Resubmissions
12/09/2026, 13:30
260912-qrt9sace72812/09/2026, 13:01
260912-p87e1azwfs812/09/2026, 12:57
260912-p63n2acb763Analysis
- user interaction
yes - max time kernel
1739s - max time network
1728s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
12/09/2026, 13:30
General
- Target CustomRP.exe
- Size 1.2MB
- Sample260912-qrt9sace72
- SHA256 912cc56c88a786941a4ba1da25eef70c398a2eb16b7e38a8a5e2b4f33eba7d7d
Score
8/10
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Downloads MZ/PE file 1 IoCs
- Creates a file in the Startup directory 1 TTPs 1 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
- Executes dropped EXE 20 IoCs
- Loads dropped DLL 64 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Drops desktop.ini file(s) 3 IoCs
- Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Network Share Discovery 1 TTPs
Attempt to gather information on host network.
- Hide Artifacts: Hidden Files and Directories 1 TTPs 4 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 2 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Inno Setup is an open-source installation builder for Windows applications. 4 IoCs
Inno Setup installer
- Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 16 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 9 IoCs
- Kills process with taskkill 4 IoCs
- Modifies Internet Explorer settings 1 TTPs 6 IoCs
- Modifies data under HKEY_USERS 9 IoCs
- Modifies registry class 64 IoCs
- Modifies system certificate store 2 TTPs 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: EnumeratesProcesses 35 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 57 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 15 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
- Views/modifies file attributes 1 TTPs 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\CustomRP.exe"C:\Users\Admin\AppData\Local\Temp\CustomRP.exe"1⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5792 -s 8842⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 5792 -ip 57921⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffcd531c728,0x7ffcd531c734,0x7ffcd531c7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1904,i,14758604657195187445,9431066507117049975,524288 --field-trial-handle=1980,i,17071460298275506978,16094359312864847396,262144 --variations-seed-version --mojo-platform-channel-handle=2132 /prefetch:112⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1624,i,18131257746363783889,6006155226144739797,262144 --field-trial-handle=1980,i,17071460298275506978,16094359312864847396,262144 --variations-seed-version --mojo-platform-channel-handle=2000 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2308,i,13763623268453328345,18028830664911195185,524288 --field-trial-handle=1980,i,17071460298275506978,16094359312864847396,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:132⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3268,i,11881382835490133094,7325633540462212895,2097152 --field-trial-handle=1980,i,17071460298275506978,16094359312864847396,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3296,i,14175967920471154667,15078003750548845831,2097152 --field-trial-handle=1980,i,17071460298275506978,16094359312864847396,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4740,i,5554765233068685137,8672926694809490172,2097152 --field-trial-handle=1980,i,17071460298275506978,16094359312864847396,262144 --variations-seed-version --mojo-platform-channel-handle=4752 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4736,i,2427240425406213715,1844254687550023964,524288 --field-trial-handle=1980,i,17071460298275506978,16094359312864847396,262144 --variations-seed-version --mojo-platform-channel-handle=4888 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5404,i,1744371616357870757,6677175826721654176,524288 --field-trial-handle=1980,i,17071460298275506978,16094359312864847396,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5508,i,8553243005405027097,10841871292345730999,2097152 --field-trial-handle=1980,i,17071460298275506978,16094359312864847396,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5544,i,7531646052001093571,3478550685510617868,2097152 --field-trial-handle=1980,i,17071460298275506978,16094359312864847396,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5500,i,15907037838273007760,8243284869082955419,2097152 --field-trial-handle=1980,i,17071460298275506978,16094359312864847396,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5992,i,6418311352603933878,3405066226486390265,2097152 --field-trial-handle=1980,i,17071460298275506978,16094359312864847396,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5572,i,6590818590269368029,1411235394382055539,2097152 --field-trial-handle=1980,i,17071460298275506978,16094359312864847396,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5960,i,7189232263879886077,7330843568948307538,524288 --field-trial-handle=1980,i,17071460298275506978,16094359312864847396,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5524,i,1434425549822389044,14189977350114967313,2097152 --field-trial-handle=1980,i,17071460298275506978,16094359312864847396,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6204,i,3736059716604852573,14366392365677302147,2097152 --field-trial-handle=1980,i,17071460298275506978,16094359312864847396,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6256,i,3583063648108740341,9270586661346017258,524288 --field-trial-handle=1980,i,17071460298275506978,16094359312864847396,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6304,i,17938036539785241150,15561245652020345304,2097152 --field-trial-handle=1980,i,17071460298275506978,16094359312864847396,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6120,i,9838709691460839242,12623940628804078670,524288 --field-trial-handle=1980,i,17071460298275506978,16094359312864847396,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5960,i,12602005969233296854,14015937461607983209,2097152 --field-trial-handle=1980,i,17071460298275506978,16094359312864847396,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5544,i,12436533644855291878,18435024210663974756,2097152 --field-trial-handle=1980,i,17071460298275506978,16094359312864847396,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:92⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6288,i,15584799329227435938,15520242912539226974,2097152 --field-trial-handle=1980,i,17071460298275506978,16094359312864847396,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4800,i,6192590577179916791,15853106197710765654,524288 --field-trial-handle=1980,i,17071460298275506978,16094359312864847396,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5700,i,15417367794254534331,13863084384011760223,524288 --field-trial-handle=1980,i,17071460298275506978,16094359312864847396,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6212,i,16993475267159912783,14589592753455694142,524288 --field-trial-handle=1980,i,17071460298275506978,16094359312864847396,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=5872,i,4502848589590363548,16830756013194123226,2097152 --field-trial-handle=1980,i,17071460298275506978,16094359312864847396,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=5480,i,11017282470720726521,1449900810674374285,2097152 --field-trial-handle=1980,i,17071460298275506978,16094359312864847396,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=4812,i,3079763015087579890,10528525878539792500,2097152 --field-trial-handle=1980,i,17071460298275506978,16094359312864847396,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=4796,i,5191020517631823284,16548230474636599406,2097152 --field-trial-handle=1980,i,17071460298275506978,16094359312864847396,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=4852,i,17441245451582738396,1871520974965380319,2097152 --field-trial-handle=1980,i,17071460298275506978,16094359312864847396,262144 --variations-seed-version --mojo-platform-channel-handle=4768 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=5952,i,16968796426177018237,5525795874150424093,2097152 --field-trial-handle=1980,i,17071460298275506978,16094359312864847396,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=3552,i,7844486592114336624,8781135400937162383,2097152 --field-trial-handle=1980,i,17071460298275506978,16094359312864847396,262144 --variations-seed-version --mojo-platform-channel-handle=4808 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --metrics-shmem-handle=5760,i,15004492856080959766,11275546177288274061,2097152 --field-trial-handle=1980,i,17071460298275506978,16094359312864847396,262144 --variations-seed-version --mojo-platform-channel-handle=6388 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --metrics-shmem-handle=6572,i,6475981433710942064,5785530195358313923,2097152 --field-trial-handle=1980,i,17071460298275506978,16094359312864847396,262144 --variations-seed-version --mojo-platform-channel-handle=6588 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --metrics-shmem-handle=6596,i,5314898163221481795,1543358099739332125,2097152 --field-trial-handle=1980,i,17071460298275506978,16094359312864847396,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --metrics-shmem-handle=5520,i,4181130660766951757,3676200473042087554,2097152 --field-trial-handle=1980,i,17071460298275506978,16094359312864847396,262144 --variations-seed-version --mojo-platform-channel-handle=6760 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --metrics-shmem-handle=3692,i,7811902132383798931,1162010106012397376,2097152 --field-trial-handle=1980,i,17071460298275506978,16094359312864847396,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --metrics-shmem-handle=6376,i,17748358953397177601,14833596594200268575,2097152 --field-trial-handle=1980,i,17071460298275506978,16094359312864847396,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --metrics-shmem-handle=7140,i,7924484109891794151,9613835747473336729,2097152 --field-trial-handle=1980,i,17071460298275506978,16094359312864847396,262144 --variations-seed-version --mojo-platform-channel-handle=7120 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --metrics-shmem-handle=7260,i,16020337778846281498,2009576516874841309,2097152 --field-trial-handle=1980,i,17071460298275506978,16094359312864847396,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --metrics-shmem-handle=7460,i,18215421937191652385,17119486368887850343,2097152 --field-trial-handle=1980,i,17071460298275506978,16094359312864847396,262144 --variations-seed-version --mojo-platform-channel-handle=7544 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --metrics-shmem-handle=7896,i,8106103337933809695,11054863451646674117,2097152 --field-trial-handle=1980,i,17071460298275506978,16094359312864847396,262144 --variations-seed-version --mojo-platform-channel-handle=7000 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6996,i,16656050290661655277,5048545598659464043,262144 --field-trial-handle=1980,i,17071460298275506978,16094359312864847396,262144 --variations-seed-version --mojo-platform-channel-handle=7092 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --metrics-shmem-handle=7068,i,3879692773510730713,5742774671101865,2097152 --field-trial-handle=1980,i,17071460298275506978,16094359312864847396,262144 --variations-seed-version --mojo-platform-channel-handle=7080 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --metrics-shmem-handle=5980,i,13139656258252646292,310572069963521448,2097152 --field-trial-handle=1980,i,17071460298275506978,16094359312864847396,262144 --variations-seed-version --mojo-platform-channel-handle=7492 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=8344,i,10069888384332311265,6834251380286058743,524288 --field-trial-handle=1980,i,17071460298275506978,16094359312864847396,262144 --variations-seed-version --mojo-platform-channel-handle=7624 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --metrics-shmem-handle=7584,i,2970178867009194291,5959657326276897113,2097152 --field-trial-handle=1980,i,17071460298275506978,16094359312864847396,262144 --variations-seed-version --mojo-platform-channel-handle=7440 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --metrics-shmem-handle=7984,i,11454474262740465252,17780424922458567868,2097152 --field-trial-handle=1980,i,17071460298275506978,16094359312864847396,262144 --variations-seed-version --mojo-platform-channel-handle=8364 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --metrics-shmem-handle=8472,i,5218452251077074208,210126054871533446,2097152 --field-trial-handle=1980,i,17071460298275506978,16094359312864847396,262144 --variations-seed-version --mojo-platform-channel-handle=8492 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=7352,i,15220574189744312770,4674288130880942457,524288 --field-trial-handle=1980,i,17071460298275506978,16094359312864847396,262144 --variations-seed-version --mojo-platform-channel-handle=7992 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --metrics-shmem-handle=8200,i,4769696560552479955,2511782763260485770,2097152 --field-trial-handle=1980,i,17071460298275506978,16094359312864847396,262144 --variations-seed-version --mojo-platform-channel-handle=8420 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=8460,i,3745456978712409102,1463718829240142661,524288 --field-trial-handle=1980,i,17071460298275506978,16094359312864847396,262144 --variations-seed-version --mojo-platform-channel-handle=4032 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵
- Modifies data under HKEY_USERS
