Analysis
- user interaction
yes - max time kernel
899s - max time network
903s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
24/10/2026, 22:07
General
- Target VencordInstaller.exe
- Size 11.0MB
- Sample261024-1146fsxtew
- SHA256 1cb4115a99a8b7a0b0371dddb2ac7dde38b9acc23f53a69540319b4b7ca6c2da
Score
8/10
Malware Config
Signatures
- Downloads MZ/PE file 2 IoCs
- Drops file in Drivers directory 2 IoCs
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 6 IoCs
- Loads dropped DLL 12 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Probable phishing domain 1 TTPs 1 IoCs
- Drops file in Program Files directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Inno Setup is an open-source installation builder for Windows applications. 4 IoCs
Inno Setup installer
- Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies registry class 64 IoCs
- Modifies system certificate store 2 TTPs 18 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 2 IoCs
- Suspicious behavior: LoadsDriver 6 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 45 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 51 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\VencordInstaller.exe"C:\Users\Admin\AppData\Local\Temp\VencordInstaller.exe"1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff84d89c728,0x7ff84d89c734,0x7ff84d89c7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1744,i,8418414916684401090,4164042783366838738,262144 --field-trial-handle=2112,i,13786214112484869019,10228512897227391108,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2108 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1604,i,2026312052376330605,1823329031953524509,524288 --field-trial-handle=2112,i,13786214112484869019,10228512897227391108,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2124 /prefetch:32⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2352,i,6572078088505900348,15931429511956172652,524288 --field-trial-handle=2112,i,13786214112484869019,10228512897227391108,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2576 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3244,i,2043056353786319582,14921358000295398433,2097152 --field-trial-handle=2112,i,13786214112484869019,10228512897227391108,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3240 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3436,i,331623081064421284,6214509046151607211,2097152 --field-trial-handle=2112,i,13786214112484869019,10228512897227391108,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3472 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4472,i,18010528706373355378,13757468541429817496,2097152 --field-trial-handle=2112,i,13786214112484869019,10228512897227391108,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4484 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4660,i,6667170254540284620,11677496120001747263,524288 --field-trial-handle=2112,i,13786214112484869019,10228512897227391108,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4712 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4872,i,2465147245180903261,16107807161421384511,2097152 --field-trial-handle=2112,i,13786214112484869019,10228512897227391108,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4888 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5528,i,9089003979109331327,158203480236014218,524288 --field-trial-handle=2112,i,13786214112484869019,10228512897227391108,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5536 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5660,i,13228669806690449533,9181285549720534386,524288 --field-trial-handle=2112,i,13786214112484869019,10228512897227391108,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5680 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5884,i,18203306797926462415,10922682138491012327,524288 --field-trial-handle=2112,i,13786214112484869019,10228512897227391108,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5596 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5528,i,9887431650350194265,2771549724943434408,524288 --field-trial-handle=2112,i,13786214112484869019,10228512897227391108,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5684 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5652,i,8309294965796265116,1567843167479100394,2097152 --field-trial-handle=2112,i,13786214112484869019,10228512897227391108,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5692 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5744,i,12916633420474558395,6938487813150312578,2097152 --field-trial-handle=2112,i,13786214112484869019,10228512897227391108,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6012 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=4944,i,5365793731207555728,5180955188858301635,2097152 --field-trial-handle=2112,i,13786214112484869019,10228512897227391108,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5000 