Analysis
- user interaction
yes - max time kernel
1799s - max time network
1799s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
23/10/2026, 17:50
General
- Target zeynep-oktay-zeynep-sude-oktay.gif
- Size 3.6MB
- Sample261023-wevbxazsgv
- SHA256 482851377d81eba6b359cef2e968af3a0cc486cc4ef46716293b06878ac8ad43
Score
8/10
Malware Config
Signatures
- Downloads MZ/PE file 1 IoCs
- Executes dropped EXE 4 IoCs
- Loads dropped DLL 5 IoCs
- Uses Wuauclt to proxy-execute a DLL 1 TTPs 1 IoCs
Wuauclt is the Windows Update Auto Update Client. It can load update deployment providers to run a malicious DLL under a trusted Windows process.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Drops Chrome extension 2 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 9 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 19 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 4 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 64 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 14 IoCs
- Modifies Internet Explorer settings 1 TTPs 6 IoCs
- Modifies data under HKEY_USERS 41 IoCs
- Modifies registry class 48 IoCs
- Suspicious behavior: EnumeratesProcesses 26 IoCs
- Suspicious behavior: LoadsDriver 10 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 58 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 16 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\zeynep-oktay-zeynep-sude-oktay.gif1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff928e7c728,0x7ff928e7c734,0x7ff928e7c7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1668,i,15148482609630530720,10756445558537904180,262144 --field-trial-handle=1984,i,11181209760228075162,15322717785290316633,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1980 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1568,i,2833311280681656195,2644819676565859293,524288 --field-trial-handle=1984,i,11181209760228075162,15322717785290316633,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2224 /prefetch:32⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2368,i,13993522159817612090,8156639756283528689,524288 --field-trial-handle=1984,i,11181209760228075162,15322717785290316633,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2548 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3208,i,9983365302115902784,14244174070247944980,2097152 --field-trial-handle=1984,i,11181209760228075162,15322717785290316633,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3224 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3212,i,14810779803526217098,551971034173969300,2097152 --field-trial-handle=1984,i,11181209760228075162,15322717785290316633,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3268 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4404,i,3166042706563199151,4178742382422010115,2097152 --field-trial-handle=1984,i,11181209760228075162,15322717785290316633,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4408 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5284,i,15474218480206944306,9947575985766635690,524288 --field-trial-handle=1984,i,11181209760228075162,15322717785290316633,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5272 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Drops Chrome extension
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff928e7c728,0x7ff928e7c734,0x7ff928e7c7402⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1728,i,17864294383524194979,6956991231147780600,262144 --field-trial-handle=1784,i,16250388174793090729,621173970859864366,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1892 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2252,i,12734781199313912440,4982223137090498559,524288 --field-trial-handle=1784,i,16250388174793090729,621173970859864366,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2272 /prefetch:32⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2400,i,6109732847443635820,6476194662741067679,524288 --field-trial-handle=1784,i,16250388174793090729,621173970859864366,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2564 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3232,i,3271899189666778227,16219746242279407842,2097152 --field-trial-handle=1784,i,16250388174793090729,621173970859864366,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3244 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3252,i,8177181595077940818,8828352800921419118,2097152 --field-trial-handle=1784,i,16250388174793090729,621173970859864366,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3276 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4544,i,2988477627889656700,411340494275269087,2097152 --field-trial-handle=1784,i,16250388174793090729,621173970859864366,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4564 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5348,i,16367241430321740434,10334572089976102951,524288 --field-trial-handle=1784,i,16250388174793090729,621173970859864366,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5352 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5424,i,15586164431923640712,2720780444193236631,2097152 --field-trial-handle=1784,i,16250388174793090729,621173970859864366,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5472 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5704,i,12838954468177126233,1846653673566560177,2097152 --field-trial-handle=1784,i,16250388174793090729,621173970859864366,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5752 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3528,i,99326270595793509,10814491788197711106,2097152 --field-trial-handle=1784,i,16250388174793090729,621173970859864366,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3696 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5888,i,12669841694071639846,5345035910481029631,524288 --field-trial-handle=1784,i,16250388174793090729,621173970859864366,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5876 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5884,i,7443351813767210663,8862769444041797856,524288 --field-trial-handle=1784,i,16250388174793090729,621173970859864366,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5904 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5880,i,1459226469281560823,9718224648126525973,524288 --field-trial-handle=1784,i,16250388174793090729,621173970859864366,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4480 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5964,i,4578262830239784408,14057521842280991392,524288 --field-trial-handle=1784,i,16250388174793090729,621173970859864366,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4460 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5948,i,148956170990102308,15163999063688577156,524288 --field-trial-handle=1784,i,16250388174793090729,621173970859864366,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5928 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5940,i,7184263354041256353,12047544631295729266,524288 --field-trial-handle=1784,i,16250388174793090729,621173970859864366,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3904 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4460,i,11253194950087207770,4185200554302801615,524288 --field-trial-handle=1784,i,16250388174793090729,621173970859864366,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5876 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3668,i,1842625004309116657,17967732009465961228,524288 --field-trial-handle=1784,i,16250388174793090729,621173970859864366,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3920 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=3640,i,6803039067226173471,16438125199488467563,2097152 --field-trial-handle=1784,i,16250388174793090729,621173970859864366,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6016 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5892,i,2212102818020784561,888432339234050461,2097152 --field-trial-handle=1784,i,16250388174793090729,621173970859864366,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4712 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6188,i,171236084090523884,11237778457692298854,524288 --field-trial-handle=1784,i,16250388174793090729,621173970859864366,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6176 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6228,i,8377572036233511628,14682409296941067130,2097152 --field-trial-handle=1784,i,16250388174793090729,621173970859864366,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6312 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=6152,i,13622185933613335803,14697941742231535963,524288 --field-trial-handle=1784,i,16250388174793090729,621173970859864366,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6396 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=3280,i,951542383675927193,9087321498632504294,2097152 --field-trial-handle=1784,i,16250388174793090729,621173970859864366,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6028 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=5628,i,3324271409402535804,11613687842249815734,2097152 --field-trial-handle=1784,i,16250388174793090729,621173970859864366,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3268 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=7140,i,12162039070756997207,6402610803758164309,2097152 --field-trial-handle=1784,i,16250388174793090729,621173970859864366,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6884 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6692,i,9635355610248924282,9270214021083854546,524288 --field-trial-handle=1784,i,16250388174793090729,621173970859864366,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6848 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6844,i,11867326822372934171,11006292422074638345,524288 --field-trial-handle=1784,i,16250388174793090729,621173970859864366,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7104 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=7120,i,17863702000908823659,17501843547375549966,524288 --field-trial-handle=1784,i,16250388174793090729,621173970859864366,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5636 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=7004,i,13843955790436008644,12729448409499991180,524288 --field-trial-handle=1784,i,16250388174793090729,621173970859864366,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6844 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6720,i,17345828094238883753,16296397841952279955,524288 --field-trial-handle=1784,i,16250388174793090729,621173970859864366,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6996 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=6136,i,10697062168916770104,191915263932963715,2097152 --field-trial-handle=1784,i,16250388174793090729,621173970859864366,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6312 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --metrics-shmem-handle=5656,i,1255415871186407089,291362387529613378,2097152 --field-trial-handle=1784,i,16250388174793090729,621173970859864366,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5864 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6896,i,1480892908426522467,3311056089990646431,262144 --field-trial-handle=1784,i,16250388174793090729,621173970859864366,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6904 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --metrics-shmem-handle=1540,i,1344701739863834071,4368126802554949676,2097152 --field-trial-handle=1784,i,16250388174793090729,621173970859864366,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5868 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --metrics-shmem-handle=6548,i,14253823504521220297,13260906380817185678,2097152 --field-trial-handle=1784,i,16250388174793090729,621173970859864366,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5948 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --metrics-shmem-handle=7100,i,3331731492543089334,12681832941600176677,2097152 --field-trial-handle=1784,i,16250388174793090729,621173970859864366,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5924 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --metrics-shmem-handle=6348,i,8606265656684323879,17805105009958611407,2097152 --field-trial-handle=1784,i,16250388174793090729,621173970859864366,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6100 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=6976,i,680356454025934642,12298883619192310919,524288 --field-trial-handle=1784,i,16250388174793090729,621173970859864366,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6928 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --metrics-shmem-handle=6896,i,9220212594247256322,9476973210231166189,2097152 --field-trial-handle=1784,i,16250388174793090729,621173970859864366,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6428 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --metrics-shmem-handle=3556,i,14286859646665892442,783409965401408234,2097152 --field-trial-handle=1784,i,16250388174793090729,621173970859864366,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6644 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5352,i,10286015806286710534,4801413174434270431,524288 --field-trial-handle=1784,i,16250388174793090729,621173970859864366,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6336 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6336,i,3929409744850336836,5733138059950295427,524288 --field-trial-handle=1784,i,16250388174793090729,621173970859864366,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6896 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4108,i,14233941678137409456,10735284283415218804,524288 --field-trial-handle=1784,i,16250388174793090729,621173970859864366,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6716 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4104,i,16928681779529129547,13846737628772229481,524288 --field-trial-handle=1784,i,16250388174793090729,621173970859864366,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5880 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4420,i,16666638612725282759,17262305245871018278,524288 --field-trial-handle=1784,i,16250388174793090729,621173970859864366,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6336 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --metrics-shmem-handle=7128,i,1961960725266616662,5224207999595559688,2097152 --field-trial-handle=1784,i,16250388174793090729,621173970859864366,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6504 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=7048,i,15076735411048425152,6508051126770634465,524288 --field-trial-handle=1784,i,16250388174793090729,621173970859864366,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6720 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=7036,i,7549192648394555743,16628541758528673265,524288 --field-trial-handle=1784,i,16250388174793090729,621173970859864366,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5864 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6876,i,2495441862208169196,18051523297139456223,524288 --field-trial-handle=1784,i,16250388174793090729,621173970859864366,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6540 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6724,i,3307027534732403838,13478597469231947663,524288 --field-trial-handle=1784,i,16250388174793090729,621173970859864366,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6604 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6524,i,6677147757187742379,8888274014961762936,524288 --field-trial-handle=1784,i,16250388174793090729,621173970859864366,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6520 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --metrics-shmem-handle=6116,i,11392395620224480060,3516764028166826279,2097152 --field-trial-handle=1784,i,16250388174793090729,621173970859864366,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6536 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --metrics-shmem-handle=5996,i,8065422631954746099,16050702274517924360,2097152 --field-trial-handle=1784,i,16250388174793090729,621173970859864366,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6904 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --metrics-shmem-handle=6700,i,8847017720272323131,9874787421940537554,2097152 --field-trial-handle=1784,i,16250388174793090729,621173970859864366,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6216 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6652,i,10746419348715835081,995458323421233779,524288 --field-trial-handle=1784,i,16250388174793090729,621173970859864366,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7060 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5892,i,11371762380354781162,9447156061018684934,524288 --field-trial-handle=1784,i,16250388174793090729,621173970859864366,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6400 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6536,i,14336500113460541603,12258550313542368895,524288 --field-trial-handle=1784,i,16250388174793090729,621173970859864366,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6496 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=7112,i,5912069279297458656,15226865573293994462,524288 --field-trial-handle=1784,i,16250388174793090729,621173970859864366,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5848 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6104,i,2060590540262157456,11936198818745893262,524288 --field-trial-handle=1784,i,16250388174793090729,621173970859864366,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7064 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --metrics-shmem-handle=7040,i,14993386848328690011,5768477871464284659,2097152 --field-trial-handle=1784,i,16250388174793090729,621173970859864366,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1536 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --metrics-shmem-handle=6240,i,13542332756009503444,13810399285520348366,2097152 --field-trial-handle=1784,i,16250388174793090729,621173970859864366,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7324 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --metrics-shmem-handle=5980,i,6867421345624521743,18068915452305973456,2097152 --field-trial-handle=1784,i,16250388174793090729,621173970859864366,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7316 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6472,i,13701184623257992238,12608106945980641571,524288 --field-trial-handle=1784,i,16250388174793090729,621173970859864366,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6672 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5924,i,4065063764967258319,10147892124092044081,524288 --field-trial-handle=1784,i,16250388174793090729,621173970859864366,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6428 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6528,i,3035773229846177208,17107127594707603294,524288 --field-trial-handle=1784,i,16250388174793090729,621173970859864366,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6664 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6484,i,16686094030041948680,15236777305535601802,524288 --field-trial-handle=1784,i,16250388174793090729,621173970859864366,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1308 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6200,i,6582281530910383249,2330615397938859302,524288 --field-trial-handle=1784,i,16250388174793090729,621173970859864366,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7080 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=7552,i,15642421875279843020,12747957820746613608,524288 --field-trial-handle=1784,i,16250388174793090729,621173970859864366,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7364 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6216,i,14975752553842248891,7757868535766637995,524288 --field-trial-handle=1784,i,16250388174793090729,621173970859864366,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7588 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=7600,i,10902279807915924379,6847025144711512395,524288 --field-trial-handle=1784,i,16250388174793090729,621173970859864366,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7660 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=7656,i,1351046109664616756,8896534524946772644,524288 --field-trial-handle=1784,i,16250388174793090729,621173970859864366,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7672 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=7624,i,2051812093334401804,18095023861526637947,524288 --field-trial-handle=1784,i,16250388174793090729,621173970859864366,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7680 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --metrics-shmem-handle=7520,i,4074335611933303322,14658720254069821627,2097152 --field-trial-handle=1784,i,16250388174793090729,621173970859864366,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7608 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=7216,i,5113602505514847799,13333113625910044117,524288 --field-trial-handle=1784,i,16250388174793090729,621173970859864366,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7200 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --metrics-shmem-handle=7352,i,16089319590503008202,11090565420917138176,2097152 --field-trial-handle=1784,i,16250388174793090729,621173970859864366,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7412 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --metrics-shmem-handle=6592,i,12006221624651786620,10419172859452881031,2097152 --field-trial-handle=1784,i,16250388174793090729,621173970859864366,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7540 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --metrics-shmem-handle=8112,i,12702639335091808584,13186334255444634643,2097152 --field-trial-handle=1784,i,16250388174793090729,621173970859864366,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7392 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --metrics-shmem-handle=6148,i,15602259395453468845,12473243932298657322,2097152 --field-trial-handle=1784,i,16250388174793090729,621173970859864366,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4676 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4684,i,14607187499418331197,10335518163825046465,524288 --field-trial-handle=1784,i,16250388174793090729,621173970859864366,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4628 /prefetch:82⤵
