Overview

overview

10

Static

static

3

v2.4.zip

windows10-2004-x64

1

v2.4.zip

windows11-21h2-x64

10

Analysis

  • user interaction
    yes
  • max time kernel
    881s
  • max time network
    879s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260130-en
  • resource tags

    arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    11/05/2026, 21:53

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    v2.4.zip
  • Size 22.0MB
  • Sample260511-1rppeaaz81
  • SHA256 54680d0325b38fb057f82984b320bc9666f3b3073c3db0a9629a841d608c8751
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwarecredential_accessdefense_evasiondiscoveryexecutionpersistenceransomwarespywarestealertrojanupx

Malware Config

Signatures

  • Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Downloads MZ/PE file 2 IoCs
  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Drops startup file 2 IoCs
  • Executes dropped EXE 22 IoCs
  • Loads dropped DLL 13 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 64 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 2 IoCs
  • Drops file in Windows directory 64 IoCs
  • Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 2 IoCs

    When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

    defense_evasion
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

    A root certificate was added, modified, or removed in the trusted certificate store registry paths.

    defense_evasion
  • System Location Discovery: System Language Discovery 1 TTPs 18 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 3 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 11 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
    defense_evasionspywaretrojan
  • NTFS ADS 3 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 37 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 16 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
      PID:2848
      • C:\Windows\system32\rundll32.exe
        "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,Control_RunDLL C:\Windows\System32\srchadmin.dll ,
        2⤵
          PID:2280
        • C:\Windows\system32\taskhostw.exe
          "C:\Windows\system32\taskhostw.exe"
          2⤵
          • Checks processor information in registry
          PID:5348
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe"
            3⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:5940
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
            3⤵
              PID:2916
          • C:\Windows\system32\taskhostw.exe
            "C:\Windows\system32\taskhostw.exe"
            2⤵
            • Checks processor information in registry
            PID:5728
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe"
              3⤵
                PID:4888
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                3⤵
                  PID:5408
            • C:\Windows\Explorer.exe
              C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\v2.4.zip
              1⤵
                PID:2648
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k LocalService -p -s fdPHost
                1⤵
                  PID:1708
                • C:\Windows\System32\rundll32.exe
                  C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                  1⤵
                    PID:4968
                  • C:\Windows\SysWOW64\DllHost.exe
                    C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
                    1⤵
                    • System Location Discovery: System Language Discovery
                    PID:3088
                  • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
                    "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
                    1⤵
                    • Modifies registry class
                    • Suspicious use of SetWindowsHookEx
                    PID:1368
                  • C:\Windows\system32\control.exe
                    "C:\Windows\system32\control.exe" SYSTEM
                    1⤵
                    • Modifies registry class
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2152
                  • C:\Windows\SysWOW64\DllHost.exe
                    C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
                    1⤵
                    • System Location Discovery: System Language Discovery
                    PID:3384
                  • C:\Windows\explorer.exe
                    C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding
                    1⤵
                    • Modifies Internet Explorer settings
                    • Modifies registry class
                    PID:3580
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
                    1⤵
                      PID:2800
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe"
                      1⤵
                      • Enumerates system info in registry
                      • Modifies data under HKEY_USERS
                      • Modifies registry class
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of FindShellTrayWindow
                      • Suspicious use of SendNotifyMessage
                      • Suspicious use of WriteProcessMemory
                      PID:1716
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff4ab7c728,0x7fff4ab7c734,0x7fff4ab7c740
                        2⤵
                          PID:4428
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1468,i,17882380750112992203,13124500138549003477,524288 --field-trial-handle=2024,i,9866067195809777469,13891983387036603881,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2056 /prefetch:11
                          2⤵
                          • Downloads MZ/PE file
                          • System Time Discovery
                          PID:2480
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1644,i,18274707433070316984,9065239785131146919,262144 --field-trial-handle=2024,i,9866067195809777469,13891983387036603881,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1996 /prefetch:2
                          2⤵
                            PID:2120
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2336,i,9621928902348337799,4228281397195209340,524288 --field-trial-handle=2024,i,9866067195809777469,13891983387036603881,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2348 /prefetch:13
                            2⤵
                              PID:4712
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3248,i,4139412306830131114,17934170426806032893,2097152 --field-trial-handle=2024,i,9866067195809777469,13891983387036603881,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3288 /prefetch:1
                              2⤵
                                PID:3172
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3312,i,1546916716453426711,12719243118861575010,2097152 --field-trial-handle=2024,i,9866067195809777469,13891983387036603881,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3336 /prefetch:1
                                2⤵
                                  PID:4388
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4108,i,3081764130133379449,14713775364298391515,2097152 --field-trial-handle=2024,i,9866067195809777469,13891983387036603881,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4128 /prefetch:9
                                  2⤵
                                    PID:2632
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4696,i,596896528265249359,2249415742182894145,2097152 --field-trial-handle=2024,i,9866067195809777469,13891983387036603881,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4692 /prefetch:1
                                    2⤵
                                      PID:3684
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5460,i,18341581110826542872,12817572667952093827,524288 --field-trial-handle=2024,i,9866067195809777469,13891983387036603881,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5464 /prefetch:14
                                      2⤵
                                        PID:4380
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5768,i,6398119952349604891,17638633522529790712,524288 --field-trial-handle=2024,i,9866067195809777469,13891983387036603881,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5704 /prefetch:14
                                        2⤵
                                          PID:4100
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5660,i,17217867556112511792,8493191856884275197,524288 --field-trial-handle=2024,i,9866067195809777469,13891983387036603881,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5500 /prefetch:14
                                          2⤵
                                            PID:3964
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5672,i,10685102642460891988,7530078965445873207,524288 --field-trial-handle=2024,i,9866067195809777469,13891983387036603881,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5676 /prefetch:14
                                            2⤵
                                              PID:2768
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5968,i,7101591609579223966,13643215990610249249,2097152 --field-trial-handle=2024,i,9866067195809777469,13891983387036603881,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5972 /prefetch:1
                                              2⤵
                                                PID:824
                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=3348,i,16330860914389828388,3165383534423487149,2097152 --field-trial-handle=2024,i,9866067195809777469,13891983387036603881,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3508 /prefetch:1
                                                2⤵
                                                  PID:3176
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5940,i,10905350848823421101,10745258224340385702,2097152 --field-trial-handle=2024,i,9866067195809777469,13891983387036603881,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3372 /prefetch:1
                                                  2⤵
                                                    PID:3252
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=3384,i,3191425306558833084,3470429068918278356,2097152 --field-trial-handle=2024,i,9866067195809777469,13891983387036603881,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4576 /prefetch:1
                                                    2⤵
                                                      PID:4980
                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=3328,i,5723145796831547532,5234881056871379886,2097152 --field-trial-handle=2024,i,9866067195809777469,13891983387036603881,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3848 /prefetch:1
                                                      2⤵
                                                        PID:4436
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5748,i,9844663699564725474,5671516486721217269,2097152 --field-trial-handle=2024,i,9866067195809777469,13891983387036603881,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5804 /prefetch:1
                                                        2⤵
                                                          PID:236
                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6016,i,3577869932274869910,5699056325241175821,2097152 --field-trial-handle=2024,i,9866067195809777469,13891983387036603881,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6176 /prefetch:1
                                                          2⤵
                                                            PID:4340
                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=5768,i,17276220629172845254,7665639981173545594,2097152 --field-trial-handle=2024,i,9866067195809777469,13891983387036603881,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6244 /prefetch:1
                                                            2⤵
                                                              PID:4984
                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6320,i,12572471155188747624,1325699766667473241,262144 --field-trial-handle=2024,i,9866067195809777469,13891983387036603881,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6324 /prefetch:10
                                                              2⤵
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              PID:2688
                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6248,i,8791333131953610793,6971863373943007584,2097152 --field-trial-handle=2024,i,9866067195809777469,13891983387036603881,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6240 /prefetch:1
                                                              2⤵
                                                                PID:3396
                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6404,i,15122050899172588465,4285136320601372800,2097152 --field-trial-handle=2024,i,9866067195809777469,13891983387036603881,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6464 /prefetch:1
                                                                2⤵
                                                                  PID:3444
                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=4584,i,17040573422539052727,14853841102438310795,2097152 --field-trial-handle=2024,i,9866067195809777469,13891983387036603881,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6048 /prefetch:1
                                                                  2⤵
                                                                    PID:3964
                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=5772,i,9302960341106327651,7752010345633782291,2097152 --field-trial-handle=2024,i,9866067195809777469,13891983387036603881,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6476 /prefetch:1
                                                                    2⤵
                                                                      PID:1620
                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=3336,i,12117763975052073308,11712121384246804597,2097152 --field-trial-handle=2024,i,9866067195809777469,13891983387036603881,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6280 /prefetch:1
                                                                      2⤵
                                                                        PID:1248
                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=6440,i,10589691931594999642,12949311571583799928,2097152 --field-trial-handle=2024,i,9866067195809777469,13891983387036603881,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5732 /prefetch:1
                                                                        2⤵
                                                                          PID:820
                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=6496,i,9243192893671759913,5342256328453006227,2097152 --field-trial-handle=2024,i,9866067195809777469,13891983387036603881,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6060 /prefetch:1
                                                                          2⤵
                                                                            PID:3132
                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=3320,i,5454687964238412722,4735616472660492581,524288 --field-trial-handle=2024,i,9866067195809777469,13891983387036603881,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6200 /prefetch:14
