Analysis
- user interaction
yes - max time kernel
1790s - max time network
1792s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
09/08/2026, 06:06
General
- Target http://helium.computer
- Sample260809-gtspasvzbv
Score
10/10
Malware Config
Signatures
- Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
- Modifies visibility of hidden/system files in Explorer 2 TTPs 1 IoCs
- Badlisted process makes network request 17 IoCs
Network request originating from process or tool commonly abused by malware.
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Boot or Logon Autostart Execution: Port Monitors 1 TTPs 13 IoCs
Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation.
- Downloads MZ/PE file 1 IoCs
- Drops file in Drivers directory 1 IoCs
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 64 IoCs
- Loads dropped DLL 64 IoCs
- Modifies file permissions 1 TTPs 2 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Drops desktop.ini file(s) 3 IoCs
- Enumerates connected drives 3 TTPs 32 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Network Service Discovery 1 TTPs 1 IoCs
Attempt to gather information on host's network.
- Power Settings 1 TTPs 3 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
- Drops file in System32 directory 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 4 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 7 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 15 IoCs
- Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
- Kills process with taskkill 2 IoCs
- Modifies Internet Explorer settings 1 TTPs 6 IoCs
- Modifies data under HKEY_USERS 64 IoCs
- Modifies registry class 64 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 4 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 64 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 64 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://helium.computer1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x284,0x7ffb6e9cc188,0x7ffb6e9cc194,0x7ffb6e9cc1a02⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1860,i,4545429807646984312,5392968530847179120,524288 --field-trial-handle=2240,i,17034632496250355997,409183896204333798,262144 --variations-seed-version --mojo-platform-channel-handle=2868 /prefetch:112⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2432,i,2084422713535682961,3706159958618846596,524288 --field-trial-handle=2240,i,17034632496250355997,409183896204333798,262144 --variations-seed-version --mojo-platform-channel-handle=2876 /prefetch:132⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3484,i,16508567680434719377,5441831977103004392,2097152 --field-trial-handle=2240,i,17034632496250355997,409183896204333798,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3488,i,17183641888176254453,4571189236774311932,2097152 --field-trial-handle=2240,i,17034632496250355997,409183896204333798,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1540,i,12851318164842632248,14608503926141322122,262144 --field-trial-handle=2240,i,17034632496250355997,409183896204333798,262144 --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4268,i,4640261966961146739,16284705749871454905,2097152 --field-trial-handle=2240,i,17034632496250355997,409183896204333798,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4304,i,13204266432281677192,3668639008634125681,2097152 --field-trial-handle=2240,i,17034632496250355997,409183896204333798,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:92⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5380,i,5142879431414421614,16040005601760337132,2097152 --field-trial-handle=2240,i,17034632496250355997,409183896204333798,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,11390826576499222061,12719533330449337628,524288 --field-trial-handle=2240,i,17034632496250355997,409183896204333798,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,11390826576499222061,12719533330449337628,524288 --field-trial-handle=2240,i,17034632496250355997,409183896204333798,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3568,i,17414061735431954548,13064391839838919926,524288 --field-trial-handle=2240,i,17034632496250355997,409183896204333798,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4928,i,10160211325902704792,1237457588250275991,524288 --field-trial-handle=2240,i,17034632496250355997,409183896204333798,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5928,i,6740840351068845362,14781970789590860306,2097152 --field-trial-handle=2240,i,17034632496250355997,409183896204333798,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=3512,i,13920935940388765086,10512630771636411054,2097152 --field-trial-handle=2240,i,17034632496250355997,409183896204333798,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4932,i,11321389528015178604,11840982871707529199,524288 --field-trial-handle=2240,i,17034632496250355997,409183896204333798,262144 --variations-seed-version --mojo-platform-channel-handle=4976 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3572,i,10679234632147942042,5418802792078968121,524288 --field-trial-handle=2240,i,17034632496250355997,409183896204333798,262144 --variations-seed-version --mojo-platform-channel-handle=4992 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4944,i,5363318184839364583,11088797657025540395,524288 --field-trial-handle=2240,i,17034632496250355997,409183896204333798,262144 --variations-seed-version --mojo-platform-channel-handle=6732 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5472,i,17810561564571362290,5927562916152058763,2097152 --field-trial-handle=2240,i,17034632496250355997,409183896204333798,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3384,i,394531488603628645,5958566341054468492,524288 --field-trial-handle=2240,i,17034632496250355997,409183896204333798,262144 --variations-seed-version --mojo-platform-channel-handle=4916 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6104,i,11857858836059713160,14235206236984170758,2097152 --field-trial-handle=2240,i,17034632496250355997,409183896204333798,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6424,i,15705354301138147826,8593033322913405696,524288 --field-trial-handle=2240,i,17034632496250355997,409183896204333798,262144 --variations-seed-version --mojo-platform-channel-handle=6900 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5216,i,4229152742172743034,17800591313191575674,524288 --field-trial-handle=2240,i,17034632496250355997,409183896204333798,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffb6b2fc728,0x7ffb6b2fc734,0x7ffb6b2fc7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1716,i,8206053056949337014,1351850786293883118,524288 --field-trial-handle=2356,i,654483818225070946,17648379946814540874,262144 --variations-seed-version --mojo-platform-channel-handle=2384 /prefetch:112⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1600,i,4092992340816101685,10440089956344796453,262144 --field-trial-handle=2356,i,654483818225070946,17648379946814540874,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1836,i,15790477838063440508,15801719117470836110,524288 --field-trial-handle=2356,i,654483818225070946,17648379946814540874,262144 --variations-seed-version --mojo-platform-channel-handle=2588 /prefetch:132⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3260,i,3575727626296130788,13885302030883271214,2097152 --field-trial-handle=2356,i,654483818225070946,17648379946814540874,262144 --variations-seed-version --mojo-platform-channel-handle=3340 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3268,i,6333560953687843525,13396415494456395568,2097152 --field-trial-handle=2356,i,654483818225070946,17648379946814540874,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4768,i,10254282212564268518,11614937613249665277,2097152 --field-trial-handle=2356,i,654483818225070946,17648379946814540874,262144 --variations-seed-version --mojo-platform-channel-handle=4804 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4924,i,2514853772711296112,720486364818440151,2097152 --field-trial-handle=2356,i,654483818225070946,17648379946814540874,262144 --variations-seed-version --mojo-platform-channel-handle=4936 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5112,i,16901056033027752450,177189862934631691,524288 --field-trial-handle=2356,i,654483818225070946,17648379946814540874,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5392,i,12108883226546320389,924204993353511340,524288 --field-trial-handle=2356,i,654483818225070946,17648379946814540874,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5488,i,6009525347393059182,4335841803240454886,2097152 --field-trial-handle=2356,i,654483818225070946,17648379946814540874,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5500,i,573807934159308912,8897133709626136232,2097152 --field-trial-handle=2356,i,654483818225070946,17648379946814540874,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5688,i,10831490173312040640,9790373457505377221,2097152 --field-trial-handle=2356,i,654483818225070946,17648379946814540874,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5812,i,16016798617549381847,2804563751259708119,524288 --field-trial-handle=2356,i,654483818225070946,17648379946814540874,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5788,i,4737066513338483161,3575847802951645476,2097152 --field-trial-handle=2356,i,654483818225070946,17648379946814540874,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5732,i,4749382586217859914,12055188030704661638,2097152 --field-trial-handle=2356,i,654483818225070946,17648379946814540874,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5916,i,1337545508607367068,17995704894644478147,524288 --field-trial-handle=2356,i,654483818225070946,17648379946814540874,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5396,i,9620247543287445953,14712416187947951120,2097152 --field-trial-handle=2356,i,654483818225070946,17648379946814540874,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6196,i,5084440575059630546,17213305841454837686,2097152 --field-trial-handle=2356,i,654483818225070946,17648379946814540874,262144 --variations-seed-version --mojo-platform-channel-handle=5732 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=5568,i,16555311708097819575,867942671453327174,2097152 --field-trial-handle=2356,i,654483818225070946,17648379946814540874,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5784,i,6686361246816636510,386261191745003171,524288 --field-trial-handle=2356,i,654483818225070946,17648379946814540874,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5536,i,7621941267842003606,11856021359860472764,2097152 --field-trial-handle=2356,i,654483818225070946,17648379946814540874,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=5056,i,5174955310751096982,12638809433412736496,2097152 --field-trial-handle=2356,i,654483818225070946,17648379946814540874,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:92⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --restart2⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x104,0x138,0x7ffb6b2fc728,0x7ffb6b2fc734,0x7ffb6b2fc7403⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1580,i,1719906762037089200,17808371057183336259,262144 --field-trial-handle=2024,i,2381038440695393995,14583424995647416716,262144 --variations-seed-version=20260808-030039.458000-production --mojo-platform-channel-handle=2008 /prefetch:23⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1840,i,11753682160422298104,12687994305042273063,524288 --field-trial-handle=2024,i,2381038440695393995,14583424995647416716,262144 --variations-seed-version=20260808-030039.458000-production --mojo-platform-channel-handle=2064 /prefetch:113⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2172,i,2724406541921405258,6552994790828860850,524288 --field-trial-handle=2024,i,2381038440695393995,14583424995647416716,262144 --variations-seed-version=20260808-030039.458000-production --mojo-platform-channel-handle=3520 /prefetch:133⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2020,i,17122001973862912668,708347477986578901,2097152 --field-trial-handle=2024,i,2381038440695393995,14583424995647416716,262144 --variations-seed-version=20260808-030039.458000-production --mojo-platform-channel-handle=3564 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3344,i,5224760036163116450,13278769662516680839,2097152 --field-trial-handle=2024,i,2381038440695393995,14583424995647416716,262144 --variations-seed-version=20260808-030039.458000-production --mojo-platform-channel-handle=3544 /prefetch:13⤵
-
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵
- Modifies data under HKEY_USERS
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\cleanmgr.exe"C:\Windows\system32\cleanmgr.exe"1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Dism\dismhost.exeC:\Windows\System32\Dism\dismhost.exe {6C78E9CD-2628-4B42-BA63-21888BD12EA2}2⤵
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\system32\SystemPropertiesPerformance.exe"C:\Windows\system32\SystemPropertiesPerformance.exe"1⤵
- Modifies visibility of file extensions in Explorer
- Modifies visibility of hidden/system files in Explorer
-
C:\Users\Admin\Downloads\helium_0.15.3.1_x64-installer.exe"C:\Users\Admin\Downloads\helium_0.15.3.1_x64-installer.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\helium_install\setup.exe"C:\Users\Admin\AppData\Local\Temp\helium_install\setup.exe" --install-archive="C:\Users\Admin\AppData\Local\Temp\helium_install\helium.7z" --do-not-launch-chrome2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\helium_install\setup.exeC:\Users\Admin\AppData\Local\Temp\helium_install\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\imput\Helium\User Data\Crashpad" --url=https://crash.helium.computer/crash --annotation=plat=Win64 --annotation=prod=Helium --annotation=ver=0.15.3.1 --attachment=C:\Windows\SystemTemp\helium_installer.log --attachment=C:\Users\Admin\AppData\Local\Chromium\ChromiumUpdater\updater.log --attachment=C:\Users\Admin\AppData\Local\Chromium\ChromiumUpdater\updater_history.jsonl --initial-client-data=0x284,0x288,0x28c,0x260,0x290,0x7ff64953bf08,0x7ff64953bf18,0x7ff64953bf283⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\helium_install\setup.exe"C:\Users\Admin\AppData\Local\Temp\helium_install\setup.exe" --verbose-logging --create-shortcuts=0 --install-level=03⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\helium_install\setup.exeC:\Users\Admin\AppData\Local\Temp\helium_install\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\imput\Helium\User Data\Crashpad" --url=https://crash.helium.computer/crash --annotation=plat=Win64 --annotation=prod=Helium --annotation=ver=0.15.3.1 --attachment=C:\Windows\SystemTemp\helium_installer.log --attachment=C:\Users\Admin\AppData\Local\Chromium\ChromiumUpdater\updater.log --attachment=C:\Users\Admin\AppData\Local\Chromium\ChromiumUpdater\updater_history.jsonl --initial-client-data=0x284,0x288,0x28c,0x260,0x290,0x7ff64953bf08,0x7ff64953bf18,0x7ff64953bf284⤵
- Executes dropped EXE
-
-
-
-
C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe"C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exeC:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\imput\Helium\User Data" /prefetch:4 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=C:\Users\Admin\AppData\Local\imput\Helium\User Data" --monitor-self-argument=/prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\imput\Helium\User Data\Crashpad" --url=https://crash.helium.computer/crash --annotation=plat=Win64 --annotation=prod=Helium --annotation=ver=0.15.3.1 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffb689823e0,0x7ffb689823f0,0x7ffb689824003⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exeC:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\imput\Helium\User Data" /prefetch:4 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\imput\Helium\User Data\Crashpad" --url=https://crash.helium.computer/crash --annotation=plat=Win64 --annotation=prod=Helium --annotation=ver=0.15.3.1 --initial-client-data=0x1ec,0x1f0,0x1f4,0x1c4,0x1f8,0x7ff621f05b08,0x7ff621f05b18,0x7ff621f05b284⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe"C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --gpu-preferences=WAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAQAAAAAAAAAADAAAAAAAAADgAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAKAAAAAAAAAAoAAAAAAAAAAgAAAAAAAAAEAAAAAIAAAABAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --metrics-shmem-handle=1616,i,14990222274769764043,10328673613921070572,262144 --field-trial-handle=2100,i,2572411215354972443,7089818753511562751,262144 --variations-seed-version --pseudonymization-salt-handle=2104,i,5218550983033606756,15890175487464154672,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2096 /prefetch:23⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe"C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --metrics-shmem-handle=1916,i,7757579105919128197,17393463639075025697,524288 --field-trial-handle=2100,i,2572411215354972443,7089818753511562751,262144 --variations-seed-version --pseudonymization-salt-handle=2104,i,5218550983033606756,15890175487464154672,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2164 /prefetch:113⤵
- Executes dropped EXE
- Loads dropped DLL
- System Time Discovery
-
-
