Analysis
- user interaction
yes - max time kernel
1200s - max time network
1099s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
24/08/2026, 02:15
General
- Target http://104.234.63.187:1906/DMA.zip
- Sample260824-cptctacl2x
Score
8/10
Malware Config
Signatures
- Downloads MZ/PE file 2 IoCs
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 21 IoCs
- Loads dropped DLL 64 IoCs
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Discovers running processes 1 TTPs 2 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
- Drops file in System32 directory 2 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 34 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 10 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Time Discovery 1 TTPs 4 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 34 IoCs
Processor information is often read in order to detect sandboxing environments.
- Delays execution with timeout.exe 2 IoCs
- Enumerates system info in registry 2 TTPs 12 IoCs
- Modifies data under HKEY_USERS 19 IoCs
- Modifies registry class 46 IoCs
- Suspicious behavior: EnumeratesProcesses 16 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 29 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 52 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://104.234.63.187:1906/DMA.zip1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff8d9d7c188,0x7ff8d9d7c194,0x7ff8d9d7c1a02⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=1812,i,2295249179595208338,10690508064481341656,524288 --field-trial-handle=2276,i,14865828928684142130,17059061299215245894,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:32⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,3970761645593572868,18063264767707058982,262144 --field-trial-handle=2276,i,14865828928684142130,17059061299215245894,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=2252,i,1487632584109847050,10288770367801203579,524288 --field-trial-handle=2276,i,14865828928684142130,17059061299215245894,262144 --variations-seed-version --mojo-platform-channel-handle=2420 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,8746773622615600333,12937473769013245660,2097152 --field-trial-handle=2276,i,14865828928684142130,17059061299215245894,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,7685468615739105390,2905335001787270942,2097152 --field-trial-handle=2276,i,14865828928684142130,17059061299215245894,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4184,i,8491982601840810441,5134310390701756131,2097152 --field-trial-handle=2276,i,14865828928684142130,17059061299215245894,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4356,i,17329685870824888522,17577289034692556760,2097152 --field-trial-handle=2276,i,14865828928684142130,17059061299215245894,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5168,i,6971937041918465805,936034795317665559,524288 --field-trial-handle=2276,i,14865828928684142130,17059061299215245894,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5176,i,7188464448620039845,8937766921945444418,524288 --field-trial-handle=2276,i,14865828928684142130,17059061299215245894,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5696,i,11531972062877764051,1997662046785977175,524288 --field-trial-handle=2276,i,14865828928684142130,17059061299215245894,262144 --variations-seed-version --mojo-platform-channel-handle=5672 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5680,i,16888660754392140503,6491763415381081271,2097152 --field-trial-handle=2276,i,14865828928684142130,17059061299215245894,262144 --variations-seed-version --mojo-platform-channel-handle=5764 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6496,i,3333930808536448533,16926126084409071449,524288 --field-trial-handle=2276,i,14865828928684142130,17059061299215245894,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6496,i,3333930808536448533,16926126084409071449,524288 --field-trial-handle=2276,i,14865828928684142130,17059061299215245894,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5180,i,18349140937750327795,6882334102689970773,524288 --field-trial-handle=2276,i,14865828928684142130,17059061299215245894,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\DMA\" -spe -an -ai#7zMap2101:68:7zEvent323531⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\Downloads\DMA\XRC FF DMA.exe"C:\Users\Admin\Downloads\DMA\XRC FF DMA.exe"1⤵
- Executes dropped EXE