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffcd531c728,0x7ffcd531c734,0x7ffcd531c7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=1708,i,7344411127933071319,10022241679238564637,524288 --field-trial-handle=2512,i,11604559522494277268,13725888350297770999,262144 --variations-seed-version=20260911-170408.034000-production --mojo-platform-channel-handle=2540 /prefetch:112⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1592,i,5721606039520861937,6901912770875137742,262144 --field-trial-handle=2512,i,11604559522494277268,13725888350297770999,262144 --variations-seed-version=20260911-170408.034000-production --mojo-platform-channel-handle=2508 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=2052,i,2764122301591868891,18439197394319732977,524288 --field-trial-handle=2512,i,11604559522494277268,13725888350297770999,262144 --variations-seed-version=20260911-170408.034000-production --mojo-platform-channel-handle=2728 /prefetch:132⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3204,i,11785838330424859903,14426115263474711730,2097152 --field-trial-handle=2512,i,11604559522494277268,13725888350297770999,262144 --variations-seed-version=20260911-170408.034000-production --mojo-platform-channel-handle=3488 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3208,i,17118849896284957555,11755153281207392403,2097152 --field-trial-handle=2512,i,11604559522494277268,13725888350297770999,262144 --variations-seed-version=20260911-170408.034000-production --mojo-platform-channel-handle=3508 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4596,i,12531531286673670471,14460345431691508342,2097152 --field-trial-handle=2512,i,11604559522494277268,13725888350297770999,262144 --variations-seed-version=20260911-170408.034000-production --mojo-platform-channel-handle=4560 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5408,i,12368842669119398258,11814604599989444040,2097152 --field-trial-handle=2512,i,11604559522494277268,13725888350297770999,262144 --variations-seed-version=20260911-170408.034000-production --mojo-platform-channel-handle=5496 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5472,i,10600845929272612968,6793522385720573548,2097152 --field-trial-handle=2512,i,11604559522494277268,13725888350297770999,262144 --variations-seed-version=20260911-170408.034000-production --mojo-platform-channel-handle=5516 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=5948,i,5311170973032518960,11952662263750540556,524288 --field-trial-handle=2512,i,11604559522494277268,13725888350297770999,262144 --variations-seed-version=20260911-170408.034000-production --mojo-platform-channel-handle=5460 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=6104,i,11957083187920508262,14900628952163953074,524288 --field-trial-handle=2512,i,11604559522494277268,13725888350297770999,262144 --variations-seed-version=20260911-170408.034000-production --mojo-platform-channel-handle=6100 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=6116,i,14666074560958064848,1448619639444111680,2097152 --field-trial-handle=2512,i,11604559522494277268,13725888350297770999,262144 --variations-seed-version=20260911-170408.034000-production --mojo-platform-channel-handle=6056 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5560,i,7743959704284127877,1683929885388747150,2097152 --field-trial-handle=2512,i,11604559522494277268,13725888350297770999,262144 --variations-seed-version=20260911-170408.034000-production --mojo-platform-channel-handle=6044 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6552,i,11489099349847938851,2048195389512213526,2097152 --field-trial-handle=2512,i,11604559522494277268,13725888350297770999,262144 --variations-seed-version=20260911-170408.034000-production --mojo-platform-channel-handle=6548 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6728,i,11474871439908846451,17578238273278403503,2097152 --field-trial-handle=2512,i,11604559522494277268,13725888350297770999,262144 --variations-seed-version=20260911-170408.034000-production --mojo-platform-channel-handle=6744 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6876,i,6579249022286691124,14491072341963638854,2097152 --field-trial-handle=2512,i,11604559522494277268,13725888350297770999,262144 --variations-seed-version=20260911-170408.034000-production --mojo-platform-channel-handle=6540 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=7248,i,3456058499762453018,16365252907892382155,2097152 --field-trial-handle=2512,i,11604559522494277268,13725888350297770999,262144 --variations-seed-version=20260911-170408.034000-production --mojo-platform-channel-handle=7268 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=7244,i,12642252049754957371,18359387460019158915,524288 --field-trial-handle=2512,i,11604559522494277268,13725888350297770999,262144 --variations-seed-version=20260911-170408.034000-production --mojo-platform-channel-handle=7240 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=7280,i,11395406532214762081,6707052458245333617,524288 --field-trial-handle=2512,i,11604559522494277268,13725888350297770999,262144 --variations-seed-version=20260911-170408.034000-production --mojo-platform-channel-handle=4444 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=7180,i,9270518268572292838,17093101011828487369,524288 --field-trial-handle=2512,i,11604559522494277268,13725888350297770999,262144 --variations-seed-version=20260911-170408.034000-production --mojo-platform-channel-handle=7232 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=4688,i,2832417186881673406,18330526269682644657,2097152 --field-trial-handle=2512,i,11604559522494277268,13725888350297770999,262144 --variations-seed-version=20260911-170408.034000-production --mojo-platform-channel-handle=4608 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=7100,i,2587739704612438440,12199906140099439418,2097152 --field-trial-handle=2512,i,11604559522494277268,13725888350297770999,262144 --variations-seed-version=20260911-170408.034000-production --mojo-platform-channel-handle=7004 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=7276,i,10681201069924218303,8410690217056264889,2097152 --field-trial-handle=2512,i,11604559522494277268,13725888350297770999,262144 --variations-seed-version=20260911-170408.034000-production --mojo-platform-channel-handle=7400 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=7548,i,15754596833321988041,17977516147910012505,2097152 --field-trial-handle=2512,i,11604559522494277268,13725888350297770999,262144 --variations-seed-version=20260911-170408.034000-production --mojo-platform-channel-handle=7536 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=7684,i,3144451467781039025,13843382974199143439,2097152 --field-trial-handle=2512,i,11604559522494277268,13725888350297770999,262144 --variations-seed-version=20260911-170408.034000-production --mojo-platform-channel-handle=7052 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=7660,i,5303362383485802080,8028683816365907318,2097152 --field-trial-handle=2512,i,11604559522494277268,13725888350297770999,262144 --variations-seed-version=20260911-170408.034000-production --mojo-platform-channel-handle=7588 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=7788,i,10781500576637024073,256866658406892079,2097152 --field-trial-handle=2512,i,11604559522494277268,13725888350297770999,262144 --variations-seed-version=20260911-170408.034000-production --mojo-platform-channel-handle=7804 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --subproc-heap-profiling --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4616,i,17112572113570006136,7878717877009296964,262144 --field-trial-handle=2512,i,11604559522494277268,13725888350297770999,262144 --variations-seed-version=20260911-170408.034000-production --mojo-platform-channel-handle=6380 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=896,i,15179898965266231072,5685792285819852055,2097152 --field-trial-handle=2512,i,11604559522494277268,13725888350297770999,262144 --variations-seed-version=20260911-170408.034000-production --mojo-platform-channel-handle=6388 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Users\Admin\Downloads\OllamaSetup.exe"C:\Users\Admin\Downloads\OllamaSetup.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\is-Q92NHBTI7T.tmp\OllamaSetup.tmp"C:\Users\Admin\AppData\Local\Temp\is-Q92NHBTI7T.tmp\OllamaSetup.tmp" /SL5="$110180,1573016807,845824,C:\Users\Admin\Downloads\OllamaSetup.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /f /t /im "ollama app.exe"3⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /f /t /im "llama-server.exe"3⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /f /t /im "ollama.exe"3⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /f /t /im "llama-server.exe"3⤵
- Kills process with taskkill
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /C set PATH=C:\Users\Admin\AppData\Local\Programs\Ollama;%PATH% & "C:\Users\Admin\AppData\Local\Programs\Ollama\ollama app.exe"3⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Programs\Ollama\ollama app.exe"C:\Users\Admin\AppData\Local\Programs\Ollama\ollama app.exe"4⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies system certificate store
