50 IoCs
- Suspicious use of SetWindowsHookEx 7 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ProjectFree.exe"C:\Users\Admin\AppData\Local\Temp\ProjectFree.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ProjectFree.exe"C:\Users\Admin\AppData\Local\Temp\ProjectFree.exe"2⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffb83cec728,0x7ffb83cec734,0x7ffb83cec7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1780,i,9307566859289538721,7999557509075609710,262144 --field-trial-handle=1972,i,752858319216390688,4630928622532116041,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1968 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1616,i,15108739974321802865,4549981116733105447,524288 --field-trial-handle=1972,i,752858319216390688,4630928622532116041,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2280 /prefetch:32⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2408,i,12909840565401042899,17121299826019952008,524288 --field-trial-handle=1972,i,752858319216390688,4630928622532116041,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2584 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3152,i,15421145971650613184,10854350933345359343,2097152 --field-trial-handle=1972,i,752858319216390688,4630928622532116041,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3268 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3452,i,17141264313240340179,12707235240198383711,2097152 --field-trial-handle=1972,i,752858319216390688,4630928622532116041,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3476 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4520,i,6249399966290674843,10366430637633739080,2097152 --field-trial-handle=1972,i,752858319216390688,4630928622532116041,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4540 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4684,i,16604925642973461556,12949416940111126134,2097152 --field-trial-handle=1972,i,752858319216390688,4630928622532116041,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4736 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4904,i,9688828823459501872,11721534195955019924,2097152 --field-trial-handle=1972,i,752858319216390688,4630928622532116041,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4920 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=3488,i,846107266978328568,945388809319152389,2097152 --field-trial-handle=1972,i,752858319216390688,4630928622532116041,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3460 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5916,i,6049680009228460343,1170020833524313591,524288 --field-trial-handle=1972,i,752858319216390688,4630928622532116041,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5924 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6052,i,7342420382293772402,18161088001343867957,524288 --field-trial-handle=1972,i,752858319216390688,4630928622532116041,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6068 /prefetch:82⤵
-
-
C:\Users\Admin\Downloads\python-3.14.6-amd64.exe"C:\Users\Admin\Downloads\python-3.14.6-amd64.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{37446877-37F0-467A-B9DC-9944C08593FA}\.cr\python-3.14.6-amd64.exe"C:\Windows\Temp\{37446877-37F0-467A-B9DC-9944C08593FA}\.cr\python-3.14.6-amd64.exe" -burn.clean.room="C:\Users\Admin\Downloads\python-3.14.6-amd64.exe" -burn.filehandle.attached=588 -burn.filehandle.self=7323⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5168,i,9546826832848750051,16985317129909402972,524288 --field-trial-handle=1972,i,752858319216390688,4630928622532116041,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6184 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5988,i,18415146398718174984,5587125531294215632,524288 --field-trial-handle=1972,i,752858319216390688,4630928622532116041,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5972 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6180,i,81423815320010672,4396843225426557333,524288 --field-trial-handle=1972,i,752858319216390688,4630928622532116041,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6228 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=3464,i,11102029043347943747,15056597725250317669,2097152 --field-trial-handle=1972,i,752858319216390688,4630928622532116041,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6384 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6540,i,14826241953785862505,11800353378935248429,2097152 --field-trial-handle=1972,i,752858319216390688,4630928622532116041,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6516 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5420,i,9006340599447971414,9491085544950813050,524288 --field-trial-handle=1972,i,752858319216390688,4630928622532116041,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6712 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 7E0C82DD204C640D955F663714EF71612⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Programs\Python\Python314\python.exe"C:\Users\Admin\AppData\Local\Programs\Python\Python314\python.exe" -I -m ensurepip -U --default-pip3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Programs\Python\Python314\python.exeC:\Users\Admin\AppData\Local\Programs\Python\Python314\python.exe -I -W ignore::DeprecationWarning -c " import runpy import sys sys.path = ['C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpyjq9uc2_\\pip-26.1.2-py3-none-any.whl'] + sys.path sys.argv[1:] = ['install', '--no-cache-dir', '--no-index', '--find-links', 'C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpyjq9uc2_', '--upgrade', 'pip'] runpy.run_module(\"pip\", run_name=\"__main__\", alter_sys=True) "4⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
