Analysis
- user interaction
yes - max time kernel
1800s - max time network
1801s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
22/10/2026, 19:53
General
- Target test_bot.exe
- Size 462KB
- Sample261022-yl2qnsbd75
- SHA256 b880db3d79a5fd544c4dde01d04b784eec0cfadc3ed6cdc697a7382baf51e624
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes a file named after a Windows system binary 1 TTPs 2 IoCs
The file runs from a user directory while carrying the name of an executable that normally only exists in System32.
- Executes dropped EXE 1 IoCs
- Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Enumerates video capture drivers 2 TTPs 1 IoCs
Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 62 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 21 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies Internet Explorer settings 1 TTPs 2 IoCs
- Modifies data under HKEY_USERS 7 IoCs
- Modifies registry class 45 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious behavior: GetForegroundWindowSpam 2 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 4 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\test_bot.exe"C:\Users\Admin\AppData\Local\Temp\test_bot.exe"1⤵
- Executes a file named after a Windows system binary
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exeschtasks.exe /create /f /tn "svchost" /tr "\"C:\Users\Admin\AppData\Roaming\Temp\svchost.exe\"" /sc onlogon /rl limited2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Roaming\Temp\svchost.exe"C:\Users\Admin\AppData\Roaming\Temp\svchost.exe"2⤵
- Executes a file named after a Windows system binary
- Executes dropped EXE
- Enumerates video capture drivers
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exeschtasks.exe /create /f /tn "svchost" /tr "\"C:\Users\Admin\AppData\Roaming\Temp\svchost.exe\"" /sc onlogon /rl limited3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffddb21c728,0x7ffddb21c734,0x7ffddb21c7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1880,i,15148857101812051177,14429166659307260328,524288 --field-trial-handle=2028,i,16634328732685389109,10195992406798288146,262144 --variations-seed-version --mojo-platform-channel-handle=1960 /prefetch:112⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1628,i,9096276869656874303,4742382253447003736,262144 --field-trial-handle=2028,i,16634328732685389109,10195992406798288146,262144 --variations-seed-version --mojo-platform-channel-handle=2024 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2360,i,5655887519434947401,6619956461541442749,524288 --field-trial-handle=2028,i,16634328732685389109,10195992406798288146,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:132⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3244,i,322940111054137177,2935685297399821140,2097152 --field-trial-handle=2028,i,16634328732685389109,10195992406798288146,262144 --variations-seed-version --mojo-platform-channel-handle=3300 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3304,i,6796038899713594091,13478858919260504158,2097152 --field-trial-handle=2028,i,16634328732685389109,10195992406798288146,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4552,i,17301552844698247724,9072656666178659002,2097152 --field-trial-handle=2028,i,16634328732685389109,10195992406798288146,262144 --variations-seed-version --mojo-platform-channel-handle=4568 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4812,i,5066513259529039079,8040518145384292133,524288 --field-trial-handle=2028,i,16634328732685389109,10195992406798288146,262144 --variations-seed-version --mojo-platform-channel-handle=4824 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5364,i,6249275574910315612,15989694071207107629,524288 --field-trial-handle=2028,i,16634328732685389109,10195992406798288146,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5464,i,11467824246465492687,16378157778769758762,2097152 --field-trial-handle=2028,i,16634328732685389109,10195992406798288146,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5492,i,10199571008539328925,5654246880615995632,2097152 --field-trial-handle=2028,i,16634328732685389109,10195992406798288146,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5808,i,638436633697100476,5976530041235464987,2097152 --field-trial-handle=2028,i,16634328732685389109,10195992406798288146,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5820,i,3417337290405740263,6521835046303749738,524288 --field-trial-handle=2028,i,16634328732685389109,10195992406798288146,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5936,i,12285430154935711646,12139455874501072082,2097152 --field-trial-handle=2028,i,16634328732685389109,10195992406798288146,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5480,i,16276503604494698329,7334105148370212148,2097152 --field-trial-handle=2028,i,16634328732685389109,10195992406798288146,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5800,i,9253608888122369738,10450619156852611555,2097152 --field-trial-handle=2028,i,16634328732685389109,10195992406798288146,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6228,i,14621388127077906790,1411060466499380588,524288 --field-trial-handle=2028,i,16634328732685389109,10195992406798288146,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6108,i,3233156648122433952,9979740995218779099,2097152 --field-trial-handle=2028,i,16634328732685389109,10195992406798288146,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5744,i,5554074784954014357,16706706621284217246,2097152 --field-trial-handle=2028,i,16634328732685389109,10195992406798288146,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6504,i,18108006773244397265,18321613131173179975,2097152 --field-trial-handle=2028,i,16634328732685389109,10195992406798288146,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5596,i,11166938236408073929,4329899481544821039,2097152 --field-trial-handle=2028,i,16634328732685389109,10195992406798288146,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5484,i,12705070552006761736,8753100737992895167,524288 --field-trial-handle=2028,i,16634328732685389109,10195992406798288146,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=3492,i,15123130489252826031,4961673770990447039,2097152 --field-trial-handle=2028,i,16634328732685389109,10195992406798288146,262144 --variations-seed-version --mojo-platform-channel-handle=4596 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6176,i,9913286468115786079,16440544621772304436,524288 --field-trial-handle=2028,i,16634328732685389109,10195992406798288146,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=6220,i,17087142678758482744,2568665797487277274,524288 --field-trial-handle=2028,i,16634328732685389109,10195992406798288146,262144 --variations-seed-version --mojo-platform-channel-handle=5620 /prefetch:122⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5668,i,13337261898149493886,2135418461826261222,524288 --field-trial-handle=2028,i,16634328732685389109,10195992406798288146,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:142⤵
- Modifies registry class
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=6980,i,9311978837698448485,17425088417389617808,2097152 --field-trial-handle=2028,i,16634328732685389109,10195992406798288146,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=6432,i,2273967164102148478,14658330001668395665,2097152 --field-trial-handle=2028,i,16634328732685389109,10195992406798288146,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:92⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6424,i,7347011289081155685,8706313435756251374,524288 --field-trial-handle=2028,i,16634328732685389109,10195992406798288146,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6384,i,4977968490047226121,10414972498441204389,524288 --field-trial-handle=2028,i,16634328732685389109,10195992406798288146,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6344,i,15204093626383905043,303259978955909595,524288 --field-trial-handle=2028,i,16634328732685389109,10195992406798288146,262144 --variations-seed-version --mojo-platform-channel-handle=5672 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=256,i,8480815168530960949,3851010730060634436,262144 --field-trial-handle=2028,i,16634328732685389109,10195992406798288146,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4728,i,5517449034691743435,6675804896281219269,524288 --field-trial-handle=2028,i,16634328732685389109,10195992406798288146,262144 --variations-seed-version --mojo-platform-channel-handle=7744 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵
- Modifies data under HKEY_USERS
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"4⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1952 -prefsLen 27019 -prefMapHandle 1956 -prefMapSize 270173 -ipcHandle 2040 -initialChannelId {f4e0b44c-470f-4ec1-9b14-d90641786512} -parentPid 5792 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5792" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu5⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2420 -prefsLen 27055 -prefMapHandle 2424 -prefMapSize 270173 -ipcHandle 2432 -initialChannelId {73b5fdb7-47a5-4082-bf2e-3d813b622e56} -parentPid 5792 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5792" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket5⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3940 -prefsLen 27245 -prefMapHandle 3944 -prefMapSize 270173 -jsInitHandle 3948 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3956 -initialChannelId {86c45b26-eb54-46d7-812e-129f5aab9c52} -parentPid 5792 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5792" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab5⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4080 -prefsLen 27245 -prefMapHandle 4100 -prefMapSize 270173 -ipcHandle 4220 -initialChannelId {97f4dfdd-b6a7-43de-95dd-00bde70e828e} -parentPid 5792 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5792" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd5⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3036 -prefsLen 34744 -prefMapHandle 1268 -prefMapSize 270173 -jsInitHandle 2792 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2468 -initialChannelId {10c5e488-5849-43cb-a334-1035ef3785fe} -parentPid 5792 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5792" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab5⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5068 -prefsLen 34851 -prefMapHandle 5072 -prefMapSize 270173 -ipcHandle 5080 -initialChannelId {92d585cb-c2dd-4bfe-9d7d-20eac1f9d38e} -parentPid 5792 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5792" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility5⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3228 -prefsLen 32757 -prefMapHandle 3836 -prefMapSize 270173 -jsInitHandle 5268 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4744 -initialChannelId {2fd43f43-9af6-4fcd-9860-e9091089eda6} -parentPid 5792 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5792" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab5⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5296 -prefsLen 32757 -prefMapHandle 5300 -prefMapSize 270173 -jsInitHandle 5304 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5256 -initialChannelId {ed307aab-bba9-40dc-8e52-ea8ecc1e1200} -parentPid 5792 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5792" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab5⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5716 -prefsLen 32757 -prefMapHandle 5720 -prefMapSize 270173 -jsInitHandle 5724 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5732 -initialChannelId {97919595-f3fc-4dee-a022-05ad42107da0} -parentPid 5792 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5792" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab5⤵
- Checks processor information in registry
-
-
-
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Active Setup
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Active Setup
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Masquerading
1Match Legitimate Name or Location
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
098cc6af-5c4c-4b4b-ac99-6910ba4d2740.tmp
2666921a-6506-4d90-97a4-0e30a242f09e.tmp