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name="ollama app.exe" --user-data-dir="C:\Users\Admin\AppData\Roaming\ollama app.exe\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=2588.5360.3410874405090530140 /pfhostedapp:28af1981ba771d116dec536a035575ed6d0365b55⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\ollama app.exe\EBWebView" /prefetch:4 /pfhostedapp:28af1981ba771d116dec536a035575ed6d0365b5 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\ollama app.exe\EBWebView\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffcce985fd8,0x7ffcce985fe4,0x7ffcce985ff06⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\ollama app.exe\EBWebView" --webview-exe-name="ollama app.exe" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1772 --field-trial-handle=1776,i,15522307838458128550,4659379916525903004,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:28af1981ba771d116dec536a035575ed6d0365b56⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\ollama app.exe\EBWebView" --webview-exe-name="ollama app.exe" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2008 --field-trial-handle=1776,i,15522307838458128550,4659379916525903004,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:28af1981ba771d116dec536a035575ed6d0365b56⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\ollama app.exe\EBWebView" --webview-exe-name="ollama app.exe" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2296 --field-trial-handle=1776,i,15522307838458128550,4659379916525903004,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:28af1981ba771d116dec536a035575ed6d0365b56⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\ollama app.exe\EBWebView" --webview-exe-name="ollama app.exe" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3636 --field-trial-handle=1776,i,15522307838458128550,4659379916525903004,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:28af1981ba771d116dec536a035575ed6d0365b5 /prefetch:16⤵
-
-
-
C:\Users\Admin\AppData\Local\Programs\Ollama\ollama.exeC:\Users\Admin\AppData\Local\Programs\Ollama\ollama.exe serve5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Programs\Ollama\lib\ollama\llama-server.exeC:\Users\Admin\AppData\Local\Programs\Ollama\lib\ollama\llama-server.exe --port 52440 --host 127.0.0.1 --no-webui --offline --verbose6⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
-
-
C:\Users\Admin\AppData\Local\Programs\Ollama\lib\ollama\llama-server.exeC:\Users\Admin\AppData\Local\Programs\Ollama\lib\ollama\llama-server.exe --list-devices --offline --verbose6⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
-
-
C:\Users\Admin\AppData\Local\Programs\Ollama\lib\ollama\llama-server.exeC:\Users\Admin\AppData\Local\Programs\Ollama\lib\ollama\llama-server.exe --port 60134 --host 127.0.0.1 --no-webui --offline --verbose6⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
-
-
C:\Users\Admin\AppData\Local\Programs\Ollama\lib\ollama\llama-server.exeC:\Users\Admin\AppData\Local\Programs\Ollama\lib\ollama\llama-server.exe --list-devices --offline --verbose6⤵
- Executes dropped EXE
- Checks processor information in registry
-
-
C:\Users\Admin\AppData\Local\Programs\Ollama\ollama.exeC:\Users\Admin\AppData\Local\Programs\Ollama\ollama.exe gpu-discover --lib-dir C:\Users\Admin\AppData\Local\Programs\Ollama\lib\ollama --lib-dir C:\Users\Admin\AppData\Local\Programs\Ollama\lib\ollama\vulkan6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Programs\Ollama\lib\ollama\llama-server.exeC:\Users\Admin\AppData\Local\Programs\Ollama\lib\ollama\llama-server.exe --port 58874 --host 127.0.0.1 --no-webui --offline --verbose6⤵
- Executes dropped EXE
- Checks processor information in registry
-
-
C:\Users\Admin\AppData\Local\Programs\Ollama\lib\ollama\llama-server.exeC:\Users\Admin\AppData\Local\Programs\Ollama\lib\ollama\llama-server.exe --list-devices --offline --verbose6⤵
- Executes dropped EXE
- Checks processor information in registry
-
-
C:\Users\Admin\AppData\Local\Programs\Ollama\ollama.exeC:\Users\Admin\AppData\Local\Programs\Ollama\ollama.exe gpu-discover --lib-dir C:\Users\Admin\AppData\Local\Programs\Ollama\lib\ollama --lib-dir C:\Users\Admin\AppData\Local\Programs\Ollama\lib\ollama\cuda_v126⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Programs\Ollama\lib\ollama\llama-server.exeC:\Users\Admin\AppData\Local\Programs\Ollama\lib\ollama\llama-server.exe --port 64571 --host 127.0.0.1 --no-webui --offline --verbose6⤵