-
C:\Users\Admin\AppData\Local\Package Cache\{7116a5c9-3a0e-4d9c-aa8b-c6f909dc9278}\python-3.14.6-amd64.exe"C:\Users\Admin\AppData\Local\Package Cache\{7116a5c9-3a0e-4d9c-aa8b-c6f909dc9278}\python-3.14.6-amd64.exe" /burn.runonce1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Package Cache\{7116a5c9-3a0e-4d9c-aa8b-c6f909dc9278}\python-3.14.6-amd64.exe"C:\Users\Admin\AppData\Local\Package Cache\{7116a5c9-3a0e-4d9c-aa8b-c6f909dc9278}\python-3.14.6-amd64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Python 3.14.6 (64-bit)_20260804135817.log"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Package Cache\{7116a5c9-3a0e-4d9c-aa8b-c6f909dc9278}\python-3.14.6-amd64.exe"C:\Users\Admin\AppData\Local\Package Cache\{7116a5c9-3a0e-4d9c-aa8b-c6f909dc9278}\python-3.14.6-amd64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Package Cache\{7116a5c9-3a0e-4d9c-aa8b-c6f909dc9278}\python-3.14.6-amd64.exe" -burn.filehandle.attached=528 -burn.filehandle.self=544 /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Python 3.14.6 (64-bit)_20260804135817.log"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Programs\Python\Python314\python.exepython pyinstxtractor.py ProjectFree.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\Desktop\ProjectFree.exe_extracted\pycdc.exepycdc.exe ProjectFree.pyc ProjectFree.py2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\Desktop\ProjectFree.exe_extracted\pycdc.exepycdc.exe ProjectFree.pyc2⤵
-
-
C:\Users\Admin\Desktop\ProjectFree.exe_extracted\pycdc.exepycdc.exe ProjectFree.pyc2⤵
-
-
C:\Users\Admin\AppData\Local\Programs\Python\Python314\Scripts\pip.exepip install uncompyle62⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Programs\Python\Python314\python.exe"C:\Users\Admin\AppData\Local\Programs\Python\Python314\python.exe" "C:\Users\Admin\AppData\Local\Programs\Python\Python314\Scripts\pip.exe" install uncompyle63⤵
- Executes dropped EXE
- Modifies system certificate store
-
-
-
C:\Users\Admin\AppData\Local\Programs\Python\Python314\Scripts\uncompyle6.exeuncompyle6 ProjectFree.pyc2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Programs\Python\Python314\python.exe"C:\Users\Admin\AppData\Local\Programs\Python\Python314\python.exe" "C:\Users\Admin\AppData\Local\Programs\Python\Python314\Scripts\uncompyle6.exe" ProjectFree.pyc3⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe"C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe" "C:\Users\Admin\Desktop\ProjectFree.exe_extracted\ProjectFree.pyc"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Programs\Python\Python314\python.exeC:\Users\Admin\AppData\Local\Programs\Python\Python314\python.exe "C:\Users\Admin\Desktop\ProjectFree.exe_extracted\ProjectFree.pyc"2⤵
- Executes dropped EXE
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffb83cec728,0x7ffb83cec734,0x7ffb83cec7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1900,i,17845412760494190286,10549181560210889334,524288 --field-trial-handle=1980,i,7187525646189831367,5918452981889053888,262144 --variations-seed-version=20260804-010031.369000-production --mojo-platform-channel-handle=2008 /prefetch:32⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1680,i,12176234592337502072,13436733001864904507,262144 --field-trial-handle=1980,i,7187525646189831367,5918452981889053888,262144 --variations-seed-version=20260804-010031.369000-production --mojo-platform-channel-handle=1976 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2360,i,12876597831827889772,2995334816031151684,524288 --field-trial-handle=1980,i,7187525646189831367,5918452981889053888,262144 --variations-seed-version=20260804-010031.369000-production --mojo-platform-channel-handle=2372 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3152,i,2233226356583994853,9411483745189121544,2097152 --field-trial-handle=1980,i,7187525646189831367,5918452981889053888,262144 --variations-seed-version=20260804-010031.369000-production --mojo-platform-channel-handle=3196 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3156,i,5044204025676191005,5699032612385649743,2097152 --field-trial-handle=1980,i,7187525646189831367,5918452981889053888,262144 --variations-seed-version=20260804-010031.369000-production --mojo-platform-channel-handle=3220 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4540,i,4411860725442957867,370042644933880287,2097152 --field-trial-handle=1980,i,7187525646189831367,5918452981889053888,262144 --variations-seed-version=20260804-010031.369000-production --mojo-platform-channel-handle=4544 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5296,i,5630153447327233065,3066221892822973255,524288 --field-trial-handle=1980,i,7187525646189831367,5918452981889053888,262144 --variations-seed-version=20260804-010031.369000-production --mojo-platform-channel-handle=5304 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5548,i,14087692754298519730,15729365865690840997,2097152 --field-trial-handle=1980,i,7187525646189831367,5918452981889053888,262144 --variations-seed-version=20260804-010031.369000-production --mojo-platform-channel-handle=5568 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffb83cec728,0x7ffb83cec734,0x7ffb83cec7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1744,i,15305050848764969285,10736393638521540198,262144 --field-trial-handle=1996,i,18104169750041639831,7455662006580588147,262144 --variations-seed-version=20260804-010031.369000-production --mojo-platform-channel-handle=1984 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2252,i,5398696876255910128,13999821799550869478,524288 --field-trial-handle=1996,i,18104169750041639831,7455662006580588147,262144 --variations-seed-version=20260804-010031.369000-production --mojo-platform-channel-handle=2288 /prefetch:32⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2372,i,13381426836419161895,13246706627557104648,524288 --field-trial-handle=1996,i,18104169750041639831,7455662006580588147,262144 --variations-seed-version=20260804-010031.369000-production --mojo-platform-channel-handle=2552 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3232,i,842535950395137292,15732801938290728040,2097152 --field-trial-handle=1996,i,18104169750041639831,7455662006580588147,262144 --variations-seed-version=20260804-010031.369000-production --mojo-platform-channel-handle=3244 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3264,i,10281271377183438753,13065295997772377789,2097152 --field-trial-handle=1996,i,18104169750041639831,7455662006580588147,262144 --variations-seed-version=20260804-010031.369000-production --mojo-platform-channel-handle=3292 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4468,i,7145866383424663417,1209989273621916479,2097152 --field-trial-handle=1996,i,18104169750041639831,7455662006580588147,262144 --variations-seed-version=20260804-010031.369000-production --mojo-platform-channel-handle=4504 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5320,i,9663670643491544494,1708234926536792049,524288 --field-trial-handle=1996,i,18104169750041639831,7455662006580588147,262144 --variations-seed-version=20260804-010031.369000-production --mojo-platform-channel-handle=4752 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5568,i,3350882322200410853,4281437718726816881,2097152 --field-trial-handle=1996,i,18104169750041639831,7455662006580588147,262144 --variations-seed-version=20260804-010031.369000-production --mojo-platform-channel-handle=5544 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=3412,i,13863605281774188458,847115636287043986,2097152 --field-trial-handle=1996,i,18104169750041639831,7455662006580588147,262144 --variations-seed-version=20260804-010031.369000-production --mojo-platform-channel-handle=3452 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3328,i,92864416014011570,1030941219570025531,2097152 --field-trial-handle=1996,i,18104169750041639831,7455662006580588147,262144 --variations-seed-version=20260804-010031.369000-production --mojo-platform-channel-handle=5708 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4532,i,7658268671816506573,15991842862183164884,524288 --field-trial-handle=1996,i,18104169750041639831,7455662006580588147,262144 --variations-seed-version=20260804-010031.369000-production --mojo-platform-channel-handle=4508 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4616,i,8427399078791325955,570868948228566337,524288 --field-trial-handle=1996,i,18104169750041639831,7455662006580588147,262144 --variations-seed-version=20260804-010031.369000-production --mojo-platform-channel-handle=5252 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4544,i,6158421631375557271,14857399993276349176,524288 --field-trial-handle=1996,i,18104169750041639831,7455662006580588147,262144 --variations-seed-version=20260804-010031.369000-production --mojo-platform-channel-handle=5548 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5624,i,12280189202665285204,15887553846680285735,2097152 --field-trial-handle=1996,i,18104169750041639831,7455662006580588147,262144 --variations-seed-version=20260804-010031.369000-production --mojo-platform-channel-handle=4436 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5780,i,16269428852816209035,14909108020107488002,2097152 --field-trial-handle=1996,i,18104169750041639831,7455662006580588147,262144 --variations-seed-version=20260804-010031.369000-production --mojo-platform-channel-handle=3096 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5908,i,16208824597586608919,3005963556143047155,2097152 --field-trial-handle=1996,i,18104169750041639831,7455662006580588147,262144 --variations-seed-version=20260804-010031.369000-production --mojo-platform-channel-handle=5784 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5876,i,4156091139601561697,17641777818386240893,524288 --field-trial-handle=1996,i,18104169750041639831,7455662006580588147,262144 --variations-seed-version=20260804-010031.369000-production --mojo-platform-channel-handle=3344 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --metrics-shmem-handle=3244,i,16843783752630790395,2297029112876899086,524288 --field-trial-handle=1996,i,18104169750041639831,7455662006580588147,262144 --variations-seed-version=20260804-010031.369000-production --mojo-platform-channel-handle=5876 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of SendNotifyMessage