- Modifies registry class
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --metrics-shmem-handle=4740,i,477945969016342907,4987385811166686699,2097152 --field-trial-handle=1784,i,16250388174793090729,621173970859864366,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4608 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=84 --metrics-shmem-handle=7312,i,11997178632342453567,11908861413109240845,2097152 --field-trial-handle=1784,i,16250388174793090729,621173970859864366,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6136 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=85 --metrics-shmem-handle=7720,i,830458758843181313,13145287091909708038,2097152 --field-trial-handle=1784,i,16250388174793090729,621173970859864366,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6940 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=86 --metrics-shmem-handle=4704,i,4307911587871922709,12923726417983462113,2097152 --field-trial-handle=1784,i,16250388174793090729,621173970859864366,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4696 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=87 --metrics-shmem-handle=6676,i,17961001941402475272,15749327897977697634,2097152 --field-trial-handle=1784,i,16250388174793090729,621173970859864366,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6296 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=88 --metrics-shmem-handle=6492,i,7427712414622630878,5738484152557925450,2097152 --field-trial-handle=1784,i,16250388174793090729,621173970859864366,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7424 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=89 --metrics-shmem-handle=5800,i,16769006786547020022,15069197993344234339,2097152 --field-trial-handle=1784,i,16250388174793090729,621173970859864366,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6924 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=90 --metrics-shmem-handle=5784,i,1130650475564332802,8576460288726159057,2097152 --field-trial-handle=1784,i,16250388174793090729,621173970859864366,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3568 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=91 --metrics-shmem-handle=3248,i,12740868290473774540,5935494145423025797,2097152 --field-trial-handle=1784,i,16250388174793090729,621173970859864366,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7380 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=92 --metrics-shmem-handle=7504,i,15557245050438414778,9684013712117884156,2097152 --field-trial-handle=1784,i,16250388174793090729,621173970859864366,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3580 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=93 --metrics-shmem-handle=5696,i,2129185522103196582,11982094198510045775,2097152 --field-trial-handle=1784,i,16250388174793090729,621173970859864366,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5720 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=94 --metrics-shmem-handle=7444,i,13149489467358134072,13724191883279675382,2097152 --field-trial-handle=1784,i,16250388174793090729,621173970859864366,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7976 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=3884,i,11709375389203885533,6250051875429829089,262144 --field-trial-handle=1784,i,16250388174793090729,621173970859864366,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1732 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\Downloads\RobloxPlayerInstaller-MDJ7997RFQ.exe"C:\Users\Admin\Downloads\RobloxPlayerInstaller-MDJ7997RFQ.exe"1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Roblox\Versions\version-9ac8595712b447a7\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-9ac8595712b447a7\RobloxPlayerBeta.exe" -personalizedToken MDJ7997RFQ --deeplink https://www.roblox.com/games/2753915549/Blox-Fruits --webBtid 1792777920605003 --downloadSource installer --authenticationTicket RRKx0fmC7dZQDaYq7imdNavPn1AbZFNj21ZjvN6wnxfnZ9ysfcxzUYwXYTfIo63Q283OwXsEANj6S9wPu_lDwR09fw4e6DdNbTzECWz5fIhEzKQ-lqWfMaH-zzcyFtRjCkGCljT4SUDmP2JFEV0184MI-jJmOi5skd0HnJh-8HQk6sMNuUWb5xKGI9yly8DBjs2Wbjw2AjHyZkbtFyEHGLFvh7pXaFayT0e93W148QzBpIotWhyGp7_qEeRx25FUriXlWxWNOhMbigoVx-08VIPvfZRONL0UYM2RXRBLsp8pHSjoZfpWA1ayyf7_4HN4iSTRF5wad6McJFgmdIsTKJjGP_yx0Xj_p2Ea-8M0jFAZThKvDv43qrsbBw7u1A694ozDaNz2X955VJNhjjM2-885BAszCerXA_ZuHPRwm6VQ_Dh6EwjCiI-wjQBMVlqpKIuhzmWI8x4YxVcnbwNjT_VrAgYBUYD2M6VZcv1Ia-EkCHxMn1z3hTdaSaK3PWE-oqONp9zw333Nl0FVrwua0lqusAiG1joSMV2bip76iz4 -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 41842⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefaultf543d6a0h40eeh42a1h87b4hbcdda038c7211⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefaultf543d6a0h40eeh42a1h87b4hbcdda038c721 --edge-skip-compat-layer-relaunch2⤵
- Enumerates system info in registry
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x244,0x7ff9082fc188,0x7ff9082fc194,0x7ff9082fc1a03⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1916,i,13098413420030649603,2300225409607080262,524288 --field-trial-handle=2204,i,766162088456445046,13610527444177526810,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:33⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,8930257970434417741,17624518619648840591,262144 --field-trial-handle=2204,i,766162088456445046,13610527444177526810,262144 --variations-seed-version --mojo-platform-channel-handle=2200 /prefetch:23⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2460,i,1816324142117221587,12083277373503334447,524288 --field-trial-handle=2204,i,766162088456445046,13610527444177526810,262144 --variations-seed-version --mojo-platform-channel-handle=2552 /prefetch:83⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -s LxpSvc1⤵
-
C:\Windows\System32\FodHelper.exeC:\Windows\System32\FodHelper.exe -Embedding1⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:21⤵
-
C:\Windows\system32\wuauclt.exe"C:\Windows\system32\wuauclt.exe" /UpdateDeploymentProvider UpdateDeploymentProvider.dll /ClassId aace33f4-6084-4020-84ab-2fb9d79d7a5e /RunHandlerComServer1⤵
- Loads dropped DLL
- Uses Wuauclt to proxy-execute a DLL
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2004 -prefsLen 27099 -prefMapHandle 2008 -prefMapSize 270279 -ipcHandle 2084 -initialChannelId {f98ec203-3f38-4133-8a08-bdb68eeb20e7} -parentPid 6468 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6468" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2496 -prefsLen 27135 -prefMapHandle 2500 -prefMapSize 270279 -ipcHandle 2360 -initialChannelId {cf61fd1d-4425-4b16-b0df-a2a6a0de9d01} -parentPid 6468 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6468" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3672 -prefsLen 27276 -prefMapHandle 3676 -prefMapSize 270279 -jsInitHandle 3680 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3688 -initialChannelId {6d5b1331-9c3b-4cb9-9034-3751dad0b905} -parentPid 6468 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6468" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3864 -prefsLen 27276 -prefMapHandle 3868 -prefMapSize 270279 -ipcHandle 3712 -initialChannelId {a09db2d6-b318-46d8-a302-cd7164553732} -parentPid 6468 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6468" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2916 -prefsLen 34775 -prefMapHandle 3584 -prefMapSize 