                                                                            2⤵
                                                                              PID:196
                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=6404,i,17771427653245898365,12528845836659149661,2097152 --field-trial-handle=2024,i,9866067195809777469,13891983387036603881,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5828 /prefetch:1
                                                                              2⤵
                                                                                PID:852
                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=5748,i,3400269981225593917,17852794842947309955,2097152 --field-trial-handle=2024,i,9866067195809777469,13891983387036603881,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6500 /prefetch:1
                                                                                2⤵
                                                                                  PID:4332
                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=3828,i,9790816958085501418,11429943550218529586,2097152 --field-trial-handle=2024,i,9866067195809777469,13891983387036603881,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6572 /prefetch:1
                                                                                  2⤵
                                                                                    PID:648
                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=6448,i,13322432305376218795,5538953636353855362,2097152 --field-trial-handle=2024,i,9866067195809777469,13891983387036603881,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3228 /prefetch:1
                                                                                    2⤵
                                                                                      PID:3124
                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --metrics-shmem-handle=3356,i,10886521376780306519,14253275120875022606,2097152 --field-trial-handle=2024,i,9866067195809777469,13891983387036603881,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6248 /prefetch:1
                                                                                      2⤵
                                                                                        PID:1388
                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --metrics-shmem-handle=6148,i,14697899561996954196,8938987412140851548,2097152 --field-trial-handle=2024,i,9866067195809777469,13891983387036603881,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6100 /prefetch:1
                                                                                        2⤵
                                                                                          PID:4196
                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6740,i,273651447735815138,1098696530159271902,524288 --field-trial-handle=2024,i,9866067195809777469,13891983387036603881,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6768 /prefetch:14
                                                                                          2⤵
                                                                                          • NTFS ADS
                                                                                          PID:1936
                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --metrics-shmem-handle=6964,i,5111919179630576981,10882447966156663157,2097152 --field-trial-handle=2024,i,9866067195809777469,13891983387036603881,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6976 /prefetch:1
                                                                                          2⤵
                                                                                            PID:3576
                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --metrics-shmem-handle=7056,i,1111774251846718583,2857534223159986122,2097152 --field-trial-handle=2024,i,9866067195809777469,13891983387036603881,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6560 /prefetch:1
                                                                                            2⤵
                                                                                              PID:1884
                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --metrics-shmem-handle=6616,i,12772821043991418155,6732532133212621433,2097152 --field-trial-handle=2024,i,9866067195809777469,13891983387036603881,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6716 /prefetch:1
                                                                                              2⤵
                                                                                                PID:3324
                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --metrics-shmem-handle=6004,i,14829336907083214292,7340154145092095375,2097152 --field-trial-handle=2024,i,9866067195809777469,13891983387036603881,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6216 /prefetch:1
                                                                                                2⤵
                                                                                                  PID:1732
                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --metrics-shmem-handle=7144,i,16843300738827608763,7708038006423193519,2097152 --field-trial-handle=2024,i,9866067195809777469,13891983387036603881,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=7140 /prefetch:1
                                                                                                  2⤵
                                                                                                    PID:1624
                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --metrics-shmem-handle=6812,i,10301084186299798160,43863267391889704,2097152 --field-trial-handle=2024,i,9866067195809777469,13891983387036603881,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6760 /prefetch:1
                                                                                                    2⤵
                                                                                                      PID:2356
                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --metrics-shmem-handle=6240,i,6380886001734996880,11619725829462920242,2097152 --field-trial-handle=2024,i,9866067195809777469,13891983387036603881,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6672 /prefetch:1
                                                                                                      2⤵
                                                                                                        PID:1240
                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --metrics-shmem-handle=6788,i,4369059175780957866,9332451761516979343,2097152 --field-trial-handle=2024,i,9866067195809777469,13891983387036603881,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=7264 /prefetch:1
                                                                                                        2⤵
                                                                                                          PID:3908
                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --metrics-shmem-handle=7440,i,13510844244293475595,17207623686213303706,2097152 --field-trial-handle=2024,i,9866067195809777469,13891983387036603881,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6892 /prefetch:1
                                                                                                          2⤵
                                                                                                            PID:1764
                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6732,i,7929262317235040994,10202280482209533144,524288 --field-trial-handle=2024,i,9866067195809777469,13891983387036603881,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=7184 /prefetch:14
                                                                                                            2⤵
                                                                                                            • Subvert Trust Controls: Mark-of-the-Web Bypass
                                                                                                            • NTFS ADS
                                                                                                            PID:1728
                                                                                                          • C:\Users\Admin\Downloads\VC_redist.x64.exe
                                                                                                            "C:\Users\Admin\Downloads\VC_redist.x64.exe"
                                                                                                            2⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            PID:4596
                                                                                                            • C:\Windows\Temp\{4E17D4E8-CC0F-418D-AE08-1D2B7588FE77}\.cr\VC_redist.x64.exe
                                                                                                              "C:\Windows\Temp\{4E17D4E8-CC0F-418D-AE08-1D2B7588FE77}\.cr\VC_redist.x64.exe" -burn.clean.room="C:\Users\Admin\Downloads\VC_redist.x64.exe" -burn.filehandle.attached=724 -burn.filehandle.self=728
                                                                                                              3⤵
                                                                                                              • Executes dropped EXE
                                                                                                              • Loads dropped DLL
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              • Suspicious use of FindShellTrayWindow
                                                                                                              PID:3640
                                                                                                              • C:\Windows\Temp\{722AAB67-4BEB-437A-9509-1843BA094D31}\.be\VC_redist.x64.exe
                                                                                                                "C:\Windows\Temp\{722AAB67-4BEB-437A-9509-1843BA094D31}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{A78E2712-F093-4D6A-9D79-D723A33DCDB4} {3F5F5717-D8E2-429D-A0E1-3978E1F185C5} 3640
                                                                                                                4⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Adds Run key to start application
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                • Modifies registry class
                                                                                                                PID:2904
                                                                                                                • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
                                                                                                                  "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00} -burn.filehandle.self=988 -burn.embedded BurnPipe.{28AFD614-D3A1-4360-BA21-0425AA959D22} {53779E8E-D2EF-4699-8845-3900A83FFD43} 2904
                                                                                                                  5⤵
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  PID:6068
                                                                                                                  • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
                                                                                                                    "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=544 -burn.filehandle.self=560 -uninstall -quiet -burn.related.upgrade -burn.ancestors={91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00} -burn.filehandle.self=988 -burn.embedded BurnPipe.{28AFD614-D3A1-4360-BA21-0425AA959D22} {53779E8E-D2EF-4699-8845-3900A83FFD43} 2904
                                                                                                                    6⤵
                                                                                                                    • Loads dropped DLL
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    PID:1056
                                                                                                                    • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
                                                                                                                      "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{CA723B57-5429-4849-A478-2B7C22BFD4FB} {4932FE03-006A-4430-BEAA-8CA1D8C419D9} 1056
                                                                                                                      7⤵
                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                      • Modifies registry class
                                                                                                                      PID:5324
                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --metrics-shmem-handle=7052,i,10195352270343603011,14694365675995552245,2097152 --field-trial-handle=2024,i,9866067195809777469,13891983387036603881,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6788 /prefetch:1
                                                                                                            2⤵
                                                                                                              PID:5200
                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1468,i,7241066071611747786,11611356337608844299,524288 --field-trial-handle=2024,i,9866067195809777469,13891983387036603881,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3760 /prefetch:11
                                                                                                              2⤵
                                                                                                              • Downloads MZ/PE file
                                                                                                              • System Time Discovery
                                                                                                              PID:6080
                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --metrics-shmem-handle=7956,i,13136146950108953043,10574701284941837275,2097152 --field-trial-handle=2024,i,9866067195809777469,13891983387036603881,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=7900 /prefetch:1
                                                                                                              2⤵
                                                                                                                PID:4468
                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --metrics-shmem-handle=6648,i,10683381272067309923,6358906196279793260,2097152 --field-trial-handle=2024,i,9866067195809777469,13891983387036603881,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6668 /prefetch:1