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff8d8dbc728,0x7ff8d8dbc734,0x7ff8d8dbc7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1948,i,9219784761657851899,3364704460859034721,524288 --field-trial-handle=2172,i,693677530670211510,17404498259639884841,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2208 /prefetch:32⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1744,i,14310327181232882986,6330031571919815565,262144 --field-trial-handle=2172,i,693677530670211510,17404498259639884841,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2168 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2416,i,1897000805006354339,9263378445891795816,524288 --field-trial-handle=2172,i,693677530670211510,17404498259639884841,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2428 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3136,i,264912005053702152,9864848667993967806,2097152 --field-trial-handle=2172,i,693677530670211510,17404498259639884841,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3148 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3188,i,8863686131177406773,8094177902018862617,2097152 --field-trial-handle=2172,i,693677530670211510,17404498259639884841,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3212 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4556,i,7702724364095930043,14892942760167927722,2097152 --field-trial-handle=2172,i,693677530670211510,17404498259639884841,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4580 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4748,i,4074336812730411837,3436995125318088041,524288 --field-trial-handle=2172,i,693677530670211510,17404498259639884841,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4440 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5336,i,8503544894402026951,934447967921540941,524288 --field-trial-handle=2172,i,693677530670211510,17404498259639884841,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5348 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5440,i,5435021816925884007,16743674851267858343,524288 --field-trial-handle=2172,i,693677530670211510,17404498259639884841,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5452 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5472,i,9556850769644527053,1881061863531753757,2097152 --field-trial-handle=2172,i,693677530670211510,17404498259639884841,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5644 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5496,i,480549524023994574,7260755654372822603,524288 --field-trial-handle=2172,i,693677530670211510,17404498259639884841,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3236 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3208,i,8880436243401460233,3202986862765095633,524288 --field-trial-handle=2172,i,693677530670211510,17404498259639884841,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3264 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5572,i,16957045492861441094,13328011906735715309,2097152 --field-trial-handle=2172,i,693677530670211510,17404498259639884841,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3448 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=3180,i,16173571036153141106,13682567740971476427,2097152 --field-trial-handle=2172,i,693677530670211510,17404498259639884841,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3408 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6068,i,16985783120218225153,10257938327933355915,524288 --field-trial-handle=2172,i,693677530670211510,17404498259639884841,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5932 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3368,i,10964680737143724753,675674793244911101,524288 --field-trial-handle=2172,i,693677530670211510,17404498259639884841,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5976 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3436,i,17754826305508527469,5195799048087360841,524288 --field-trial-handle=2172,i,693677530670211510,17404498259639884841,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5940 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5356,i,1226599847112407245,2623163141742749486,2097152 --field-trial-handle=2172,i,693677530670211510,17404498259639884841,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5864 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5836,i,11313147079935705812,12738332035379328513,262144 --field-trial-handle=2172,i,693677530670211510,17404498259639884841,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5236 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3300,i,8251770792585527738,4865598425637784409,524288 --field-trial-handle=2172,i,693677530670211510,17404498259639884841,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5236 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\ghidra_12.1.3_PUBLIC_20260817\" -spe -an -ai#7zMap7051:120:7zEvent280711⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\ghidra_12.1.3_PUBLIC_20260817\ghidra_12.1.3_PUBLIC\ghidraRun.bat" "1⤵
