Analysis
- user interaction
yes - max time kernel
533s - max time network
541s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
18/08/2026, 16:57
General
- Target https://github.com/Darkvinx88/TvLauncher/releases/download/1.3.1/TVLauncher_Windows_v1.3.1.zip
- Sample260818-vgnfpsek4w
Score
8/10
Malware Config
Signatures
- Downloads MZ/PE file 1 IoCs
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 20 IoCs
- Loads dropped DLL 64 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops desktop.ini file(s) 1 IoCs
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 8 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 4 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 25 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 11 IoCs
- Modifies data under HKEY_USERS 4 IoCs
- Modifies registry class 64 IoCs
- Modifies system certificate store 2 TTPs 5 IoCs
- NTFS ADS 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 26 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 44 IoCs
- Suspicious use of SetWindowsHookEx 11 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://github.com/Darkvinx88/TvLauncher/releases/download/1.3.1/TVLauncher_Windows_v1.3.1.zip"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://github.com/Darkvinx88/TvLauncher/releases/download/1.3.1/TVLauncher_Windows_v1.3.1.zip2⤵
- Checks processor information in registry
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1976 -prefsLen 27097 -prefMapHandle 1980 -prefMapSize 270279 -ipcHandle 2036 -initialChannelId {d54d736a-ce07-4b27-b5f3-ffd89e9e55ab} -parentPid 2064 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2064" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2412 -prefsLen 27133 -prefMapHandle 2416 -prefMapSize 270279 -ipcHandle 2432 -initialChannelId {0a690767-9806-44a3-bddd-ed8408218e44} -parentPid 2064 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2064" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3868 -prefsLen 25164 -prefMapHandle 3872 -prefMapSize 270279 -jsInitHandle 3876 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3884 -initialChannelId {2f2874e5-e556-4ca7-bd11-548939784b82} -parentPid 2064 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2064" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4032 -prefsLen 27274 -prefMapHandle 4036 -prefMapSize 270279 -ipcHandle 4108 -initialChannelId {5df04844-70bb-4629-a83d-9cdecc790345} -parentPid 2064 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2064" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2952 -prefsLen 34773 -prefMapHandle 2680 -prefMapSize 270279 -jsInitHandle 2852 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4424 -initialChannelId {f82124f0-3cfd-4273-ae45-4b6dd0a20416} -parentPid 2064 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2064" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5060 -prefsLen 35010 -prefMapHandle 5064 -prefMapSize 270279 -ipcHandle 5016 -initialChannelId {125e095a-279c-4191-93d9-d52d82b8a0dc} -parentPid 2064 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2064" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5848 -prefsLen 32992 -prefMapHandle 1576 -prefMapSize 270279 -jsInitHandle 5856 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5860 -initialChannelId {1202821f-5479-40b0-b2da-1302a5296f78} -parentPid 2064 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2064" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6044 -prefsLen 32992 -prefMapHandle 6048 -prefMapSize 270279 -jsInitHandle 6052 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5884 -initialChannelId {30669583-efbd-405d-ab6e-92bc43ddb29d} -parentPid 2064 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2064" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6228 -prefsLen 32992 -prefMapHandle 6232 -prefMapSize 270279 -jsInitHandle 6236 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6244 -initialChannelId {65b055d5-9306-4402-97bc-f32d91f05c60} -parentPid 2064 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2064" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab3⤵
- Checks processor information in registry
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\TVLauncher_Windows_v1.3.1\TVLauncher_Windows_v1.3.1\TVLauncher.bat" "1⤵