                                                                                                                2⤵
                                                                                                                  PID:1468
                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=6672,i,12406383296768361423,4104419604933244156,524288 --field-trial-handle=2024,i,9866067195809777469,13891983387036603881,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=7976 /prefetch:12
                                                                                                                  2⤵
                                                                                                                    PID:1612
                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6644,i,11214570420876119411,5408889580393579957,524288 --field-trial-handle=2024,i,9866067195809777469,13891983387036603881,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=8020 /prefetch:14
                                                                                                                    2⤵
                                                                                                                    • Modifies registry class
                                                                                                                    PID:6048
                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3408,i,17994474819598885773,3047373206643628666,524288 --field-trial-handle=2024,i,9866067195809777469,13891983387036603881,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6396 /prefetch:14
                                                                                                                    2⤵
                                                                                                                    • Subvert Trust Controls: Mark-of-the-Web Bypass
                                                                                                                    • NTFS ADS
                                                                                                                    PID:5604
                                                                                                                  • C:\Users\Admin\Downloads\NDP481-Web.exe
                                                                                                                    "C:\Users\Admin\Downloads\NDP481-Web.exe"
                                                                                                                    2⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    PID:728
                                                                                                                    • F:\242cf54a286a8d9b062c8c7e8c\Setup.exe
                                                                                                                      F:\242cf54a286a8d9b062c8c7e8c\\Setup.exe /x86 /x64 /web
                                                                                                                      3⤵
                                                                                                                      • Executes dropped EXE
                                                                                                                      • Loads dropped DLL
                                                                                                                      • Drops file in System32 directory
                                                                                                                      • Drops file in Program Files directory
                                                                                                                      • Drops file in Windows directory
                                                                                                                      • Modifies trusted root certificate store through registry
                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                      • Checks processor information in registry
                                                                                                                      • Modifies system certificate store
                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                      PID:5820
                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3744,i,9458278531341797815,13063885959824128434,524288 --field-trial-handle=2024,i,9866067195809777469,13891983387036603881,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1468 /prefetch:11
                                                                                                                    2⤵
                                                                                                                    • System Time Discovery
                                                                                                                    PID:5832
                                                                                                                • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                                                                  "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                                                                  1⤵
                                                                                                                    PID:3252
                                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                                    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                                                                                                    1⤵
                                                                                                                      PID:1288
                                                                                                                    • C:\Windows\system32\svchost.exe
                                                                                                                      C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
                                                                                                                      1⤵
                                                                                                                        PID:800
                                                                                                                      • C:\Program Files\7-Zip\7zFM.exe
                                                                                                                        "C:\Program Files\7-Zip\7zFM.exe"
                                                                                                                        1⤵
                                                                                                                        • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                        • Suspicious use of FindShellTrayWindow
                                                                                                                        PID:1536
                                                                                                                      • C:\Users\Admin\Downloads\GitApp Installer.exe
                                                                                                                        "C:\Users\Admin\Downloads\GitApp Installer.exe"
                                                                                                                        1⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        PID:976
                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                          powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
                                                                                                                          2⤵
                                                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                          PID:1968
                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                          powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
                                                                                                                          2⤵
                                                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                          PID:3160
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zr.exe
                                                                                                                          C:\Users\Admin\AppData\Local\Temp\7zr.exe x "C:\Users\Admin\AppData\Local\Temp\t43776\a.7z" -o"C:\Users\Admin\AppData\Local\Temp\c92872" -p2026 -y
                                                                                                                          2⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          PID:3596
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c92872\Windows Helper.exe
                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c92872\Windows Helper.exe"
                                                                                                                          2⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          • Suspicious behavior: AddClipboardFormatListener
                                                                                                                          PID:1644
                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                            "powershell" -NoProfile -NonInteractive -Command "$ErrorActionPreference='Stop'; $shell = New-Object -ComObject WScript.Shell; $shortcut = $shell.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Helper.lnk'); $shortcut.TargetPath='C:\Users\Admin\AppData\Local\Temp\c92872\Windows Helper.exe'; $shortcut.WorkingDirectory='C:\Users\Admin\AppData\Local\Temp\c92872'; $shortcut.Description='Windows Helper'; $shortcut.WindowStyle=1; $shortcut.Save();"
                                                                                                                            3⤵
                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                            • Drops startup file
                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                            PID:1732
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zr.exe
                                                                                                                          C:\Users\Admin\AppData\Local\Temp\7zr.exe x "C:\Users\Admin\AppData\Local\Temp\t58556\a.7z" -o"C:\Users\Admin\AppData\Local\Temp\c79377" -p2026 -y
                                                                                                                          2⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          PID:3576
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c79377\Retro.exe
                                                                                                                          C:\Users\Admin\AppData\Local\Temp\c79377\Retro.exe
                                                                                                                          2⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          • Adds Run key to start application
                                                                                                                          PID:2928
                                                                                                                          • C:\Windows\SYSTEM32\makecab.exe
                                                                                                                            makecab.exe /?3kzf1h5lkrdqqskgzt8dm0uf6
                                                                                                                            3⤵
                                                                                                                              PID:3960
                                                                                                                            • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                              cmd /v /c Set bxlIUB=cmd & !bxlIUB! < Relief
                                                                                                                              3⤵
                                                                                                                                PID:5012
                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                  cmd
                                                                                                                                  4⤵
                                                                                                                                    PID:3936
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\718089\Accommodation.exe
                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\718089\Accommodation.exe C:\Users\Admin\AppData\Local\Temp\718089\WVNTkImK
                                                                                                                                      5⤵
                                                                                                                                      • Suspicious use of NtCreateUserProcessOtherParentProcess
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      • Suspicious use of SetThreadContext
                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                      PID:1468
                                                                                                                            • C:\Windows\system32\NOTEPAD.EXE
                                                                                                                              "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Installation_Instructions.txt
                                                                                                                              1⤵
                                                                                                                              • Opens file in notepad (likely ransom note)
                                                                                                                              PID:3504
                                                                                                                            • C:\Windows\system32\vssvc.exe
                                                                                                                              C:\Windows\system32\vssvc.exe
                                                                                                                              1⤵
                                                                                                                              • Checks SCSI registry key(s)
                                                                                                                              PID:4152
                                                                                                                            • C:\Windows\system32\srtasks.exe
