Analysis
- geolocation tags
- user interaction
yes - max time kernel
1799s - max time network
1763s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
09/08/2026, 06:37
General
- Target https://helium.computer
- Sample260809-hdw78aar3x
Score
10/10
Malware Config
Signatures
- Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
- Modifies visibility of hidden/system files in Explorer 2 TTPs 1 IoCs
- Badlisted process makes network request 17 IoCs
Network request originating from process or tool commonly abused by malware.
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 5 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Downloads MZ/PE file 1 IoCs
- Drops file in Drivers directory 1 IoCs
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 25 IoCs
- Loads dropped DLL 47 IoCs
- Modifies file permissions 1 TTPs 3 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Drops desktop.ini file(s) 6 IoCs
- Enumerates connected drives 3 TTPs 11 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Network Service Discovery 1 TTPs 1 IoCs
Attempt to gather information on host's network.
- Power Settings 1 TTPs 4 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
- Drops file in System32 directory 11 IoCs
- Drops file in Windows directory 13 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 4 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 7 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 15 IoCs
- Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
- Kills process with taskkill 2 IoCs
- Modifies Internet Explorer settings 1 TTPs 11 IoCs
- Modifies data under HKEY_USERS 64 IoCs
- Modifies registry class 64 IoCs
- Suspicious behavior: AddClipboardFormatListener 3 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 5 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 35 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 64 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://helium.computer1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2c0,0x7fff85f3c188,0x7fff85f3c194,0x7fff85f3c1a02⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1868,i,17579849451705211607,14006310320793408018,524288 --field-trial-handle=2868,i,17819388290333514867,8866846037123156948,262144 --variations-seed-version --mojo-platform-channel-handle=2908 /prefetch:112⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1592,i,8699405821463189588,10080654579962140563,262144 --field-trial-handle=2868,i,17819388290333514867,8866846037123156948,262144 --variations-seed-version --mojo-platform-channel-handle=2860 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2256,i,6869828681230124298,8980069818850246216,524288 --field-trial-handle=2868,i,17819388290333514867,8866846037123156948,262144 --variations-seed-version --mojo-platform-channel-handle=2944 /prefetch:132⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3612,i,16745806370767920099,3541422808620105366,2097152 --field-trial-handle=2868,i,17819388290333514867,8866846037123156948,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3616,i,18179409102885754933,5720295557020795562,2097152 --field-trial-handle=2868,i,17819388290333514867,8866846037123156948,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4268,i,18200543956565028259,5872973406976782775,2097152 --field-trial-handle=2868,i,17819388290333514867,8866846037123156948,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4272,i,6914825244591251310,1296080299887911735,2097152 --field-trial-handle=2868,i,17819388290333514867,8866846037123156948,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:92⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5308,i,15981827497924067821,292892291662648845,524288 --field-trial-handle=2868,i,17819388290333514867,8866846037123156948,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5276,i,7906157436963496054,2439422935787763080,524288 --field-trial-handle=2868,i,17819388290333514867,8866846037123156948,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,16334110432980581034,17680066814478810846,524288 --field-trial-handle=2868,i,17819388290333514867,8866846037123156948,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,16334110432980581034,17680066814478810846,524288 --field-trial-handle=2868,i,17819388290333514867,8866846037123156948,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6536,i,6529305424208840951,15471735859490624192,2097152 --field-trial-handle=2868,i,17819388290333514867,8866846037123156948,262144 --variations-seed-version --mojo-platform-channel-handle=6524 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6856,i,930279576723269461,10073637494477032397,524288 --field-trial-handle=2868,i,17819388290333514867,8866846037123156948,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6276,i,1226115344423764893,11956330152625919922,2097152 --field-trial-handle=2868,i,17819388290333514867,8866846037123156948,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6772,i,5847621888750472753,1748100348994148473,2097152 --field-trial-handle=2868,i,17819388290333514867,8866846037123156948,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5324,i,457129490402469385,17030927842844611333,524288 --field-trial-handle=2868,i,17819388290333514867,8866846037123156948,262144 --variations-seed-version --mojo-platform-channel-handle=7160 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7180,i,8034611280812002143,2862950006528432766,524288 --field-trial-handle=2868,i,17819388290333514867,8866846037123156948,262144 --variations-seed-version --mojo-platform-channel-handle=7224 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7136,i,14184612350417594070,13907885647744282153,524288 --field-trial-handle=2868,i,17819388290333514867,8866846037123156948,262144 --variations-seed-version --mojo-platform-channel-handle=7272 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6380,i,8917595383725606140,9746781863936844939,524288 --field-trial-handle=2868,i,17819388290333514867,8866846037123156948,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7fff8991c728,0x7fff8991c734,0x7fff8991c7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1704,i,11359826499216794526,12322941475129129107,262144 --field-trial-handle=1876,i,10991695541641150401,14629749745026136085,262144 --variations-seed-version --mojo-platform-channel-handle=1872 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1532,i,6488188340961934473,8468842776743946818,524288 --field-trial-handle=1876,i,10991695541641150401,14629749745026136085,262144 --variations-seed-version --mojo-platform-channel-handle=2124 /prefetch:112⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2316,i,5689500624548820521,13025136322097756337,524288 --field-trial-handle=1876,i,10991695541641150401,14629749745026136085,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:132⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3276,i,12732419149956622164,2147968818286140748,2097152 --field-trial-handle=1876,i,10991695541641150401,14629749745026136085,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3352,i,13242225826726044599,15871451656734622071,2097152 --field-trial-handle=1876,i,10991695541641150401,14629749745026136085,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4752,i,10918298943780184701,2128027543248213999,2097152 --field-trial-handle=1876,i,10991695541641150401,14629749745026136085,262144 --variations-seed-version --mojo-platform-channel-handle=4764 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4940,i,7687500304900624821,9890982802870629132,524288 --field-trial-handle=1876,i,10991695541641150401,14629749745026136085,262144 --variations-seed-version --mojo-platform-channel-handle=4928 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5400,i,3711231908077229521,15951756012590974715,524288 --field-trial-handle=1876,i,10991695541641150401,14629749745026136085,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5496,i,13676559666816039259,7512556107501453669,2097152 --field-trial-handle=1876,i,10991695541641150401,14629749745026136085,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5536,i,14166238676731871496,17382898830022454717,2097152 --field-trial-handle=1876,i,10991695541641150401,14629749745026136085,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5484,i,7195102619006722298,6087399026208068493,2097152 --field-trial-handle=1876,i,10991695541641150401,14629749745026136085,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5824,i,13743773037902467168,9909200894898227809,524288 --field-trial-handle=1876,i,10991695541641150401,14629749745026136085,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5560,i,17907486655006574298,5005354153713950175,2097152 --field-trial-handle=1876,i,10991695541641150401,14629749745026136085,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6248,i,5506928177342347113,18300727177931640518,2097152 --field-trial-handle=1876,i,10991695541641150401,14629749745026136085,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5836,i,11200458647621757044,8867377288102462405,524288 --field-trial-handle=1876,i,10991695541641150401,14629749745026136085,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5672,i,16403510022543118138,8580712347075432639,2097152 --field-trial-handle=1876,i,10991695541641150401,14629749745026136085,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6372,i,8289508808475659316,15999928275987209852,2097152 --field-trial-handle=1876,i,10991695541641150401,14629749745026136085,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6164,i,6470263177168024267,1012617961931196101,524288 --field-trial-handle=1876,i,10991695541641150401,14629749745026136085,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=5632,i,3150079189010629516,11403573119833413769,2097152 --field-trial-handle=1876,i,10991695541641150401,14629749745026136085,262144 --variations-seed-version --mojo-platform-channel-handle=5672 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6372,i,12130389222090589375,13257830607521109927,2097152 --field-trial-handle=1876,i,10991695541641150401,14629749745026136085,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:92⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=4740,i,14257413439713348103,14197206128702422419,2097152 --field-trial-handle=1876,i,10991695541641150401,14629749745026136085,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=5496,i,4277918980535618744,3708572434346952138,2097152 --field-trial-handle=1876,i,10991695541641150401,14629749745026136085,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6024,i,10450292710249005996,12882998504629790590,524288 --field-trial-handle=1876,i,10991695541641150401,14629749745026136085,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6288,i,3237667274574084597,1565360205703734105,524288 --field-trial-handle=1876,i,10991695541641150401,14629749745026136085,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6276,i,9505117433158117833,13491380214363282489,524288 --field-trial-handle=1876,i,10991695541641150401,14629749745026136085,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --restart2⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7fff8991c728,0x7fff8991c734,0x7fff8991c7403⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1812,i,14955942971128604268,6946930584487608382,524288 --field-trial-handle=1996,i,13639330126530069352,7052255083443963982,262144 --variations-seed-version=20260808-030039.458000-production --mojo-platform-channel-handle=2168 /prefetch:113⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1592,i,1278532846558084816,7076873808634654569,262144 --field-trial-handle=1996,i,13639330126530069352,7052255083443963982,262144 --variations-seed-version=20260808-030039.458000-production --mojo-platform-channel-handle=1992 /prefetch:23⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2328,i,5854244179872330086,9820829799892893562,524288 --field-trial-handle=1996,i,13639330126530069352,7052255083443963982,262144 --variations-seed-version=20260808-030039.458000-production --mojo-platform-channel-handle=1732 /prefetch:133⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3700,i,17359408995601487382,13785083687946502120,2097152 --field-trial-handle=1996,i,13639330126530069352,7052255083443963982,262144 --variations-seed-version=20260808-030039.458000-production --mojo-platform-channel-handle=3824 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3964,i,10433241671157146565,4078857406385926898,2097152 --field-trial-handle=1996,i,13639330126530069352,7052255083443963982,262144 --variations-seed-version=20260808-030039.458000-production --mojo-platform-channel-handle=3984 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5368,i,14333529329308667212,16422574009909530576,524288 --field-trial-handle=1996,i,13639330126530069352,7052255083443963982,262144 --variations-seed-version=20260808-030039.458000-production --mojo-platform-channel-handle=5364 /prefetch:143⤵
-
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵
- Modifies data under HKEY_USERS
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\SystemPropertiesPerformance.exe"C:\Windows\system32\SystemPropertiesPerformance.exe"1⤵
- Modifies visibility of file extensions in Explorer
- Modifies visibility of hidden/system files in Explorer
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"1⤵
- Badlisted process makes network request
- Drops file in Drivers directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\i4u0qsun\i4u0qsun.cmdline"2⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2504.tmp" "c:\Users\Admin\AppData\Local\Temp\i4u0qsun\CSCB784CDA1EDB04F1897BC7EE1177069.TMP"3⤵
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\0t401e1m\0t401e1m.cmdline"2⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES264C.tmp" "c:\Users\Admin\AppData\Local\Temp\0t401e1m\CSCD1DD46138EC4675B4AC3952AB36AA57.TMP"3⤵