- Executes a command shell one-liner
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava.exe -version2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c call "java.exe" -cp "C:\Users\Admin\Downloads\ghidra_12.1.3_PUBLIC_20260817\ghidra_12.1.3_PUBLIC\support\LaunchSupport.jar" LaunchSupport "C:\Users\Admin\Downloads\ghidra_12.1.3_PUBLIC_20260817\ghidra_12.1.3_PUBLIC\support\.." -jdk_home -save2⤵
- Executes a command shell one-liner
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe"java.exe" -cp "C:\Users\Admin\Downloads\ghidra_12.1.3_PUBLIC_20260817\ghidra_12.1.3_PUBLIC\support\LaunchSupport.jar" LaunchSupport "C:\Users\Admin\Downloads\ghidra_12.1.3_PUBLIC_20260817\ghidra_12.1.3_PUBLIC\support\.." -jdk_home -save3⤵
-
C:\Program Files\Java\jdk-1.8\bin\java.exe"C:\Program Files\Java\jdk-1.8\bin\java.exe" -XshowSettings:properties -version4⤵
-
-
C:\Program Files\Java\jdk-1.8\bin\java.exe"C:\Program Files\Java\jdk-1.8\bin\java.exe" -XshowSettings:properties -version4⤵
-
-
-
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe"java.exe" -cp "C:\Users\Admin\Downloads\ghidra_12.1.3_PUBLIC_20260817\ghidra_12.1.3_PUBLIC\support\LaunchSupport.jar" LaunchSupport "C:\Users\Admin\Downloads\ghidra_12.1.3_PUBLIC_20260817\ghidra_12.1.3_PUBLIC\support\.." -jdk_home -ask2⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0x98,0x104,0x7ff8d8dbc728,0x7ff8d8dbc734,0x7ff8d8dbc7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1796,i,6091250138173448267,7319169047879730172,524288 --field-trial-handle=2076,i,13177402293744218367,5082810533751252100,262144 --variations-seed-version=20260823-030042.303000-production --mojo-platform-channel-handle=2104 /prefetch:32⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1648,i,8475245099144055156,17619205971322702797,262144 --field-trial-handle=2076,i,13177402293744218367,5082810533751252100,262144 --variations-seed-version=20260823-030042.303000-production --mojo-platform-channel-handle=2064 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2388,i,2856346248259578323,14913130244936271310,524288 --field-trial-handle=2076,i,13177402293744218367,5082810533751252100,262144 --variations-seed-version=20260823-030042.303000-production --mojo-platform-channel-handle=2556 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3212,i,16981157015147430489,7615062915126260548,2097152 --field-trial-handle=2076,i,13177402293744218367,5082810533751252100,262144 --variations-seed-version=20260823-030042.303000-production --mojo-platform-channel-handle=3224 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3244,i,11836395690124269320,8372257992973841449,2097152 --field-trial-handle=2076,i,13177402293744218367,5082810533751252100,262144 --variations-seed-version=20260823-030042.303000-production --mojo-platform-channel-handle=3232 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4512,i,10947042458624707459,9886377885148617210,2097152 --field-trial-handle=2076,i,13177402293744218367,5082810533751252100,262144 --variations-seed-version=20260823-030042.303000-production --mojo-platform-channel-handle=4504 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5316,i,6637615291509391343,39328248535497614,524288 --field-trial-handle=2076,i,13177402293744218367,5082810533751252100,262144 --variations-seed-version=20260823-030042.303000-production --mojo-platform-channel-handle=5308 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5324,i,13707604633933075887,13978230002073599735,2097152 --field-trial-handle=2076,i,13177402293744218367,5082810533751252100,262144 --variations-seed-version=20260823-030042.303000-production --mojo-platform-channel-handle=5592 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=3304,i,8439797217883531270,123792929946873837,2097152 --field-trial-handle=2076,i,13177402293744218367,5082810533751252100,262144 --variations-seed-version=20260823-030042.303000-production --mojo-platform-channel-handle=3440 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4408,i,7438574977787250383,3895415596070448862,2097152 --field-trial-handle=2076,i,13177402293744218367,5082810533751252100,262144 --variations-seed-version=20260823-030042.303000-production --mojo-platform-channel-handle=5612 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5912,i,11782496549533411746,10312584899487473679,2097152 --field-trial-handle=2076,i,13177402293744218367,5082810533751252100,262144 --variations-seed-version=20260823-030042.303000-production --mojo-platform-channel-handle=4528 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5788,i,1669858820302901701,1762655178003166872,524288 --field-trial-handle=2076,i,13177402293744218367,5082810533751252100,262144 --variations-seed-version=20260823-030042.303000-production --mojo-platform-channel-handle=5764 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5736,i,17073403183590614758,2898177109705683990,524288 --field-trial-handle=2076,i,13177402293744218367,5082810533751252100,262144 --variations-seed-version=20260823-030042.303000-production --mojo-platform-channel-handle=5972 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5744,i,13318673999107538317,7210882510213598775,524288 --field-trial-handle=2076,i,13177402293744218367,5082810533751252100,262144 --variations-seed-version=20260823-030042.303000-production --mojo-platform-channel-handle=6012 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Users\Admin\Downloads\DMA\XRC FF DMA.exe"C:\Users\Admin\Downloads\DMA\XRC FF DMA.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\Downloads\DMA\XRC FF DMA.exe"C:\Users\Admin\Downloads\DMA\XRC FF DMA.exe"1⤵
- Executes dropped EXE
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd4,0x108,0x7ff8d8dbc728,0x7ff8d8dbc734,0x7ff8d8dbc7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1748,i,17604826687101304491,13197611876731620466,262144 --field-trial-handle=2000,i,5314544865154491006,171809867735726251,262144 --variations-seed-version=20260823-030042.303000-production --mojo-platform-channel-handle=1996 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2248,i,6478918684801337670,6755358614043525765,524288 --field-trial-handle=2000,i,5314544865154491006,171809867735726251,262144 --variations-seed-version=20260823-030042.303000-production --mojo-platform-channel-handle=2240 /prefetch:32⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2360,i,4483742412603543586,11624145431911416466,524288 --field-trial-handle=2000,i,5314544865154491006,171809867735726251,262144 --variations-seed-version=20260823-030042.303000-production --mojo-platform-channel-handle=2548 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3220,i,14233167847458728918,5912505696414817650,2097152 --field-trial-handle=2000,i,5314544865154491006,171809867735726251,262144 --variations-seed-version=20260823-030042.303000-production --mojo-platform-channel-handle=3232 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3244,i,360610674117583441,2615066385776784097,2097152 --field-trial-handle=2000,i,5314544865154491006,171809867735726251,262144 --variations-seed-version=20260823-030042.303000-production --mojo-platform-channel-handle=3284 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4504,i,16034059256517460378,12187854298980544780,2097152 --field-trial-handle=2000,i,5314544865154491006,171809867735726251,262144 --variations-seed-version=20260823-030042.303000-production --mojo-platform-channel-handle=4524 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5284,i,781827177975540579,2925214436740347448,524288 --field-trial-handle=2000,i,5314544865154491006,171809867735726251,262144 --variations-seed-version=20260823-030042.303000-production --mojo-platform-channel-handle=4884 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5572,i,6822401395085575884,11577236947029327271,2097152 --field-trial-handle=2000,i,5314544865154491006,171809867735726251,262144 --variations-seed-version=20260823-030042.303000-production --mojo-platform-channel-handle=5652 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5752,i,5599066915727791816,8139255830149820857,2097152 --field-trial-handle=2000,i,5314544865154491006,171809867735726251,262144 --variations-seed-version=20260823-030042.303000-production --mojo-platform-channel-handle=4664 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5744,i,16164681882309957418,5420220578305762099,524288 --field-trial-handle=2000,i,5314544865154491006,171809867735726251,262144 --variations-seed-version=20260823-030042.303000-production --mojo-platform-channel-handle=5784 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3300,i,9540927771774784055,2867285564480641560,524288 --field-trial-handle=2000,i,5314544865154491006,171809867735726251,262144 --variations-seed-version=20260823-030042.303000-production --mojo-platform-channel-handle=3268 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3924,i,7948009533555471657,5000258084537250504,524288 --field-trial-handle=2000,i,5314544865154491006,171809867735726251,262144 --variations-seed-version=20260823-030042.303000-production --mojo-platform-channel-handle=3480 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=3440,i,13631578300254411051,13826406966262639304,2097152 --field-trial-handle=2000,i,5314544865154491006,171809867735726251,262144 --variations-seed-version=20260823-030042.303000-production --mojo-platform-channel-handle=5664 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5756,i,336459516271133303,9838260124561921673,2097152 --field-trial-handle=2000,i,5314544865154491006,171809867735726251,262144 --variations-seed-version=20260823-030042.303000-production --mojo-platform-channel-handle=3468 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=6060,i,11347975200683380512,8341807253354480005,524288 --field-trial-handle=2000,i,5314544865154491006,171809867735726251,262144 --variations-seed-version=20260823-030042.303000-production --mojo-platform-channel-handle=6028 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5656,i,2218575388156685869,4633177243642004351,524288 --field-trial-handle=2000,i,5314544865154491006,171809867735726251,262144 --variations-seed-version=20260823-030042.303000-production --mojo-platform-channel-handle=6032 /prefetch:82⤵
- Modifies registry class
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=4676,i,4523398995742037062,3984845983915257368,2097152 --field-trial-handle=2000,i,5314544865154491006,171809867735726251,262144 --variations-seed-version=20260823-030042.303000-production --mojo-platform-channel-handle=5976 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=3432,i,8519097159868357511,15423543239544084238,2097152 --field-trial-handle=2000,i,5314544865154491006,171809867735726251,262144 --variations-seed-version=20260823-030042.303000-production --mojo-platform-channel-handle=3476 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6216,i,225550094199344475,15277752242236826777,2097152 --field-trial-handle=2000,i,5314544865154491006,171809867735726251,262144 --variations-seed-version=20260823-030042.303000-production --mojo-platform-channel-handle=5896 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6148,i,7384870268120891608,10318166855629436408,524288 --field-trial-handle=2000,i,5314544865154491006,171809867735726251,262144 --variations-seed-version=20260823-030042.303000-production --mojo-platform-channel-handle=6092 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6164,i,5566983775717822549,12612090900508371972,262144 --field-trial-handle=2000,i,5314544865154491006,171809867735726251,262144 --variations-seed-version=20260823-030042.303000-production --mojo-platform-channel-handle=6148 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Users\Admin\Downloads\jdk-21_windows-x64_bin.exe"C:\Users\Admin\Downloads\jdk-21_windows-x64_bin.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\jds241271812.tmp\jdk-21_windows-x64_bin.exe"C:\Users\Admin\AppData\Local\Temp\jds241271812.tmp\jdk-21_windows-x64_bin.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\LocalLow\Oracle\Java\jdk21.0.12.1_x64\jdk21.0.12.164.msi" WRAPPER=13⤵
- Badlisted process makes network request
- Enumerates connected drives
- Checks processor information in registry
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 4A26AEAE6554C460641D451A781ED117 C2⤵
- Loads dropped DLL
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 1917D835BBBF905AE257FD4CE7B3DAFE2⤵
- Loads dropped DLL
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 669CB2D3B290FC72FADB371EE00B9055 E Global\MSI00002⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Modifies registry class
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\ghidra_12.1.3_PUBLIC_20260817\ghidra_12.1.3_PUBLIC\ghidraRun.bat" "1⤵
- Executes a command shell one-liner
-
C:\Program Files\Common Files\Oracle\Java\javapath\java.exejava.exe -version2⤵
- Executes dropped EXE
-
C:\Program Files\Java\jdk-21.0.12.1\bin\java.exe"C:\Program Files\Java\jdk-21.0.12.1\bin\java.exe" -version3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c call "java.exe" -cp "C:\Users\Admin\Downloads\ghidra_12.1.3_PUBLIC_20260817\ghidra_12.1.3_PUBLIC\support\LaunchSupport.jar" LaunchSupport "C:\Users\Admin\Downloads\ghidra_12.1.3_PUBLIC_20260817\ghidra_12.1.3_PUBLIC\support\.." -jdk_home -save2⤵
- Executes a command shell one-liner
-
C:\Program Files\Common Files\Oracle\Java\javapath\java.exe"java.exe" -cp "C:\Users\Admin\Downloads\ghidra_12.1.3_PUBLIC_20260817\ghidra_12.1.3_PUBLIC\support\LaunchSupport.jar" LaunchSupport "C:\Users\Admin\Downloads\ghidra_12.1.3_PUBLIC_20260817\ghidra_12.1.3_PUBLIC\support\.." -jdk_home -save3⤵
- Executes dropped EXE
-