C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe"C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2488,i,12476074354171806075,999992498039979760,524288 --field-trial-handle=2100,i,2572411215354972443,7089818753511562751,262144 --variations-seed-version --pseudonymization-salt-handle=2104,i,5218550983033606756,15890175487464154672,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2568 /prefetch:133⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe"C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3244,i,3903835356212551930,2249865164964236483,2097152 --field-trial-handle=2100,i,2572411215354972443,7089818753511562751,262144 --variations-seed-version --pseudonymization-salt-handle=2104,i,5218550983033606756,15890175487464154672,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=3296 /prefetch:13⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe"C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3428,i,6036485205200157314,12998383264093820211,2097152 --field-trial-handle=2100,i,2572411215354972443,7089818753511562751,262144 --variations-seed-version --pseudonymization-salt-handle=2104,i,5218550983033606756,15890175487464154672,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3488 /prefetch:13⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe"C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3736,i,9233730679436904624,1999893490337482576,2097152 --field-trial-handle=2100,i,2572411215354972443,7089818753511562751,262144 --variations-seed-version --pseudonymization-salt-handle=2104,i,5218550983033606756,15890175487464154672,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=3856 /prefetch:93⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe"C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5492,i,10318490896621545177,5282886772472778010,524288 --field-trial-handle=2100,i,2572411215354972443,7089818753511562751,262144 --variations-seed-version --pseudonymization-salt-handle=2104,i,5218550983033606756,15890175487464154672,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=5496 /prefetch:143⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe"C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5696,i,3229734762628288849,6377961200395494882,2097152 --field-trial-handle=2100,i,2572411215354972443,7089818753511562751,262144 --variations-seed-version --pseudonymization-salt-handle=2104,i,5218550983033606756,15890175487464154672,4 --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=4324 /prefetch:93⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe"C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=3724,i,12368243416103865176,15063455388155188478,2097152 --field-trial-handle=2100,i,2572411215354972443,7089818753511562751,262144 --variations-seed-version --pseudonymization-salt-handle=2104,i,5218550983033606756,15890175487464154672,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=5680 /prefetch:13⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe"C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=3808,i,11956444958451674353,9481281387520605932,2097152 --field-trial-handle=2100,i,2572411215354972443,7089818753511562751,262144 --variations-seed-version --pseudonymization-salt-handle=2104,i,5218550983033606756,15890175487464154672,4 --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=4292 /prefetch:13⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe"C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --start-stack-profiler --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5848,i,12289625226652046734,6979227405536575043,2097152 --field-trial-handle=2100,i,2572411215354972443,7089818753511562751,262144 --variations-seed-version --pseudonymization-salt-handle=2104,i,5218550983033606756,15890175487464154672,4 --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=3896 /prefetch:13⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe"C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6076,i,8707091717010206555,10581223034904339193,2097152 --field-trial-handle=2100,i,2572411215354972443,7089818753511562751,262144 --variations-seed-version --pseudonymization-salt-handle=2104,i,5218550983033606756,15890175487464154672,4 --trace-process-track-uuid=3190708999430457380 --mojo-platform-channel-handle=3356 /prefetch:13⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe"C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5500,i,1070247861939713118,7517279223993616855,2097152 --field-trial-handle=2100,i,2572411215354972443,7089818753511562751,262144 --variations-seed-version --pseudonymization-salt-handle=2104,i,5218550983033606756,15890175487464154672,4 --trace-process-track-uuid=3190709000367499229 --mojo-platform-channel-handle=5860 /prefetch:93⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe"C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5736,i,5444769007415396664,7386575857068468181,2097152 --field-trial-handle=2100,i,2572411215354972443,7089818753511562751,262144 --variations-seed-version --pseudonymization-salt-handle=2104,i,5218550983033606756,15890175487464154672,4 --trace-process-track-uuid=3190709001304541078 --mojo-platform-channel-handle=6028 /prefetch:13⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe"C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6168,i,10954595513143175188,16310314676264103183,2097152 --field-trial-handle=2100,i,2572411215354972443,7089818753511562751,262144 --variations-seed-version --pseudonymization-salt-handle=2104,i,5218550983033606756,15890175487464154672,4 --trace-process-track-uuid=3190709002241582927 --mojo-platform-channel-handle=3632 /prefetch:13⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe"C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6076,i,12118371591976585765,6592041493033942121,2097152 --field-trial-handle=2100,i,2572411215354972443,7089818753511562751,262144 --variations-seed-version --pseudonymization-salt-handle=2104,i,5218550983033606756,15890175487464154672,4 --trace-process-track-uuid=3190709003178624776 --mojo-platform-channel-handle=3320 /prefetch:93⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe"C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=252,i,12979133974819909227,17485600570437572186,2097152 --field-trial-handle=2100,i,2572411215354972443,7089818753511562751,262144 --variations-seed-version --pseudonymization-salt-handle=2104,i,5218550983033606756,15890175487464154672,4 --trace-process-track-uuid=3190709004115666625 --mojo-platform-channel-handle=3368 /prefetch:13⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe"C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=7108,i,14668085702594656901,5578279650545479170,2097152 --field-trial-handle=2100,i,2572411215354972443,7089818753511562751,262144 --variations-seed-version --pseudonymization-salt-handle=2104,i,5218550983033606756,15890175487464154672,4 --trace-process-track-uuid=3190709005989750323 --mojo-platform-channel-handle=6212 /prefetch:93⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe"C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=3348,i,17926410614555643079,1962014331321996964,2097152 --field-trial-handle=2100,i,2572411215354972443,7089818753511562751,262144 --variations-seed-version --pseudonymization-salt-handle=2104,i,5218550983033606756,15890175487464154672,4 --trace-process-track-uuid=3190709005052708474 --mojo-platform-channel-handle=6400 /prefetch:13⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe"C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5672,i,10395607270179900028,15912978060732707731,2097152 --field-trial-handle=2100,i,2572411215354972443,7089818753511562751,262144 --variations-seed-version --pseudonymization-salt-handle=2104,i,5218550983033606756,15890175487464154672,4 --trace-process-track-uuid=3190709006926792172 --mojo-platform-channel-handle=5840 /prefetch:13⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe"C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6988,i,7654004251613121899,79292267911355476,2097152 --field-trial-handle=2100,i,2572411215354972443,7089818753511562751,262144 --variations-seed-version --pseudonymization-salt-handle=2104,i,5218550983033606756,15890175487464154672,4 --trace-process-track-uuid=3190709007863834021 --mojo-platform-channel-handle=5728 /prefetch:13⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe"C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=5492,i,12680737126862634033,8273568645016380564,2097152 --field-trial-handle=2100,i,2572411215354972443,7089818753511562751,262144 --variations-seed-version --pseudonymization-salt-handle=2104,i,5218550983033606756,15890175487464154672,4 --trace-process-track-uuid=3190709008800875870 --mojo-platform-channel-handle=628 /prefetch:13⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe"C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=3376,i,5734314337110854587,5931996715206508541,524288 --field-trial-handle=2100,i,2572411215354972443,7089818753511562751,262144 --variations-seed-version --pseudonymization-salt-handle=2104,i,5218550983033606756,15890175487464154672,4 --trace-process-track-uuid=3190709009737917719 --mojo-platform-channel-handle=6304 /prefetch:123⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe"C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6240,i,5710145410958465365,17835412783257098454,524288 --field-trial-handle=2100,i,2572411215354972443,7089818753511562751,262144 --variations-seed-version --pseudonymization-salt-handle=2104,i,5218550983033606756,15890175487464154672,4 --trace-process-track-uuid=3190709010674959568 --mojo-platform-channel-handle=5820 /prefetch:143⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe"C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --start-stack-profiler --gpu-preferences=WAAAAAAAAADoAAAEAAAAAAAAAAAAAGAAQAAAAAAAAAAAAAAAAAAAADgAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAKAAAAAAAAAAoAAAAAAAAAAgAAAAAAAAADAAAAAEAAAAAAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=d3d11-warp-webgl --metrics-shmem-handle=7352,i,11219220805681004765,13220604775726885840,262144 --field-trial-handle=2100,i,2572411215354972443,7089818753511562751,262144 --variations-seed-version --pseudonymization-salt-handle=2104,i,5218550983033606756,15890175487464154672,4 --trace-process-track-uuid=3190709012549043266 --mojo-platform-channel-handle=7088 /prefetch:103⤵