-
-
-
C:\Windows\system32\taskkill.exe"C:\Windows\system32\taskkill.exe" /F /IM explorer.exe2⤵
- Kills process with taskkill
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\icacls.exe"C:\Windows\system32\icacls.exe" C:\Users\Admin\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\LocalState\store.db /deny Everyone:F2⤵
- Modifies file permissions
-
-
C:\Windows\system32\taskkill.exe"C:\Windows\system32\taskkill.exe" /F /IM explorer.exe2⤵
- Kills process with taskkill
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\icacls.exe"C:\Windows\system32\icacls.exe" C:\Users\Admin\OneDrive /deny Administrators:(D,DC)2⤵
- Modifies file permissions
-
-
C:\Windows\system32\cleanmgr.exe"C:\Windows\system32\cleanmgr.exe" /d C: /VERYLOWDISK2⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
-
C:\Windows\System32\Dism\dismhost.exeC:\Windows\System32\Dism\dismhost.exe {2234C661-6DB9-4127-9437-E45D53FB3090}3⤵
- Drops file in Windows directory
-
-
-
C:\Windows\system32\Dism.exe"C:\Windows\system32\Dism.exe" /online /Cleanup-Image /StartComponentCleanup /ResetBase2⤵
- Drops file in Windows directory
-
C:\Windows\System32\Dism\dismhost.exeC:\Windows\System32\Dism\dismhost.exe {8303C5B4-E0E3-47A8-A96C-4302163470EA}3⤵
- Drops file in Windows directory
-
-
-
C:\Windows\system32\powercfg.exe"C:\Windows\system32\powercfg.exe" /hibernate off2⤵
- Power Settings
-
-
C:\Windows\system32\ipconfig.exe"C:\Windows\system32\ipconfig.exe" /flushdns2⤵
- Gathers network information
-
-
C:\Windows\system32\icacls.exe"C:\Windows\system32\icacls.exe" C:\Windows\Installer\Razer /deny Everyone:(W)2⤵
- Modifies file permissions
-
-
C:\Windows\system32\powercfg.exe"C:\Windows\system32\powercfg.exe" /duplicatescheme e9a42b02-d5df-448d-aa00-03f14749eb612⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exe"C:\Windows\system32\powercfg.exe" /setactive 36eb29e6-4cf8-4ce8-b8eb-fe053add425d2⤵
- Power Settings
-
-
C:\Windows\system32\Dism.exe"C:\Windows\system32\Dism.exe" /Online /Set-ReservedStorageState /State:Disabled2⤵
- Drops file in Windows directory
-
C:\Windows\System32\Dism\dismhost.exeC:\Windows\System32\Dism\dismhost.exe {C305A149-8860-490F-9E5B-DABFC38C602C}3⤵
- Drops file in Windows directory
-
-
-
C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\SecHealthUI.exe"C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\SecHealthUI.exe" -ServerName:SecHealthUI.AppX8tam42xc7v2czs3s1nt0nkxvfjtepzp9.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {E041C90B-68BA-42C9-991E-477B73A75C90} -Embedding1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k WbioSvcGroup -s WbioSrvc1⤵
- Drops file in System32 directory
- Checks processor information in registry
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {8E67B5C5-BAD3-4263-9F80-F769D50884F7} -Embedding1⤵
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {88866959-07B0-4ED8-8EF5-54BC7443D28C} -Embedding1⤵
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\userinit.exeC:\Windows\system32\userinit.exe1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /73⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}1⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" shell32.dll,Control_RunDLL PowerCfg.cpl @0,/editplan:36eb29e6-4cf8-4ce8-b8eb-fe053add425d2⤵
- Power Settings
- Suspicious behavior: GetForegroundWindowSpam
-
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops desktop.ini file(s)
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\userinit.exeC:\Windows\system32\userinit.exe1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE2⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops desktop.ini file(s)
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Users\Admin\Downloads\helium_0.15.3.1_x64-installer.exe"C:\Users\Admin\Downloads\helium_0.15.3.1_x64-installer.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\helium_install\setup.exe"C:\Users\Admin\AppData\Local\Temp\helium_install\setup.exe" --install-archive="C:\Users\Admin\AppData\Local\Temp\helium_install\helium.7z" --do-not-launch-chrome4⤵
- Executes dropped EXE
- Drops file in Windows directory