- Executes a command shell one-liner
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\TVLauncher_Windows_v1.3.1\TVLauncher_Windows_v1.3.1\installer.bat" "1⤵
- Executes a command shell one-liner
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ffcdee1c188,0x7ffcdee1c194,0x7ffcdee1c1a02⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2148,i,1305788846966320354,312012743715058169,524288 --field-trial-handle=2568,i,17329695784365475891,4176516924542188715,262144 --variations-seed-version --mojo-platform-channel-handle=3016 /prefetch:112⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1984,i,10309486038424556591,17192409437080809518,262144 --field-trial-handle=2568,i,17329695784365475891,4176516924542188715,262144 --variations-seed-version --mojo-platform-channel-handle=2564 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,4430196490614022659,17070737686782888304,2097152 --field-trial-handle=2568,i,17329695784365475891,4176516924542188715,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2608,i,16467342640161675617,2127132302052635913,524288 --field-trial-handle=2568,i,17329695784365475891,4176516924542188715,262144 --variations-seed-version --mojo-platform-channel-handle=3280 /prefetch:132⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,2815582720766541416,5420785712540643930,2097152 --field-trial-handle=2568,i,17329695784365475891,4176516924542188715,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4252,i,9355528057803401307,13526507771372132544,2097152 --field-trial-handle=2568,i,17329695784365475891,4176516924542188715,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4288,i,16840624459991836653,17956503242825357005,2097152 --field-trial-handle=2568,i,17329695784365475891,4176516924542188715,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:92⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5232,i,6807335690859519373,5343446046045384930,524288 --field-trial-handle=2568,i,17329695784365475891,4176516924542188715,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5468,i,4307141597869941690,11082958975928630880,524288 --field-trial-handle=2568,i,17329695784365475891,4176516924542188715,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=4872,i,14823683228848820804,10692467804305768110,2097152 --field-trial-handle=2568,i,17329695784365475891,4176516924542188715,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3444,i,3950061939924789976,4594344417984504954,524288 --field-trial-handle=2568,i,17329695784365475891,4176516924542188715,262144 --variations-seed-version --mojo-platform-channel-handle=5660 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3404,i,970157557127896482,10934557917894721385,524288 --field-trial-handle=2568,i,17329695784365475891,4176516924542188715,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5656,i,15554188665343870722,6245113553510727298,2097152 --field-trial-handle=2568,i,17329695784365475891,4176516924542188715,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6292,i,2155033987077597410,3245793086682434905,2097152 --field-trial-handle=2568,i,17329695784365475891,4176516924542188715,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6888,i,14198475871454970727,575435890648564460,524288 --field-trial-handle=2568,i,17329695784365475891,4176516924542188715,262144 --variations-seed-version --mojo-platform-channel-handle=6904 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6888,i,14198475871454970727,575435890648564460,524288 --field-trial-handle=2568,i,17329695784365475891,4176516924542188715,262144 --variations-seed-version --mojo-platform-channel-handle=6904 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4840,i,1493038883895116480,8956149806254500098,524288 --field-trial-handle=2568,i,17329695784365475891,4176516924542188715,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7128,i,8076192029572556056,5539771623549027132,524288 --field-trial-handle=2568,i,17329695784365475891,4176516924542188715,262144 --variations-seed-version --mojo-platform-channel-handle=7240 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4520,i,17805457712591331884,2047964975511405297,524288 --field-trial-handle=2568,i,17329695784365475891,4176516924542188715,262144 --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4536,i,14310152149445336723,15005024582761452178,524288 --field-trial-handle=2568,i,17329695784365475891,4176516924542188715,262144 --variations-seed-version --mojo-platform-channel-handle=4564 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5000,i,10987679993611626740,1915269072480834393,524288 --field-trial-handle=2568,i,17329695784365475891,4176516924542188715,262144 --variations-seed-version --mojo-platform-channel-handle=1276 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5628,i,7030459963012098294,5218538740376878467,524288 --field-trial-handle=2568,i,17329695784365475891,4176516924542188715,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=5560,i,11415033602442651570,9255171219166595809,2097152 --field-trial-handle=2568,i,17329695784365475891,4176516924542188715,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2964,i,1728612919579711663,4715774466307048216,524288 --field-trial-handle=2568,i,17329695784365475891,4176516924542188715,262144 --variations-seed-version --mojo-platform-channel-handle=4856 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window2⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x328,0x7ffcdee1c188,0x7ffcdee1c194,0x7ffcdee1c1a03⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1672,i,7436826036913205659,5573783016166343124,262144 --field-trial-handle=3320,i,3990286839438039035,1372042495267691102,262144 --variations-seed-version --mojo-platform-channel-handle=3316 /prefetch:23⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1880,i,6690894018719782458,3814792283235078754,524288 --field-trial-handle=3320,i,3990286839438039035,1372042495267691102,262144 --variations-seed-version --mojo-platform-channel-handle=3332 /prefetch:113⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2336,i,11748100918623590634,13820628084465939202,524288 --field-trial-handle=3320,i,3990286839438039035,1372042495267691102,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:133⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4432,i,15286334436331779576,3716541385189193522,524288 --field-trial-handle=3320,i,3990286839438039035,1372042495267691102,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4432,i,15286334436331779576,3716541385189193522,524288 --field-trial-handle=3320,i,3990286839438039035,1372042495267691102,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4904,i,18223674862977292042,14726261015793399639,2097152 --field-trial-handle=3320,i,3990286839438039035,1372042495267691102,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5172,i,17004807767143625592,9192147511280427506,524288 --field-trial-handle=3320,i,3990286839438039035,1372042495267691102,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5188,i,7444897060508052441,488734659821419019,524288 --field-trial-handle=3320,i,3990286839438039035,1372042495267691102,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5676,i,1901966012222583754,1276287195429541855,2097152 --field-trial-handle=3320,i,3990286839438039035,1372042495267691102,262144 --variations-seed-version --mojo-platform-channel-handle=5672 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6092,i,2992914878421726921,5521481033374957769,524288 --field-trial-handle=3320,i,3990286839438039035,1372042495267691102,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,4648350986845997370,4695486771570885874,524288 --field-trial-handle=3320,i,3990286839438039035,1372042495267691102,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6100,i,11782711680395733509,11243177172761272085,524288 --field-trial-handle=3320,i,3990286839438039035,1372042495267691102,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6324,i,1753928418989991319,18393778894067740058,524288 --field-trial-handle=3320,i,3990286839438039035,1372042495267691102,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6556,i,15463008962074672509,16506969144466191520,2097152 --field-trial-handle=3320,i,3990286839438039035,1372042495267691102,262144 --variations-seed-version --mojo-platform-channel-handle=6576 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5936,i,17113310179550968896,13282139124761288645,2097152 --field-trial-handle=3320,i,3990286839438039035,1372042495267691102,262144 --variations-seed-version --mojo-platform-channel-handle=6684 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6832,i,12501113847866550758,7896880277162913517,2097152 --field-trial-handle=3320,i,3990286839438039035,1372042495267691102,262144 --variations-seed-version --mojo-platform-channel-handle=6848 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6984,i,18085120324103889559,17436802822871245336,2097152 --field-trial-handle=3320,i,3990286839438039035,1372042495267691102,262144 --variations-seed-version --mojo-platform-channel-handle=6992 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7244,i,9616424773958433566,10523155781836314198,524288 --field-trial-handle=3320,i,3990286839438039035,1372042495267691102,262144 --variations-seed-version --mojo-platform-channel-handle=7252 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=7248,i,3253299379419809602,17530342420066519406,2097152 --field-trial-handle=3320,i,3990286839438039035,1372042495267691102,262144 --variations-seed-version --mojo-platform-channel-handle=7188 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7152,i,13138249581921425737,17922742366205305173,524288 --field-trial-handle=3320,i,3990286839438039035,1372042495267691102,262144 --variations-seed-version --mojo-platform-channel-handle=7676 /prefetch:143⤵
-
-
C:\Users\Admin\Downloads\python-3.13.15-amd64.exe"C:\Users\Admin\Downloads\python-3.13.15-amd64.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\Temp\{2B2DAADB-45BF-4F21-8D4C-7357DC6D2C9E}\.cr\python-3.13.15-amd64.exe"C:\Windows\Temp\{2B2DAADB-45BF-4F21-8D4C-7357DC6D2C9E}\.cr\python-3.13.15-amd64.exe" -burn.clean.room="C:\Users\Admin\Downloads\python-3.13.15-amd64.exe" -burn.filehandle.attached=764 -burn.filehandle.self=7684⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x274,0x7ffcdee1c188,0x7ffcdee1c194,0x7ffcdee1c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1548,i,9427168482839957536,2323789165862443323,262144 --field-trial-handle=2540,i,18254718104727141825,8362148255435365144,262144 --variations-seed-version --mojo-platform-channel-handle=2536 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1856,i,1555015399355532600,2999501011850495209,524288 --field-trial-handle=2540,i,18254718104727141825,8362148255435365144,262144 --variations-seed-version --mojo-platform-channel-handle=2600 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2300,i,9868944729315192649,2596577425638366222,524288 --field-trial-handle=2540,i,18254718104727141825,8362148255435365144,262144 --variations-seed-version --mojo-platform-channel-handle=3432 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4440,i,6134983175982503487,8624665347570076750,524288 --field-trial-handle=2540,i,18254718104727141825,8362148255435365144,262144 --variations-seed-version --mojo-platform-channel-handle=4456 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4440,i,6134983175982503487,8624665347570076750,524288 --field-trial-handle=2540,i,18254718104727141825,8362148255435365144,262144 --variations-seed-version --mojo-platform-channel-handle=4456 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4960,i,8024337729037325804,11259971906258381573,2097152 --field-trial-handle=2540,i,18254718104727141825,8362148255435365144,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4876,i,13318210566374576984,3927474100434933440,524288 --field-trial-handle=2540,i,18254718104727141825,8362148255435365144,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5112,i,15357068741148139934,2010002389398164553,524288 --field-trial-handle=2540,i,18254718104727141825,8362148255435365144,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5680,i,14257077285311684341,13752069073500089379,2097152 --field-trial-handle=2540,i,18254718104727141825,8362148255435365144,262144 --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4496,i,2342918063602789835,7602876153598373747,524288 --field-trial-handle=2540,i,18254718104727141825,8362148255435365144,262144 --variations-seed-version --mojo-platform-channel-handle=4544 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4444,i,1977571713449317993,3586651698569465149,524288 --field-trial-handle=2540,i,18254718104727141825,8362148255435365144,262144 --variations-seed-version --mojo-platform-channel-handle=4532 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,3617627881209720864,3037057824555474958,524288 --field-trial-handle=2540,i,18254718104727141825,8362148255435365144,262144 --variations-seed-version --mojo-platform-channel-handle=4584 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5212,i,16181914326991798986,4395036725975753709,524288 --field-trial-handle=2540,i,18254718104727141825,8362148255435365144,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=812,i,17962494993035907909,2678753980367686033,524288 --field-trial-handle=2540,i,18254718104727141825,8362148255435365144,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5460,i,14807655383299380412,6942390302987314873,262144 --field-trial-handle=2540,i,18254718104727141825,8362148255435365144,262144 --variations-seed-version --mojo-platform-channel-handle=816 /prefetch:104⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4804,i,5011434273393743074,14350357208962918419,524288 --field-trial-handle=2540,i,18254718104727141825,8362148255435365144,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4808,i,7564313552497486659,4124289009274295734,524288 --field-trial-handle=2540,i,18254718104727141825,8362148255435365144,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5956,i,499797624916191928,13344556737465745702,524288 --field-trial-handle=2540,i,18254718104727141825,8362148255435365144,262144 --variations-seed-version --mojo-platform-channel-handle=2824 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4004,i,12452067781855759469,4348283981177578030,524288 --field-trial-handle=2540,i,18254718104727141825,8362148255435365144,262144 --variations-seed-version --mojo-platform-channel-handle=3852 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5304,i,3471603942616039017,11428264849119529485,524288 --field-trial-handle=2540,i,18254718104727141825,8362148255435365144,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3756,i,11787220754573400411,1649432761078674266,524288 --field-trial-handle=2540,i,18254718104727141825,8362148255435365144,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2824,i,13731355839687529817,17388783125067747103,524288 --field-trial-handle=2540,i,18254718104727141825,8362148255435365144,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4128,i,12817586232785206285,17411716097324129518,524288 --field-trial-handle=2540,i,18254718104727141825,8362148255435365144,262144 --variations-seed-version --mojo-platform-channel-handle=4168 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3724,i,550074656838772216,9015194400977514035,524288 --field-trial-handle=2540,i,18254718104727141825,8362148255435365144,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4008,i,5089588451159564023,11098990222437336755,524288 --field-trial-handle=2540,i,18254718104727141825,8362148255435365144,262144 --variations-seed-version --mojo-platform-channel-handle=4544 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3756,i,10083554895637577491,8350680928728200007,524288 --field-trial-handle=2540,i,18254718104727141825,8362148255435365144,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window4⤵
- Enumerates system info in registry
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2b8,0x7ffcdee1c188,0x7ffcdee1c194,0x7ffcdee1c1a05⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,8528764047026471090,8625060813391150014,262144 --field-trial-handle=2284,i,1250640199183099664,15363229046563454389,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:25⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1800,i,11479045661697532047,5793606191702217399,524288 --field-trial-handle=2284,i,1250640199183099664,15363229046563454389,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:115⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2340,i,5053734016897599540,4289326969902781648,524288 --field-trial-handle=2284,i,1250640199183099664,15363229046563454389,262144 --variations-seed-version --mojo-platform-channel-handle=2908 /prefetch:135⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4416,i,8533074308368491628,2970823961762622695,524288 --field-trial-handle=2284,i,1250640199183099664,15363229046563454389,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4416,i,8533074308368491628,2970823961762622695,524288 --field-trial-handle=2284,i,1250640199183099664,15363229046563454389,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4916,i,2359161626992454962,1606200299681109427,2097152 --field-trial-handle=2284,i,1250640199183099664,15363229046563454389,262144 --variations-seed-version --mojo-platform-channel-handle=4924 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5264,i,4260617307679272097,1223400923036965787,524288 --field-trial-handle=2284,i,1250640199183099664,15363229046563454389,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5288,i,15795520208929213064,569471888843984200,524288 --field-trial-handle=2284,i,1250640199183099664,15363229046563454389,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5636,i,1455630951889724760,1549706868107601546,2097152 --field-trial-handle=2284,i,1250640199183099664,15363229046563454389,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:15⤵
-
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 171EB5D6795A968DFB51387539789FE92⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Programs\Python\Python313\python.exe"C:\Users\Admin\AppData\Local\Programs\Python\Python313\python.exe" -I -m ensurepip -U --default-pip3⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Programs\Python\Python313\python.exeC:\Users\Admin\AppData\Local\Programs\Python\Python313\python.exe -I -W ignore::DeprecationWarning -c " import runpy import sys sys.path = ['C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpj8n8aio3\\pip-26.2.1-py3-none-any.whl'] + sys.path sys.argv[1:] = ['install', '--no-cache-dir', '--no-index', '--find-links', 'C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpj8n8aio3', '--upgrade', 'pip'] runpy.run_module(\"pip\", run_name=\"__main__\", alter_sys=True) "4⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
-
C:\Users\Admin\AppData\Local\Package Cache\{bdda61aa-57d0-45c8-ae92-fa67d560e32f}\python-3.13.15-amd64.exe"C:\Users\Admin\AppData\Local\Package Cache\{bdda61aa-57d0-45c8-ae92-fa67d560e32f}\python-3.13.15-amd64.exe" /burn.runonce1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Package Cache\{bdda61aa-57d0-45c8-ae92-fa67d560e32f}\python-3.13.15-amd64.exe"C:\Users\Admin\AppData\Local\Package Cache\{bdda61aa-57d0-45c8-ae92-fa67d560e32f}\python-3.13.15-amd64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Python 3.13.15 (64-bit)_20260818130023.log"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Package Cache\{bdda61aa-57d0-45c8-ae92-fa67d560e32f}\python-3.13.15-amd64.exe"C:\Users\Admin\AppData\Local\Package Cache\{bdda61aa-57d0-45c8-ae92-fa67d560e32f}\python-3.13.15-amd64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Package Cache\{bdda61aa-57d0-45c8-ae92-fa67d560e32f}\python-3.13.15-amd64.exe" -burn.filehandle.attached=568 -burn.filehandle.self=588 /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Python 3.13.15 (64-bit)_20260818130023.log"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\TVLauncher_Windows_v1.3.1\TVLauncher_Windows_v1.3.1\installer.bat" "1⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Programs\Python\Python313\python.exepython --version2⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Programs\Python\Python313\python.exepython -c "import sys; exit(0) if sys.version_info >= (3,10) else exit(1)"2⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c python --version2⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Programs\Python\Python313\python.exepython --version3⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