270279 -jsInitHandle 4284 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4292 -initialChannelId {39e0c258-c9a6-46d7-a9a1-0b1bd7146b78} -parentPid 6468 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6468" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4820 -prefsLen 35012 -prefMapHandle 4800 -prefMapSize 270279 -ipcHandle 1632 -initialChannelId {1bc30ee7-fd85-4c3d-87a5-1a909eb10473} -parentPid 6468 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6468" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4956 -prefsLen 32900 -prefMapHandle 4960 -prefMapSize 270279 -jsInitHandle 5004 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5012 -initialChannelId {a63df4ed-6111-419e-966e-7ce99505d093} -parentPid 6468 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6468" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5036 -prefsLen 32900 -prefMapHandle 5040 -prefMapSize 270279 -jsInitHandle 5044 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5052 -initialChannelId {7b912837-04b5-4549-94ab-3f7dd9a57e42} -parentPid 6468 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6468" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5484 -prefsLen 32952 -prefMapHandle 5488 -prefMapSize 270279 -jsInitHandle 5492 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5500 -initialChannelId {b7b02913-e45a-4c6a-85c6-9de7d776693a} -parentPid 6468 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6468" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6112 -prefsLen 33071 -prefMapHandle 2788 -prefMapSize 270279 -jsInitHandle 6368 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6156 -initialChannelId {169576af-ed65-4fd1-9072-aca1e1dead1c} -parentPid 6468 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6468" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6500 -prefsLen 36885 -prefMapHandle 4512 -prefMapSize 270279 -jsInitHandle 6524 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6536 -initialChannelId {7ee11925-b921-4afd-94fd-db932fc4ceed} -parentPid 6468 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6468" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5172 -prefsLen 36885 -prefMapHandle 5248 -prefMapSize 270279 -jsInitHandle 5236 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5244 -initialChannelId {a554f969-5c4f-4297-9b3b-1e58ab40c95d} -parentPid 6468 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6468" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 1 -prefsHandle 6776 -prefsLen 40024 -prefMapHandle 6780 -prefMapSize 270279 -ipcHandle 6764 -initialChannelId {a7c548fe-e90c-488e-969a-3b852128c7a9} -parentPid 6468 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6468" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 utility3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6964 -prefsLen 36885 -prefMapHandle 6968 -prefMapSize 270279 -jsInitHandle 6972 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6980 -initialChannelId {ef52d111-f6e6-4b3f-9d16-f69578bd84db} -parentPid 6468 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6468" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 2 -prefsHandle 7008 -prefsLen 40024 -prefMapHandle 6996 -prefMapSize 270279 -ipcHandle 7224 -initialChannelId {3ca3c68c-d902-4ca9-b414-321d76e1cbfa} -parentPid 6468 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6468" -appDir "C:\Program Files\Mozilla Firefox\browser" - 15 utility3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7440 -prefsLen 36885 -prefMapHandle 7444 -prefMapSize 270279 -jsInitHandle 7448 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6520 -initialChannelId {71bf4d9c-561e-4d7d-9b22-7566121cc177} -parentPid 6468 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6468" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 16 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6212 -prefsLen 36885 -prefMapHandle 5968 -prefMapSize 270279 -jsInitHandle 4616 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6168 -initialChannelId {6bc72b9d-f47a-43a9-8500-637d93737088} -parentPid 6468 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6468" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 17 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6436 -prefsLen 36885 -prefMapHandle 6336 -prefMapSize 270279 -jsInitHandle 6164 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6064 -initialChannelId {2b2f7ef5-9042-46bf-8d22-b7e09e8a2fa0} -parentPid 6468 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6468" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 18 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7892 -prefsLen 36885 -prefMapHandle 7896 -prefMapSize 270279 -jsInitHandle 7900 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7908 -initialChannelId {96cb2b8a-4f3f-48c2-b407-5745210d91c4} -parentPid 6468 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6468" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 19 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8068 -prefsLen 36885 -prefMapHandle 8064 -prefMapSize 270279 -jsInitHandle 8060 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6164 -initialChannelId {387e34d3-cda7-4726-bf5a-901d74f84ae3} -parentPid 6468 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6468" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 20 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8236 -prefsLen 36885 -prefMapHandle 8240 -prefMapSize 270279 -jsInitHandle 8244 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8188 -initialChannelId {3e0fcab7-1e7b-4456-8c1b-0d3009990508} -parentPid 6468 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6468" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 21 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8404 -prefsLen 36885 -prefMapHandle 8400 -prefMapSize 270279 -jsInitHandle 8444 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8456 -initialChannelId {05af847d-02b9-4534-97a5-9db9535a3298} -parentPid 6468 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6468" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 22 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6948 -prefsLen 36885 -prefMapHandle 7260 -prefMapSize 270279 -jsInitHandle 7272 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7228 -initialChannelId {31523b20-41a3-4dda-9b98-b11153314319} -parentPid 6468 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6468" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 23 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8456 -prefsLen 36885 -prefMapHandle 7272 -prefMapSize 270279 -jsInitHandle 8696 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8176 -initialChannelId {07d2bf27-1a88-49d7-adc9-1771439ad9fc} -parentPid 6468 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6468" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 24 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4592 -prefsLen 36885 -prefMapHandle 6432 -prefMapSize 270279 -jsInitHandle 6092 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8048 -initialChannelId {6c9ec0ef-c08e-4d41-98f3-440d94598d71} -parentPid 6468 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6468" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 25 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6564 -prefsLen 36885 -prefMapHandle 7824 -prefMapSize 270279 -jsInitHandle 3652 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8032 -initialChannelId {0fd2a0d2-5a9e-40ec-a8a3-521a895aea02} -parentPid 6468 