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x104,0x108,0x10c,0x100,0x110,0x7ffb83cec728,0x7ffb83cec734,0x7ffb83cec7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1656,i,9835812507192994126,11322636869248402715,262144 --field-trial-handle=1980,i,5298431629292423202,14088447284056353332,262144 --variations-seed-version=20260804-010031.369000-production --mojo-platform-channel-handle=1976 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2100,i,13061743672436502807,4260888648923336156,524288 --field-trial-handle=1980,i,5298431629292423202,14088447284056353332,262144 --variations-seed-version=20260804-010031.369000-production --mojo-platform-channel-handle=2144 /prefetch:32⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2340,i,18213343509664937933,17176789926239326805,524288 --field-trial-handle=1980,i,5298431629292423202,14088447284056353332,262144 --variations-seed-version=20260804-010031.369000-production --mojo-platform-channel-handle=2528 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3180,i,7889875531046262162,4814687837112372081,2097152 --field-trial-handle=1980,i,5298431629292423202,14088447284056353332,262144 --variations-seed-version=20260804-010031.369000-production --mojo-platform-channel-handle=3224 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3188,i,14355642697760728920,3691705641809389738,2097152 --field-trial-handle=1980,i,5298431629292423202,14088447284056353332,262144 --variations-seed-version=20260804-010031.369000-production --mojo-platform-channel-handle=3252 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4520,i,1371863043414455432,8984187102779007686,2097152 --field-trial-handle=1980,i,5298431629292423202,14088447284056353332,262144 --variations-seed-version=20260804-010031.369000-production --mojo-platform-channel-handle=4516 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5348,i,311634825769337947,6627653567368390377,524288 --field-trial-handle=1980,i,5298431629292423202,14088447284056353332,262144 --variations-seed-version=20260804-010031.369000-production --mojo-platform-channel-handle=5352 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=6124,i,5036550951144063566,7067511341518598310,2097152 --field-trial-handle=1980,i,5298431629292423202,14088447284056353332,262144 --variations-seed-version=20260804-010031.369000-production --mojo-platform-channel-handle=5736 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4516,i,8842992384548285169,15494900915518744893,524288 --field-trial-handle=1980,i,5298431629292423202,14088447284056353332,262144 --variations-seed-version=20260804-010031.369000-production --mojo-platform-channel-handle=4500 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xd4,0xd8,0xdc,0x104,0xe0,0x7ffb83cec728,0x7ffb83cec734,0x7ffb83cec7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1912,i,13800884437556914058,7467117843139145500,524288 --field-trial-handle=2028,i,5746822633239115618,8165422002996093280,262144 --variations-seed-version=20260804-010031.369000-production --mojo-platform-channel-handle=2144 /prefetch:32⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1652,i,1629476856108831483,5588802541755682133,262144 --field-trial-handle=2028,i,5746822633239115618,8165422002996093280,262144 --variations-seed-version=20260804-010031.369000-production --mojo-platform-channel-handle=2024 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2360,i,5238801709527908177,18225016835459928631,524288 --field-trial-handle=2028,i,5746822633239115618,8165422002996093280,262144 --variations-seed-version=20260804-010031.369000-production --mojo-platform-channel-handle=2536 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3188,i,15892406423691081680,17572848258649188812,2097152 --field-trial-handle=2028,i,5746822633239115618,8165422002996093280,262144 --variations-seed-version=20260804-010031.369000-production --mojo-platform-channel-handle=3228 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3192,i,4284858261235678900,18200817943914890490,2097152 --field-trial-handle=2028,i,5746822633239115618,8165422002996093280,262144 --variations-seed-version=20260804-010031.369000-production --mojo-platform-channel-handle=3252 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4484,i,10000842001370388734,16909315167039227491,2097152 --field-trial-handle=2028,i,5746822633239115618,8165422002996093280,262144 --variations-seed-version=20260804-010031.369000-production --mojo-platform-channel-handle=4500 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4688,i,5992618718394154751,15113506136581844728,2097152 --field-trial-handle=2028,i,5746822633239115618,8165422002996093280,262144 --variations-seed-version=20260804-010031.369000-production --mojo-platform-channel-handle=4704 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3420,i,7446418763560605032,3727791635634015729,2097152 --field-trial-handle=2028,i,5746822633239115618,8165422002996093280,262144 --variations-seed-version=20260804-010031.369000-production --mojo-platform-channel-handle=3460 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3372,i,15651433527374758390,355518477069922079,524288 --field-trial-handle=2028,i,5746822633239115618,8165422002996093280,262144 --variations-seed-version=20260804-010031.369000-production --mojo-platform-channel-handle=4964 