- Executes dropped EXE
- Loads dropped DLL
- Network Service Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe"C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=3732,i,11730143373985590121,13753073108136111139,2097152 --field-trial-handle=2100,i,2572411215354972443,7089818753511562751,262144 --variations-seed-version --pseudonymization-salt-handle=2104,i,5218550983033606756,15890175487464154672,4 --trace-process-track-uuid=3190709013486085115 --mojo-platform-channel-handle=7316 /prefetch:13⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe"C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=1504,i,3531107594467764262,7368286159651259765,2097152 --field-trial-handle=2100,i,2572411215354972443,7089818753511562751,262144 --variations-seed-version --pseudonymization-salt-handle=2104,i,5218550983033606756,15890175487464154672,4 --trace-process-track-uuid=3190709014423126964 --mojo-platform-channel-handle=7232 /prefetch:13⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe"C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=8168,i,13492701805709919459,7868523362354472877,2097152 --field-trial-handle=2100,i,2572411215354972443,7089818753511562751,262144 --variations-seed-version --pseudonymization-salt-handle=2104,i,5218550983033606756,15890175487464154672,4 --trace-process-track-uuid=3190709015360168813 --mojo-platform-channel-handle=7340 /prefetch:13⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe"C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=4392,i,3649204923123440148,10796774684853676966,2097152 --field-trial-handle=2100,i,2572411215354972443,7089818753511562751,262144 --variations-seed-version --pseudonymization-salt-handle=2104,i,5218550983033606756,15890175487464154672,4 --trace-process-track-uuid=3190709016297210662 --mojo-platform-channel-handle=7464 /prefetch:13⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe"C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=7316,i,7318798474529471297,11560612611765957365,2097152 --field-trial-handle=2100,i,2572411215354972443,7089818753511562751,262144 --variations-seed-version --pseudonymization-salt-handle=2104,i,5218550983033606756,15890175487464154672,4 --trace-process-track-uuid=3190709017234252511 --mojo-platform-channel-handle=6152 /prefetch:13⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe"C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --metrics-shmem-handle=1808,i,5575827789311852456,3160150223810850791,2097152 --field-trial-handle=2100,i,2572411215354972443,7089818753511562751,262144 --variations-seed-version --pseudonymization-salt-handle=2104,i,5218550983033606756,15890175487464154672,4 --trace-process-track-uuid=3190709018171294360 --mojo-platform-channel-handle=8036 /prefetch:13⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe"C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=7924,i,7679156056003910816,333753773176651184,524288 --field-trial-handle=2100,i,2572411215354972443,7089818753511562751,262144 --variations-seed-version --pseudonymization-salt-handle=2104,i,5218550983033606756,15890175487464154672,4 --trace-process-track-uuid=3190709019108336209 --mojo-platform-channel-handle=6160 /prefetch:143⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe"C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=8024,i,14596446017044944023,17229863522731156027,524288 --field-trial-handle=2100,i,2572411215354972443,7089818753511562751,262144 --variations-seed-version --pseudonymization-salt-handle=2104,i,5218550983033606756,15890175487464154672,4 --trace-process-track-uuid=3190709020045378058 --mojo-platform-channel-handle=7952 /prefetch:143⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe"C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --metrics-shmem-handle=4308,i,9942160896763754262,14428245061717119355,2097152 --field-trial-handle=2100,i,2572411215354972443,7089818753511562751,262144 --variations-seed-version --pseudonymization-salt-handle=2104,i,5218550983033606756,15890175487464154672,4 --trace-process-track-uuid=3190709020982419907 --mojo-platform-channel-handle=8136 /prefetch:13⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe"C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --metrics-shmem-handle=4432,i,11359667413465666358,5682894514314165170,2097152 --field-trial-handle=2100,i,2572411215354972443,7089818753511562751,262144 --variations-seed-version --pseudonymization-salt-handle=2104,i,5218550983033606756,15890175487464154672,4 --trace-process-track-uuid=3190709021919461756 --mojo-platform-channel-handle=6156 /prefetch:13⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe"C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --metrics-shmem-handle=6052,i,5991961597109325688,6479125482657819599,2097152 --field-trial-handle=2100,i,2572411215354972443,7089818753511562751,262144 --variations-seed-version --pseudonymization-salt-handle=2104,i,5218550983033606756,15890175487464154672,4 --trace-process-track-uuid=3190709022856503605 --mojo-platform-channel-handle=5796 /prefetch:13⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe"C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --start-stack-profiler --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --metrics-shmem-handle=7736,i,15146989342001521484,18100899110646968005,2097152 --field-trial-handle=2100,i,2572411215354972443,7089818753511562751,262144 --variations-seed-version --pseudonymization-salt-handle=2104,i,5218550983033606756,15890175487464154672,4 --trace-process-track-uuid=3190709023793545454 --mojo-platform-channel-handle=8028 /prefetch:13⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe"C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --metrics-shmem-handle=7300,i,9282082210069825372,12010454605688920844,2097152 --field-trial-handle=2100,i,2572411215354972443,7089818753511562751,262144 --variations-seed-version --pseudonymization-salt-handle=2104,i,5218550983033606756,15890175487464154672,4 --trace-process-track-uuid=3190709024730587303 --mojo-platform-channel-handle=8080 /prefetch:13⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe"C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --metrics-shmem-handle=4400,i,16119741290431030464,8314929762811365433,2097152 --field-trial-handle=2100,i,2572411215354972443,7089818753511562751,262144 --variations-seed-version --pseudonymization-salt-handle=2104,i,5218550983033606756,15890175487464154672,4 --trace-process-track-uuid=3190709025667629152 --mojo-platform-channel-handle=6348 /prefetch:13⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe"C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=7760,i,4553017835214334953,15769810324501685202,524288 --field-trial-handle=2100,i,2572411215354972443,7089818753511562751,262144 --variations-seed-version --pseudonymization-salt-handle=2104,i,5218550983033606756,15890175487464154672,4 --trace-process-track-uuid=3190709026604671001 --mojo-platform-channel-handle=5972 /prefetch:143⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe"C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4276,i,8255986024012310423,18309118835429062984,524288 --field-trial-handle=2100,i,2572411215354972443,7089818753511562751,262144 --variations-seed-version --pseudonymization-salt-handle=2104,i,5218550983033606756,15890175487464154672,4 --trace-process-track-uuid=3190709027541712850 --mojo-platform-channel-handle=6448 /prefetch:143⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe"C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --metrics-shmem-handle=1808,i,7858138157312187653,2169589267458326937,2097152 --field-trial-handle=2100,i,2572411215354972443,7089818753511562751,262144 --variations-seed-version --pseudonymization-salt-handle=2104,i,5218550983033606756,15890175487464154672,4 --trace-process-track-uuid=3190709028478754699 --mojo-platform-channel-handle=7920 /prefetch:13⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe"C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --metrics-shmem-handle=6128,i,13719065499797738581,8218146804088750792,2097152 --field-trial-handle=2100,i,2572411215354972443,7089818753511562751,262144 --variations-seed-version --pseudonymization-salt-handle=2104,i,5218550983033606756,15890175487464154672,4 --trace-process-track-uuid=3190709029415796548 --mojo-platform-channel-handle=4892 /prefetch:13⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe"C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --metrics-shmem-handle=8084,i,12797099712967491608,13955725381202141871,2097152 --field-trial-handle=2100,i,2572411215354972443,7089818753511562751,262144 --variations-seed-version --pseudonymization-salt-handle=2104,i,5218550983033606756,15890175487464154672,4 --trace-process-track-uuid=3190709030352838397 --mojo-platform-channel-handle=4420 /prefetch:13⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe"C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --metrics-shmem-handle=8104,i,6804921236507403108,2051268856089140915,2097152 --field-trial-handle=2100,i,2572411215354972443,7089818753511562751,262144 --variations-seed-version --pseudonymization-salt-handle=2104,i,5218550983033606756,15890175487464154672,4 --trace-process-track-uuid=3190709031289880246 --mojo-platform-channel-handle=7628 /prefetch:13⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe"C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --metrics-shmem-handle=5972,i,1464532308021582326,18173024677301883687,2097152 --field-trial-handle=2100,i,2572411215354972443,7089818753511562751,262144 --variations-seed-version --pseudonymization-salt-handle=2104,i,5218550983033606756,15890175487464154672,4 --trace-process-track-uuid=3190709032226922095 --mojo-platform-channel-handle=4228 /prefetch:13⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe"C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --start-stack-profiler --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --metrics-shmem-handle=8260,i,8288042349740582743,7228758857765847780,2097152 --field-trial-handle=2100,i,2572411215354972443,7089818753511562751,262144 --variations-seed-version --pseudonymization-salt-handle=2104,i,5218550983033606756,15890175487464154672,4 --trace-process-track-uuid=3190709033163963944 --mojo-platform-channel-handle=8272 /prefetch:13⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe"C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --start-stack-profiler --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --metrics-shmem-handle=6588,i,10211263186936636803,1392062500770631241,2097152 --field-trial-handle=2100,i,2572411215354972443,7089818753511562751,262144 --variations-seed-version --pseudonymization-salt-handle=2104,i,5218550983033606756,15890175487464154672,4 --trace-process-track-uuid=3190709034101005793 --mojo-platform-channel-handle=6072 /prefetch:13⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe"C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --metrics-shmem-handle=8260,i,12962914450479443943,14200145613706128844,2097152 --field-trial-handle=2100,i,2572411215354972443,7089818753511562751,262144 --variations-seed-version --pseudonymization-salt-handle=2104,i,5218550983033606756,15890175487464154672,4 --trace-process-track-uuid=3190709035038047642 --mojo-platform-channel-handle=6132 /prefetch:13⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe"C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --metrics-shmem-handle=4380,i,7660124517717671111,3180969866894083801,2097152 --field-trial-handle=2100,i,2572411215354972443,7089818753511562751,262144 --variations-seed-version --pseudonymization-salt-handle=2104,i,5218550983033606756,15890175487464154672,4 --trace-process-track-uuid=3190709035975089491 --mojo-platform-channel-handle=7696 /prefetch:13⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe"C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --metrics-shmem-handle=3352,i,7669603546017324932,17020629939648303788,2097152 --field-trial-handle=2100,i,2572411215354972443,7089818753511562751,262144 --variations-seed-version --pseudonymization-salt-handle=2104,i,5218550983033606756,15890175487464154672,4 --trace-process-track-uuid=3190709036912131340 --mojo-platform-channel-handle=6176 /prefetch:13⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe"C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --metrics-shmem-handle=6328,i,9023867626315354054,16155562130873648857,2097152 --field-trial-handle=2100,i,2572411215354972443,7089818753511562751,262144 --variations-seed-version --pseudonymization-salt-handle=2104,i,5218550983033606756,15890175487464154672,4 --trace-process-track-uuid=3190709037849173189 --mojo-platform-channel-handle=5100 /prefetch:13⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe"C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --metrics-shmem-handle=3352,i,4109314455825698446,11259728199516776207,2097152 --field-trial-handle=2100,i,2572411215354972443,7089818753511562751,262144 --variations-seed-version --pseudonymization-salt-handle=2104,i,5218550983033606756,15890175487464154672,4 --trace-process-track-uuid=3190709038786215038 --mojo-platform-channel-handle=7708 /prefetch:13⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe"C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --metrics-shmem-handle=7760,i,1603969375665956594,11519852899247316680,2097152 --field-trial-handle=2100,i,2572411215354972443,7089818753511562751,262144 --variations-seed-version --pseudonymization-salt-handle=2104,i,5218550983033606756,15890175487464154672,4 --trace-process-track-uuid=3190709039723256887 --mojo-platform-channel-handle=7608 /prefetch:13⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe"C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --metrics-shmem-handle=8616,i,4672823630482617210,9493740676974678859,2097152 --field-trial-handle=2100,i,2572411215354972443,7089818753511562751,262144 --variations-seed-version --pseudonymization-salt-handle=2104,i,5218550983033606756,15890175487464154672,4 --trace-process-track-uuid=3190709040660298736 --mojo-platform-channel-handle=6176 /prefetch:13⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe"C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --metrics-shmem-handle=6112,i,4812649221792450000,5703369133482404360,2097152 --field-trial-handle=2100,i,2572411215354972443,7089818753511562751,262144 --variations-seed-version --pseudonymization-salt-handle=2104,i,5218550983033606756,15890175487464154672,4 --trace-process-track-uuid=3190709041597340585 --mojo-platform-channel-handle=3504 /prefetch:13⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe"C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --start-stack-profiler --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --metrics-shmem-handle=2072,i,16005433178041023923,2252755303815325899,2097152 --field-trial-handle=2100,i,2572411215354972443,7089818753511562751,262144 --variations-seed-version --pseudonymization-salt-handle=2104,i,5218550983033606756,15890175487464154672,4 --trace-process-track-uuid=3190709042534382434 --mojo-platform-channel-handle=6124 /prefetch:13⤵
-
-
C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe"C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --metrics-shmem-handle=8464,i,5062443992967422224,13641848189625218350,2097152 --field-trial-handle=2100,i,2572411215354972443,7089818753511562751,262144 --variations-seed-version --pseudonymization-salt-handle=2104,i,5218550983033606756,15890175487464154672,4 --trace-process-track-uuid=3190709043471424283 --mojo-platform-channel-handle=6112 /prefetch:13⤵
-
-
C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe"C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --start-stack-profiler --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --metrics-shmem-handle=8512,i,10482708799590571664,15623490447297560791,2097152 --field-trial-handle=2100,i,2572411215354972443,7089818753511562751,262144 --variations-seed-version --pseudonymization-salt-handle=2104,i,5218550983033606756,15890175487464154672,4 --trace-process-track-uuid=3190709044408466132 --mojo-platform-channel-handle=8372 /prefetch:13⤵
-
-
C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe"C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --metrics-shmem-handle=7692,i,18099791731102890011,7879642237206372336,2097152 --field-trial-handle=2100,i,2572411215354972443,7089818753511562751,262144 --variations-seed-version --pseudonymization-salt-handle=2104,i,5218550983033606756,15890175487464154672,4 --trace-process-track-uuid=3190709045345507981 --mojo-platform-channel-handle=8256 /prefetch:13⤵
-
-
C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe"C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --start-stack-profiler --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --metrics-shmem-handle=2608,i,1881798234863946579,6426018799530183587,2097152 --field-trial-handle=2100,i,2572411215354972443,7089818753511562751,262144 --variations-seed-version --pseudonymization-salt-handle=2104,i,5218550983033606756,15890175487464154672,4 --trace-process-track-uuid=3190709046282549830 --mojo-platform-channel-handle=7764 /prefetch:13⤵
-
-