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=3592,i,3111800355903037501,861606012575282233,2097152 --field-trial-handle=2112,i,13786214112484869019,10228512897227391108,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3572 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=4648,i,15768944640581687522,16895458361979991757,2097152 --field-trial-handle=2112,i,13786214112484869019,10228512897227391108,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3248 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5780,i,16991150134770230355,17888437781734457242,524288 --field-trial-handle=2112,i,13786214112484869019,10228512897227391108,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5732 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=2452,i,11686709683901298999,10000498976006841648,524288 --field-trial-handle=2112,i,13786214112484869019,10228512897227391108,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6048 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5580,i,3844420367628900268,3178641345735027143,524288 --field-trial-handle=2112,i,13786214112484869019,10228512897227391108,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6540 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6252,i,7962997745136442352,343961118864716606,524288 --field-trial-handle=2112,i,13786214112484869019,10228512897227391108,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6236 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=4512,i,15546240667926364639,9368611814582935478,2097152 --field-trial-handle=2112,i,13786214112484869019,10228512897227391108,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4592 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=5984,i,1874456123430138301,15246828854575114447,2097152 --field-trial-handle=2112,i,13786214112484869019,10228512897227391108,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6568 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6108,i,15722146804712698837,12713343402902039855,2097152 --field-trial-handle=2112,i,13786214112484869019,10228512897227391108,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6152 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=6552,i,13459629419552325656,10885662906053875343,2097152 --field-trial-handle=2112,i,13786214112484869019,10228512897227391108,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3580 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=6148,i,3606800696296642659,16427145011388868077,2097152 --field-trial-handle=2112,i,13786214112484869019,10228512897227391108,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4576 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=3460,i,6635925162198851698,10328646781824580850,2097152 --field-trial-handle=2112,i,13786214112484869019,10228512897227391108,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6788 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=3484,i,17380099861975876963,5723620274475165092,2097152 --field-trial-handle=2112,i,13786214112484869019,10228512897227391108,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5584 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=3524,i,9321893184539509987,10288291519322193643,2097152 --field-trial-handle=2112,i,13786214112484869019,10228512897227391108,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6428 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=5800,i,14193411162096751286,11161492491587405728,2097152 --field-trial-handle=2112,i,13786214112484869019,10228512897227391108,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5960 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=6556,i,10021763919418949497,15246825776126553728,2097152 --field-trial-handle=2112,i,13786214112484869019,10228512897227391108,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6188 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=4532,i,18182384689241682081,10312981414484550749,2097152 --field-trial-handle=2112,i,13786214112484869019,10228512897227391108,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7400 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --metrics-shmem-handle=7308,i,16748210048715976217,16600263026236374877,2097152 --field-trial-handle=2112,i,13786214112484869019,10228512897227391108,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6764 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6808,i,8391826357256534620,7100450958588409770,524288 --field-trial-handle=2112,i,13786214112484869019,10228512897227391108,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6900 /prefetch:82⤵
- Modifies registry class