                                                                                                                              C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
                                                                                                                              1⤵
                                                                                                                                PID:5532
                                                                                                                              • C:\Windows\system32\msiexec.exe
                                                                                                                                C:\Windows\system32\msiexec.exe /V
                                                                                                                                1⤵
                                                                                                                                • Enumerates connected drives
                                                                                                                                • Drops file in System32 directory
                                                                                                                                • Drops file in Windows directory
                                                                                                                                • Modifies data under HKEY_USERS
                                                                                                                                • Modifies registry class
                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                PID:5628
                                                                                                                              • C:\ProgramData\Package Cache\{91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00}\VC_redist.x64.exe
                                                                                                                                "C:\ProgramData\Package Cache\{91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00}\VC_redist.x64.exe" /burn.runonce
                                                                                                                                1⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                PID:5804
                                                                                                                                • C:\ProgramData\Package Cache\{91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00}\VC_redist.x64.exe
                                                                                                                                  "C:\ProgramData\Package Cache\{91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00}\VC_redist.x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260511230726.log"
                                                                                                                                  2⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  PID:5848
                                                                                                                                  • C:\ProgramData\Package Cache\{91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00}\VC_redist.x64.exe
                                                                                                                                    "C:\ProgramData\Package Cache\{91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00}\VC_redist.x64.exe" -burn.filehandle.attached=548 -burn.filehandle.self=564 /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260511230726.log"
                                                                                                                                    3⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    • Loads dropped DLL
                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                    PID:5920
                                                                                                                              • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                                                                                "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                                                                                1⤵
                                                                                                                                  PID:4220
                                                                                                                                • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                                                                                  "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                                                                                  1⤵
                                                                                                                                    PID:1668
                                                                                                                                  • C:\Users\Admin\Downloads\GitApp Installer.exe
                                                                                                                                    "C:\Users\Admin\Downloads\GitApp Installer.exe"
                                                                                                                                    1⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    • Loads dropped DLL
                                                                                                                                    PID:5968
                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
                                                                                                                                      2⤵
                                                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                                                      PID:6028
                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                      powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
                                                                                                                                      2⤵
                                                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                                                      PID:3996
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zr.exe
                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\7zr.exe x "C:\Users\Admin\AppData\Local\Temp\t26036\a.7z" -o"C:\Users\Admin\AppData\Local\Temp\c23080" -p2026 -y
                                                                                                                                      2⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                      PID:5304
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c23080\Windows Helper.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c23080\Windows Helper.exe"
                                                                                                                                      2⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      • Suspicious behavior: AddClipboardFormatListener
                                                                                                                                      PID:1936
                                                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        "powershell" -NoProfile -NonInteractive -Command "$ErrorActionPreference='Stop'; $shell = New-Object -ComObject WScript.Shell; $shortcut = $shell.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Helper.lnk'); $shortcut.TargetPath='C:\Users\Admin\AppData\Local\Temp\c23080\Windows Helper.exe'; $shortcut.WorkingDirectory='C:\Users\Admin\AppData\Local\Temp\c23080'; $shortcut.Description='Windows Helper'; $shortcut.WindowStyle=1; $shortcut.Save();"
                                                                                                                                        3⤵
                                                                                                                                        • Command and Scripting Interpreter: PowerShell
                                                                                                                                        • Drops startup file
                                                                                                                                        PID:1760
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zr.exe
                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\7zr.exe x "C:\Users\Admin\AppData\Local\Temp\t83485\a.7z" -o"C:\Users\Admin\AppData\Local\Temp\c60621" -p2026 -y
                                                                                                                                      2⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                      PID:3964
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c60621\Retro.exe
                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\c60621\Retro.exe
                                                                                                                                      2⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      • Adds Run key to start application
                                                                                                                                      PID:5360
                                                                                                                                      • C:\Windows\SYSTEM32\makecab.exe
                                                                                                                                        makecab.exe /?3kzf1h5lkrdqqskgzt8dm0uf6
                                                                                                                                        3⤵
                                                                                                                                          PID:4260
                                                                                                                                        • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                          cmd /v /c Set bxlIUB=cmd & !bxlIUB! < Relief
                                                                                                                                          3⤵
                                                                                                                                            PID:1384
                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                              cmd
                                                                                                                                              4⤵
                                                                                                                                                PID:4204
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\718089\Accommodation.exe
                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\718089\Accommodation.exe C:\Users\Admin\AppData\Local\Temp\718089\WVNTkImK
                                                                                                                                                  5⤵
                                                                                                                                                  • Suspicious use of NtCreateUserProcessOtherParentProcess
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  • Suspicious use of SetThreadContext
                                                                                                                                                  PID:1372
                                                                                                                                        • C:\Users\Admin\Downloads\GitApp Installer.exe
                                                                                                                                          "C:\Users\Admin\Downloads\GitApp Installer.exe"
                                                                                                                                          1⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          • Loads dropped DLL
                                                                                                                                          PID:5564
                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                            powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
                                                                                                                                            2⤵
                                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                                            PID:4828
                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                            powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
                                                                                                                                            2⤵
                                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                                            PID:5324
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zr.exe
                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\7zr.exe x "C:\Users\Admin\AppData\Local\Temp\t33902\a.7z" -o"C:\Users\Admin\AppData\Local\Temp\c88071" -p2026 -y
                                                                                                                                            2⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                            PID:5640
                                                                                                                                        • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                                                                                          "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                                                                                          1⤵
                                                                                                                                            PID:5292
                                                                                                                                          • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                                                                                            "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                                                                                            1⤵
                                                                                                                                              PID:5384