C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe"C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --metrics-shmem-handle=6120,i,7979625868402179361,1068009941571872907,2097152 --field-trial-handle=2100,i,2572411215354972443,7089818753511562751,262144 --variations-seed-version --pseudonymization-salt-handle=2104,i,5218550983033606756,15890175487464154672,4 --trace-process-track-uuid=3190709047219591679 --mojo-platform-channel-handle=8568 /prefetch:13⤵
-
-
C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe"C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --metrics-shmem-handle=4428,i,7270828671136059152,17849904029327612430,2097152 --field-trial-handle=2100,i,2572411215354972443,7089818753511562751,262144 --variations-seed-version --pseudonymization-salt-handle=2104,i,5218550983033606756,15890175487464154672,4 --trace-process-track-uuid=3190709048156633528 --mojo-platform-channel-handle=8644 /prefetch:13⤵
-
-
C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe"C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --start-stack-profiler --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --metrics-shmem-handle=3540,i,9697682131903358458,10118456344134458961,2097152 --field-trial-handle=2100,i,2572411215354972443,7089818753511562751,262144 --variations-seed-version --pseudonymization-salt-handle=2104,i,5218550983033606756,15890175487464154672,4 --trace-process-track-uuid=3190709049093675377 --mojo-platform-channel-handle=8520 /prefetch:13⤵
-
-
C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe"C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --start-stack-profiler --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --metrics-shmem-handle=7636,i,9405293199022833127,9295979237305122795,2097152 --field-trial-handle=2100,i,2572411215354972443,7089818753511562751,262144 --variations-seed-version --pseudonymization-salt-handle=2104,i,5218550983033606756,15890175487464154672,4 --trace-process-track-uuid=3190709050030717226 --mojo-platform-channel-handle=7576 /prefetch:13⤵
-
-
C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe"C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --metrics-shmem-handle=8316,i,2154337425371805949,15854696756124930042,2097152 --field-trial-handle=2100,i,2572411215354972443,7089818753511562751,262144 --variations-seed-version --pseudonymization-salt-handle=2104,i,5218550983033606756,15890175487464154672,4 --trace-process-track-uuid=3190709050967759075 --mojo-platform-channel-handle=8308 /prefetch:13⤵
-
-
C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe"C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --start-stack-profiler --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --metrics-shmem-handle=8456,i,8744678070727149960,11121798305368907576,2097152 --field-trial-handle=2100,i,2572411215354972443,7089818753511562751,262144 --variations-seed-version --pseudonymization-salt-handle=2104,i,5218550983033606756,15890175487464154672,4 --trace-process-track-uuid=3190709051904800924 --mojo-platform-channel-handle=5852 /prefetch:13⤵
-
-
C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe"C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --metrics-shmem-handle=7644,i,17055374336492089987,4214281114065556067,2097152 --field-trial-handle=2100,i,2572411215354972443,7089818753511562751,262144 --variations-seed-version --pseudonymization-salt-handle=2104,i,5218550983033606756,15890175487464154672,4 --trace-process-track-uuid=3190709052841842773 --mojo-platform-channel-handle=8268 /prefetch:13⤵
-
-
C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe"C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --metrics-shmem-handle=4400,i,8741359372102663008,14185395632448943363,2097152 --field-trial-handle=2100,i,2572411215354972443,7089818753511562751,262144 --variations-seed-version --pseudonymization-salt-handle=2104,i,5218550983033606756,15890175487464154672,4 --trace-process-track-uuid=3190709053778884622 --mojo-platform-channel-handle=8124 /prefetch:13⤵
-
-
C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe"C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --metrics-shmem-handle=7408,i,6713385088429291261,13167981547625422329,2097152 --field-trial-handle=2100,i,2572411215354972443,7089818753511562751,262144 --variations-seed-version --pseudonymization-salt-handle=2104,i,5218550983033606756,15890175487464154672,4 --trace-process-track-uuid=3190709054715926471 --mojo-platform-channel-handle=8088 /prefetch:13⤵
-
-
C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe"C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=8244,i,9339607424160269561,101394089026411630,524288 --field-trial-handle=2100,i,2572411215354972443,7089818753511562751,262144 --variations-seed-version --pseudonymization-salt-handle=2104,i,5218550983033606756,15890175487464154672,4 --trace-process-track-uuid=3190709055652968320 --mojo-platform-channel-handle=8440 /prefetch:143⤵
-
-
C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe"C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --metrics-shmem-handle=8120,i,17367946639257937334,15137628569566989182,2097152 --field-trial-handle=2100,i,2572411215354972443,7089818753511562751,262144 --variations-seed-version --pseudonymization-salt-handle=2104,i,5218550983033606756,15890175487464154672,4 --trace-process-track-uuid=3190709056590010169 --mojo-platform-channel-handle=8476 /prefetch:13⤵
-
-
C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe"C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --metrics-shmem-handle=7464,i,3231450886915151694,320355062782047616,2097152 --field-trial-handle=2100,i,2572411215354972443,7089818753511562751,262144 --variations-seed-version --pseudonymization-salt-handle=2104,i,5218550983033606756,15890175487464154672,4 --trace-process-track-uuid=3190709057527052018 --mojo-platform-channel-handle=2588 /prefetch:13⤵
-
-
C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe"C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --metrics-shmem-handle=5840,i,10126404097802444244,18444917735378888494,2097152 --field-trial-handle=2100,i,2572411215354972443,7089818753511562751,262144 --variations-seed-version --pseudonymization-salt-handle=2104,i,5218550983033606756,15890175487464154672,4 --trace-process-track-uuid=3190709058464093867 --mojo-platform-channel-handle=8644 /prefetch:13⤵
-
-
C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe"C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --start-stack-profiler --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --metrics-shmem-handle=8484,i,585492510361429224,7255532903993932970,2097152 --field-trial-handle=2100,i,2572411215354972443,7089818753511562751,262144 --variations-seed-version --pseudonymization-salt-handle=2104,i,5218550983033606756,15890175487464154672,4 --trace-process-track-uuid=3190709059401135716 --mojo-platform-channel-handle=7920 /prefetch:13⤵
-
-
C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe"C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --metrics-shmem-handle=5780,i,15129985599358877293,1182179119440085104,2097152 --field-trial-handle=2100,i,2572411215354972443,7089818753511562751,262144 --variations-seed-version --pseudonymization-salt-handle=2104,i,5218550983033606756,15890175487464154672,4 --trace-process-track-uuid=3190709060338177565 --mojo-platform-channel-handle=8352 /prefetch:13⤵
-
-
C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe"C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --metrics-shmem-handle=4376,i,12118783976092450177,6068570350792598140,2097152 --field-trial-handle=2100,i,2572411215354972443,7089818753511562751,262144 --variations-seed-version --pseudonymization-salt-handle=2104,i,5218550983033606756,15890175487464154672,4 --trace-process-track-uuid=3190709061275219414 --mojo-platform-channel-handle=4248 /prefetch:13⤵
-
-
C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe"C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --start-stack-profiler --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --metrics-shmem-handle=5960,i,8957602217806010556,2145596299673931365,2097152 --field-trial-handle=2100,i,2572411215354972443,7089818753511562751,262144 --variations-seed-version --pseudonymization-salt-handle=2104,i,5218550983033606756,15890175487464154672,4 --trace-process-track-uuid=3190709062212261263 --mojo-platform-channel-handle=5804 /prefetch:13⤵
-
-
C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe"C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --metrics-shmem-handle=6088,i,8855684006523261569,5130558372044887197,2097152 --field-trial-handle=2100,i,2572411215354972443,7089818753511562751,262144 --variations-seed-version --pseudonymization-salt-handle=2104,i,5218550983033606756,15890175487464154672,4 --trace-process-track-uuid=3190709063149303112 --mojo-platform-channel-handle=7936 /prefetch:13⤵
-
-