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=7236,i,2956049595401738820,15073242909431983319,524288 --field-trial-handle=2112,i,13786214112484869019,10228512897227391108,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4512 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6816,i,612359729521274982,10847718983009068032,524288 --field-trial-handle=2112,i,13786214112484869019,10228512897227391108,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6840 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=7800,i,11806717188039894458,3389415440619179488,524288 --field-trial-handle=2112,i,13786214112484869019,10228512897227391108,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7792 /prefetch:82⤵
-
-
C:\Users\Admin\Downloads\processhacker-2.39-setup.exe"C:\Users\Admin\Downloads\processhacker-2.39-setup.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\is-U1QGL.tmp\processhacker-2.39-setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-U1QGL.tmp\processhacker-2.39-setup.tmp" /SL5="$10004C,1874675,150016,C:\Users\Admin\Downloads\processhacker-2.39-setup.exe"3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
-
C:\Program Files\Process Hacker 2\ProcessHacker.exe"C:\Program Files\Process Hacker 2\ProcessHacker.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SendNotifyMessage
-
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=7408,i,18355757910767335774,15609224452314968210,262144 --field-trial-handle=2112,i,13786214112484869019,10228512897227391108,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7624 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --metrics-shmem-handle=7500,i,17443313440514907940,9094634937471006332,2097152 --field-trial-handle=2112,i,13786214112484869019,10228512897227391108,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7744 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --metrics-shmem-handle=7688,i,12547571194082043478,9548482130658805583,2097152 --field-trial-handle=2112,i,13786214112484869019,10228512897227391108,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7800 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --metrics-shmem-handle=8076,i,13239254199928835863,10835370487812351576,2097152 --field-trial-handle=2112,i,13786214112484869019,10228512897227391108,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=8084 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=7832,i,13623694101598525407,9923647652507317336,524288 --field-trial-handle=2112,i,13786214112484869019,10228512897227391108,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7484 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=7796,i,197484467315804949,2831971053705565996,524288 --field-trial-handle=2112,i,13786214112484869019,10228512897227391108,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7492 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --metrics-shmem-handle=6776,i,9990694622026512782,10036649640341438763,2097152 --field-trial-handle=2112,i,13786214112484869019,10228512897227391108,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6160 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --metrics-shmem-handle=4472,i,11676449385860492164,8943337038673183722,2097152 --field-trial-handle=2112,i,13786214112484869019,10228512897227391108,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7400 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --metrics-shmem-handle=7744,i,4341337485960656195,5140235513863843871,2097152 --field-trial-handle=2112,i,13786214112484869019,10228512897227391108,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7984 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --metrics-shmem-handle=7592,i,2830434277987343836,9961385425530419228,2097152 --field-trial-handle=2112,i,13786214112484869019,10228512897227391108,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4544 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --metrics-shmem-handle=8316,i,18146562412582143452,15235655947911692766,2097152 --field-trial-handle=2112,i,13786214112484869019,10228512897227391108,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=8288 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5700,i,10091851926232987901,7523957511938949934,524288 --field-trial-handle=2112,i,13786214112484869019,10228512897227391108,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=8388 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --metrics-shmem-handle=7840,i,1386798749952814834,6512929279357512874,2097152 --field-trial-handle=2112,i,13786214112484869019,10228512897227391108,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7584 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --metrics-shmem-handle=8032,i,8247900975109658058,3874746672351377018,2097152 --field-trial-handle=2112,i,13786214112484869019,10228512897227391108,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7924 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --metrics-shmem-handle=7748,i,7067410815286688566,5370099352727706417,2097152 --field-trial-handle=2112,i,13786214112484869019,10228512897227391108,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4148 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --metrics-shmem-handle=6180,i,18321277604638419745,6171216303842004830,2097152 --field-trial-handle=2112,i,13786214112484869019,10228512897227391108,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=8112 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --metrics-shmem-handle=8472,i,18305007266909856906,3197859023698197008,2097152 --field-trial-handle=2112,i,13786214112484869019,10228512897227391108,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=8412 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=8324,i,15951108024681148576,3079001496254745438,524288 --field-trial-handle=2112,i,13786214112484869019,10228512897227391108,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=8348 /prefetch:82⤵