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=3244,i,856994760133106299,1920799021461924332,524288 --field-trial-handle=2028,i,5746822633239115618,8165422002996093280,262144 --variations-seed-version=20260804-010031.369000-production --mojo-platform-channel-handle=4952 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5100,i,17740391661238556006,11939312165172310766,2097152 --field-trial-handle=2028,i,5746822633239115618,8165422002996093280,262144 --variations-seed-version=20260804-010031.369000-production --mojo-platform-channel-handle=3300 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6172,i,8157270756229376588,14719048988245067259,524288 --field-trial-handle=2028,i,5746822633239115618,8165422002996093280,262144 --variations-seed-version=20260804-010031.369000-production --mojo-platform-channel-handle=6228 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5548,i,3774285666647794915,1267972545542527456,524288 --field-trial-handle=2028,i,5746822633239115618,8165422002996093280,262144 --variations-seed-version=20260804-010031.369000-production --mojo-platform-channel-handle=5656 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --metrics-shmem-handle=5548,i,15776212675814965410,3832460500482801248,524288 --field-trial-handle=2028,i,5746822633239115618,8165422002996093280,262144 --variations-seed-version=20260804-010031.369000-production --mojo-platform-channel-handle=5408 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --metrics-shmem-handle=6304,i,15190375797546397378,7171889876311751096,524288 --field-trial-handle=2028,i,5746822633239115618,8165422002996093280,262144 --variations-seed-version=20260804-010031.369000-production --mojo-platform-channel-handle=5200 /prefetch:82⤵
-
-
C:\Users\Admin\Downloads\sublime_text_build_4200_x64_setup.exe"C:\Users\Admin\Downloads\sublime_text_build_4200_x64_setup.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\is-KV7BG.tmp\sublime_text_build_4200_x64_setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-KV7BG.tmp\sublime_text_build_4200_x64_setup.tmp" /SL5="$120042,15795678,121344,C:\Users\Admin\Downloads\sublime_text_build_4200_x64_setup.exe"3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Sublime Text\sublime_text.exe"C:\Program Files\Sublime Text\sublime_text.exe"1⤵
- Executes dropped EXE
-
C:\Program Files\Sublime Text\crash_handler.exe"C:\Program Files\Sublime Text\crash_handler.exe" --no-rate-limit "--database=C:\Users\Admin\AppData\Local\Sublime Text\Crash Reports" "--metrics-dir=C:\Users\Admin\AppData\Local\Sublime Text\Crash Reports" --url=https://crash-server.sublimehq.com/api/upload --annotation=hash=9153973254676204383 --annotation=ident=sublime_text_4200 --initial-client-data=0x304,0x308,0x30c,0x2e0,0x310,0x7ff6bfb94738,0x7ff6bfb94744,0x7ff6bfb947502⤵
- Executes dropped EXE
-
-
C:\Program Files\Sublime Text\plugin_host-3.3.exe"/C/Program Files/Sublime Text/plugin_host-3.3.exe" 4580 "/C/Program Files/Sublime Text/sublime_text.exe" \\.\pipe\crashpad_4580_JHFQQJGDZTHXZYGL "/C/Users/Admin/AppData/Roaming/Sublime Text" "/C/Users/Admin/AppData/Local/Sublime Text" "/C/Program Files/Sublime Text/Packages"2⤵
- Executes dropped EXE
-
-
C:\Program Files\Sublime Text\plugin_host-3.8.exe"/C/Program Files/Sublime Text/plugin_host-3.8.exe" 4580 "/C/Program Files/Sublime Text/sublime_text.exe" \\.\pipe\crashpad_4580_JHFQQJGDZTHXZYGL false "/C/Users/Admin/AppData/Roaming/Sublime Text" "/C/Users/Admin/AppData/Local/Sublime Text" "/C/Program Files/Sublime Text/Packages"2⤵
- Executes dropped EXE
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of SendNotifyMessage
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffb83cec728,0x7ffb83cec734,0x7ffb83cec7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1852,i,16789689597740830204,17110433865757748269,524288 --field-trial-handle=2400,i,16848231284049518193,11160212381515727193,262144 --variations-seed-version=20260804-010031.369000-production --mojo-platform-channel-handle=2432 /prefetch:32⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1640,i,13836278369689053172,7090940217997742668,262144 --field-trial-handle=2400,i,16848231284049518193,11160212381515727193,262144 --variations-seed-version=20260804-010031.369000-production --mojo-platform-channel-handle=2396 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=2060,i,17880811220668097555,2994590604850976594,524288 --field-trial-handle=2400,i,16848231284049518193,11160212381515727193,262144 --variations-seed-version=20260804-010031.369000-production --mojo-platform-channel-handle=2512 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3192,i,15147698352545690423,1057000065299139147,2097152 --field-trial-handle=2400,i,16848231284049518193,11160212381515727193,262144 --variations-seed-version=20260804-010031.369000-production --mojo-platform-channel-handle=3224 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3196,i,3426188977250250836,12232022728104089981,2097152 --field-trial-handle=2400,i,16848231284049518193,11160212381515727193,262144 --variations-seed-version=20260804-010031.369000-production --mojo-platform-channel-handle=3244 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4484,i,17173417823312358410,14802987774853173190,2097152 --field-trial-handle=2400,i,16848231284049518193,11160212381515727193,262144 --variations-seed-version=20260804-010031.369000-production --mojo-platform-channel-handle=4508 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5264,i,5741168316953787478,8778626433056867968,524288 --field-trial-handle=2400,i,16848231284049518193,11160212381515727193,262144 --variations-seed-version=20260804-010031.369000-production --mojo-platform-channel-handle=5272 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5652,i,2899908558013767275,337256177296563957,2097152 --field-trial-handle=2400,i,16848231284049518193,11160212381515727193,262144 --variations-seed-version=20260804-010031.369000-production --mojo-platform-channel-handle=5620 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=3340,i,11502770308689247433,7515687705258348789,2097152 --field-trial-handle=2400,i,16848231284049518193,11160212381515727193,262144 --variations-seed-version=20260804-010031.369000-production --mojo-platform-channel-handle=3288 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3240,i,5463287405850636857,15997415183402617031,2097152 --field-trial-handle=2400,i,16848231284049518193,11160212381515727193,262144 --variations-seed-version=20260804-010031.369000-production --mojo-platform-channel-handle=3268 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5852,i,5796822866015409084,5506289384403286224,2097152 --field-trial-handle=2400,i,16848231284049518193,11160212381515727193,262144 --variations-seed-version=20260804-010031.369000-production --mojo-platform-channel-handle=3448 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=6252,i,8058243349692150332,4295273967134914063,2097152 --field-trial-handle=2400,i,16848231284049518193,11160212381515727193,262144 --variations-seed-version=20260804-010031.369000-production --mojo-platform-channel-handle=6236 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6332,i,3883505810017726288,3847379005610863859,2097152 --field-trial-handle=2400,i,16848231284049518193,11160212381515727193,262144 --variations-seed-version=20260804-010031.369000-production --mojo-platform-channel-handle=6132 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5956,i,2060190830638020715,11569968846330154074,2097152 --field-trial-handle=2400,i,16848231284049518193,11160212381515727193,262144 --variations-seed-version=20260804-010031.369000-production --mojo-platform-channel-handle=6392 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6116,i,3535238384788705107,17503439891739482391,2097152 --field-trial-handle=2400,i,16848231284049518193,11160212381515727193,262144 --variations-seed-version=20260804-010031.369000-production --mojo-platform-channel-handle=6380 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6624,i,17296000335998784912,14406760423707912354,524288 --field-trial-handle=2400,i,16848231284049518193,11160212381515727193,262144 --variations-seed-version=20260804-010031.369000-production --mojo-platform-channel-handle=6128 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5956,i,14368884395272903849,1983649945415295719,524288 --field-trial-handle=2400,i,16848231284049518193,11160212381515727193,262144 --variations-seed-version=20260804-010031.369000-production --mojo-platform-channel-handle=6528 /prefetch:82⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6396,i,14313163492104598283,8041970421851561807,524288 --field-trial-handle=2400,i,16848231284049518193,11160212381515727193,262144 --variations-seed-version=20260804-010031.369000-production --mojo-platform-channel-handle=6756 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6504,i,18425179629160131207,14331678517580233013,524288 --field-trial-handle=2400,i,16848231284049518193,11160212381515727193,262144 --variations-seed-version=20260804-010031.369000-production --mojo-platform-channel-handle=6776 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6764,i,12539861652509815886,14951005535943383311,524288 --field-trial-handle=2400,i,16848231284049518193,11160212381515727193,262144 --variations-seed-version=20260804-010031.369000-production --mojo-platform-channel-handle=6716 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6652,i,6021201224543262481,13352601518836773080,2097152 --field-trial-handle=2400,i,16848231284049518193,11160212381515727193,262144 --variations-seed-version=20260804-010031.369000-production --mojo-platform-channel-handle=6064 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6068,i,5326296239751667172,17716833082131815773,2097152 --field-trial-handle=2400,i,16848231284049518193,11160212381515727193,262144 --variations-seed-version=20260804-010031.369000-production --mojo-platform-channel-handle=6880 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1128,i,10186690065754263685,11905803992515383486,262144 --field-trial-handle=2400,i,16848231284049518193,11160212381515727193,262144 --variations-seed-version=20260804-010031.369000-production --mojo-platform-channel-handle=5200 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=1128,i,8029468482220455337,15924928431021086811,524288 --field-trial-handle=2400,i,16848231284049518193,11160212381515727193,262144 --variations-seed-version=20260804-010031.369000-production --mojo-platform-channel-handle=5748 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Defense Evasion
Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
e58e107.rbs
e58e10c.rbs
e58e111.rbs
e58e116.rbs
e58e11b.rbs
e58e120.rbs
e58e125.rbs