C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe"C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --metrics-shmem-handle=8436,i,10124848088557944974,10676505884520467485,2097152 --field-trial-handle=2100,i,2572411215354972443,7089818753511562751,262144 --variations-seed-version --pseudonymization-salt-handle=2104,i,5218550983033606756,15890175487464154672,4 --trace-process-track-uuid=3190709064086344961 --mojo-platform-channel-handle=5940 /prefetch:13⤵
-
-
C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe"C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=84 --metrics-shmem-handle=7700,i,13619115085473064365,1483445034977193381,2097152 --field-trial-handle=2100,i,2572411215354972443,7089818753511562751,262144 --variations-seed-version --pseudonymization-salt-handle=2104,i,5218550983033606756,15890175487464154672,4 --trace-process-track-uuid=3190709065023386810 --mojo-platform-channel-handle=8632 /prefetch:13⤵
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SendNotifyMessage
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"3⤵
- Badlisted process makes network request
- Drops file in Drivers directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\erqv3dyt\erqv3dyt.cmdline"4⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDFD5.tmp" "c:\Users\Admin\AppData\Local\Temp\erqv3dyt\CSCDD9A4EED16F4938BBE72D4F357282EB.TMP"5⤵
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\44lzly1u\44lzly1u.cmdline"4⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE11D.tmp" "c:\Users\Admin\AppData\Local\Temp\44lzly1u\CSCB45F1A4162A44D2C8FCDA3FE955A501.TMP"5⤵
-
-
-
C:\Windows\system32\powercfg.exe"C:\Windows\system32\powercfg.exe" /duplicatescheme e9a42b02-d5df-448d-aa00-03f14749eb614⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exe"C:\Windows\system32\powercfg.exe" /setactive 3fb4ad6b-4d21-49b0-a7de-4bb0068b24de4⤵
- Power Settings
-
-
C:\Windows\system32\taskkill.exe"C:\Windows\system32\taskkill.exe" /F /IM explorer.exe4⤵
- Kills process with taskkill
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"4⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\system32\ipconfig.exe"C:\Windows\system32\ipconfig.exe" /flushdns4⤵
- Gathers network information
-
-
C:\Windows\system32\icacls.exe"C:\Windows\system32\icacls.exe" C:\Windows\Installer\Razer /deny Everyone:(W)4⤵
- Modifies file permissions
-
-
C:\Windows\system32\taskkill.exe"C:\Windows\system32\taskkill.exe" /F /IM explorer.exe4⤵
- Kills process with taskkill
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"4⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops desktop.ini file(s)
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /75⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /75⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
-
-
-
C:\Windows\system32\icacls.exe"C:\Windows\system32\icacls.exe" C:\Users\Admin\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\LocalState\store.db /deny Everyone:F4⤵
- Modifies file permissions
-
-
C:\Windows\system32\powercfg.exe"C:\Windows\system32\powercfg.exe" /hibernate off4⤵
- Power Settings
-
-
C:\Windows\system32\cleanmgr.exe"C:\Windows\system32\cleanmgr.exe" /d C: /VERYLOWDISK4⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
-
C:\Windows\System32\Dism\dismhost.exeC:\Windows\System32\Dism\dismhost.exe {95A8B071-C38E-44EF-A654-1F2C58445F28}5⤵
-
-
-
C:\Windows\system32\Dism.exe"C:\Windows\system32\Dism.exe" /online /Cleanup-Image /StartComponentCleanup /ResetBase4⤵
- Drops file in Windows directory
-
C:\Windows\System32\Dism\dismhost.exeC:\Windows\System32\Dism\dismhost.exe {1D0967C7-1EA1-4470-AFE5-C19625239A1E}5⤵
- Drops file in Windows directory
-
-
-
C:\Windows\system32\Dism.exe"C:\Windows\system32\Dism.exe" /Online /Set-ReservedStorageState /State:Disabled4⤵
- Drops file in Windows directory
-
C:\Windows\System32\Dism\dismhost.exeC:\Windows\System32\Dism\dismhost.exe {FD072B5B-7FB3-49B2-958B-139E79E05819}5⤵
-
-
-
-
-
C:\Windows\system32\SystemPropertiesPerformance.exe"C:\Windows\system32\SystemPropertiesPerformance.exe"2⤵
- Suspicious behavior: GetForegroundWindowSpam
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Modifies registry class
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵
- Modifies data under HKEY_USERS
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵
- Boot or Logon Autostart Execution: Port Monitors
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
-
C:\Windows\system32\userinit.exeC:\Windows\system32\userinit.exe1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Modifies registry class
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "d" "C:\Windows\system32\spool\tools\Microsoft Print To PDF\prnms009.Inf" "9" "43057df13" "000000000000018C" "WinSta0\Default" "0000000000000190" "208" "C:\Windows\system32\spool\tools\Microsoft Print To PDF"1⤵
- Drops file in System32 directory
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Port Monitors
1Event Triggered Execution
1Component Object Model Hijacking
1Power Settings
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Port Monitors
1Event Triggered Execution
1Component Object Model Hijacking
1Defense Evasion
File and Directory Permissions Modification
1Hide Artifacts
2Hidden Files and Directories
2Modify Registry
4Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
CrashpadMetrics-active.pma
settings.dat
000003.log
LOG
messages.json
craw_background.js
data_1
Network Persistent State
Network Persistent State
TransportSecurity
TransportSecurity
Preferences
Preferences
Preferences
Preferences
Secure Preferences
LOG
Session_13430729255085081
Tabs_13430729279072081
LOG
the-real-index
the-real-index
data_0
data_2
data_3
Network Persistent State
Network Persistent State~RFe5a23f4.TMP
000003.log
LOG
32.png
48.png
64.png
32.png
48.png
64.png
f849c232-9f70-465c-bea8-d2ae97e5615f.tmp
Last Version
Local State
Local State
Local State
Local State
Local State
Variations
settings.dat
settings.dat
settings.dat
13a8ca6a-7c16-4620-8c1f-522c578c9522.tmp
BookmarkMergedSurfaceOrdering
the-real-index
the-real-index~RFe597620.TMP
SiteList-Enterprise.json
Edge Profile.ico
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Preferences
Preferences
Preferences
Preferences
Secure Preferences
sync_diagnostic.log
CURRENT
MANIFEST-000001
OperationConfig
Local State
Local State
Local State
Local State
Local State
Local State
Local State
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter~RFe5960f2.TMP
158204f6-2f6f-47cd-b34f-507e70bf2947.tmp
iconcache_idx.db
iconcache_idx.db
StartUnifiedTileModelCache.dat
StartUnifiedTileModelCache.dat
prep_Activatable Class_Hermes_perf.cache
microsoftwindows.client[1].xml
SearchUnifiedTileModelCache.dat
SettingsCache.txt
~earchUnifiedTileModelCache.tmp
__PSScriptPolicyTest_3sqmia5i.c50.ps1
modern-wizard.bmp
messages.json
am_MASCULINE.pak
793a3809-3201-4808-b831-7dc6f8441516.tmp
settings.dat
125aa8fb-a828-4ddb-8aab-52702653b0af.tmp
91a3cc4a-848b-4312-8235-e6bbac95324c.tmp
f_00000d
f_00000e
f_00000f
f_000011
f_000015
f_000016
f_000019
f_000033
f_000036
f_000039
f_00003b
f_00003c
f_0000a5
f_0000f6
f_0000f7
f_0000f8
f_0000f9
f_0000fb
f_0000fc
f_0000fe
f_0000ff
f_000100
f_000103
f_000104
f_00010e
f_000121
f_000155
f_000176
f_000177
f_000182
f_000184
f_000185
f_00018b
f_000203
f_000205
f_00020e
f_000210
f_000212
f_00024a
f_00024b
f_00024c
f_00024d
f_00024e
f_00024f
f_000250
f_000251
f_000252
f_000253
f_000254
f_000255
f_000258
f_00025b
f_00025c
f_00025d
f_00025f
f_000260
f_000262
f_000264
f_000278
f_000279
f_000283
f_000284
f_000285
f_000286
f_000287
f_000288
f_000289
f_00028a
f_00028b
f_00028c
f_00028d
f_00028e
f_00028f
f_000290
f_000291
f_000292
f_000293
f_000294
f_000295
f_000296
f_000297
f_000298
f_00029b
f_00029c
f_0002a7
f_0002ae
f_0002af
f_0002c2
00d045a958b25c0d_0
02cba9d43f494e35_0
02eb51d021ce6090_0
0347bb0dd095b25f_0
0487ccfb65a21d8d_0
052fb6ec8452f4b8_0
0532e8170293a9f0_0
06de4c2c419178d4_0
0983cba2244be9db_0
0aa92814d97490e9_0
0dc99e8f51b92ec4_0
12fb0abe64cdd06d_0
147f283818bd64c1_0
1484507a0f533b7d_0
181886363ba2b62b_0
192fa63ba266f1ab_0
19cbfe0bdcbb2e4d_0
1b5f99f6306267ec_0
1cefb6e18e947d6d_0
1dec1c4c7eea662c_0
1e6cc3fb84c184a9_0
2129eccfda81ece2_0
222efa161f5fc914_0
226de431af1cc9a3_0
292667c5b5c8f0bf_0
2c08faabaf989d8b_0
2dd1068b85971ecc_0
2fbedb9c8b716497_0
34c50d1c37d77e38_0
378bf9cb705fe68e_0
37a35f72b724e8d6_0
3c5688c3532119a3_0
435c5acafe2cce76_0
441aa94f48f631f3_0
4470aa4c377fc6e1_0
447e83e6dfb037f8_0
45b7b8dee96c8e37_0
4607858c45ac5b16_0
46970d5e15ce4e15_0
471ca5522ccf8af7_0
493286545beeea13_0
49e796ab1b873d09_0
4a9f533d8853ba98_0
4bfffec4239cece3_0
504df606c70ff422_0
51d9692ac6469890_0
528d33e34cdd6887_0
5732b7ad9646c659_0
5763f40b12873fb5_0
57ac082db1154e41_0
5956dcd35084ef65_0
5c4b1e329e1a702a_0
5c98b90eb48b00bf_0
5dc3512c5b269390_0
60f6c9d112fcc339_0
612758a9479a6abd_0
65ff149b609efcc8_0
673edc49310909b0_0
67cf3cf1aedffedb_0
693c6163d2ca1520_0
7353fa8847c3733a_0
7405dcebd9665c87_0
77754cebe334e9f0_0
7c90db00405de049_0
7d5e047104b38131_0
7dbf0337b6e32640_0
7f3fbdeefd4c9113_0
80e28319d23a544c_0
834de55785f14785_0
847ae5f7095fae78_0
870ea3a43f8ea974_0