                                                                                                                                            Network

                                                                                                                                                  MITRE ATT&CK Enterprise v16

                                                                                                                                                  Reconnaissance

                                                                                                                                                  Resource Development

                                                                                                                                                  Initial Access

                                                                                                                                                  Execution

                                                                                                                                                  Command and Scripting Interpreter

                                                                                                                                                  1
                                                                                                                                                  T1059

                                                                                                                                                  PowerShell

                                                                                                                                                  1
                                                                                                                                                  T1059.001

                                                                                                                                                  Persistence

                                                                                                                                                  Boot or Logon Autostart Execution

                                                                                                                                                  1
                                                                                                                                                  T1547

                                                                                                                                                  Registry Run Keys / Startup Folder

                                                                                                                                                  1
                                                                                                                                                  T1547.001

                                                                                                                                                  Privilege Escalation

                                                                                                                                                  Boot or Logon Autostart Execution

                                                                                                                                                  1
                                                                                                                                                  T1547

                                                                                                                                                  Registry Run Keys / Startup Folder

                                                                                                                                                  1
                                                                                                                                                  T1547.001

                                                                                                                                                  Defense Evasion

                                                                                                                                                  Modify Registry

                                                                                                                                                  3
                                                                                                                                                  T1112

                                                                                                                                                  Subvert Trust Controls

                                                                                                                                                  3
                                                                                                                                                  T1553

                                                                                                                                                  Install Root Certificate

                                                                                                                                                  2
                                                                                                                                                  T1553.004

                                                                                                                                                  SIP and Trust Provider Hijacking

                                                                                                                                                  1
                                                                                                                                                  T1553.003

                                                                                                                                                  Credential Access

                                                                                                                                                  Credentials from Password Stores

                                                                                                                                                  1
                                                                                                                                                  T1555

                                                                                                                                                  Windows Credential Manager

                                                                                                                                                  1
                                                                                                                                                  T1555.004

                                                                                                                                                  Unsecured Credentials

                                                                                                                                                  1
                                                                                                                                                  T1552

                                                                                                                                                  Credentials In Files

                                                                                                                                                  1
                                                                                                                                                  T1552.001

                                                                                                                                                  Discovery

                                                                                                                                                  Browser Information Discovery

                                                                                                                                                  1
                                                                                                                                                  T1217

                                                                                                                                                  Peripheral Device Discovery

                                                                                                                                                  2
                                                                                                                                                  T1120

                                                                                                                                                  Query Registry

                                                                                                                                                  5
                                                                                                                                                  T1012

                                                                                                                                                  System Information Discovery

                                                                                                                                                  5
                                                                                                                                                  T1082

                                                                                                                                                  System Location Discovery

                                                                                                                                                  1
                                                                                                                                                  T1614

                                                                                                                                                  System Language Discovery

                                                                                                                                                  1
                                                                                                                                                  T1614.001

                                                                                                                                                  System Time Discovery

                                                                                                                                                  1
                                                                                                                                                  T1124

                                                                                                                                                  Lateral Movement

                                                                                                                                                  Collection

                                                                                                                                                  Data from Local System

                                                                                                                                                  1
                                                                                                                                                  T1005

                                                                                                                                                  Command and Control

                                                                                                                                                  Web Service

                                                                                                                                                  1
                                                                                                                                                  T1102

                                                                                                                                                  Exfiltration

                                                                                                                                                  Impact

                                                                                                                                                  Replay Monitor

                                                                                                                                                  Loading Replay Monitor...

                                                                                                                                                  Downloads

                                                                                                                                                  e645624.rbs
                                                                                                                                                  • Path C:\Config.Msi\e645624.rbs
                                                                                                                                                  • Size 19KB
                                                                                                                                                  • SHA256 b227a46128147cd03bf6b8d9832db465f3cc062bffbf2c1ec36dd956fe98d76f
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  e645630.rbs
                                                                                                                                                  • Path C:\Config.Msi\e645630.rbs
                                                                                                                                                  • Size 19KB
                                                                                                                                                  • SHA256 c680ebb4a26422afbae83ffa7a5ae6b8cf755ac29cc10ee79ffb62b925173a38
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  e645637.rbs
                                                                                                                                                  • Path C:\Config.Msi\e645637.rbs
                                                                                                                                                  • Size 21KB
                                                                                                                                                  • SHA256 9d72fd045b16530b2ff4ea9b3de9b1dbe1e686043bceaccd54d610bee8a861e9
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  e645646.rbs
                                                                                                                                                  • Path C:\Config.Msi\e645646.rbs
                                                                                                                                                  • Size 21KB
                                                                                                                                                  • SHA256 8e2583a5402aa1f23310d92d8b3b94174c8760df2b0b4af6e723fcb9b3411eed
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  BookmarkMergedSurfaceOrdering
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
                                                                                                                                                  • Size 6B
                                                                                                                                                  • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                  Submit Download

                                                                                                                                                  BrowsingTopicsState
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
                                                                                                                                                  • Size 414B
                                                                                                                                                  • SHA256 433692e30e6a6a7e14023c75fa06da2f02a53e1fb7572d36f53b93375fde5854
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  f_000064
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000064
                                                                                                                                                  • Size 42KB
                                                                                                                                                  • SHA256 db6c6f42e1d56092fb2c3d317968077cb29435139274faefbf4ab7681955bec6
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  the-real-index
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                  • Size 3KB
                                                                                                                                                  • SHA256 48d68eb28dfc47879e2eba4ed79d1a5ca745011205072aa771d6b78bbb2805ee
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  the-real-index
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                  • Size 3KB
                                                                                                                                                  • SHA256 d7e867a76d3739a923e562f42e0262cda454426f9a6e5b8d47dc13bcc0977652
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  the-real-index
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                  • Size 4KB
                                                                                                                                                  • SHA256 eadec6fc0d27b94cdcd4949d8f536a03349f3e0ba39501571636bc3edae63da9
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  the-real-index
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                  • Size 5KB
                                                                                                                                                  • SHA256 d7f02b9917d4ade1e4f3b5523bc9cc2d55a527eb4e7700441b53402d10b372c1
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  data_1
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnWebGPUCache\data_1
                                                                                                                                                  • Size 264KB
                                                                                                                                                  • SHA256 97c7f8a9f53906df04b225b7090f1d2d2386ab819b70b709a2e4dde5198cc2a3
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  Network Persistent State
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                                                                  • Size 2KB
                                                                                                                                                  • SHA256 6abcb964d8ab46d06a80d0978ac5648b5986a3c5b52de45361bd978fa4ab95a6
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  Network Persistent State
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                                                                  • Size 8KB
                                                                                                                                                  • SHA256 416224bf467ff8c7c2e896bffc7e4395940cc268b1bcccd7378aa4d443d52769
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  Network Persistent State
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                                                                  • Size 6KB
                                                                                                                                                  • SHA256 65f59886f1aa12c247e6c76ef7f45139c552a50f790fb6f8846300b63bfb6426
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  Network Persistent State
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                                                                  • Size 8KB
                                                                                                                                                  • SHA256 c3cfd4ae00bccbd492189a9d96060182846e8f589eb6d628a7529a1b52eada10
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  SCT Auditing Pending Reports
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                                                                                  • Size 2B
                                                                                                                                                  • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                  Submit Download