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6468" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 26 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5544 -prefsLen 36885 -prefMapHandle 5540 -prefMapSize 270279 -jsInitHandle 5556 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5548 -initialChannelId {59365cc9-5e8f-449c-aecf-99a86e41177a} -parentPid 6468 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6468" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 27 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7844 -prefsLen 36885 -prefMapHandle 7836 -prefMapSize 270279 -jsInitHandle 7872 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2676 -initialChannelId {5351a6db-4005-44df-98fd-0cbd487f9708} -parentPid 6468 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6468" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 28 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6548 -prefsLen 36885 -prefMapHandle 5532 -prefMapSize 270279 -jsInitHandle 8632 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7156 -initialChannelId {c3ebad97-d4e6-40d4-affd-80c3da7fcb40} -parentPid 6468 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6468" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 29 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8460 -prefsLen 36885 -prefMapHandle 8464 -prefMapSize 270279 -jsInitHandle 8560 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6960 -initialChannelId {603bc3e7-8b85-4b20-9326-23842c95180e} -parentPid 6468 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6468" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 30 tab3⤵
- Checks processor information in registry
-
-
-
C:\Program Files\Roblox\Versions\version-9ac8595712b447a7\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-9ac8595712b447a7\RobloxPlayerBeta.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Roblox\Versions\version-9ac8595712b447a7\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-9ac8595712b447a7\RobloxPlayerBeta.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\Ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\Ngen.exe Update /Queue /Delay1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\Ngen.exe Update /Queue /Delay1⤵
- Drops file in Windows directory
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c82192ee-6cb5-4bc0-9ef0-fb818773790a} -Embedding1⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff928e7c728,0x7ff928e7c734,0x7ff928e7c7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1832,i,6298399449394261298,7368647929047791269,262144 --field-trial-handle=1980,i,8184832152560303812,2649712561250771320,262144 --variations-seed-version=20261023-010040.137000-production --mojo-platform-channel-handle=1976 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2236,i,15792897910955611450,7417605345310871821,524288 --field-trial-handle=1980,i,8184832152560303812,2649712561250771320,262144 --variations-seed-version=20261023-010040.137000-production --mojo-platform-channel-handle=2240 /prefetch:32⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2368,i,1973516470855169084,145605883407469435,524288 --field-trial-handle=1980,i,8184832152560303812,2649712561250771320,262144 --variations-seed-version=20261023-010040.137000-production --mojo-platform-channel-handle=2484 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3252,i,1277319222813126170,16169278601451471464,2097152 --field-trial-handle=1980,i,8184832152560303812,2649712561250771320,262144 --variations-seed-version=20261023-010040.137000-production --mojo-platform-channel-handle=3248 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3292,i,12105626101006947165,16106260053036867680,2097152 --field-trial-handle=1980,i,8184832152560303812,2649712561250771320,262144 --variations-seed-version=20261023-010040.137000-production --mojo-platform-channel-handle=3300 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4556,i,14068528876691040416,15399642969886881869,2097152 --field-trial-handle=1980,i,8184832152560303812,2649712561250771320,262144 --variations-seed-version=20261023-010040.137000-production --mojo-platform-channel-handle=4592 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5320,i,13966154458426598404,17733438414943792191,524288 --field-trial-handle=1980,i,8184832152560303812,2649712561250771320,262144 --variations-seed-version=20261023-010040.137000-production --mojo-platform-channel-handle=5324 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5584,i,8001048879858117173,9601091070820587692,2097152 --field-trial-handle=1980,i,8184832152560303812,2649712561250771320,262144 --variations-seed-version=20261023-010040.137000-production --mojo-platform-channel-handle=5316 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5704,i,11572017301700933401,10418153858637079424,2097152 --field-trial-handle=1980,i,8184832152560303812,2649712561250771320,262144 --variations-seed-version=20261023-010040.137000-production --mojo-platform-channel-handle=5656 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3508,i,1414857331236717263,346634699181681181,2097152 --field-trial-handle=1980,i,8184832152560303812,2649712561250771320,262144 --variations-seed-version=20261023-010040.137000-production --mojo-platform-channel-handle=5696 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=3424,i,7936690397966278490,8498589413354906332,2097152 --field-trial-handle=1980,i,8184832152560303812,2649712561250771320,262144 --variations-seed-version=20261023-010040.137000-production --mojo-platform-channel-handle=5892 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=3512,i,10947617995525568319,7219670149291788868,2097152 --field-trial-handle=1980,i,8184832152560303812,2649712561250771320,262144 --variations-seed-version=20261023-010040.137000-production --mojo-platform-channel-handle=3488 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5976,i,13908985303831629459,16780142536857123073,524288 --field-trial-handle=1980,i,8184832152560303812,2649712561250771320,262144 --variations-seed-version=20261023-010040.137000-production --mojo-platform-channel-handle=5876 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5888,i,9302395475122487044,12931112148806000470,524288 --field-trial-handle=1980,i,8184832152560303812,2649712561250771320,262144 --variations-seed-version=20261023-010040.137000-production --mojo-platform-channel-handle=5912 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3468,i,14513623805572657855,11432683999047813897,524288 --field-trial-handle=1980,i,8184832152560303812,2649712561250771320,262144 --variations-seed-version=20261023-010040.137000-production --mojo-platform-channel-handle=5572 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5904,i,5416502094729916975,6891093541868603644,524288 --field-trial-handle=1980,i,8184832152560303812,2649712561250771320,262144 --variations-seed-version=20261023-010040.137000-production --mojo-platform-channel-handle=5320 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5940,i,12665054309447572024,17375950039440775023,524288 --field-trial-handle=1980,i,8184832152560303812,2649712561250771320,262144 --variations-seed-version=20261023-010040.137000-production --mojo-platform-channel-handle=5616 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5508,i,9672281874631917922,7743275567177798424,524288 --field-trial-handle=1980,i,8184832152560303812,2649712561250771320,262144 --variations-seed-version=20261023-010040.137000-production --mojo-platform-channel-handle=3108 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4080,i,3092673218837017003,15558850643655360687,524288 --field-trial-handle=1980,i,8184832152560303812,2649712561250771320,262144 --variations-seed-version=20261023-010040.137000-production --mojo-platform-channel-handle=3360 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4044,i,16809758786467913710,17164810053421153696,524288 --field-trial-handle=1980,i,8184832152560303812,2649712561250771320,262144 --variations-seed-version=20261023-010040.137000-production --mojo-platform-channel-handle=5608 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5608,i,9692897794158993201,15407176412430831693,2097152 --field-trial-handle=1980,i,8184832152560303812,2649712561250771320,262144 --variations-seed-version=20261023-010040.137000-production --mojo-platform-channel-handle=5508 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=5896,i,6125069222624776385,1575453510851758541,2097152 --field-trial-handle=1980,i,8184832152560303812,2649712561250771320,262144 --variations-seed-version=20261023-010040.137000-production --mojo-platform-channel-handle=6028 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5836,i,13126283552592994343,2427733672058796368,524288 --field-trial-handle=1980,i,8184832152560303812,2649712561250771320,262144 --variations-seed-version=20261023-010040.137000-production --mojo-platform-channel-handle=6060 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6060,i,10370222787845399779,16607227998149989832,524288 --field-trial-handle=1980,i,8184832152560303812,2649712561250771320,262144 --variations-seed-version=20261023-010040.137000-production --mojo-platform-channel-handle=6236 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6220,i,12166292424293493547,16427041573457444149,524288 --field-trial-handle=1980,i,8184832152560303812,2649712561250771320,262144 --variations-seed-version=20261023-010040.137000-production --mojo-platform-channel-handle=5836 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5848,i,1090963157348996668,13395978447090919128,524288 --field-trial-handle=1980,i,8184832152560303812,2649712561250771320,262144 --variations-seed-version=20261023-010040.137000-production --mojo-platform-channel-handle=6176 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3432,i,16007799429523168374,15337877500680092805,524288 --field-trial-handle=1980,i,8184832152560303812,2649712561250771320,262144 --variations-seed-version=20261023-010040.137000-production --mojo-platform-channel-handle=6200 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=3264,i,1903420673521067921,11790104051592888797,2097152 --field-trial-handle=1980,i,8184832152560303812,2649712561250771320,262144 --variations-seed-version=20261023-010040.137000-production --mojo-platform-channel-handle=5848 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5688,i,10479697047604139412,9506922054995952690,262144 --field-trial-handle=1980,i,8184832152560303812,2649712561250771320,262144 --variations-seed-version=20261023-010040.137000-production --mojo-platform-channel-handle=5500 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵
Network
MITRE ATT&CK Enterprise v16
Discovery
Browser Information Discovery
1Debugger Evasion
1Peripheral Device Discovery
1Query Registry
5System Information Discovery
5System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1System Time Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
RobloxStudioInstaller.exe
0c224d33-0e5c-43a1-b0f4-9e170450c838.tmp
13a55659-06e5-451d-ab88-2b5c4d9364ae.tmp
16b04192-d85b-40c1-a8b9-e35bb7906fad.tmp
209648a4-bec3-4791-9fdf-909ab9c5c241.tmp
2dc30f7d-e92d-4e12-9066-a3ac9713c028.tmp
46ce651c-e010-471f-b865-0665ae124580.tmp
4a7822a8-20a3-4fb9-bd9f-32bf31c83fcd.tmp
535f1d7d-b796-4c8f-9f8d-8bdc601e5d5d.tmp
6ca0df4e-892b-45e5-8ee0-09b04a3b73ca.tmp
74175500-4eeb-4fcb-a863-d512a6f5d17f.tmp
7bee1eac-1cc6-44c9-9a2d-c70ddd99efbf.tmp
7e8ee375-cd16-44f6-b63a-e5e9a2a98c63.tmp
87c47ca3-3716-4576-9b6d-c2c9fe06bfe4.tmp
CrashpadMetrics-active.pma
metadata
7bfad661-c985-4faa-a19f-2f339ea2c1fa.dmp
settings.dat
03e26dc0-47bf-4730-ac05-a9ad6c8f02e1.tmp
087bb88f-d7c7-4233-97f7-f18b0caeb90d.tmp
09528f46-01d5-4d86-b39d-4ae726d01fc8.tmp
18a0cfac-5cdb-4b54-92e4-068449e1fdad.tmp
20484265-5515-4f6b-857b-bd9b2d80e4a7.tmp
247b524a-c339-47ff-93fa-e6dd23b7850a.tmp
2c506a18-5218-4f36-8c7e-6aefd0234bd6.tmp
30cbe775-7cb3-42f8-b009-489865296ca0.tmp
48343285-7e3d-4cf8-a00f-cd0e0eae837d.tmp
4aaadda2-159a-4461-bb2c-44cc93f7d048.tmp
56bdc149-a979-4a09-8e56-9d7d77bb38f5.tmp
643b1d76-fdfe-4e44-87e6-7bc02d5ccf88.tmp
660a5a86-e725-46bb-9613-230f2cf1ab15.tmp
6809e3c4-6720-406e-aaaa-399fb6ecb39e.tmp
6b5484e9-842e-466a-804e-7b154d304ef8.tmp
71a9bf0c-27c1-406c-9688-699c971cbe48.tmp
77ded1fc-192f-43d9-a914-a4cc4546f114.tmp
86d0859f-c595-4115-b473-00ccc908305e.tmp
8f28866d-7f85-469e-860c-911ec4704b06.tmp
973c2c65-a853-4c02-9a33-f71efa780f79.tmp
data_0
data_1
data_2
data_3
f_000005
f_000008
f_00000a
f_00000c
f_000010
f_000013
f_000016
f_00002a
f_00002b
f_00002c
f_000032
f_000033
f_000034
f_000035
f_000038
f_00003b
f_00003c
f_00003d
f_00003e
f_00003f
f_000040
f_000041
f_000042
f_000043
f_000044
f_000045
f_00004a
f_00004c
f_00004f
f_000055
f_000078
f_000079
f_00007a
f_00007b
f_00007c
f_00007d
f_00007e
f_00007f
f_000080
f_000081
f_000082
f_000083
f_000084
f_000085
f_000087
f_000088
f_00008a
f_00008b
f_00008c
f_00008d
f_00008e
f_00008f
f_000090
f_000091
f_000092
f_000093
f_000094
f_000095
f_000096
f_000097
f_000098
f_000099
f_00009a
f_00009b
f_00009d
f_00009e
f_0000a0
f_0000a1
f_0000a9
f_0000aa
f_0000ab
f_0000ac
f_0000ad
f_0000ae
f_0000af
f_0000b0
f_0000b1
f_0000b2
f_0000b3
f_0000b5
f_00017a
f_00017c
f_00017d
f_00017e
f_00017f
f_000180
f_000181
f_000182
f_000183
f_000184
f_000185
f_000186
f_000187
f_000188
f_000189
f_00018a
f_00018b
f_00018c
f_00018d
f_00018e
f_00018f
f_000190
f_000191
f_000192
f_000193
f_000194
f_000195
f_000196
f_000197
f_000198
f_000199
f_00019a
f_00019b
f_00019c
f_00019d
f_00019e
f_00019f
f_0001a0
f_0001a1
f_0001a2
f_0001a3
f_0001a4
f_0001a5
f_0001a6
f_0001a7
f_0001a8
f_0001a9
f_0001aa
f_0001ab
f_0001ac
f_0001ad
f_0001ae
f_0001af
f_0001b0
f_0001b1
f_0001b2
f_0001b3
f_0001b4
f_0001b5
f_0001b6
f_0001b7
f_0001b8
f_0001b9
f_0001ba
f_0001bb
f_0001bc
f_0001bd
f_0001be
f_0001bf
f_0001c0
f_0001c1
f_0001c2
f_0001c3
f_0001c4
f_0001c5
f_0001c6
f_0001c7
f_0001c8
f_0001c9
f_0001ca
f_0001cb
f_0001cc
f_0001cd
f_0001ce
f_0001cf
f_0001d0
f_0001d1
f_0001d2
f_0001d3
f_0001d4
f_0001d5
f_0001d6
f_0001d7
f_0001d8
f_0001d9
f_0001da
f_0001db
f_0001dc
f_0001dd
f_0001de
f_0001df
f_0001e0
f_0001e1
f_0001e2
f_0001e3
f_0001e4
f_0001e5
f_0001e6
f_0001e7
f_0001e8
f_0001e9
f_0001ea
f_0001eb
f_0001ec
f_0001ed
f_0001ee
f_0001ef
f_0001f0
f_0001f1
f_0001f2
f_0001f3
f_0001f4
f_0001f5
f_0001f6
f_0001f7
f_0001f8
f_0001f9
f_0001fa
f_0001fb
f_0001fc
f_0001fd
f_0001fe
f_0001ff
f_000200
f_000201
f_000202
f_000203
f_000204
f_000205
f_000206
f_000207
f_000208
f_000209
f_00020a
f_00020b
f_00020c
f_00020d
f_00020e
f_00020f
f_000210
f_000211
f_000212
f_000213
f_000214
f_000215
f_000216
f_000217
f_000218
f_000219
f_00021a
f_00021b
f_00021c
f_00021d
f_00021e
f_00021f
f_000220
f_000221
f_000222
f_000223
f_000224
f_000225
f_000226
f_000227
f_000228
f_000229
f_00022a
f_00022b
f_00022c
f_00022d
f_00022e
f_00022f
f_000230
f_000231
f_000232
f_000233
f_000234
f_000235
f_000236
f_000237
f_000238
f_000239
f_00023a
f_00023b
f_00023c
f_00023d
f_00023e
f_0003c6
f_00048d
f_00048e
f_000491