e58e12a.rbs
e58e12f.rbs
e58e134.rbs
settings.dat
BookmarkMergedSurfaceOrdering
BrowsingTopicsState
f_000060
f_000062
f_000063
f_000076
f_000089
temp-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
000003.log
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
the-real-index
the-real-index~RFe62cce0.TMP
index.txt
index.txt~RFe62cd2e.TMP
the-real-index
the-real-index
the-real-index~RFe58b35d.TMP
the-real-index
the-real-index
000003.log
Last Browser
Last Version
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
data_1
Variations
Variations
doc_JustForMe
lib_JustForMe
tcltk_JustForMe
python-3.14.6-amd64.exe
__init__.py
_compat.py
_termui_impl.py
_textwrap.py
_utils.py
_winconsole.py
core.py
decorators.py
exceptions.py
formatting.py
globals.py
parser.py
shell_completion.py
termui.py
testing.py
types.py
utils.py
__init__.py
ansi.py
ansitowin32.py
initialise.py
__init__.py
ansi_test.py
ansitowin32_test.py
initialise_test.py
isatty_test.py
utils.py
winterm_test.py
win32.py
winterm.py
LICENSE.APACHE
LICENSE
__init__.py
__main__.py
__pip-runner__.py
__init__.py
build_env.py
cache.py
__init__.py
autocompletion.py
base_command.py
cmdoptions.py
command_context.py
index_command.py
main.py
main_parser.py
parser.py
progress_bars.py
req_command.py
spinners.py
status_codes.py
__init__.py
cache.py
check.py
completion.py
configuration.py
debug.py
download.py
freeze.py
hash.py
help.py
index.py
inspect.py
install.py
list.py
lock.py
search.py
show.py
uninstall.py
wheel.py
configuration.py
__init__.py
base.py
installed.py
sdist.py
wheel.py
exceptions.py
__init__.py
collector.py
package_finder.py
sources.py
__init__.py
_distutils.py
_sysconfig.py
base.py
main.py
__init__.py
_json.py
base.py
__init__.py
_compat.py
_dists.py
_envs.py
pkg_resources.py
__init__.py
candidate.py
direct_url.py
format_control.py
index.py
installation_report.py
link.py
release_control.py
scheme.py
search_scope.py
selection_prefs.py
target_python.py
wheel.py
__init__.py
auth.py
cache.py
download.py
lazy_wheel.py
session.py
utils.py
xmlrpc.py
build_tracker.py
metadata.py
metadata_editable.py
wheel.py
wheel_editable.py
check.py
freeze.py
__init__.py
wheel.py
prepare.py
pyproject.py
__init__.py
constructors.py
pep723.py
req_dependency_group.py
req_file.py
req_install.py
req_set.py
req_uninstall.py
base.py
resolver.py
base.py
candidates.py
factory.py
found_candidates.py
provider.py
reporter.py
requirements.py
resolver.py
self_outdated_check.py
_jaraco_text.py
_log.py
appdirs.py
compat.py
compatibility_tags.py
datetime.py
deprecation.py
direct_url_helpers.py
egg_link.py
entrypoints.py
filesystem.py
filetypes.py
glibc.py
hashes.py
logging.py
misc.py
packaging.py
pylock.py
retry.py
subprocess.py
temp_dir.py
unpacking.py
urls.py
virtualenv.py
wheel.py
__init__.py
bazaar.py
git.py
mercurial.py
subversion.py
versioncontrol.py
wheel_builder.py
__init__.py
__init__.py
_cmd.py
adapter.py
cache.py
__init__.py
file_cache.py
redis_cache.py
controller.py
filewrapper.py
heuristics.py
serialize.py
wrapper.py
__init__.py
__main__.py
core.py
__init__.py
compat.py
resources.py
scripts.py
util.py
__init__.py
__main__.py
distro.py
__init__.py
codec.py
compat.py
core.py
idnadata.py
intranges.py
package_data.py
uts46data.py
__init__.py
exceptions.py
ext.py
fallback.py
__init__.py
_elffile.py
_manylinux.py
_musllinux.py
_parser.py
_structures.py
_tokenizer.py
dependency_groups.py
direct_url.py
errors.py
__init__.py
_spdx.py
markers.py
metadata.py
pylock.py
requirements.py
specifiers.py
tags.py
utils.py
version.py
__init__.py
__init__.py
__main__.py
android.py
api.py
macos.py
unix.py
version.py
windows.py
__init__.py
__main__.py
console.py
filter.py
__init__.py
formatter.py
__init__.py
_mapping.py
lexer.py
__init__.py
_mapping.py
python.py
modeline.py
plugin.py
regexopt.py
scanner.py
sphinxext.py
style.py
__init__.py
_mapping.py
token.py
unistring.py
util.py
__init__.py
_impl.py
__init__.py
_in_process.py
__init__.py
__version__.py
_internal_utils.py
adapters.py
api.py
auth.py
certs.py
compat.py
cookies.py
exceptions.py
help.py
hooks.py
models.py
packages.py
sessions.py
status_codes.py
structures.py
utils.py
__init__.py
providers.py
reporters.py
__init__.py
abstract.py
criterion.py
exceptions.py
resolution.py
structs.py
__init__.py
__main__.py
_cell_widths.py
_emoji_codes.py
_emoji_replace.py
_export_format.py
_extension.py
_fileno.py
_inspect.py
_log_render.py
_loop.py
_null_file.py
_palettes.py
_pick.py
_ratio.py
_spinners.py
_stack.py
_timer.py
_win32_console.py
_windows.py
_windows_renderer.py
_wrap.py
abc.py
align.py
ansi.py
bar.py
box.py
cells.py
color.py
color_triplet.py
columns.py
console.py
constrain.py
containers.py
control.py
default_styles.py
diagnose.py
emoji.py
errors.py
file_proxy.py
filesize.py
highlighter.py
json.py
jupyter.py
layout.py
live.py
live_render.py
logging.py
markup.py
measure.py
padding.py
pager.py
palette.py
panel.py
pretty.py
progress.py
progress_bar.py
prompt.py
protocol.py
region.py
repr.py
rule.py
scope.py
screen.py
segment.py
spinner.py
status.py
style.py
styled.py
syntax.py
table.py
terminal_theme.py
text.py
theme.py
themes.py
traceback.py
tree.py
__init__.py
_parser.py
_re.py
_types.py
__init__.py
_writer.py
__init__.py
_api.py
_macos.py
_openssl.py
_ssl_constants.py
_windows.py
__init__.py
_base_connection.py
_collections.py
_request_methods.py
_version.py
connection.py