                                                                                                                                                  Preferences
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                  • Size 12KB
                                                                                                                                                  • SHA256 12c2bda836c29d522d4c1272bb9f09035372c783636ea19dd41ac127e37e56e8
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  Preferences
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                  • Size 12KB
                                                                                                                                                  • SHA256 70bb518630f6ec8df4d9e6a7552e9fd5b881b44d8be7adb24bbf4ab766a4564e
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  Preferences
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                  • Size 12KB
                                                                                                                                                  • SHA256 54f2ae07829924e156c5eb531e62397a269e241a6249000ebe24931cf4fab78d
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  Preferences
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                  • Size 13KB
                                                                                                                                                  • SHA256 d5b44a0b3ec8787902c1d5dc3fc19d8aac03311866523658bdbb62c3e50aeebb
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  Preferences
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                  • Size 14KB
                                                                                                                                                  • SHA256 6355220e59837279332a03f9ae351e520d95957fca61e6f4d56cf1a17527ac2b
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  Preferences
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                  • Size 14KB
                                                                                                                                                  • SHA256 35eca1b208eed49987f26a6f67fa59fefd5a77e0d5a866c6ba89c6e79dce9d87
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  Preferences
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                  • Size 15KB
                                                                                                                                                  • SHA256 b2623f9646c3a5d983bc873907983241dfd5441037c379e8248b3c66ffdde7af
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  Preferences
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                  • Size 15KB
                                                                                                                                                  • SHA256 d42ac0560a916c598a4983e5006f6da36bc79f350e6bacddf67fdc2c29fbdb83
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  Preferences
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                  • Size 15KB
                                                                                                                                                  • SHA256 3c1b1b59d3f5e0ffba60cc222e08b35137d92e14d0ff7ce96aea2e8439bcd813
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  Preferences
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                  • Size 14KB
                                                                                                                                                  • SHA256 e0a7082e04072dc871716fb28276c4e299e7c6ba890c541df79c86e969ddfe60
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  Preferences
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                  • Size 16KB
                                                                                                                                                  • SHA256 38e5ba6e5c673debc487460acc3b35677016586b9a874ca584a428fe4a4bce3f
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  Preferences
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                  • Size 15KB
                                                                                                                                                  • SHA256 83bb296a46b7abf0bb79f996aa8f8bc742843bee8c2e9b835945fa7d7208cbbd
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  Preferences
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                  • Size 16KB
                                                                                                                                                  • SHA256 d132df2bba142f13fad3ef20134cebecc24629c9e730cdede4ccf2957d0b2a88
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  Preferences
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                  • Size 14KB
                                                                                                                                                  • SHA256 6961d106fce6f6d9b0c1a8b222de0722eb84ab6a1c27677cff3eb42771549493
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  Preferences
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                  • Size 14KB
                                                                                                                                                  • SHA256 55d0eddb4309a65b75f793da18e67ec0d4409d16a3b62761a5d8f5c2172ef0a5
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  Secure Preferences
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                                                                                                                                  • Size 17KB
                                                                                                                                                  • SHA256 5ab444414a02d4891c7cbb4db3735bec720facb3265bdedc915a68f6beef1cd9
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  the-real-index
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                                                                                                                                  • Size 120B
                                                                                                                                                  • SHA256 c975f0821d9c4fcc2928b4e830fe1388e3d530d1ec54318ca1aed4bf7a45691e
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  the-real-index~RFe5e3527.TMP
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5e3527.TMP
                                                                                                                                                  • Size 96B
                                                                                                                                                  • SHA256 425193998f047c3f08187e79f7683db681f1db8df4b84d0e22fe51a408902f90
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  the-real-index
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
                                                                                                                                                  • Size 72B
                                                                                                                                                  • SHA256 4d1513a5a08552baada477496478b57489f1ab3e3c64fe99a91a3485ab7f2f89
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  index.txt
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt
                                                                                                                                                  • Size 150B
                                                                                                                                                  • SHA256 1f454af6c9228f06b895b24e97f227f0d8976ec4a5f32e900ef087a591f13496
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  index.txt~RFe643f4c.TMP
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt~RFe643f4c.TMP
                                                                                                                                                  • Size 157B
                                                                                                                                                  • SHA256 62ae5116131560265908da672aed4f7e08cf5d188af21c2fcf69fee57209397a
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  Local State
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                  • Size 201KB
                                                                                                                                                  • SHA256 b833ee255339f1b419e731787a15afc777bc7b37f3b029e2d6c652974c5ff5df
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  Local State
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                  • Size 90KB
                                                                                                                                                  • SHA256 50238fd7a0dcb5c35f1987e96149c2a7f00744d7b0912430b5516600f7f14844
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  Local State
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                  • Size 202KB
                                                                                                                                                  • SHA256 346aca08eed61a8c287ffa48c2ac0f885daf50a2758944644bfd1a867083d94d
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  Local State
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                  • Size 201KB
                                                                                                                                                  • SHA256 05edd42590bd0d64917fbc95ba84e4ecb1cbf7110ece5dead43f5eb2ba5b8481
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  Local State
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                  • Size 202KB
                                                                                                                                                  • SHA256 63389bcb8be92449f168f6ecc55c9c735847a949a3abb655c64dfe6e8dc9673d
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  Local State
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                  • Size 202KB
                                                                                                                                                  • SHA256 589634e5a43613c9661a6120a620212a2090f9af17c44491b5246570ba683559
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  Local State
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                  • Size 202KB
                                                                                                                                                  • SHA256 be678cdcdc09799ee38519f4be12876def9736324a6b1f23f200a10a085ebeeb
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  Local State
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                  • Size 202KB
                                                                                                                                                  • SHA256 129920cbd9497d32e7976079c459e0a326539a205c1eecb747a8192c0e272edf
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  Local State
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                  • Size 202KB
                                                                                                                                                  • SHA256 aeb2844984c64e95def5e6df357d00c8c840a3250473480aba26c65d4c84fa3a
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  Local State
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                  • Size 202KB
                                                                                                                                                  • SHA256 cc1ee373a628bd62462dadf2053d69703c2415ace3753fd870dfab75a698a5bc
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  powershell.exe.log
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                                                                                                                                  • Size 4KB
                                                                                                                                                  • SHA256 e27390d57580e3dfba07bec3d8e430203bbc91e90f6937079b3fd52abc721bd4
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  StartupProfileData-NonInteractive
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                  • Size 1KB
                                                                                                                                                  • SHA256 b79f569e6c453b33139dcd90442a80e59ac882a1e272a8e4a322d295bfac3ab0
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  SearchHoverUnifiedTileModelCache.dat
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
                                                                                                                                                  • Size 20KB
                                                                                                                                                  • SHA256 25b1e50883644d800aa97dc2fbcd183a7ebfa85f8deb969af4ec5b60c46bb4d4
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  Accommodation.exe
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\718089\Accommodation.exe
                                                                                                                                                  • Size 1.1MB
                                                                                                                                                  • SHA256 5d69a932a077fee044b193c28e84564143f5c7e51079ab48e88fef74ab0b77b7
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  WVNTkImK
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\718089\WVNTkImK
                                                                                                                                                  • Size 5.1MB
                                                                                                                                                  • SHA256 61f0cfbb4c93eba08e1c34c3dec813fa68b504e6f3aa1183771e420702be7194
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  7zr.exe
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\7zr.exe
                                                                                                                                                  • Size 588KB
                                                                                                                                                  • SHA256 abcf64ae1cbafddb5395e4cdd3bdc7e3e0561d54a0c6380e3dd43bdbffe519a2
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  HFIF33B.tmp.html
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\HFIF33B.tmp.html
                                                                                                                                                  • Size 16KB
                                                                                                                                                  • SHA256 b7adb33ce1381fbf852de9a5727f1148a87677a48d0c0a7ca90e5c28a70a7e6a
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  Advisory.potm
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Advisory.potm
                                                                                                                                                  • Size 87KB
                                                                                                                                                  • SHA256 079a73a62dedbdf8092abcc7389cfae7ce1961c0c0a0864f0899cedcb951e58a
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  Assumes
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Assumes
                                                                                                                                                  • Size 8KB
                                                                                                                                                  • SHA256 7c3c8408eb1e7a2d8995b60811ac7570a921749a56288e86999a3b6ac184a8ad
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  Bacterial.potm
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Bacterial.potm
                                                                                                                                                  • Size 11KB
                                                                                                                                                  • SHA256 3448085685d620387d30096a62d58cd417ceab6684e97c74cddaaa743f438901
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  Counters.potm
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Counters.potm
                                                                                                                                                  • Size 89KB
                                                                                                                                                  • SHA256 a277d498f0edaa4113ed19cb20ec7d68e0d2eadfd1243bf35337ec68864aaaf8
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  Maintenance.potm
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Maintenance.potm
                                                                                                                                                  • Size 41KB
                                                                                                                                                  • SHA256 a87a36575d3db4b62c05a1efeb96bec7dc4808afab7f34c4d82973a37d5e13bd
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  Relief
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Relief
                                                                                                                                                  • Size 23KB
                                                                                                                                                  • SHA256 90cfd9d1d0ba95e7e9a8e4a9de9eec047009a7907b789c216ba191f148dec7cd
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  Societies.potm
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Societies.potm
                                                                                                                                                  • Size 327KB
                                                                                                                                                  • SHA256 d23c0ec6507385c7526274886f349423d85776ce5f33ab5e5f2719461fd18cde
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  Swap.potm
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Swap.potm
                                                                                                                                                  • Size 49KB
                                                                                                                                                  • SHA256 7fdadaf66d4bf13f32b2c432cf7f02e8a23805cc8cdeb0a5a2a8fd72725eb12d
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  Thorough.potm
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Thorough.potm
                                                                                                                                                  • Size 211KB
                                                                                                                                                  • SHA256 ad8d95edcb8196ce1bed97645e704d26f107fdbff74798ea9d1a10ba0b193142
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  Treasures.potm
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Treasures.potm
                                                                                                                                                  • Size 112KB
                                                                                                                                                  • SHA256 225829cf01b31a07da1aa6a94aac04f653a31bea0d1d1859d1616020d75aaac1
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  White
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\White
                                                                                                                                                  • Size 9KB
                                                                                                                                                  • SHA256 215265f20c968cb9aede353bae2df1ee550461d4fc8272db4f6d1747e4b56ae3
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  Biblical
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Biblical
                                                                                                                                                  • Size 10B
                                                                                                                                                  • SHA256 e09036285cc6f5207fb3413b897d2a8ea5c5d6e6ddded1cf9b341e38d281b4b0
                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                  Submit Download