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\helium_install\setup.exeC:\Users\Admin\AppData\Local\Temp\helium_install\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\imput\Helium\User Data\Crashpad" --url=https://crash.helium.computer/crash --annotation=plat=Win64 --annotation=prod=Helium --annotation=ver=0.15.3.1 --attachment=C:\Windows\SystemTemp\helium_installer.log --attachment=C:\Users\Admin\AppData\Local\Chromium\ChromiumUpdater\updater.log --attachment=C:\Users\Admin\AppData\Local\Chromium\ChromiumUpdater\updater_history.jsonl --initial-client-data=0x284,0x288,0x28c,0x260,0x290,0x7ff78b26bf08,0x7ff78b26bf18,0x7ff78b26bf285⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\helium_install\setup.exe"C:\Users\Admin\AppData\Local\Temp\helium_install\setup.exe" --verbose-logging --create-shortcuts=0 --install-level=05⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\helium_install\setup.exeC:\Users\Admin\AppData\Local\Temp\helium_install\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\imput\Helium\User Data\Crashpad" --url=https://crash.helium.computer/crash --annotation=plat=Win64 --annotation=prod=Helium --annotation=ver=0.15.3.1 --attachment=C:\Windows\SystemTemp\helium_installer.log --attachment=C:\Users\Admin\AppData\Local\Chromium\ChromiumUpdater\updater.log --attachment=C:\Users\Admin\AppData\Local\Chromium\ChromiumUpdater\updater_history.jsonl --initial-client-data=0x280,0x284,0x288,0x25c,0x28c,0x7ff78b26bf08,0x7ff78b26bf18,0x7ff78b26bf286⤵
- Executes dropped EXE
-
-
-
-
C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe"C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exeC:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\imput\Helium\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\imput\Helium\User Data\Crashpad" --url=https://crash.helium.computer/crash --annotation=plat=Win64 --annotation=prod=Helium --annotation=ver=0.15.3.1 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7fff7fc423e0,0x7fff7fc423f0,0x7fff7fc424005⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe"C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --gpu-preferences=WAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAQAAAAAAAAAADAAAAAAAAADgAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAKAAAAAAAAAAoAAAAAAAAAAgAAAAAAAAAEAAAAAIAAAABAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --metrics-shmem-handle=1644,i,15719630909973807752,10856512430773007984,262144 --field-trial-handle=2260,i,18163654347263187605,15125381408431300872,262144 --variations-seed-version --pseudonymization-salt-handle=2264,i,18040893958881786089,8729163205411889530,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2256 /prefetch:25⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe"C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --metrics-shmem-handle=1860,i,8239397004475464930,2912255865183035945,524288 --field-trial-handle=2260,i,18163654347263187605,15125381408431300872,262144 --variations-seed-version --pseudonymization-salt-handle=2264,i,18040893958881786089,8729163205411889530,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2292 /prefetch:115⤵
- Executes dropped EXE
- Loads dropped DLL
- System Time Discovery
-
-
C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe"C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2392,i,16360555824674112815,9418968861105710637,524288 --field-trial-handle=2260,i,18163654347263187605,15125381408431300872,262144 --variations-seed-version --pseudonymization-salt-handle=2264,i,18040893958881786089,8729163205411889530,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2868 /prefetch:135⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe"C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3284,i,616809446439875823,16800636533653907119,2097152 --field-trial-handle=2260,i,18163654347263187605,15125381408431300872,262144 --variations-seed-version --pseudonymization-salt-handle=2264,i,18040893958881786089,8729163205411889530,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=3308 /prefetch:15⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe"C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --start-stack-profiler --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3336,i,13173255460455056473,6630044768721827082,2097152 --field-trial-handle=2260,i,18163654347263187605,15125381408431300872,262144 --variations-seed-version --pseudonymization-salt-handle=2264,i,18040893958881786089,8729163205411889530,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3380 /prefetch:15⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe"C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3732,i,18049185355922608751,2949928472919328861,2097152 --field-trial-handle=2260,i,18163654347263187605,15125381408431300872,262144 --variations-seed-version --pseudonymization-salt-handle=2264,i,18040893958881786089,8729163205411889530,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=3752 /prefetch:95⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe"C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5516,i,13435732330661196222,4766731337842868769,524288 --field-trial-handle=2260,i,18163654347263187605,15125381408431300872,262144 --variations-seed-version --pseudonymization-salt-handle=2264,i,18040893958881786089,8729163205411889530,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=5520 /prefetch:145⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe"C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4276,i,1341090084524118960,2947739560946660962,2097152 --field-trial-handle=2260,i,18163654347263187605,15125381408431300872,262144 --variations-seed-version --pseudonymization-salt-handle=2264,i,18040893958881786089,8729163205411889530,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=5684 /prefetch:15⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe"C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3268,i,1495128311997528276,11363450564639072345,2097152 --field-trial-handle=2260,i,18163654347263187605,15125381408431300872,262144 --variations-seed-version --pseudonymization-salt-handle=2264,i,18040893958881786089,8729163205411889530,4 --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=5708 /prefetch:95⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe"C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=3856,i,10272469927915531291,12459738839203851760,2097152 --field-trial-handle=2260,i,18163654347263187605,15125381408431300872,262144 --variations-seed-version --pseudonymization-salt-handle=2264,i,18040893958881786089,8729163205411889530,4 --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=3756 /prefetch:15⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe"C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=3900,i,13133308137495160361,5502270832784465118,2097152 --field-trial-handle=2260,i,18163654347263187605,15125381408431300872,262144 --variations-seed-version --pseudonymization-salt-handle=2264,i,18040893958881786089,8729163205411889530,4 --trace-process-track-uuid=3190708999430457380 --mojo-platform-channel-handle=3304 /prefetch:95⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe"C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5928,i,9611182824493454770,6852425361875328412,2097152 --field-trial-handle=2260,i,18163654347263187605,15125381408431300872,262144 --variations-seed-version --pseudonymization-salt-handle=2264,i,18040893958881786089,8729163205411889530,4 --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=3848 /prefetch:15⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe"C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=3800,i,4733924464533325543,247107494554103913,2097152 --field-trial-handle=2260,i,18163654347263187605,15125381408431300872,262144 --variations-seed-version --pseudonymization-salt-handle=2264,i,18040893958881786089,8729163205411889530,4 --trace-process-track-uuid=3190709000367499229 --mojo-platform-channel-handle=6212 /prefetch:15⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe"C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5844,i,8748287558176189339,8088960649039712789,2097152 --field-trial-handle=2260,i,18163654347263187605,15125381408431300872,262144 --variations-seed-version --pseudonymization-salt-handle=2264,i,18040893958881786089,8729163205411889530,4 --trace-process-track-uuid=3190709001304541078 --mojo-platform-channel-handle=6840 /prefetch:15⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe"C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5496,i,18247779598948935322,269151478654781696,2097152 --field-trial-handle=2260,i,18163654347263187605,15125381408431300872,262144 --variations-seed-version --pseudonymization-salt-handle=2264,i,18040893958881786089,8729163205411889530,4 --trace-process-track-uuid=3190709002241582927 --mojo-platform-channel-handle=3472 /prefetch:95⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe"C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6024,i,7436561510367930450,14947338448555643146,2097152 --field-trial-handle=2260,i,18163654347263187605,15125381408431300872,262144 --variations-seed-version --pseudonymization-salt-handle=2264,i,18040893958881786089,8729163205411889530,4 --trace-process-track-uuid=3190709003178624776 --mojo-platform-channel-handle=5848 /prefetch:15⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe"C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=852,i,4431595854209269493,12209974928036712463,524288 --field-trial-handle=2260,i,18163654347263187605,15125381408431300872,262144 --variations-seed-version --pseudonymization-salt-handle=2264,i,18040893958881786089,8729163205411889530,4 --trace-process-track-uuid=3190709004115666625 --mojo-platform-channel-handle=3880 /prefetch:145⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe"C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --start-stack-profiler --gpu-preferences=WAAAAAAAAADoAAAEAAAAAAAAAAAAAGAAQAAAAAAAAAAAAAAAAAAAADgAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAKAAAAAAAAAAoAAAAAAAAAAgAAAAAAAAADAAAAAEAAAAAAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=d3d11-warp-webgl --metrics-shmem-handle=6540,i,7998708936199019920,7775575629655006049,262144 --field-trial-handle=2260,i,18163654347263187605,15125381408431300872,262144 --variations-seed-version --pseudonymization-salt-handle=2264,i,18040893958881786089,8729163205411889530,4 --trace-process-track-uuid=3190709005052708474 --mojo-platform-channel-handle=6756 /prefetch:105⤵
- Executes dropped EXE
- Loads dropped DLL
- Network Service Discovery
-
-
-
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
1Component Object Model Hijacking
1Power Settings
1Privilege Escalation
Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
1Component Object Model Hijacking
1Defense Evasion
File and Directory Permissions Modification
1Hide Artifacts
2Hidden Files and Directories
2Modify Registry
4Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
534bdc0f-097a-46a3-a3e7-88976b082cb6.tmp
CrashpadMetrics-active.pma
settings.dat
0423f774-bcc6-46d8-80d8-c0c58e07dc81.tmp
messages.json
computed_hashes.json
verified_contents.json
craw_background.js
Network Persistent State
Network Persistent State
TransportSecurity
TransportSecurity
Preferences
Preferences
Preferences
Secure Preferences
Secure Preferences
LOG
Session_13430731163786721
Tabs_13430731191755721
LOG
the-real-index
the-real-index~RFe5ae262.TMP
data_0
data_2
data_3
Network Persistent State
Network Persistent State~RFe5aecc3.TMP
000003.log
LOG
bb8c24cc-8425-4633-98a8-272e2b9a1330.tmp
Last Version
Local State
Local State
Local State
Local State
Local State
data_1
Variations
ukm_db
settings.dat
settings.dat
settings.dat
the-real-index
the-real-index~RFe5a42b7.TMP
SiteList-Enterprise.json
Edge Profile.ico
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
CURRENT
MANIFEST-000001
data_1
Local State
Local State
Local State
Local State
Local State
Local State
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter~RFe5a322d.TMP
metadata.json
microsoftwindows.client[1].xml
__PSScriptPolicyTest_znmvtul5.tsj.ps1
modern-wizard.bmp
messages.json
am_MASCULINE.pak
settings.dat
263b243d-6873-46f5-bf70-eaf19c754a4b.tmp
02eb51d021ce6090_0
0487ccfb65a21d8d_0
0dc99e8f51b92ec4_0
65ff149b609efcc8_0
a7e9dc082429aaef_0
bb0151f09c552ec7_0
ddfaa83ccf6be6c0_0
index
5a6bcb50-d16c-4e65-94a9-21b0e634068b.tmp
temp-index
14
16
17
18
19
1a
1b
1c
MANIFEST-000001
000016.ldb
000034.ldb
Network Persistent State
Network Persistent State
Preferences
Preferences
Preferences
Secure Preferences
af7352ba-3865-4334-a226-f602f63f3efa.tmp
b148b823-7dcd-4bd2-8d7f-dbd9320523ea.tmp
Local State
Local State
Local State
Local State
Local State
aa64ec3944dd7c20850b2faf3188b6c6d81b2fcc21b5491caa746201fddddb16
metadata.json
fa5929e7-f782-4591-8eed-443de6ced0d7.tmp
default.exc
dism.log
diagerr.xml
diagwrn.xml
setupact.log
setuperr.log
memory/712-4011-0x0000019094230000-0x0000019094250000-memory.dmp
memory/712-3997-0x0000019083D10000-0x0000019083D30000-memory.dmp
memory/712-3965-0x00000190801E0000-0x00000190802E0000-memory.dmp
memory/712-3974-0x00000190839D0000-0x00000190839F0000-memory.dmp
memory/712-3976-0x0000019083DF0000-0x0000019083EF0000-memory.dmp
memory/1656-4150-0x000000000E730000-0x000000000E7C9000-memory.dmp
memory/1752-1452-0x000001F235CA0000-0x000001F235CA8000-memory.dmp
memory/1752-1447-0x000001F23A460000-0x000001F23A664000-memory.dmp
memory/1752-1435-0x000001F230E20000-0x000001F230E28000-memory.dmp
memory/1752-1439-0x000001F235F00000-0x000001F235F1E000-memory.dmp
memory/1752-1232-0x000001F22FC20000-0x000001F22FC42000-memory.dmp
memory/1752-1235-0x000001F230070000-0x000001F2300B8000-memory.dmp
memory/1752-1238-0x000001F230390000-0x000001F230552000-memory.dmp
memory/1752-1242-0x000001F230200000-0x000001F2302B2000-memory.dmp
memory/1752-1241-0x000001F2301E0000-0x000001F2301FE000-memory.dmp
memory/1752-1243-0x000001F2301D0000-0x000001F2301DA000-memory.dmp
memory/1752-1244-0x000001F230E90000-0x000001F2313B8000-memory.dmp
memory/1752-1440-0x000001F235C80000-0x000001F235C90000-memory.dmp
memory/1752-1441-0x000001F235CB0000-0x000001F235CCA000-memory.dmp