C:\Users\Admin\AppData\Local\Programs\Python\Python313\python.exepython -m venv venv2⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\Downloads\TVLauncher_Windows_v1.3.1\TVLauncher_Windows_v1.3.1\venv\Scripts\python.exeC:\Users\Admin\Downloads\TVLauncher_Windows_v1.3.1\TVLauncher_Windows_v1.3.1\venv\Scripts\python.exe -m ensurepip --upgrade --default-pip3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Programs\Python\Python313\python.exeC:\Users\Admin\Downloads\TVLauncher_Windows_v1.3.1\TVLauncher_Windows_v1.3.1\venv\Scripts\python.exe -m ensurepip --upgrade --default-pip4⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\Downloads\TVLauncher_Windows_v1.3.1\TVLauncher_Windows_v1.3.1\venv\Scripts\python.exeC:\Users\Admin\Downloads\TVLauncher_Windows_v1.3.1\TVLauncher_Windows_v1.3.1\venv\Scripts\python.exe -W ignore::DeprecationWarning -c " import runpy import sys sys.path = ['C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp8elfv0v1\\pip-26.2.1-py3-none-any.whl'] + sys.path sys.argv[1:] = ['install', '--no-cache-dir', '--no-index', '--find-links', 'C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp8elfv0v1', '--upgrade', 'pip'] runpy.run_module(\"pip\", run_name=\"__main__\", alter_sys=True) "5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Programs\Python\Python313\python.exeC:\Users\Admin\Downloads\TVLauncher_Windows_v1.3.1\TVLauncher_Windows_v1.3.1\venv\Scripts\python.exe -W ignore::DeprecationWarning -c " import runpy import sys sys.path = ['C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp8elfv0v1\\pip-26.2.1-py3-none-any.whl'] + sys.path sys.argv[1:] = ['install', '--no-cache-dir', '--no-index', '--find-links', 'C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp8elfv0v1', '--upgrade', 'pip'] runpy.run_module(\"pip\", run_name=\"__main__\", alter_sys=True) "6⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Windows\System32\chcp.com"2⤵
- Executes a command shell one-liner
-
C:\Windows\System32\chcp.comC:\Windows\System32\chcp.com3⤵
-
-
-
C:\Windows\System32\chcp.com"C:\Windows\System32\chcp.com" 650012⤵
-
-
C:\Windows\System32\chcp.com"C:\Windows\System32\chcp.com" 4372⤵
-
-
C:\Users\Admin\Downloads\TVLauncher_Windows_v1.3.1\TVLauncher_Windows_v1.3.1\venv\Scripts\pip.exepip install -r requirements.txt2⤵
- Executes dropped EXE
-
C:\Users\Admin\Downloads\TVLauncher_Windows_v1.3.1\TVLauncher_Windows_v1.3.1\venv\Scripts\python.exe"C:\Users\Admin\Downloads\TVLauncher_Windows_v1.3.1\TVLauncher_Windows_v1.3.1\venv\Scripts\python.exe" "C:\Users\Admin\Downloads\TVLauncher_Windows_v1.3.1\TVLauncher_Windows_v1.3.1\venv\Scripts\pip.exe" install -r requirements.txt3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Programs\Python\Python313\python.exe"C:\Users\Admin\Downloads\TVLauncher_Windows_v1.3.1\TVLauncher_Windows_v1.3.1\venv\Scripts\python.exe" "C:\Users\Admin\Downloads\TVLauncher_Windows_v1.3.1\TVLauncher_Windows_v1.3.1\venv\Scripts\pip.exe" install -r requirements.txt4⤵
- Executes dropped EXE
- Modifies system certificate store
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\TVLauncher_Windows_v1.3.1\TVLauncher_Windows_v1.3.1\TVLauncher.bat" "1⤵
- Executes a command shell one-liner
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Windows\System32\chcp.com"2⤵
- Executes a command shell one-liner
-
C:\Windows\System32\chcp.comC:\Windows\System32\chcp.com3⤵
-
-
-
C:\Windows\System32\chcp.com"C:\Windows\System32\chcp.com" 650012⤵
-
-
C:\Windows\System32\chcp.com"C:\Windows\System32\chcp.com" 4372⤵
-
-
C:\Users\Admin\Downloads\TVLauncher_Windows_v1.3.1\TVLauncher_Windows_v1.3.1\venv\Scripts\python.exepython TvLauncher_Windows.py2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Programs\Python\Python313\python.exepython TvLauncher_Windows.py3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"4⤵
- Executes a command shell one-liner
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"5⤵
-
-
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004F0 0x00000000000004F41⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Defense Evasion
Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
e5bd38c.rbs
e5bd391.rbs
e5bd396.rbs
e5bd39b.rbs
e5bd3a0.rbs
e5bd3a5.rbs
e5bd3aa.rbs
e5bd3af.rbs
e5bd3b4.rbs
e5bd3b9.rbs
settings.dat
settings.dat
settings.dat
settings.dat
settings.dat
settings.dat
0ebf4240-2f4d-4afb-b69e-5db0e6e7d958.tmp
52e9aa51-a193-47fd-bd3e-8978de013c5f.tmp
LOG.old
LOG.old
LOG.old
BookmarkMergedSurfaceOrdering
data_0
data_1
data_2
data_3
f_000070
f_000071
f_00007b
temp-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index~RFe5acd63.TMP
data_1
SiteList-Enterprise.json
Edge Profile.ico
000003.log