- Executes dropped EXE
- Checks processor information in registry
-
-
C:\Users\Admin\AppData\Local\Programs\Ollama\lib\ollama\llama-server.exeC:\Users\Admin\AppData\Local\Programs\Ollama\lib\ollama\llama-server.exe --list-devices --offline --verbose6⤵
- Executes dropped EXE
- Checks processor information in registry
-
-
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops desktop.ini file(s)
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Desktop\YUNA-Release\YUNA-Release\YUNA.exe"C:\Users\Admin\Desktop\YUNA-Release\YUNA-Release\YUNA.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\YUNA-Release\YUNA-Release\YUNA.exe"C:\Users\Admin\Desktop\YUNA-Release\YUNA-Release\YUNA.exe"4⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "attrib +H +S C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\.yuna_auth"5⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +H +S C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\.yuna_auth6⤵
- Views/modifies file attributes
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "attrib +H +S C:\Users\Admin\AppData\Local\Temp\.~yuna_cache"5⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +H +S C:\Users\Admin\AppData\Local\Temp\.~yuna_cache6⤵
- Views/modifies file attributes
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "attrib +H +S C:\Users\Admin\AppData\Local\Temp\_MEI176162\.yuna_state"5⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +H +S C:\Users\Admin\AppData\Local\Temp\_MEI176162\.yuna_state6⤵
- Views/modifies file attributes
-
-
-
C:\Users\Admin\AppData\Local\Programs\Ollama\ollama.exeollama --version5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\New Text Document.txt3⤵
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\Desktop\YUNA-Release\YUNA-Release\YUNA.exe"C:\Users\Admin\Desktop\YUNA-Release\YUNA-Release\YUNA.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\YUNA-Release\YUNA-Release\YUNA.exe"C:\Users\Admin\Desktop\YUNA-Release\YUNA-Release\YUNA.exe"4⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "attrib +H +S C:\Users\Admin\AppData\Local\Temp\_MEI120442\.yuna_state"5⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +H +S C:\Users\Admin\AppData\Local\Temp\_MEI120442\.yuna_state6⤵
- Views/modifies file attributes
-
-
-
C:\Users\Admin\AppData\Local\Programs\Ollama\ollama.exeollama --version5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
-
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\mobsync.exeC:\Windows\System32\mobsync.exe -Embedding1⤵
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵
-
C:\Windows\System32\DataExchangeHost.exeC:\Windows\System32\DataExchangeHost.exe -Embedding1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Modify Registry
3Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
id_ed25519
CrashpadMetrics-active.pma
settings.dat
BookmarkMergedSurfaceOrdering
f_000005
f_000026
f_000053
temp-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
messages.json
craw_background.js
CURRENT
History
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
TransportSecurity
TransportSecurity
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
Secure Preferences
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
data_0
data_1
data_2
data_3
MANIFEST-000001
Network Persistent State
Network Persistent State~RFe5f9525.TMP
000003.log
LOG
c80f09a3-09dd-4261-b23d-0b7c177e9cf8.tmp
Last Version
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Variations
metadata.json
ukm_db
prep_Activatable Class_Hermes_perf.cache
ollama app.exe
unins000.exe
qt_help_en.qm
SDL2.dll
SDL2_image.dll
SDL2_mixer.dll
SDL2_ttf.dll
freetype.dll
libjpeg-9.dll
libogg-0.dll
libopus-0.dll
libpng16-16.dll
zlib1.dll
namespace_packages.txt
INSTALLER
messages.json
YUNA.log
f01b4d95cf55d32a.automaticDestinations-ms
f01b4d95cf55d32a.automaticDestinations-ms
settings.dat
settings.dat
the-real-index
the-real-index~RFe627692.TMP
index
Preferences
Preferences~RFe627692.TMP
Local State
Local State
Local State
Local State
Local State~RFe6240bd.TMP
WHEEL
LICENSE
INSTALLER
WHEEL
_utils.py
zip-safe
_compat.py
_compat.py
_typing.py
__init__.py
WHEEL
py.typed
WHEEL
__init__.py
WHEEL
_base_client.py
_constants.py
_models.py
__init__.py
_reflection.py
_transform.py
.keep
WHEEL
WHEEL
WHEEL
__init__.py
__init__.py
_qs.py
_datetime_parse.py
_json.py
_path.py
_proxy.py
_streams.py
_sync.py
__init__.py
__init__.py
LICENSE
WHEEL
fake_6_test.py
__init__.py
fake_4_test.py
WHEEL
License.txt
WHEEL
WHEEL
LICENSE.APACHE2
WHEEL
WHEEL