memory/1752-1444-0x000001F235CD0000-0x000001F235CFA000-memory.dmp
memory/1752-1445-0x000001F235CD0000-0x000001F235CF4000-memory.dmp
memory/1752-1619-0x000001F235EF0000-0x000001F235EFA000-memory.dmp
memory/1752-1448-0x000001F235D50000-0x000001F235D7A000-memory.dmp
memory/1752-1449-0x000001F2353E0000-0x000001F2353E8000-memory.dmp
memory/1752-1450-0x000001F2353F0000-0x000001F2353F6000-memory.dmp
memory/1752-1451-0x000001F235400000-0x000001F23540A000-memory.dmp
memory/1752-1453-0x000001F235D00000-0x000001F235D26000-memory.dmp
memory/1752-1269-0x000001F230DD0000-0x000001F230DD8000-memory.dmp
memory/1752-1261-0x000001F230D70000-0x000001F230D78000-memory.dmp
memory/1752-1250-0x000001F235420000-0x000001F2355A8000-memory.dmp
memory/1752-1249-0x000001F230360000-0x000001F23036E000-memory.dmp
memory/1752-1248-0x000001F230CF0000-0x000001F230D2E000-memory.dmp
memory/1752-1247-0x000001F230350000-0x000001F230358000-memory.dmp
memory/1752-1615-0x000001F235CF0000-0x000001F235CFA000-memory.dmp
memory/1752-1616-0x000001F235F00000-0x000001F235F1C000-memory.dmp
memory/1752-1617-0x000001F235D80000-0x000001F235D88000-memory.dmp
memory/1752-1618-0x000001F235EE0000-0x000001F235EE6000-memory.dmp
memory/2256-1647-0x000001EF01D60000-0x000001EF01E60000-memory.dmp
memory/2256-2099-0x000001EF1DB60000-0x000001EF1DC60000-memory.dmp
memory/2256-1901-0x000001EF19930000-0x000001EF19A30000-memory.dmp
memory/2256-1627-0x000001EF001E0000-0x000001EF002E0000-memory.dmp
memory/2256-1629-0x000001EF001E0000-0x000001EF002E0000-memory.dmp
memory/2256-1628-0x000001EF001E0000-0x000001EF002E0000-memory.dmp
memory/2256-1661-0x000001EF01C40000-0x000001EF01C60000-memory.dmp
memory/2256-1675-0x000001EF140E0000-0x000001EF14100000-memory.dmp
memory/2256-1645-0x000001EF01900000-0x000001EF01920000-memory.dmp
memory/2532-888-0x0000020330A20000-0x0000020330AB2000-memory.dmp
memory/3472-4185-0x0000029402C70000-0x0000029402C90000-memory.dmp
memory/3472-5641-0x000002941DF50000-0x000002941E050000-memory.dmp
memory/3472-4153-0x00000294001E0000-0x00000294002E0000-memory.dmp
memory/3472-4629-0x000002941D2F0000-0x000002941D3F0000-memory.dmp
memory/3472-4168-0x0000029402EE0000-0x0000029402FE0000-memory.dmp
memory/3472-4199-0x00000294142F0000-0x0000029414310000-memory.dmp
memory/3472-4154-0x00000294001E0000-0x00000294002E0000-memory.dmp
memory/3472-4167-0x0000029402A30000-0x0000029402A50000-memory.dmp
memory/3472-4660-0x000002941DB30000-0x000002941DC30000-memory.dmp
memory/3472-4358-0x0000029415C70000-0x0000029415D70000-memory.dmp
memory/3472-4801-0x000002941DB30000-0x000002941DC30000-memory.dmp
memory/3472-4945-0x00000294151D0000-0x00000294152D0000-memory.dmp
memory/3472-5168-0x000002941DC70000-0x000002941DD70000-memory.dmp
memory/3472-5450-0x000002941DF50000-0x000002941E050000-memory.dmp
memory/3472-4155-0x00000294001E0000-0x00000294002E0000-memory.dmp
memory/3472-5743-0x000002941E050000-0x000002941E150000-memory.dmp
memory/4376-1272-0x0000029B801E0000-0x0000029B802E0000-memory.dmp
memory/4376-1318-0x0000029B841E0000-0x0000029B84200000-memory.dmp
memory/4376-1303-0x0000029B82E20000-0x0000029B82F20000-memory.dmp
memory/4376-1302-0x0000029B82900000-0x0000029B82920000-memory.dmp
memory/4376-1304-0x0000029B82DE0000-0x0000029B82E00000-memory.dmp
memory/4892-3936-0x000002227D650000-0x000002227D651000-memory.dmp
memory/4892-3932-0x000002227D650000-0x000002227D651000-memory.dmp
memory/4892-3930-0x000002227D650000-0x000002227D651000-memory.dmp
memory/4892-3938-0x000002227D650000-0x000002227D651000-memory.dmp
memory/4892-3941-0x000002227D650000-0x000002227D651000-memory.dmp
memory/4892-3937-0x000002227D650000-0x000002227D651000-memory.dmp
memory/4892-3939-0x000002227D650000-0x000002227D651000-memory.dmp
memory/4892-3940-0x000002227D650000-0x000002227D651000-memory.dmp
memory/5504-7554-0x00000200823E0000-0x00000200823E1000-memory.dmp
memory/5504-7552-0x00000200823E0000-0x00000200823E1000-memory.dmp
memory/5504-7558-0x00000200823E0000-0x00000200823E1000-memory.dmp
memory/5504-7562-0x00000200823E0000-0x00000200823E1000-memory.dmp
memory/5504-7561-0x00000200823E0000-0x00000200823E1000-memory.dmp
memory/5504-7560-0x00000200823E0000-0x00000200823E1000-memory.dmp
memory/5504-7559-0x00000200823E0000-0x00000200823E1000-memory.dmp
memory/6008-1456-0x0000026600170000-0x0000026600270000-memory.dmp
memory/6008-1457-0x0000026600170000-0x0000026600270000-memory.dmp
memory/6008-1486-0x0000026602AF0000-0x0000026602B10000-memory.dmp
memory/6008-1469-0x0000026602CD0000-0x0000026602DD0000-memory.dmp
memory/6008-1500-0x0000026614080000-0x00000266140A0000-memory.dmp
memory/6008-1467-0x0000026602890000-0x00000266028B0000-memory.dmp