C:\Program Files\Java\jdk-21.0.12.1\bin\java.exe"C:\Program Files\Java\jdk-21.0.12.1\bin\java.exe" -cp C:\Users\Admin\Downloads\ghidra_12.1.3_PUBLIC_20260817\ghidra_12.1.3_PUBLIC\support\LaunchSupport.jar LaunchSupport C:\Users\Admin\Downloads\ghidra_12.1.3_PUBLIC_20260817\ghidra_12.1.3_PUBLIC\support\.. -jdk_home -save4⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
-
C:\Program Files\Java\jdk-21.0.12.1\bin\java.exe"C:\Program Files\Java\jdk-21.0.12.1\bin\java.exe" -XshowSettings:properties -version5⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
-
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c call "C:\Program Files\Java\jdk-21.0.12.1\bin\java" -cp "C:\Users\Admin\Downloads\ghidra_12.1.3_PUBLIC_20260817\ghidra_12.1.3_PUBLIC\support\LaunchSupport.jar" LaunchSupport "C:\Users\Admin\Downloads\ghidra_12.1.3_PUBLIC_20260817\ghidra_12.1.3_PUBLIC\support\.." -envvars2⤵
- Executes a command shell one-liner
-
C:\Program Files\Java\jdk-21.0.12.1\bin\java.exe"C:\Program Files\Java\jdk-21.0.12.1\bin\java" -cp "C:\Users\Admin\Downloads\ghidra_12.1.3_PUBLIC_20260817\ghidra_12.1.3_PUBLIC\support\LaunchSupport.jar" LaunchSupport "C:\Users\Admin\Downloads\ghidra_12.1.3_PUBLIC_20260817\ghidra_12.1.3_PUBLIC\support\.." -envvars3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c call "C:\Program Files\Java\jdk-21.0.12.1\bin\java" -cp "C:\Users\Admin\Downloads\ghidra_12.1.3_PUBLIC_20260817\ghidra_12.1.3_PUBLIC\support\LaunchSupport.jar" LaunchSupport "C:\Users\Admin\Downloads\ghidra_12.1.3_PUBLIC_20260817\ghidra_12.1.3_PUBLIC\support\.." -vmargs2⤵
- Executes a command shell one-liner
-
C:\Program Files\Java\jdk-21.0.12.1\bin\java.exe"C:\Program Files\Java\jdk-21.0.12.1\bin\java" -cp "C:\Users\Admin\Downloads\ghidra_12.1.3_PUBLIC_20260817\ghidra_12.1.3_PUBLIC\support\LaunchSupport.jar" LaunchSupport "C:\Users\Admin\Downloads\ghidra_12.1.3_PUBLIC_20260817\ghidra_12.1.3_PUBLIC\support\.." -vmargs3⤵
- Executes dropped EXE
- Checks processor information in registry
-
-
-
C:\Program Files\Java\jdk-21.0.12.1\bin\javaw.exe"C:\Program Files\Java\jdk-21.0.12.1\bin\javaw" -Djava.system.class.loader=ghidra.GhidraClassLoader -Dfile.encoding=UTF8 -Duser.country=US -Duser.language=en -Duser.variant= -Dsun.java2d.opengl=false -Djdk.tls.client.protocols=TLSv1.2,TLSv1.3 -Dcpu.core.limit= -Dcpu.core.override= -Dfont.size.override= -Dpython.console.encoding=UTF-8 -Xshare:off -Djavax.xml.accessExternalDTD= -Djavax.xml.accessExternalSchema= -Djavax.xml.accessExternalStylesheet= --enable-native-access=ALL-UNNAMED -Dsun.java2d.d3d=false -Dlog4j.skipJansi=true -Duser.home="C:\Users\Admin" -cp "C:\Users\Admin\Downloads\ghidra_12.1.3_PUBLIC_20260817\ghidra_12.1.3_PUBLIC\support\..\Ghidra\Framework\Utility\lib\Utility.jar" ghidra.Ghidra ghidra.GhidraRun2⤵
- Checks computer location settings
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\System32\timeout.exeC:\Windows\System32\timeout.exe /NOBREAK 12⤵
- Delays execution with timeout.exe
-
-
C:\Windows\System32\tasklist.exeC:\Windows\System32\tasklist.exe2⤵
- Discovers running processes
-
-
C:\Windows\System32\findstr.exeC:\Windows\System32\findstr.exe "javaw"2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\ghidra_12.1.3_PUBLIC_20260817\ghidra_12.1.3_PUBLIC\ghidraRun.bat" "1⤵
- Executes a command shell one-liner
-
C:\Program Files\Common Files\Oracle\Java\javapath\java.exejava.exe -version2⤵
- Executes dropped EXE
-
C:\Program Files\Java\jdk-21.0.12.1\bin\java.exe"C:\Program Files\Java\jdk-21.0.12.1\bin\java.exe" -version3⤵
- Executes dropped EXE
- Checks processor information in registry
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c call "java.exe" -cp "C:\Users\Admin\Downloads\ghidra_12.1.3_PUBLIC_20260817\ghidra_12.1.3_PUBLIC\support\LaunchSupport.jar" LaunchSupport "C:\Users\Admin\Downloads\ghidra_12.1.3_PUBLIC_20260817\ghidra_12.1.3_PUBLIC\support\.." -jdk_home -save2⤵
- Executes a command shell one-liner
-
C:\Program Files\Common Files\Oracle\Java\javapath\java.exe"java.exe" -cp "C:\Users\Admin\Downloads\ghidra_12.1.3_PUBLIC_20260817\ghidra_12.1.3_PUBLIC\support\LaunchSupport.jar" LaunchSupport "C:\Users\Admin\Downloads\ghidra_12.1.3_PUBLIC_20260817\ghidra_12.1.3_PUBLIC\support\.." -jdk_home -save3⤵
- Executes dropped EXE
-
C:\Program Files\Java\jdk-21.0.12.1\bin\java.exe"C:\Program Files\Java\jdk-21.0.12.1\bin\java.exe" -cp C:\Users\Admin\Downloads\ghidra_12.1.3_PUBLIC_20260817\ghidra_12.1.3_PUBLIC\support\LaunchSupport.jar LaunchSupport C:\Users\Admin\Downloads\ghidra_12.1.3_PUBLIC_20260817\ghidra_12.1.3_PUBLIC\support\.. -jdk_home -save4⤵
- Executes dropped EXE
- Checks processor information in registry
-