WHEEL
License.txt
__init__.py
__init__.py
dotenv.exe
edge-tts.exe
uvicorn.exe
webview_data.zip
yuna.ico
OllamaSetup.exe.crdownload
memory/792-4183-0x00007FFCC24B0000-0x00007FFCC26D8000-memory.dmp
memory/792-4189-0x00007FFCC24E0000-0x00007FFCC26D1000-memory.dmp
memory/792-4196-0x00007FFCC2530000-0x00007FFCC26D7000-memory.dmp
memory/792-4197-0x00007FFCC2530000-0x00007FFCC26D4000-memory.dmp
memory/792-4198-0x00007FFCC24B0000-0x00007FFCC26DB000-memory.dmp
memory/792-4173-0x00007FFCC24F0000-0x00007FFCC26DE000-memory.dmp
memory/792-4181-0x00007FFCC24B0000-0x00007FFCC26DD000-memory.dmp
memory/792-4160-0x00007FFCE2C20000-0x00007FFCE2C30000-memory.dmp
memory/792-4194-0x00007FFCC2470000-0x00007FFCC26DF000-memory.dmp
memory/792-4193-0x00007FFCC2500000-0x00007FFCC26D3000-memory.dmp
memory/792-4195-0x00007FFCC24B0000-0x00007FFCC26DB000-memory.dmp
memory/792-4162-0x00007FFCC3370000-0x00007FFCC35D3000-memory.dmp
memory/792-4192-0x00007FFCC2500000-0x00007FFCC26D8000-memory.dmp
memory/792-4199-0x00007FFCC24E0000-0x00007FFCC26D1000-memory.dmp
memory/792-4191-0x00007FFCC2500000-0x00007FFCC26D8000-memory.dmp
memory/792-4190-0x00007FFCC24B0000-0x00007FFCC26DA000-memory.dmp
memory/792-4161-0x00007FFCC26E0000-0x00007FFCC2A25000-memory.dmp
memory/792-4184-0x00007FFCC24B0000-0x00007FFCC26D9000-memory.dmp
memory/1212-3962-0x00007FFCEAA80000-0x00007FFCEAA81000-memory.dmp
memory/1212-4220-0x000001A9EC990000-0x000001A9EC9BA000-memory.dmp
memory/2984-4056-0x00007FFCEAA80000-0x00007FFCEAA81000-memory.dmp
memory/3136-1477-0x0000000000B10000-0x0000000000BED000-memory.dmp
memory/3136-3939-0x0000000000B10000-0x0000000000BED000-memory.dmp
memory/3136-1632-0x0000000000B10000-0x0000000000BED000-memory.dmp
memory/3148-2042-0x00000000001F0000-0x0000000000627000-memory.dmp
memory/3148-1953-0x00000000001F0000-0x0000000000627000-memory.dmp
memory/3148-1633-0x00000000001F0000-0x0000000000627000-memory.dmp
memory/3148-3938-0x00000000001F0000-0x0000000000627000-memory.dmp
memory/3148-1882-0x00000000001F0000-0x0000000000627000-memory.dmp
memory/3148-3917-0x00000000001F0000-0x0000000000627000-memory.dmp
memory/3148-2135-0x00000000001F0000-0x0000000000627000-memory.dmp
memory/3148-2075-0x00000000001F0000-0x0000000000627000-memory.dmp
memory/3148-2066-0x00000000001F0000-0x0000000000627000-memory.dmp
memory/3148-1932-0x00000000001F0000-0x0000000000627000-memory.dmp
memory/3148-2038-0x00000000001F0000-0x0000000000627000-memory.dmp
memory/3148-2034-0x00000000001F0000-0x0000000000627000-memory.dmp
memory/3148-2010-0x00000000001F0000-0x0000000000627000-memory.dmp
memory/3148-1981-0x00000000001F0000-0x0000000000627000-memory.dmp
memory/3148-1968-0x00000000001F0000-0x0000000000627000-memory.dmp
memory/3460-1738-0x0000025984450000-0x0000025984470000-memory.dmp
memory/3460-1706-0x0000025983D10000-0x0000025983D30000-memory.dmp
memory/3460-1695-0x00000259801E0000-0x00000259802E0000-memory.dmp
memory/3460-1699-0x0000025983D30000-0x0000025983D50000-memory.dmp
memory/3460-1700-0x0000025984080000-0x0000025984180000-memory.dmp
memory/3524-4233-0x00007FFCC23F0000-0x00007FFCC261A000-memory.dmp
memory/3524-4230-0x00007FFCC23F0000-0x00007FFCC2618000-memory.dmp
memory/3524-4236-0x00007FFCC2440000-0x00007FFCC2613000-memory.dmp
memory/3524-4227-0x00007FFCC3370000-0x00007FFCC35D3000-memory.dmp
memory/3524-4355-0x00007FFCC2420000-0x00007FFCC2611000-memory.dmp
memory/3524-4225-0x00007FFCE2C20000-0x00007FFCE2C30000-memory.dmp
memory/3524-4238-0x00007FFCC23F0000-0x00007FFCC261B000-memory.dmp
memory/3524-4241-0x00007FFCC23F0000-0x00007FFCC261B000-memory.dmp
memory/3524-4226-0x00007FFCC0EA0000-0x00007FFCC11E5000-memory.dmp
memory/3524-4239-0x00007FFCC2470000-0x00007FFCC2617000-memory.dmp
memory/3524-4240-0x00007FFCC2470000-0x00007FFCC2614000-memory.dmp
memory/3524-4231-0x00007FFCC23F0000-0x00007FFCC2619000-memory.dmp
memory/3524-4228-0x00007FFCC2430000-0x00007FFCC261E000-memory.dmp
memory/3524-4232-0x00007FFCC2420000-0x00007FFCC2611000-memory.dmp
memory/3524-4229-0x00007FFCC23F0000-0x00007FFCC261D000-memory.dmp
memory/3524-4234-0x00007FFCC2440000-0x00007FFCC2618000-memory.dmp
memory/3524-4235-0x00007FFCC2440000-0x00007FFCC2618000-memory.dmp
memory/3524-4237-0x00007FFCC0590000-0x00007FFCC07FF000-memory.dmp
memory/5792-1-0x0000000000E80000-0x0000000000FBC000-memory.dmp
memory/5792-2-0x0000000005F80000-0x000000000653A000-memory.dmp
memory/5792-0-0x0000000074BE2000-0x0000000074BE3000-memory.dmp
memory/6448-4388-0x00007FFCE2C20000-0x00007FFCE2C30000-memory.dmp
memory/6448-4389-0x00007FFCC0EA0000-0x00007FFCC11E5000-memory.dmp