f_00049a
f_00049c
f_0004aa
f_0004ab
f_0004ac
f_0004ad
f_0004ae
f_0004af
f_0004b0
f_0004b1
f_0004c1
f_0004c5
f_00058d
f_00058e
f_00058f
f_000590
f_000591
f_000592
f_000593
f_000664
f_00067b
f_00068b
f_00068c
f_00068d
f_00068f
f_000690
f_000692
f_000693
f_0006cc
f_0006d1
f_0006d2
f_000701
f_000702
f_000714
f_000734
CdmStorage.db
04ad8d30f93dc63d_0
189e190e018e5d60_0
1abe8d446362f1b0_0
1bcecdcc35fb169c_0
2edeb88b4d1820bb_0
304755a05497f9a8_0
42d1a53900159970_0
46f789cd7bd5cf06_0
605c7bb0902cbd26_0
69237b9f581abafb_0
7a337661e2933325_0
8ce0c42fa6062393_0
8fa68734b7bcc94f_0
9a65fb5fc738c520_0
a9ba2766f5eca421_0
b0fe78249d01ded3_0
ba02431d6fadb43a_0
c6f9c052c386fdfc_0
d98d4f3f50866a33_0
e3db129568451977_0
e45a75230cbd4eae_0
e76e111880941a2c_0
f8de8a8c70934d5f_0
fc460f8e20bb2c92_0
temp-index
temp-index
temp-index
temp-index
temp-index
temp-index
temp-index
temp-index
DIPS
LOG
manifest.json
messages.json
main.js
settings.html
manifest.json
service-worker.js
popup.html
content.js
index.html
logo.png
manifest.json
script.js
style.css
icon.png
background.js
content.js
content2.js
manifest.json
popup.html
rules_1.json
000003.log
LOG
LOG
History
000004.log
000005.ldb
CURRENT
LOG
MANIFEST-000001
MANIFEST-000001
LOG
0274d9e0-fc5f-4f7a-ad8b-e328ffbce726.tmp
08f5b59b-82ed-4d65-acad-935ac495bade.tmp
0a30f44e-1284-4e7a-a29d-06bcfe9cc912.tmp
20af2bea-56f0-40d1-bceb-bcbe64f22f5a.tmp
34e15852-19c0-4165-a290-801e7deb433c.tmp
5222bb5b-818f-444a-8a09-0e1496bfe79e.tmp
62d18c22-c45b-4fce-9de2-f7dc21b066a4.tmp
8818fbb9-5fa6-43c5-a196-2d21c05cd075.tmp
89fdaf02-65b9-4a6b-97d0-4ebde81352cc.tmp
8b2bade1-cbf2-4077-a3d3-3728a00a4f0d.tmp
8be61164-0e03-470a-b782-94c71e42947f.tmp
8cf784cd-8e12-4ae7-8a3a-17ec8a2568d4.tmp
9804922a-45be-4d43-8751-22e59bde2160.tmp
Cookies
Reporting and NEL
d63d552b-5bd7-405b-8778-25cd004e76a5.tmp
dbe79d14-fea2-44b6-9d71-3c3b99ddc5ca.tmp
f5260720-073b-412f-86a1-f211500b2925.tmp
LOG
temp-index
the-real-index
index.txt
index.txt.tmp
000003.log
LOG
temp-index
temp-index
temp-index
temp-index
temp-index
the-real-index
000003.log
LOG
Session_13437251454332406
Tabs_13437251459217406
temp-index
LOG
LOG
Web Data
Web Data-journal
the-real-index
index.txt
index.txt.tmp
000003.log
LOG.old
MANIFEST-000001
QuotaManager
QuotaManager-journal
ab9050c1-1f0a-492c-80aa-78957e426f61.tmp
ad4a0aca-446d-4c62-88e4-a1f874ff327a.tmp
ae5481f4-4338-4f75-875f-1f8341d8b004.tmp
b99dc985-b6ca-4a83-8dba-a4e04626ee54.tmp
bb38b615-3c86-441d-8cb6-1872de8abbd0.tmp
cc89df8b-64b1-40ed-b0c2-f7ca6f83fb47.tmp
d1f461af-3caa-46e9-9239-08047344f543.tmp
d4e3d504-e457-475b-b4f8-f46bfd571f7e.tmp
e3a93c6b-90d6-4cc0-a9e5-2d3913b46a62.tmp
e40ea7a9-f8eb-4032-a9c8-c04931bdb383.tmp
fc9039ef-e2cd-4ab9-9a15-db082d06c61d.tmp
000003.log
LOG
000003.log
LOG
data_1
Last Browser
Last Version
Variations
icdbahmpfjhbccfjhhbckaapbbjggogp_10934.crx
mpkdmplemknfcmgpcjfaflogdcojcema_7988.crx
aa4558f5-d5b8-4813-a874-7f95794d547d.tmp
ad0a0507-dd6f-47bf-93d9-33d57cb4a79c.tmp
bc39deab-2bdd-4b36-93b3-c3821bc24351.tmp
bccab935-71a7-4ad2-96a9-1562b2e180d3.tmp
c13298bb-319e-4a10-b899-4302b7927dab.tmp
c7291dda-b2b4-430c-838a-b936e372a5ca.tmp
d3f48b63-ab25-413b-9fe1-3f6edec2afe6.tmp
e7fa5c75-9cf5-4fdc-a031-32f11e6e82b5.tmp
ef01e505-3652-4b6a-8107-7c107c349b30.tmp
f2780857-f4f6-4e12-b2c5-f3c31194681d.tmp
fefca04b-3071-43b1-afd8-fdf3ada00416.tmp
first_party_sets.db
first_party_sets.db-journal
020f0899-715a-47c1-91f4-3357e3a3aefe.tmp
3e068e8e-b337-43b4-bdc3-4db417c67310.tmp
3593d980-765a-474e-9a53-77d8c06e6aba.tmp
35817d3b-7554-4fb3-8fba-276eaa2b1a18.tmp
cd7d51b9-ea6f-45b1-9f1c-79ef856f974c.tmp
b01e2ec0-6eff-4074-ad5f-9b1be4718647.tmp
activity-stream.contile.json
activity-stream.discovery_stream.json
activity-stream.discovery_stream.json
activity-stream.weather_feed.json
11541
13765
14803
14927
16246
21531
22328
23129
25248
27588
28105
28459
29673
2975
30387
4861
8876
15648F475CD0217846F10D6774586C35794A7720
2880EA6A342A51B382E7FEE1928353DFF356BC94
3CA9428188222AFDB7C7F24C3A7B5A0FE71F2625
3EDDA4487B7BB0FA688CCAD556998906EC4B89A1
49BB092627E74D9F7F7103B469492D0756A6281A
4B134ABF1289DCC5EAF886C43CC75323CC8E1590
60FDB32EEAC2E0BC3778955426BE2E9B1B7656C6
655792F2EA77C8C6289EC98A2483ADDB78BA0BD3
79D2BD2E4E5883C3B556376CEDB57D34EBE28DBB
90D492C9DAA6BD441FDABF1899F412C947274DB8
AA2572B320CC11F99432337CB020B54C752257AA
AAAA9913CF3A19BC81A7B0EBA4648FD380BB095E
ABCEA0A31D30058FAEAA468BB79EAC8C3BC65AF2
B9EA966D15ACA96BB084248FAAB297BD11EB78AD
BE6F08F32DB6C889C3C019E926B2E515215DFF55
C30874BD97B565B8BCD9082FB86E5F45793A5365
C6924D314F5F204A8D1B88F1813ED3EDC7908AD1
D5057E6AD6834D5391A24AFFC99289D4120B907A
E2E41CA3E48D2627D2A1C76828444D9215432E1A
E9338C5CCF1E2FCF149487351399F198A4F9FCD6
F0D643EF6B9C2AF7A13E21040859BA661F0FB452
F491AF5FDFBA2136A791400E168AE52D1B17292A
F6D56D30EA3947ADEA3631C7D94C457F4E0864DF
webext.sc.lz4
webext.sc.lz4
theme_ntp_background.jpg
manifest.json
fgiaibpabhdkjenjhgpmgcieobcjaonj_61081.crx
verified_contents.json
theme_ntp_background.jpg
bfkddaggabgkfkmgglhobiipoapmkekk_38154.crx
verified_contents.json
theme_frame.png
theme_ntp_background.jpg
theme_tab_background.png
theme_toolbar.png
README.md
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
verified_contents.json
fake_verified_loader.js
icon128.png
icon128.png
icon16.png
icon32.png
icon48.png
manifest.json
reset_cache.js
settings.js
settings.json
thank_you.html
thank_you.js
kediboibmfffkllcmgemojpkphmokaea_33998.crx
theme_frame.png
theme_tab_background.png
theme_toolbar.png
jeafcbgcfpijmojcfbpfakeebmpheodk_43353.crx
logo.png
eckkigjljmmomedimeajklflhbikodhh_5806.crx
verified_contents.json
flamingo.png
fulllogo.png
icon128.png
icon16.png
icon16.png
icon32.png
icon32.png
icon48.png
icon48.png
manifest.json
adapters.js
detector.js
main.js
shield.css
shield.js
popup.css
popup.js
ext.js
journey.js
keywords.js
nowplaying.js
scene.svg
settings.js
tokens.css
trophies.js
card.js
trophies.css
trophies.html
trophies.js
fjlphfamanblaepnmikmpmkcplnckipm_60799.crx
tmpaddon
tmpaddon
tmpaddon
default.dic
5d696d521de238c3.customDestinations-ms
5d696d521de238c3.customDestinations-ms
BKZ1Y0XU23ZJAT1UG0N8.temp
G8NQ1NDCNEXZG5KIXH6Z.temp
Q8A1GCK7CH968OUT4A9R.temp
UTN8O3RTNXK1Y4GJMA4L.temp
AlternateServices.bin
AlternateServices.bin
AlternateServices.bin
AlternateServices.bin
AlternateServices.bin
AlternateServices.bin
addonStartup.json.lz4
store.json.mozlz4
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
events
events
0e36e0c0-8e09-4e0c-a91a-75dae8b402f1
15b97800-1270-4808-9df8-f83222c3fd54
64ab3545-7ed4-4613-a03e-babff6d28943
86dd477c-1005-4283-8c4b-be70d88f67f8
8f9d8789-5a7d-460f-a3bf-23c1717d47c6
b1c7b8f9-f4d7-420c-9304-2a3cd4b08a0a
c879f5e1-2bf0-4f11-a8ce-0c5dd6b6447f
extension-preferences.json
extensions.json
gmpopenh264.dll
gmpopenh264.info
LICENSE
manifest.json
widevinecdm.dll
widevinecdm.dll.sig
places.sqlite
prefs-1.js
prefs-1.js
prefs.js
prefs.js
prefs.js
prefs.js
prefs.js
sessionCheckpoints.json
sessionCheckpoints.json
sessionCheckpoints.json
sessionCheckpoints.json
sessionCheckpoints.json
sessionCheckpoints.json
sessionCheckpoints.json
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
sessionstore.jsonlz4
3870112724rsegmnoittet-es.sqlite
3870112724rsegmnoittet-es.sqlite
3870112724rsegmnoittet-es.sqlite
3870112724rsegmnoittet-es.sqlite
3870112724rsegmnoittet-es.sqlite
3870112724rsegmnoittet-es.sqlite
3870112724rsegmnoittet-es.sqlite
targeting.snapshot.json
xulstore.json
xulstore.json
Unconfirmed 439499.crdownload
d3d4ef8f-734f-48b8-8b67-58fd6b119327.tmp