C:\Program Files\Java\jdk-21.0.12.1\bin\java.exe"C:\Program Files\Java\jdk-21.0.12.1\bin\java.exe" -XshowSettings:properties -version5⤵
- Executes dropped EXE
- Checks processor information in registry
-
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c call "C:\Program Files\Java\jdk-21.0.12.1\bin\java" -cp "C:\Users\Admin\Downloads\ghidra_12.1.3_PUBLIC_20260817\ghidra_12.1.3_PUBLIC\support\LaunchSupport.jar" LaunchSupport "C:\Users\Admin\Downloads\ghidra_12.1.3_PUBLIC_20260817\ghidra_12.1.3_PUBLIC\support\.." -envvars2⤵
- Executes a command shell one-liner
-
C:\Program Files\Java\jdk-21.0.12.1\bin\java.exe"C:\Program Files\Java\jdk-21.0.12.1\bin\java" -cp "C:\Users\Admin\Downloads\ghidra_12.1.3_PUBLIC_20260817\ghidra_12.1.3_PUBLIC\support\LaunchSupport.jar" LaunchSupport "C:\Users\Admin\Downloads\ghidra_12.1.3_PUBLIC_20260817\ghidra_12.1.3_PUBLIC\support\.." -envvars3⤵
- Executes dropped EXE
- Checks processor information in registry
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c call "C:\Program Files\Java\jdk-21.0.12.1\bin\java" -cp "C:\Users\Admin\Downloads\ghidra_12.1.3_PUBLIC_20260817\ghidra_12.1.3_PUBLIC\support\LaunchSupport.jar" LaunchSupport "C:\Users\Admin\Downloads\ghidra_12.1.3_PUBLIC_20260817\ghidra_12.1.3_PUBLIC\support\.." -vmargs2⤵
- Executes a command shell one-liner
-
C:\Program Files\Java\jdk-21.0.12.1\bin\java.exe"C:\Program Files\Java\jdk-21.0.12.1\bin\java" -cp "C:\Users\Admin\Downloads\ghidra_12.1.3_PUBLIC_20260817\ghidra_12.1.3_PUBLIC\support\LaunchSupport.jar" LaunchSupport "C:\Users\Admin\Downloads\ghidra_12.1.3_PUBLIC_20260817\ghidra_12.1.3_PUBLIC\support\.." -vmargs3⤵
- Executes dropped EXE
- Checks processor information in registry
-
-
-
C:\Program Files\Java\jdk-21.0.12.1\bin\javaw.exe"C:\Program Files\Java\jdk-21.0.12.1\bin\javaw" -Djava.system.class.loader=ghidra.GhidraClassLoader -Dfile.encoding=UTF8 -Duser.country=US -Duser.language=en -Duser.variant= -Dsun.java2d.opengl=false -Djdk.tls.client.protocols=TLSv1.2,TLSv1.3 -Dcpu.core.limit= -Dcpu.core.override= -Dfont.size.override= -Dpython.console.encoding=UTF-8 -Xshare:off -Djavax.xml.accessExternalDTD= -Djavax.xml.accessExternalSchema= -Djavax.xml.accessExternalStylesheet= --enable-native-access=ALL-UNNAMED -Dsun.java2d.d3d=false -Dlog4j.skipJansi=true -Duser.home="C:\Users\Admin" -cp "C:\Users\Admin\Downloads\ghidra_12.1.3_PUBLIC_20260817\ghidra_12.1.3_PUBLIC\support\..\Ghidra\Framework\Utility\lib\Utility.jar" ghidra.Ghidra ghidra.GhidraRun2⤵
- Checks computer location settings
- Executes dropped EXE
- Checks processor information in registry
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\System32\timeout.exeC:\Windows\System32\timeout.exe /NOBREAK 12⤵
- Delays execution with timeout.exe
-
-
C:\Windows\System32\tasklist.exeC:\Windows\System32\tasklist.exe2⤵
- Discovers running processes
-
-
C:\Windows\System32\findstr.exeC:\Windows\System32\findstr.exe "javaw"2⤵
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
e61e010.rbs
java.exe
windowsaccessbridge-64.dll
COPYRIGHT
LICENSE
Reference Documentation.url
Get Help.url
Visit Java.com.url
CrashpadMetrics-active.pma
settings.dat
29d1b6c7-aad8-4ab1-8048-237238b07559.tmp
BrowsingTopicsState
f_000007
f_00006e
f_00006f
f_000074
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
messages.json
computed_hashes.json
verified_contents.json
craw_background.js
Favicons
History
CURRENT
833fcf3e-9ba7-45c1-850b-efcc563e53c0.tmp
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
TransportSecurity
TransportSecurity
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
Secure Preferences
LOG
the-real-index
LOG
the-real-index
Network Persistent State
Network Persistent State~RFe5c6818.TMP
MANIFEST-000001
LOG
Last Version
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
data_1
Variations
metadata.json
ukm_db
settings.dat
settings.dat
settings.dat
the-real-index
the-real-index~RFe5877ea.TMP
Edge Profile.ico
Network Persistent State
SCT Auditing Pending Reports
Preferences
Secure Preferences
Local State
Local State
data_1
c7d970a0-a080-4398-950d-1974ab494e58.tmp
5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
JavaLauncher.log
JavaLauncher.log
JavaLauncher.log
MSI904B.tmp
ghidra441385388662468181.cache
jusched.log
0677b90c-80c6-4355-aad7-fe2f6f691109.tmp
messages.json
DMA.zip
XRC FF DMA.exe
closedFolderInvalid.svg
openProject.svg
LICENSE.txt
LICENSE
go1.15.12.json.diff
go1.15.15.json.diff
go1.16.12.json.diff
go1.16.8.json.diff
go1.17.12.json.diff
go1.19.12.json.diff
go1.20.12.json.diff
go1.20.4.json.diff
go1.21.13.json.diff
go1.21.2.json.diff
go1.22.6.json.diff
go1.22.8.json.diff
go1.23.3.json.diff