-
-
C:\Users\Admin\Downloads\7z2605-x64.exe"C:\Users\Admin\Downloads\7z2605-x64.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies registry class
-
-
C:\Users\Admin\Downloads\7z2605-x64.exe"C:\Users\Admin\Downloads\7z2605-x64.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies registry class
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --metrics-shmem-handle=8432,i,10608303401752747549,11943398105934330338,2097152 --field-trial-handle=2112,i,13786214112484869019,10228512897227391108,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=8324 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --metrics-shmem-handle=6252,i,1352087172516532964,10490771101123584064,2097152 --field-trial-handle=2112,i,13786214112484869019,10228512897227391108,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6512 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --metrics-shmem-handle=8068,i,4840800291393778935,772476180828445665,2097152 --field-trial-handle=2112,i,13786214112484869019,10228512897227391108,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7928 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --metrics-shmem-handle=8436,i,14017339891284588926,8043775206228752207,2097152 --field-trial-handle=2112,i,13786214112484869019,10228512897227391108,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=8548 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --metrics-shmem-handle=7976,i,16390245101475331911,13680532802270699487,2097152 --field-trial-handle=2112,i,13786214112484869019,10228512897227391108,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=8472 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --metrics-shmem-handle=8104,i,13017917452194785640,13523211528264040286,2097152 --field-trial-handle=2112,i,13786214112484869019,10228512897227391108,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=8272 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --metrics-shmem-handle=8568,i,3156496395623500485,16180146757896003563,2097152 --field-trial-handle=2112,i,13786214112484869019,10228512897227391108,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=8064 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --metrics-shmem-handle=8268,i,1544638057640862622,4491038226505645251,2097152 --field-trial-handle=2112,i,13786214112484869019,10228512897227391108,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7332 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --metrics-shmem-handle=6748,i,12576109133535075897,15367198475423552611,2097152 --field-trial-handle=2112,i,13786214112484869019,10228512897227391108,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=8476 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --metrics-shmem-handle=8396,i,13903336758586200876,13351545362270559166,2097152 --field-trial-handle=2112,i,13786214112484869019,10228512897227391108,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=8488 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --metrics-shmem-handle=4508,i,3102866484823949229,16639402223418768262,2097152 --field-trial-handle=2112,i,13786214112484869019,10228512897227391108,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5640 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files\Process Hacker 2\kprocesshacker.sys"C:\Program Files\Process Hacker 2\kprocesshacker.sys"1⤵
- Executes dropped EXE
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Downloads\New folder\UninstallToolPortable.exe"C:\Users\Admin\Downloads\New folder\UninstallToolPortable.exe"1⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\Downloads\New folder\UninstallTool_x64.dat"C:\Users\Admin\Downloads\New folder\UninstallTool_x64.dat"2⤵
- Drops file in Drivers directory
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Downloads\New folder\UninstallToolHelper.exe"C:\Users\Admin\Downloads\New folder\UninstallToolHelper.exe" /pid:53403⤵
- System Location Discovery: System Language Discovery
-
-
Network
MITRE ATT&CK Enterprise v16
Defense Evasion
Modify Registry
1Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
7-zip.chm
7-zip.dll.tmp2
7-zip32.dll
7z.dll
7z.exe
7z.sfx
7zCon.sfx
7zFM.exe
7zG.exe
History.txt
af.txt
an.txt
ar.txt
ast.txt
az.txt
ba.txt
be.txt
bg.txt
bn.txt
br.txt
ca.txt
co.txt
cs.txt
cy.txt
da.txt
de.txt
el.txt