                                                                                                                                                  Education.potm
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Education.potm
                                                                                                                                                  • Size 7B
                                                                                                                                                  • SHA256 e8ab35112ad55756c3af6357b3a9a018dbe8aa52bbcf8062241777bda1ec13cc
                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                  Submit Download

                                                                                                                                                  Log.txt
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\Log.txt
                                                                                                                                                  • Size 256B
                                                                                                                                                  • SHA256 544f34b6959b4585ef0da4fd7c1f579fe49424c207c6f3a907d55d7037c1cb5e
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  Log.txt
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\Log.txt
                                                                                                                                                  • Size 594B
                                                                                                                                                  • SHA256 84e01bcdcde8d8ed2d0be672a69d5ae5f89a452020df484e2f743ae556957d71
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  Log.txt
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\Log.txt
                                                                                                                                                  • Size 1KB
                                                                                                                                                  • SHA256 49fe3747d329f61a73d968e994ab7548587bd41fd913185822da3e30c8f74109
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  Log.txt
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\Log.txt
                                                                                                                                                  • Size 2KB
                                                                                                                                                  • SHA256 0caa6c6c6d16f5494ae7fae74f654d71b1a74da2f3ff023269bd1773b4bedfd2
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  Log.txt
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\Log.txt
                                                                                                                                                  • Size 3KB
                                                                                                                                                  • SHA256 a0e318a9788ea15f861003595f9c6b4da20532add45df7acacca027b5ca88ba8
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  Log.txt
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\Log.txt
                                                                                                                                                  • Size 4KB
                                                                                                                                                  • SHA256 ff23d71f41bdf2430b6484ee45a6884073aedbed4e394004b0799d5cfd071e3e
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  Log.txt
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\Log.txt
                                                                                                                                                  • Size 48B
                                                                                                                                                  • SHA256 518f42a81ff5ffb7239ec4cef1e7ebacaf02c2d1d4b768b50480eee4a35c798d
                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                  Submit Download

                                                                                                                                                  Log.txt
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\Log.txt
                                                                                                                                                  • Size 745B
                                                                                                                                                  • SHA256 06717006c898b73230452b30d2d42b3643a99f5d2816f88532b6c4d0064b44c5
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  Log.txt
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\Log.txt
                                                                                                                                                  • Size 1019B
                                                                                                                                                  • SHA256 55a08bfda237ca30533519f6bfb2d98dc96cf507ac448cd5cdce1201c45c38c6
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  Log.txt
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\Log.txt
                                                                                                                                                  • Size 1KB
                                                                                                                                                  • SHA256 e2ca7e6b2ddd7a8b46577ee44f1a04ce0c0c6ba8ddd40b29b90e82894503fa02
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  Log.txt
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\Log.txt
                                                                                                                                                  • Size 2KB
                                                                                                                                                  • SHA256 247b35d9ce09e7bb007fa3f79703717ca4d8eb428a4f3f2c4693bf99497d68c5
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  Log.txt
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\Log.txt
                                                                                                                                                  • Size 2KB
                                                                                                                                                  • SHA256 156e28bce6330d3c46b6fb7d3cf349d407c327b0e0acd4fd9110b4aa9121a2bb
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  Log.txt
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\Log.txt
                                                                                                                                                  • Size 3KB
                                                                                                                                                  • SHA256 909983fb41aae13238e1c694c9a582730fae92cb0a5748afca6e029323251cd7
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  Log.txt
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\Log.txt
                                                                                                                                                  • Size 4KB
                                                                                                                                                  • SHA256 b57f8239b19b7e50a4808dc310d0fe218bcec68ab8690fe415b31c5a83fb739c
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  __PSScriptPolicyTest_hdumc5nk.r3r.ps1
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hdumc5nk.r3r.ps1
                                                                                                                                                  • Size 60B
                                                                                                                                                  • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  Retro.exe
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\c79377\Retro.exe
                                                                                                                                                  • Size 5.7MB
                                                                                                                                                  • SHA256 5243c2d15a4c8c69593856198a007a0d8ca7ae84854a52d9d769e771be7e7499
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  Windows Helper.exe
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\c92872\Windows Helper.exe
                                                                                                                                                  • Size 7.9MB
                                                                                                                                                  • SHA256 d5b7315271defc600b8110c707a067395e6001fcbc767df9b887caa905c04d2b
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  pwd_3868.db
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\pwd_3868.db
                                                                                                                                                  • Size 40KB
                                                                                                                                                  • SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  a.7z
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\t43776\a.7z
                                                                                                                                                  • Size 7.6MB
                                                                                                                                                  • SHA256 72c7a2d5f3bf355756d48576234643c5e615a6d401374dab3857548f6795566c
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  a.7z
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\t58556\a.7z
                                                                                                                                                  • Size 5.7MB
                                                                                                                                                  • SHA256 344da4d4f6cd92f34e8c98ee728b2b0aaa423cffcda893f0a69df8add5cb1aea
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  GitApp Installer.exe
                                                                                                                                                  • Path C:\Users\Admin\Downloads\GitApp Installer.exe
                                                                                                                                                  • Size 66KB
                                                                                                                                                  • SHA256 e19264572cfad900c929afb283bb07504388b302e90a66f32e573b9973231354
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  GitApp [Latest Version, 2026].rar
                                                                                                                                                  • Path C:\Users\Admin\Downloads\GitApp [Latest Version, 2026].rar
                                                                                                                                                  • Size 31.4MB
                                                                                                                                                  • SHA256 c9cf3c84b22fd624f570ffb18dde727185f8a322e0d46961fb59ac619538e037
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  GitApp [Latest Version, 2026].rar:Zone.Identifier
                                                                                                                                                  • Path C:\Users\Admin\Downloads\GitApp [Latest Version, 2026].rar:Zone.Identifier
                                                                                                                                                  • Size 26B
                                                                                                                                                  • SHA256 eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913
                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                  Submit Download