LOG
computed_hashes.json
verified_contents.json
content.js
Favicons
History
000003.log
CURRENT
MANIFEST-000001
000003.log
LOG
Cookies
Network Persistent State
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Sdch Dictionaries
Sdch Dictionaries
TransportSecurity
TransportSecurity
TransportSecurity
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
the-real-index
the-real-index
the-real-index~RFe5c1cd6.TMP
the-real-index
the-real-index
the-real-index~RFe5af464.TMP
the-real-index
the-real-index
the-real-index
index.txt
index.txt
index.txt
index.txt
LOG
the-real-index
the-real-index~RFe5b509d.TMP
000003.log
LOG
000003.log
LOG
sync_diagnostic.log
Web Data
8a8097ac-7cc4-4908-a768-d262ea436246.tmp
data_1
Last Version
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
campaign_history
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter~RFe5aabc2.TMP
data_1
Variations
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
e8ba8039-f644-4145-a0f7-66ebce8c0494.tmp
iconcache_idx.db
iconcache_idx.db
webext.sc.lz4
doc_JustForMe
lib_JustForMe
tcltk.msi
__init__.py
__main__.py
pip.exe
python.exe
pywin32-312-cp313-cp313-win_amd64.whl.metadata
certifi-2026.7.22-py3-none-any.whl.metadata
idna-3.19-py3-none-any.whl.metadata
pyqt6-6.10.0-cp39-abi3-win_amd64.whl.metadata
pycaw-20251023-py3-none-any.whl.metadata
certifi-2026.7.22-py3-none-any.whl
comtypes-1.4.16-py3-none-any.whl
idna-3.19-py3-none-any.whl
psutil-7.2.2-cp37-abi3-win_amd64.whl
pycaw-20251023-py3-none-any.whl
pygame-2.6.1-cp313-cp313-win_amd64.whl
pyqt6-6.10.0-cp39-abi3-win_amd64.whl
pywin32-312-cp313-cp313-win_amd64.whl
requests-2.34.2-py3-none-any.whl
urllib3-2.7.0-py3-none-any.whl
urllib3-2.7.0-py3-none-any.whl.metadata
pygame-2.6.1-cp313-cp313-win_amd64.whl.metadata
psutil-7.2.2-cp37-abi3-win_amd64.whl.metadata
comtypes-1.4.16-py3-none-any.whl.metadata
pyqt6_sip-13.12.0-cp313-cp313-win_amd64.whl.metadata
requests-2.34.2-py3-none-any.whl.metadata
charset_normalizer-3.5.1-cp313-cp313-win_amd64.whl.metadata
pyqt6_qt6-6.10.0-py3-none-win_amd64.whl.metadata
content_new.js
sgc975g4
tmp0r9t8z71cacert.pem
tmps2cx47hg
tmpxrf78vg1
compatibility.ini
data.safe.tmp
events
09d6ef2e-752e-4a1a-96ba-7b25e2ef3a68
121014b0-5828-4bcd-8fc1-e210b3c6ee38
26bca5d4-7bd3-4079-97a0-09845a384ad5
45a8aea9-3ee6-4a80-91cb-0e30e2da41d5
6f2d59fb-7f19-4142-ace2-814da0db6e7d
8bfc91cf-1318-45a5-be82-2e16f2bf2215
prefs.js
prefs.js
3870112724rsegmnoittet-es.sqlite
TVLauncher_Windows_v1.-9vvZp4K.3.1.zip.part
dummy.png
dummy16.png
combobox-indicator-open-pressed.png
slider-handle-disabled.png
slider-handle-hovered.png
spinbox-background-up-pressed.png
spinbox-indicator-down-background-up-pressed.png
spinbox-indicator-down-icon.png
spinbox-indicator-up-icon.png
combobox-indicator-focused.png
slider-handle-disabled.png
slider-handle-hovered.png
spinbox-background-up-pressed.png
spinbox-indicator-down-icon.png
spinbox-indicator-up-icon.png
QuickControls2WindowsStyleImpl.qmltypes
qtdeclarative_en.qm
LICENSE
LICENSE.md
__main__.py
idnadata.py
intranges.py
INSTALLERoefo7i_n.tmp
__init__.py
LICENSE.APACHE
LICENSE
fake_6_test.py
__init__.py
fake_4_test.py
__version__.py
_internal_utils.py
_types.py
api.py
auth.py
cookies.py
hooks.py
sessions.py
status_codes.py
structures.py
LICENSE.txt
__init__.py
_base_connection.py
_collections.py
_request_methods.py
_version.py
connection.py
connectionpool.py
connection.py
fetch.py
request.py
response.py
socks.py
exceptions.py
fields.py
filepost.py
__init__.py
connection.py
probe.py
poolmanager.py
__init__.py
connection.py
proxy.py
response.py
retry.py
ssl_.py
ssl_match_hostname.py
ssltransport.py
url.py
util.py
wait.py
pywin32_postinstall.py
pywin32_testall.py
__init__.py
__init__.py
python-3.13.15-amd64.exe
desktop.ini
LICENSE
PythonBA.dll
SideBar.png
python-3.13.15-amd64.exe
pip_JustForMe
memory/3672-19044-0x00007FFCD5910000-0x00007FFCD5F52000-memory.dmp
memory/3672-19102-0x000001BC9DB80000-0x000001BC9DE1E000-memory.dmp
memory/3672-19045-0x00007FFCD8A80000-0x00007FFCD8F58000-memory.dmp
memory/3672-19047-0x00007FFCE1830000-0x00007FFCE1A61000-memory.dmp
memory/3672-19046-0x00007FFCDFF80000-0x00007FFCE01F7000-memory.dmp
memory/6112-1567-0x000001F121C20000-0x000001F121E7F000-memory.dmp