en.ttt
eo.txt
es.txt
et.txt
eu.txt
ext.txt
fa.txt
fi.txt
fr.txt
fur.txt
fy.txt
ga.txt
gl.txt
gu.txt
he.txt
hi.txt
hr.txt
hu.txt
hy.txt
id.txt
io.txt
is.txt
it.txt
ja.txt
ka.txt
kaa.txt
kab.txt
kk.txt
ko.txt
ku-ckb.txt
ku.txt
ky.txt
lij.txt
lt.txt
lv.txt
mk.txt
mn.txt
mng.txt
mng2.txt
mr.txt
ms.txt
nb.txt
ne.txt
nl.txt
nn.txt
pa-in.txt
pl.txt
ps.txt
pt-br.txt
pt.txt
ro.txt
ru.txt
sa.txt
si.txt
sk.txt
sl.txt
sq.txt
sr-spc.txt
sr-spl.txt
sv.txt
sw.txt
ta.txt
tg.txt
th.txt
tk.txt
tr.txt
tt.txt
ug.txt
uk.txt
uz-cyrl.txt
uz.txt
va.txt
vi.txt
yo.txt
zh-cn.txt
zh-tw.txt
License.txt
Uninstall.exe
descript.ion
readme.txt
CHANGELOG.txt
ProcessHacker.exe
ProcessHacker.sig
peview.exe
DotNetTools.dll
ExtendedNotifications.dll
ExtendedServices.dll
ExtendedTools.dll
HardwareDevices.dll
unins000.exe
0e3f0586-6791-4dee-8b7d-772cb29384a8.tmp
2751e867-2fa7-4fec-ab07-32e69ef27a65.tmp
2d8da5ef-b1b6-48e4-a923-e46b37ba06dd.tmp
5c324a38-5c69-4324-b82d-7ac31b74b078.tmp
5f2b4820-8c56-4ebd-af4d-4121137cb44e.tmp
6021c137-a15c-4406-9f29-3bf26dd3bbe3.tmp
70753bc7-d08c-48cf-a926-cbdbe7cf8bb4.tmp
77f201ac-edac-4fb3-a6fc-ec7486c24442.tmp
8cae54c0-26b4-488d-b4c3-ea4dc7626fec.tmp
8e9586c8-e882-458b-a957-67b2be2ba267.tmp
9183d276-e4c8-48c2-817b-31e14f373666.tmp
05e9449d-aa63-49ab-b7b3-7394ffce0fb8.tmp
0806faab-f83a-4280-9471-be37522fea61.tmp
0ba9a472-fc2e-4632-bbd7-61569cb563a4.tmp
0e45cf48-8041-43fe-b33c-fc4311d1a02f.tmp
16c11079-1c67-4759-b8dc-8e53ed43f7b2.tmp
24f5e52f-3354-42a6-9b83-cd90f9290187.tmp
2f0f709e-4af7-4485-a173-e26246d4bc4d.tmp
34554afc-e0b5-4936-9a77-143c88c2987d.tmp
3d95c160-cbe4-4941-bbce-eb27af1dbea0.tmp
48b05fa3-91ce-4f0a-9391-e790ff8bc09a.tmp
52efa2af-5d89-432b-9864-c5f5666162f6.tmp
54eeae21-c110-4584-8733-b64bf7948105.tmp
5953f8d1-7437-4c7c-b7fd-2305618cd3fd.tmp
76dd1e4a-03da-4a8a-8a19-989355a76d12.tmp
7b24bf80-349b-4eae-a160-f7531875e91c.tmp
f_000005
f_000007
f_000009
f_00000a
f_00000b
f_000016
f_000017
f_000022
f_000023
f_000024
f_000025
f_000026
f_000027
f_000028
f_000029
f_00002d
f_00002e
f_00002f
f_000030
f_000031
f_000032
f_000033
f_00003a
f_00003d
f_00003e
f_000046
f_000047
f_000048
f_000049
f_00004b
f_00004c
f_00004d
f_00004f
f_000050
f_000053
f_000054
f_000057
f_000058
f_000064
f_000065
f_000069
f_00006a
f_000077
f_000078
f_000079
f_00007a
f_00007b
f_00007c
f_00007d
f_00007e
f_00007f
f_000080
f_000081
f_000082
f_000083
f_000084
f_000085
f_000086
f_000087
f_00009d
f_00009e
f_0000ac
f_0000b3
e248a41e8151d7ea_0
temp-index
temp-index
temp-index
temp-index
the-real-index
messages.json
craw_background.js
000014.ldb
000015.log
000017.ldb
LOG
LOG
MANIFEST-000001
MANIFEST-000001
732fccf8-2e9c-4fc4-b563-57f12c7f6318.tmp
0f128aff-19ed-4cc9-b308-5ad514932cbd.tmp
14aadbe8-1a2a-44b3-bdd7-8856df761ef7.tmp
2e361cc5-c583-47b5-9b15-d1ad25c7f6d8.tmp
504fc318-3f95-454f-af42-638b58181724.tmp
7b9556e9-0e1d-43c4-8e75-b6f349ac4d0a.tmp
dbbc7bf0-7329-42cb-a880-4b8b6d40c956.tmp
e83ea38b-45ff-4841-89c5-e5b66c9a38e8.tmp
f2efcd05-46d7-4e05-a9eb-7b8aaf86f66e.tmp
799896942fd42cf3_0
799896942fd42cf3_1
edf9fa60ca7d8131_0
edf9fa60ca7d8131_1
temp-index
the-real-index
the-real-index
2e2413a06637b0ec_0
9fd5f62bf71b3d75_0
b2141b088ee5e98c_0
index
temp-index
temp-index
temp-index
the-real-index
index.txt
index.txt.tmp
index.txt.tmp
index.txt.tmp
index.txt.tmp
index.txt.tmp
index.txt.tmp
index.txt.tmp
index.txt.tmp
index.txt.tmp
013888a1cda32b90_0
b6c28cea6ed9dfc1_0
temp-index
temp-index
the-real-index
9ed67082e994aa86_0
d265e33758016e28_0
temp-index
temp-index
temp-index
temp-index
index
data_0
data_1
data_2
data_3
CURRENT
MANIFEST-000001
192.png
512.png
16.png
32.png
48.png
512.png
128.png
144.png
192.png
256.png
32.png
48.png
64.png
96.png
aa53cba1-76c5-4e5a-9675-0b81da0ea811.tmp
b43e59b9-6eaa-4baa-90ff-265cb415540c.tmp
b8c650ff-b171-4600-93da-9e8ae4d6acdb.tmp
0
eda0a13b-fdf1-4048-9be1-170f66c84aea.tmp
bf6d98f3-8ad0-4b36-9ebd-a55d69b7cb70.tmp
d2cbea16-324a-4700-bcaa-f41ce4f9bd7d.tmp
fa061755-b939-47af-b9a8-03a2f49d1474.tmp
0cb69823-aeaf-4bf0-81c8-65f9928732c3.tmp
processhacker-2.39-setup.tmp
messages.json
28DLX168S57W41CP1I63.temp
5d696d521de238c3.customDestinations-ms
OTJ1DJ2EGQG528923G3G.temp
QHR4QRFQTO6MRH0E1SKC.temp
518e06cf-8795-4b02-8a28-f85e35fad168.tmp
bd2c2b63-7484-4541-98c4-d0d63eb38286.tmp
processhacker-2.39-setup.exe
uninstalltool_portable.zip.crdownload
CisUtMonitor.sys
memory/1316-0-0x00007FF7CB210000-0x00007FF7CE5AE000-memory.dmp
memory/3396-1602-0x0000000000400000-0x00000000004D4000-memory.dmp
memory/3396-2496-0x0000000000400000-0x00000000004D4000-memory.dmp
memory/3908-2498-0x0000000000400000-0x000000000042B000-memory.dmp
memory/3908-1359-0x0000000000400000-0x000000000042B000-memory.dmp
memory/3908-1601-0x0000000000400000-0x000000000042B000-memory.dmp
memory/5184-3330-0x0000000000400000-0x0000000000474000-memory.dmp
memory/5184-3296-0x0000000000400000-0x0000000000474000-memory.dmp
memory/6032-2497-0x0000000000010000-0x000000000001B000-memory.dmp