88cb01c9c6114e4b_0
8d360d8d7a2c10eb_0
8e57f302d63e524d_0
9446c3a73471f7bb_0
94e28244da241ac5_0
9aba52d8dcfa8687_0
9b7f5a238b28781c_0
9c81708319694937_0
9ce20acdbc09e0aa_0
9e8c237d9ea487e6_0
a0e90f732b21c9b5_0
a2b709056dcc8253_0
a2e002368d67493e_0
a71f050a7c7b1e2e_0
a74174e30af5772e_0
a7cfe5cbea07145e_0
a7e9dc082429aaef_0
a91a06b5fe7a37f7_0
aa924d59af1a8230_0
afe042bc5bd440cb_0
b080f2e71e8f1719_0
b1494923f2930b5a_0
b26c75b0a854ea8b_0
b34ad2073c234221_0
b394ffcd8aac3eb5_0
b92288c60239b694_0
b965736d714f355e_0
bb0151f09c552ec7_0
bd45e670ea07df95_0
bdd5d4a0f6c82056_0
c009979a5f8b8e0b_0
c1a25bdb61289c55_0
c235939ff53763fc_0
c2d5f87519bbe3b1_0
c2ee9923f4129e95_0
c5482053ad284987_0
c6cd2492074170d6_0
c92b36158c599b53_0
c9a2119ff852daba_0
cb8caa8ca8f4c44d_0
cc2a0670275d2597_0
cc5bdc5198bc55c5_0
cd7d8f93adcfb6d7_0
cf13a7c27df43339_0
cf6203ee21b9dc07_0
d243ce0413d116df_0
d9af7bbf130f50db_0
daea6dd11ab012c4_0
dc501126542a9fd9_0
dc62763de5cecf4c_0
dd989c09be55f5fd_0
deeec7e01c3f3e57_0
df1b4d3312c7e351_0
e1826cb1f9bc2ea0_0
e24ff761b0146c05_0
e4168bf954dec99e_0
e4c59ea3b9ac9fcc_0
e56c9df39c5a58bb_0
e6f89d57574bd869_0
ee60afd983187c26_0
ef23008ac0f86ada_0
f43a265ff7572568_0
f495f7d3cdcdcadb_0
f7529d86a8084405_0
fc67b2b274b5bafb_0
fca100f02f083a31_0
fe3b6b914082df21_0
index
1af09691-c60b-4255-a957-1ad0f8384158.tmp
temp-index
temp-index
temp-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
3
4
5
6
7
8
9
a
35a5971a-1f18-470b-b8f8-225f9fb092c7.tmp
LOG.old
LOG.old
LOG.old
LOG.old
LOG.old
LOG.old
LOG.old
LOG.old
LOG.old
LOG.old
LOG.old
LOG.old
LOG.old
MANIFEST-000001
79fb132e-0de7-49ec-8a3c-a7c7b6ba7ab0.tmp
544c466f-6b4f-415e-98be-33f488877132.tmp
000016.ldb
000034.ldb
653b488e-214f-45f0-8bec-548dad01dcc3.tmp
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
TransportSecurity
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
Secure Preferences
5a930ec0-ba7c-4eaf-ba7e-ff69dd2b7740.tmp
the-real-index
dcf26a75-9803-4849-961d-4863bfd454e5.tmp
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
default.exc
651970411ad012ac.customDestinations-ms
651970411ad012ac.customDestinations-ms
651970411ad012ac.customDestinations-ms
651970411ad012ac.customDestinations-ms
651970411ad012ac.customDestinations-ms
651970411ad012ac.customDestinations-ms
651970411ad012ac.customDestinations-ms
651970411ad012ac.customDestinations-ms
651970411ad012ac.customDestinations-ms
651970411ad012ac.customDestinations-ms
651970411ad012ac.customDestinations-ms
651970411ad012ac.customDestinations-ms
651970411ad012ac.customDestinations-ms
651970411ad012ac.customDestinations-ms
651970411ad012ac.customDestinations-ms
651970411ad012ac.customDestinations-ms
651970411ad012ac.customDestinations-ms
651970411ad012ac.customDestinations-ms
651970411ad012ac.customDestinations-ms
651970411ad012ac.customDestinations-ms
86WO5ID0A2AI9Z8SZT9P.temp
dism.log
diagerr.xml
diagwrn.xml
setupact.log
setuperr.log
memory/1248-6659-0x000001E1001E0000-0x000001E1002E0000-memory.dmp
memory/1248-8286-0x000001E1566D0000-0x000001E156E6C000-memory.dmp
memory/1248-6705-0x000001E1141E0000-0x000001E114200000-memory.dmp
memory/1248-7947-0x000001E1566D0000-0x000001E156E6C000-memory.dmp
memory/1248-6669-0x000001E102900000-0x000001E102920000-memory.dmp
memory/1248-6670-0x000001E102E20000-0x000001E102F20000-memory.dmp
memory/1248-7950-0x000001E1160C0000-0x000001E1161C0000-memory.dmp
memory/1248-6823-0x000001E1566D0000-0x000001E156E6C000-memory.dmp
memory/1248-7954-0x000001E116640000-0x000001E116740000-memory.dmp
memory/1248-6690-0x000001E102C60000-0x000001E102C80000-memory.dmp
memory/1308-4993-0x000001E5ED810000-0x000001E5ED818000-memory.dmp
memory/1308-5183-0x000001E5F7020000-0x000001E5F703A000-memory.dmp
memory/1308-5197-0x000001E5F3490000-0x000001E5F3498000-memory.dmp
memory/1308-5357-0x000001E5F7070000-0x000001E5F709A000-memory.dmp
memory/1308-5190-0x000001E5F3450000-0x000001E5F345A000-memory.dmp
memory/1308-5198-0x000001E5F3560000-0x000001E5F3566000-memory.dmp
memory/1308-5188-0x000001E5F3430000-0x000001E5F3438000-memory.dmp
memory/1308-5189-0x000001E5F3440000-0x000001E5F3446000-memory.dmp
memory/1308-5191-0x000001E5F3460000-0x000001E5F3468000-memory.dmp
memory/1308-5199-0x000001E5F7010000-0x000001E5F701A000-memory.dmp
memory/1308-5187-0x000001E5F3530000-0x000001E5F355A000-memory.dmp
memory/1308-5186-0x000001E5FA910000-0x000001E5FAB14000-memory.dmp
memory/1308-5192-0x000001E5F34A0000-0x000001E5F34C6000-memory.dmp
memory/1308-5358-0x000001E5F7070000-0x000001E5F7094000-memory.dmp
memory/1308-4985-0x000001E5ECA30000-0x000001E5ECA38000-memory.dmp
memory/1308-5177-0x000001E5F3520000-0x000001E5F3528000-memory.dmp
memory/1308-4962-0x000001E5F3580000-0x000001E5F3708000-memory.dmp
memory/1308-5195-0x000001E5F3480000-0x000001E5F348A000-memory.dmp
memory/1308-4953-0x000001E5ECD40000-0x000001E5ECD4E000-memory.dmp
memory/1308-5181-0x000001E5F7020000-0x000001E5F703E000-memory.dmp
memory/1308-4952-0x000001E5ED6D0000-0x000001E5ED70E000-memory.dmp
memory/1308-4951-0x000001E5ECD30000-0x000001E5ECD38000-memory.dmp
memory/1308-4948-0x000001E5ED870000-0x000001E5EDD98000-memory.dmp
memory/1308-4947-0x000001E5ECBB0000-0x000001E5ECBBA000-memory.dmp
memory/1308-4946-0x000001E5ECBE0000-0x000001E5ECC92000-memory.dmp
memory/1308-4945-0x000001E5ECBC0000-0x000001E5ECBDE000-memory.dmp
memory/1308-4942-0x000001E5ECD70000-0x000001E5ECF32000-memory.dmp
memory/1308-5182-0x000001E5F3570000-0x000001E5F3580000-memory.dmp
memory/1308-5196-0x000001E5F7060000-0x000001E5F707C000-memory.dmp
memory/1308-4939-0x000001E5ECA50000-0x000001E5ECA98000-memory.dmp
memory/1308-4938-0x000001E5EC620000-0x000001E5EC642000-memory.dmp
memory/2112-5169-0x00000184A6AB0000-0x00000184A724C000-memory.dmp
memory/2112-5017-0x00000184801E0000-0x00000184802E0000-memory.dmp
memory/2112-5061-0x0000018494260000-0x0000018494280000-memory.dmp
memory/2112-5047-0x0000018481D40000-0x0000018481D60000-memory.dmp
memory/2112-5016-0x00000184801E0000-0x00000184802E0000-memory.dmp
memory/2112-5015-0x00000184801E0000-0x00000184802E0000-memory.dmp
memory/2112-5028-0x0000018481A00000-0x0000018481A20000-memory.dmp
memory/2112-5030-0x0000018481E40000-0x0000018481F40000-memory.dmp
memory/3020-5214-0x0000024481D40000-0x0000024481E40000-memory.dmp
memory/3020-5376-0x00000244E23E0000-0x00000244E2B7C000-memory.dmp
memory/3020-5248-0x00000244941E0000-0x0000024494200000-memory.dmp
memory/3020-6656-0x00000244E23E0000-0x00000244E2B7C000-memory.dmp
memory/3020-6628-0x00000244E23E0000-0x00000244E2B7C000-memory.dmp
memory/3020-5527-0x0000024496EB0000-0x0000024496FB0000-memory.dmp
memory/3020-5891-0x000002449D510000-0x000002449D610000-memory.dmp
memory/3020-5893-0x000002449D510000-0x000002449D610000-memory.dmp
memory/3020-5203-0x00000244801E0000-0x00000244802E0000-memory.dmp
memory/3020-6489-0x00000244E23E0000-0x00000244E2B7C000-memory.dmp
memory/3020-5234-0x0000024481B60000-0x0000024481B80000-memory.dmp
memory/3020-6187-0x00000244E23E0000-0x00000244E2B7C000-memory.dmp
memory/3020-5976-0x00000244E23E0000-0x00000244E2B7C000-memory.dmp
memory/3020-5213-0x0000024481900000-0x0000024481920000-memory.dmp
memory/3020-5204-0x00000244801E0000-0x00000244802E0000-memory.dmp
memory/4980-6160-0x0000023648640000-0x0000023648641000-memory.dmp
memory/4980-6168-0x0000023648640000-0x0000023648641000-memory.dmp
memory/4980-6164-0x0000023648640000-0x0000023648641000-memory.dmp
memory/4980-6165-0x0000023648640000-0x0000023648641000-memory.dmp
memory/4980-6158-0x0000023648640000-0x0000023648641000-memory.dmp
memory/4980-6167-0x0000023648640000-0x0000023648641000-memory.dmp
memory/4980-6166-0x0000023648640000-0x0000023648641000-memory.dmp
memory/5456-3272-0x0000014921040000-0x00000149217DC000-memory.dmp
memory/5456-4940-0x0000014921040000-0x00000149217DC000-memory.dmp
memory/5456-3053-0x00000149219C0000-0x0000014921AC0000-memory.dmp
memory/5456-3092-0x0000014922CB0000-0x0000014922CD0000-memory.dmp
memory/5456-3106-0x0000015125EA0000-0x0000015125EC0000-memory.dmp
memory/5456-3091-0x0000015125B00000-0x0000015125C00000-memory.dmp
memory/5456-3090-0x0000014923F00000-0x0000014923F20000-memory.dmp
memory/5456-4873-0x0000014921040000-0x00000149217DC000-memory.dmp
memory/5456-3953-0x000001513E190000-0x000001513E290000-memory.dmp
memory/5456-3498-0x0000014921040000-0x00000149217DC000-memory.dmp
memory/5456-4243-0x0000014921040000-0x00000149217DC000-memory.dmp
memory/5456-4454-0x000001513EA20000-0x000001513EB20000-memory.dmp
memory/5456-3755-0x0000015138D00000-0x0000015138E00000-memory.dmp
memory/6156-2962-0x000002334B1C0000-0x000002334B1C1000-memory.dmp
memory/6156-2953-0x000002334B1C0000-0x000002334B1C1000-memory.dmp
memory/6156-2961-0x000002334B1C0000-0x000002334B1C1000-memory.dmp
memory/6156-2959-0x000002334B1C0000-0x000002334B1C1000-memory.dmp
memory/6156-2963-0x000002334B1C0000-0x000002334B1C1000-memory.dmp
memory/6156-2964-0x000002334B1C0000-0x000002334B1C1000-memory.dmp
memory/6156-2955-0x000002334B1C0000-0x000002334B1C1000-memory.dmp
memory/6156-2960-0x000002334B1C0000-0x000002334B1C1000-memory.dmp