go1.23.5.json.diff
Module.manifest
Module.manifest
build.xml
Dalvik_DEX_Pie.sla
sleighArgs.txt
probe_fixup.xml
application.properties
A3-Breakpoints.html
Wallace.h
GhidraLogo64.png
ghidra.framework.plugintool.annotation.pypredef
__init__.pyi
ghidraRun.bat
LaunchSupport.jar
launch.bat
launch.properties
00000000.prp
db.1.gbf
~index.tmp
memory/1888-11434-0x0000019FC0B30000-0x0000019FC0B31000-memory.dmp
memory/3220-11798-0x00000255EC3B0000-0x00000255EC3B1000-memory.dmp
memory/3220-11872-0x00000255EC3B0000-0x00000255EC3B1000-memory.dmp
memory/3220-11889-0x00000255EC3B0000-0x00000255EC3B1000-memory.dmp
memory/3220-11929-0x00000255EC3B0000-0x00000255EC3B1000-memory.dmp
memory/3220-11931-0x00000255EC3B0000-0x00000255EC3B1000-memory.dmp
memory/3220-11587-0x00000255EC3B0000-0x00000255EC3B1000-memory.dmp
memory/3220-11573-0x00000255EC3B0000-0x00000255EC3B1000-memory.dmp
memory/3220-11568-0x00000255EC3B0000-0x00000255EC3B1000-memory.dmp
memory/3220-11570-0x00000255EC3B0000-0x00000255EC3B1000-memory.dmp
memory/3220-11569-0x00000255EC3B0000-0x00000255EC3B1000-memory.dmp
memory/3220-11558-0x00000255EC3B0000-0x00000255EC3B1000-memory.dmp
memory/3220-11544-0x00000255EC3B0000-0x00000255EC3B1000-memory.dmp
memory/3220-11543-0x00000255EC3B0000-0x00000255EC3B1000-memory.dmp
memory/3220-11537-0x00000255EC3B0000-0x00000255EC3B1000-memory.dmp
memory/3220-11524-0x00000255EC3B0000-0x00000255EC3B1000-memory.dmp
memory/3220-11518-0x00000255EC3B0000-0x00000255EC3B1000-memory.dmp
memory/3220-11502-0x00000255EC3B0000-0x00000255EC3B1000-memory.dmp
memory/3220-11501-0x00000255EC3B0000-0x00000255EC3B1000-memory.dmp
memory/3220-11500-0x00000255EC3B0000-0x00000255EC3B1000-memory.dmp
memory/3220-11499-0x00000255EC3B0000-0x00000255EC3B1000-memory.dmp
memory/3220-11497-0x00000255EC3B0000-0x00000255EC3B1000-memory.dmp
memory/3220-11494-0x00000255EC3B0000-0x00000255EC3B1000-memory.dmp
memory/3220-11486-0x00000255EC3B0000-0x00000255EC3B1000-memory.dmp
memory/3220-11655-0x00000255EC3B0000-0x00000255EC3B1000-memory.dmp
memory/3220-11657-0x00000255EC3B0000-0x00000255EC3B1000-memory.dmp
memory/3220-11658-0x00000255EC3B0000-0x00000255EC3B1000-memory.dmp
memory/3220-11880-0x00000255EC3B0000-0x00000255EC3B1000-memory.dmp
memory/3220-11881-0x00000255EC3B0000-0x00000255EC3B1000-memory.dmp
memory/3220-11882-0x00000255EC3B0000-0x00000255EC3B1000-memory.dmp
memory/3220-11877-0x00000255EC3B0000-0x00000255EC3B1000-memory.dmp
memory/3220-11879-0x00000255EC3B0000-0x00000255EC3B1000-memory.dmp
memory/3220-11883-0x00000255EC3B0000-0x00000255EC3B1000-memory.dmp
memory/3220-11861-0x00000255EC3B0000-0x00000255EC3B1000-memory.dmp
memory/3220-11841-0x00000255EC3B0000-0x00000255EC3B1000-memory.dmp
memory/3220-11827-0x00000255EC3B0000-0x00000255EC3B1000-memory.dmp
memory/3220-11814-0x00000255EC3B0000-0x00000255EC3B1000-memory.dmp
memory/3220-11816-0x00000255EC3B0000-0x00000255EC3B1000-memory.dmp
memory/3220-11815-0x00000255EC3B0000-0x00000255EC3B1000-memory.dmp
memory/3220-11636-0x00000255EC3B0000-0x00000255EC3B1000-memory.dmp
memory/3220-11799-0x00000255EC3B0000-0x00000255EC3B1000-memory.dmp
memory/3220-11804-0x00000255EC3B0000-0x00000255EC3B1000-memory.dmp
memory/3220-11805-0x00000255EC3B0000-0x00000255EC3B1000-memory.dmp
memory/3220-11796-0x00000255EC3B0000-0x00000255EC3B1000-memory.dmp
memory/3220-11753-0x00000255EC3B0000-0x00000255EC3B1000-memory.dmp
memory/3220-11754-0x00000255EC3B0000-0x00000255EC3B1000-memory.dmp
memory/3220-11752-0x00000255EC3B0000-0x00000255EC3B1000-memory.dmp
memory/3220-11751-0x00000255EC3B0000-0x00000255EC3B1000-memory.dmp
memory/3220-11744-0x00000255EC3B0000-0x00000255EC3B1000-memory.dmp
memory/3220-11743-0x00000255EC3B0000-0x00000255EC3B1000-memory.dmp
memory/3220-11741-0x00000255EC3B0000-0x00000255EC3B1000-memory.dmp
memory/3220-11738-0x00000255EC3B0000-0x00000255EC3B1000-memory.dmp
memory/3220-11740-0x00000255EC3B0000-0x00000255EC3B1000-memory.dmp
memory/3220-11736-0x00000255EC3B0000-0x00000255EC3B1000-memory.dmp
memory/3220-11719-0x00000255EC3B0000-0x00000255EC3B1000-memory.dmp
memory/3220-11725-0x00000255EC3B0000-0x00000255EC3B1000-memory.dmp
memory/3220-11680-0x00000255EC3B0000-0x00000255EC3B1000-memory.dmp
memory/3220-11674-0x00000255EC3B0000-0x00000255EC3B1000-memory.dmp
memory/3220-11662-0x00000255EC3B0000-0x00000255EC3B1000-memory.dmp
memory/3220-11660-0x00000255EC3B0000-0x00000255EC3B1000-memory.dmp
memory/3220-11659-0x00000255EC3B0000-0x00000255EC3B1000-memory.dmp
memory/3588-11474-0x0000024D62D10000-0x0000024D62D11000-memory.dmp
memory/3600-11472-0x0000015568650000-0x0000015568651000-memory.dmp
memory/5076-11460-0x0000020C37A70000-0x0000020C37A71000-memory.dmp