connectionpool.py
__init__.py
connection.py
fetch.py
request.py
response.py
pyopenssl.py
socks.py
exceptions.py
fields.py
filepost.py
__init__.py
connection.py
probe.py
poolmanager.py
response.py
__init__.py
connection.py
proxy.py
request.py
response.py
retry.py
ssl_.py
ssl_match_hostname.py
ssltransport.py
timeout.py
url.py
util.py
wait.py
INSTALLERobrirfpo.tmp
six.py
__init__.py
ast.py
parser_coverage.py
__init__.py
eval.py
expr_parser.py
scanner.py
test_grammar.py
expr.py
parser.py
scanner.py
semantics.py
tok.py
test_parser.py
test_scanner.py
test_semantics.py
setup.py
__init__.py
format-python.py
py2_format.py
py2_parser.py
py2_scan.py
py2_token.py
reflow.py
assert.py
def.py
exec.py
expr.py
global.py
if.py
imports.py
while.py
with.py
helper.py
def.py
if.py
while.py
expr1.py
indent1.py
syms.py
test_class.py
test_format.py
test_format_inline.py
test_parse.py
test_parse_inline.py
test_scan.py
test_scan_inline.py
scanner.py
spark.py
version.py
__init__.py
pydisassemble.py
uncompile.py
code_fns.py
linenumbers.py
main.py
parser.py
__init__.py
parse10.py
parse11.py
parse12.py
parse13.py
parse14.py
parse15.py
parse16.py
parse2.py
parse21.py
parse22.py
parse23.py
parse24.py
parse25.py
parse26.py
parse27.py
parse3.py
parse30.py
parse31.py
parse32.py
parse33.py
parse34.py
parse35.py
parse36.py
parse37.py
parse37base.py
parse38.py
__init__.py
and_check.py
and_not_check.py
aug_assign.py
except_handler.py
except_handler_else.py
for_block_check.py
ifelsestmt.py
ifelsestmt2.py
iflaststmt.py
ifstmt.py
ifstmt2.py
ifstmts_jump.py
joined_str_check.py
or_check.py
pop_return.py
testtrue.py
tryelsestmt.py
tryelsestmtl3.py
tryexcept.py
while1elsestmt.py
while1stmt.py
whilestmt.py
whilestmt38.py
treenode.py
scanner.py
__init__.py
pypy27.py
pypy32.py
pypy33.py
pypy35.py
pypy36.py
pypy37.py
pypy38.py
scanner10.py
scanner11.py
scanner12.py
scanner13.py
scanner14.py
scanner15.py
scanner16.py
scanner2.py
scanner21.py
scanner22.py
scanner23.py
scanner24.py
scanner25.py
scanner26.py
scanner27.py
scanner3.py
scanner30.py
scanner31.py
scanner32.py
scanner33.py
scanner34.py
scanner35.py
scanner36.py
scanner37.py
scanner37base.py
scanner38.py
scanner39.py
tok.py
aligner.py
check_ast.py
consts.py
customize.py
customize14.py
customize25.py
customize26_27.py
customize3.py
customize35.py
customize36.py
customize37.py
customize38.py
fragments.py
gencomp.py
helper.py
linemap.py
make_function1.py
make_function2.py
make_function3.py
make_function36.py
n_actions.py
parser_error.py
pysource.py
transform.py
show.py
util.py
verify.py
version.py
__init__.py
__main__.py
pydisasm.py
bytecode.py
__init__.py
base.py
code13.py
code15.py
code20.py
code30.py
code310.py
code311.py
code38.py
cross_dis.py
cross_types.py
disasm.py
__init__.py
decrypt25.py
instruction.py
lineoffsets.py
load.py
magics.py
marsh.py
op_imports.py
__init__.py
base.py
__init__.py
basic.py
extended.py
opcode_10.py
opcode_11.py
opcode_12.py
opcode_13.py
opcode_14.py
opcode_15.py
opcode_16.py
opcode_1x.py
opcode_20.py
opcode_21.py
opcode_22.py
opcode_23.py
opcode_24.py
opcode_25.py
opcode_26.py
opcode_26pypy.py
opcode_27.py
opcode_27pypy.py
opcode_2x.py
opcode_30.py
opcode_31.py
opcode_310.py
opcode_310graal.py
opcode_310pypy.py
opcode_311.py
opcode_311pypy.py
opcode_312.py
opcode_312rust.py
opcode_313.py
opcode_314.py
opcode_32.py
opcode_32pypy.py
opcode_33.py
opcode_33pypy.py
opcode_34.py
opcode_35.py
opcode_35pypy.py
opcode_36.py
opcode_36pypy.py
opcode_37.py
opcode_37pypy.py
opcode_38.py
opcode_38pypy.py
opcode_39.py
opcode_39pypy.py
opcode_3x.py
std.py
unmarshal.py
util.py
verify.py
version.py
version_info.py
wordcode.py
__init__.py
__main__.py
pip3.14.exe
python.exe
VCRUNTIME140.dll
VCRUNTIME140_1.dll
_asyncio.pyd
_bz2.pyd
_ctypes.pyd
_decimal.pyd
_hashlib.pyd
_lzma.pyd
_multiprocessing.pyd
_overlapped.pyd
_queue.pyd
_socket.pyd
_sqlite3.pyd
_ssl.pyd
cp1252.enc
init.tcl
tclIndex
_tkinter.pyd
_wmi.pyd
_zstd.pyd
ada92cb5d92a588d1b93__mypyc.cp314-win_amd64.pyd
base_library.zip
cd.cp314-win_amd64.pyd
libcrypto-3.dll
libffi-8.dll
libssl-3.dll
pyexpat.pyd
python314.dll
pywintypes314.dll
select.pyd
Lorem ipsum.txt
sqlite3.dll
tcl86t.dll
tk86t.dll
unicodedata.pyd
win32crypt.pyd
zlib1.dll
uncompyle6-3.9.3-py3-none-any.whl.metadata
six-1.17.0-py2.py3-none-any.whl.metadata
spark_parser-1.9.0-py313-none-any.whl.metadata
xdis-6.1.7-py313-none-any.whl.metadata
colorama-0.4.6-py2.py3-none-any.whl.metadata
click-8.4.2-py3-none-any.whl.metadata
click-8.4.2-py3-none-any.whl
colorama-0.4.6-py2.py3-none-any.whl
six-1.17.0-py2.py3-none-any.whl
spark_parser-1.9.0-py313-none-any.whl
uncompyle6-3.9.3-py3-none-any.whl
xdis-6.1.7-py313-none-any.whl
euc-cn.enc
3c863092-c76c-4aab-9d42-48aabe593235.tmp
Unconfirmed 192142.crdownload
Unconfirmed 632017.crdownload
python-3.14.6-amd64.exe
PythonBA.dll
SideBar.png
pip_JustForMe
memory/1120-1026-0x00007FFB84870000-0x00007FFB84899000-memory.dmp
memory/1120-1265-0x00007FFB84870000-0x00007FFB84899000-memory.dmp
memory/1440-12743-0x0000000000860000-0x0000000000A6B000-memory.dmp
memory/1808-12607-0x0000000000860000-0x0000000000A6B000-memory.dmp
memory/2864-12861-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2864-13132-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2932-13131-0x0000000000400000-0x000000000052D000-memory.dmp
memory/3004-12608-0x0000000000860000-0x0000000000A6B000-memory.dmp