0a9620f3-ae7f-437b-bc3c-caca9b25831f.tmp
2fe51c4c-a2e8-4bd8-934a-9a1a3560f8c6.tmp
4bf161ef-e546-4e91-9c9e-e37e75a23191.tmp
6333e264-1504-4316-a81b-b3d65d3e6e51.tmp
787ae406-3d58-4125-a826-29820e5648a9.tmp
94ba1cf8-7b4c-4eb2-9ee2-816d8e24c954.tmp
955515b5-4946-47ff-8d8d-dab03db61e38.tmp
96550637-84f3-4909-9049-85be3704a663.tmp
f_00000b
f_00000c
f_00000d
f_00000e
f_000010
temp-index
messages.json
craw_background.js
CURRENT
MANIFEST-000001
000011.ldb
000012.log
000014.ldb
LOG
MANIFEST-000001
MANIFEST-000001
4fd1f9cb-c771-45d9-a6b2-8934197af9ca.tmp
87f4cfb5-a126-413f-a122-95b021436bc0.tmp
92ad5ac1-592b-40b7-b305-249783186b8e.tmp
92fa116e-134f-4f23-aba0-6a117604fcca.tmp
95fdb532-6cf4-4ebb-aa60-92c243bd8f79.tmp
ae63a95a-541f-4e64-a0a2-8e49c73e6051.tmp
be909ccc-c137-4ade-bbf4-8264c284d876.tmp
e20e7047-2153-4a46-947d-354c54bdf4b9.tmp
temp-index
temp-index
the-real-index
index.txt
index.txt.tmp
index.txt.tmp
index.txt.tmp
index.txt.tmp
index.txt.tmp
temp-index
temp-index
the-real-index
index
data_0
data_1
data_2
data_3
512.png
512.png
512.png
e201bd1d-4de2-49d1-bead-f58438e1e954.tmp
e7d976e4-cc80-4e2a-92fd-029b552c6569.tmp
f3beae41-80c3-4435-b79a-aab30a9acdae.tmp
a0bca417-a220-4941-9f91-086776a3ffe8.tmp
f495ae9d-8a12-4d33-853d-64202e186e41.tmp
f5f4abf0-6c20-4b69-8634-addb988794f3.tmp
activity-stream.contile.json
activity-stream.discovery_stream.json
activity-stream.discovery_stream.json
activity-stream.personalization.json
10722
14179
18946
24866
27870
2821
5289
E9338C5CCF1E2FCF149487351399F198A4F9FCD6
nb_model_build_attachment_arts_and_entertainment.json
nb_model_build_attachment_autos_and_vehicles.json
nb_model_build_attachment_beauty_and_fitness.json
nb_model_build_attachment_blogging_resources_and_services.json
nb_model_build_attachment_books_and_literature.json
nb_model_build_attachment_business_and_industrial.json
nb_model_build_attachment_computers_and_electronics.json
nb_model_build_attachment_finance.json
nb_model_build_attachment_food_and_drink.json
nb_model_build_attachment_games.json
nb_model_build_attachment_health.json
nb_model_build_attachment_hobbies_and_leisure.json
nb_model_build_attachment_home_and_garden.json
nb_model_build_attachment_internet_and_telecom.json
nb_model_build_attachment_jobs_and_education.json
nb_model_build_attachment_law_and_government.json
nb_model_build_attachment_online_communities.json
nb_model_build_attachment_people_and_society.json
nb_model_build_attachment_pets_and_animals.json
nb_model_build_attachment_real_estate.json
nb_model_build_attachment_reference.json
nb_model_build_attachment_science.json
nb_model_build_attachment_shopping.json
nb_model_build_attachment_sports.json
nb_model_build_attachment_travel.json
recipe_attachment.json
asrouter.ftl
webext.sc.lz4
webext.sc.lz4
prep_Activatable Class_Hermes_perf.cache
prep_Activatable Class_Hermes_perf.cache
a72ec81f-87df-4ed6-8655-20beb1a6ff67.tmp
e6af5e69-c190-48eb-b7a8-2cf2082cfaf4.zip
remote-settings-startup-bundle--1
messages.json
tmpaddon
tmpaddon
tmpaddon
6625IP9T1IJ8QNFR5QGO.temp
addonStartup.json.lz4
bookmarks-2026-10-22.jsonlz4
broadcast-listeners.json
broadcast-listeners.json
store.json.mozlz4
data.safe.bin
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
events
events
66299b4f-33c0-471f-b509-94a55e9a8822
bbe46b2b-c2f3-4e91-8bf0-f0fd10ead5d4
d5274270-8475-4308-a221-1eaacbf21810
dbc66c9d-48d9-4e2e-a0b8-f6a6b13ab98f
e30e2730-868c-4bd7-ba95-3a28b4b7153e
ec1b1717-5124-4ec2-9ec6-7bae6b6b87e0
extension-preferences.json
extensions.json
gmpopenh264.dll
gmpopenh264.info
LICENSE
manifest.json
widevinecdm.dll
widevinecdm.dll.sig
prefs-1.js
prefs.js
prefs.js
prefs.js
prefs.js
prefs.js
prefs.js
search.json.mozlz4
sessionCheckpoints.json
sessionCheckpoints.json
recovery.jsonlz4
recovery.jsonlz4
3870112724rsegmnoittet-es.sqlite
3870112724rsegmnoittet-es.sqlite
3870112724rsegmnoittet-es.sqlite
3870112724rsegmnoittet-es.sqlite
3870112724rsegmnoittet-es.sqlite
targeting.snapshot.json
svchost.exe
memory/3964-1-0x00007FF655CD0000-0x00007FF655D4B000-memory.dmp
memory/3980-1339-0x000000000CD90000-0x000000000CE23000-memory.dmp
memory/5856-1049-0x00007FF60E880000-0x00007FF60E8FB000-memory.dmp
memory/5856-1115-0x00007FF60E880000-0x00007FF60E8FB000-memory.dmp
memory/5856-1399-0x00007FF60E880000-0x00007FF60E8FB000-memory.dmp
memory/5856-1397-0x00007FF60E880000-0x00007FF60E8FB000-memory.dmp
memory/5856-1395-0x00007FF60E880000-0x00007FF60E8FB000-memory.dmp
memory/5856-1393-0x00007FF60E880000-0x00007FF60E8FB000-memory.dmp
memory/5856-1383-0x00007FF60E880000-0x00007FF60E8FB000-memory.dmp
memory/5856-1381-0x00007FF60E880000-0x00007FF60E8FB000-memory.dmp
memory/5856-1379-0x00007FF60E880000-0x00007FF60E8FB000-memory.dmp
memory/5856-1377-0x00007FF60E880000-0x00007FF60E8FB000-memory.dmp
memory/5856-1359-0x00007FF60E880000-0x00007FF60E8FB000-memory.dmp
memory/5856-1356-0x00007FF60E880000-0x00007FF60E8FB000-memory.dmp
memory/5856-1354-0x00007FF60E880000-0x00007FF60E8FB000-memory.dmp
memory/5856-1344-0x00007FF60E880000-0x00007FF60E8FB000-memory.dmp
memory/5856-1342-0x00007FF60E880000-0x00007FF60E8FB000-memory.dmp
memory/5856-1340-0x00007FF60E880000-0x00007FF60E8FB000-memory.dmp
memory/5856-1302-0x00007FF60E880000-0x00007FF60E8FB000-memory.dmp
memory/5856-1152-0x00007FF60E880000-0x00007FF60E8FB000-memory.dmp
memory/5856-1151-0x00007FF60E880000-0x00007FF60E8FB000-memory.dmp
memory/5856-1150-0x00007FF60E880000-0x00007FF60E8FB000-memory.dmp
memory/5856-1149-0x00007FF60E880000-0x00007FF60E8FB000-memory.dmp
memory/5856-1140-0x00007FF60E880000-0x00007FF60E8FB000-memory.dmp
memory/5856-1133-0x00007FF60E880000-0x00007FF60E8FB000-memory.dmp
memory/5856-1132-0x00007FF60E880000-0x00007FF60E8FB000-memory.dmp
memory/5856-1130-0x00007FF60E880000-0x00007FF60E8FB000-memory.dmp
memory/5856-1129-0x00007FF60E880000-0x00007FF60E8FB000-memory.dmp
memory/5856-1128-0x00007FF60E880000-0x00007FF60E8FB000-memory.dmp
memory/5856-1127-0x00007FF60E880000-0x00007FF60E8FB000-memory.dmp
memory/5856-1126-0x00007FF60E880000-0x00007FF60E8FB000-memory.dmp
memory/5856-1117-0x00007FF60E880000-0x00007FF60E8FB000-memory.dmp
memory/5856-1116-0x00007FF60E880000-0x00007FF60E8FB000-memory.dmp
memory/5856-1401-0x00007FF60E880000-0x00007FF60E8FB000-memory.dmp
memory/5856-1114-0x00007FF60E880000-0x00007FF60E8FB000-memory.dmp
memory/5856-1105-0x00007FF60E880000-0x00007FF60E8FB000-memory.dmp
memory/5856-1104-0x00007FF60E880000-0x00007FF60E8FB000-memory.dmp
memory/5856-1103-0x00007FF60E880000-0x00007FF60E8FB000-memory.dmp
memory/5856-1102-0x00007FF60E880000-0x00007FF60E8FB000-memory.dmp
memory/5856-1101-0x00007FF60E880000-0x00007FF60E8FB000-memory.dmp
memory/5856-1092-0x00007FF60E880000-0x00007FF60E8FB000-memory.dmp
memory/5856-1090-0x00007FF60E880000-0x00007FF60E8FB000-memory.dmp
memory/5856-1086-0x00007FF60E880000-0x00007FF60E8FB000-memory.dmp
memory/5856-1085-0x00007FF60E880000-0x00007FF60E8FB000-memory.dmp
memory/5856-1084-0x00007FF60E880000-0x00007FF60E8FB000-memory.dmp
memory/5856-1082-0x00007FF60E880000-0x00007FF60E8FB000-memory.dmp
memory/5856-1081-0x00007FF60E880000-0x00007FF60E8FB000-memory.dmp
memory/5856-1059-0x00007FF60E880000-0x00007FF60E8FB000-memory.dmp
memory/5856-1048-0x00007FF60E880000-0x00007FF60E8FB000-memory.dmp
memory/5856-916-0x00007FF60E880000-0x00007FF60E8FB000-memory.dmp
memory/5856-861-0x00007FF60E880000-0x00007FF60E8FB000-memory.dmp
memory/5856-647-0x00007FF60E880000-0x00007FF60E8FB000-memory.dmp
memory/5856-39-0x00007FF60E880000-0x00007FF60E8FB000-memory.dmp
memory/5856-7-0x00007FF60E880000-0x00007FF60E8FB000-memory.dmp
memory/5856-6-0x00007FF60E880000-0x00007FF60E8FB000-memory.dmp
memory/5856-5-0x00007FF60E880000-0x00007FF60E8FB000-memory.dmp
memory/5856-4-0x00007FF60E880000-0x00007FF60E8FB000-memory.dmp
memory/5856-3-0x00007FF60E880000-0x00007FF60E8FB000-memory.dmp
memory/5856-2-0x00007FF60E880000-0x00007FF60E8FB000-memory.dmp
memory/5920-1205-0x0000019008900000-0x0000019008920000-memory.dmp
memory/5920-1191-0x0000019018B70000-0x0000019018C70000-memory.dmp
memory/5920-1215-0x0000019018F80000-0x0000019018FA0000-memory.dmp
memory/5920-1189-0x00000190086A0000-0x00000190086C0000-memory.dmp
memory/5920-1173-0x0000019004F70000-0x0000019005070000-memory.dmp