                                                                                                                                                  Installation_Instructions.txt
                                                                                                                                                  • Path C:\Users\Admin\Downloads\Installation_Instructions.txt
                                                                                                                                                  • Size 1KB
                                                                                                                                                  • SHA256 81eba3cb1948c3bef0d4783b860c76ea97b7bb1bdbba86b4e0df1c00ccdff0d7
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  Unconfirmed 262228.crdownload
                                                                                                                                                  • Path C:\Users\Admin\Downloads\Unconfirmed 262228.crdownload
                                                                                                                                                  • Size 1.4MB
                                                                                                                                                  • SHA256 05e9ada305fd0013a6844e7657f06ed330887093e3df59c11cb528b86efa3fbf
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  Unconfirmed 611297.crdownload
                                                                                                                                                  • Path C:\Users\Admin\Downloads\Unconfirmed 611297.crdownload
                                                                                                                                                  • Size 17.7MB
                                                                                                                                                  • SHA256 8995548dfffcde7c49987029c764355612ba6850ee09a7b6f0fddc85bdc5c280
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  e645631.msi
                                                                                                                                                  • Path C:\Windows\Installer\e645631.msi
                                                                                                                                                  • Size 208KB
                                                                                                                                                  • SHA256 57d65221ca418dabfcc6320215b2c05eec907690aa4f93384f2007eb9e1394b0
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  logo.png
                                                                                                                                                  • Path C:\Windows\Temp\{722AAB67-4BEB-437A-9509-1843BA094D31}\.ba\logo.png
                                                                                                                                                  • Size 1KB
                                                                                                                                                  • SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  VC_redist.x64.exe
                                                                                                                                                  • Path C:\Windows\Temp\{722AAB67-4BEB-437A-9509-1843BA094D31}\.be\VC_redist.x64.exe
                                                                                                                                                  • Size 615KB
                                                                                                                                                  • SHA256 806e6252db45be78bfc064eb9a774dd1320d8f9aa70dd746996a1d9ddf9b8fd4
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  wixstdba.dll
                                                                                                                                                  • Path C:\Windows\Temp\{8BB0D651-0B07-47B2-9FDD-9CAA25F7A53D}\.ba\wixstdba.dll
                                                                                                                                                  • Size 215KB
                                                                                                                                                  • SHA256 e921f69b9fb4b5ad4691809d06896c5f1d655ab75e0ce94a372319c243c56d4e
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  memory/800-124-0x0000026519800000-0x00000265198AF000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/800-2166-0x0000026519800000-0x00000265198AF000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/976-1438-0x000001194E1A0000-0x000001194E24F000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/976-1296-0x000001194E1A0000-0x000001194E24F000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1056-2094-0x0000000000FB0000-0x0000000001027000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1056-2097-0x0000000001070000-0x00000000010EB000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1468-1876-0x000002165A8D0000-0x000002165A97F000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1468-1678-0x00007FFF6A6A0000-0x00007FFF6A8A9000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1468-1582-0x000002165A8D0000-0x000002165A97F000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1536-1211-0x000001E81A790000-0x000001E81A83F000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1536-1161-0x000001E81A790000-0x000001E81A83F000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1644-1318-0x000001F283840000-0x000001F283850000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1644-1344-0x00007FF6E80B0000-0x00007FF6E9967000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1644-1569-0x00007FF6E80B0000-0x00007FF6E9967000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1644-1303-0x00007FF6E80B0000-0x00007FF6E9967000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1668-1763-0x00000280ECBA0000-0x00000280ECC4F000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1708-1-0x0000022FC57C0000-0x0000022FC57CC000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1708-0-0x0000022FC56E0000-0x0000022FC578F000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1732-1331-0x00000200438F0000-0x0000020043902000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1732-1330-0x000002005BE00000-0x000002005BEAF000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1732-1329-0x0000020041F90000-0x0000020041F9C000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1936-2632-0x00007FF6813B0000-0x00007FF682C67000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1936-2361-0x00007FF6813B0000-0x00007FF682C67000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1968-1246-0x0000029466100000-0x000002946610A000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1968-1255-0x000002944C0D0000-0x000002944C0E2000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1968-1231-0x0000029466130000-0x00000294661E3000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1968-1232-0x00000294660F0000-0x00000294660FA000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1968-1248-0x00000294661F0000-0x00000294661F8000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1968-1230-0x0000029466110000-0x000002946612C000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1968-1249-0x0000029466200000-0x0000029466206000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1968-1223-0x0000029466060000-0x0000029466082000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1968-1239-0x0000029466210000-0x000002946622C000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1968-1253-0x000002944C070000-0x000002944C07C000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1968-1254-0x000002944D930000-0x000002944D9DF000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1968-1250-0x0000029466250000-0x000002946625A000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1968-1247-0x0000029466230000-0x000002946624A000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2152-47-0x00000246DE090000-0x00000246DE13F000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2800-52-0x00000199180C0000-0x000001991816F000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2904-2104-0x00000000008B0000-0x000000000092B000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2904-1949-0x00000000008B0000-0x000000000092B000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/3088-38-0x00000000010D0000-0x000000000114B000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/3160-1259-0x000001955AB60000-0x000001955AB6C000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/3160-1261-0x0000019574940000-0x0000019574952000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/3160-1260-0x0000019574890000-0x000001957493F000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/3252-66-0x0000028347CB0000-0x0000028347D5F000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/3384-48-0x0000000001080000-0x00000000010FB000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/3504-1306-0x0000024261CB0000-0x0000024261D5F000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/3576-1316-0x0000000001670000-0x0000000001732000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/3580-51-0x0000000002D80000-0x0000000002E2F000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/3580-166-0x0000000002D80000-0x0000000002E2F000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/3596-1293-0x0000000001730000-0x00000000017F2000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/3640-2106-0x0000000001140000-0x00000000011BB000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/3640-1684-0x0000000001140000-0x00000000011BB000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/3996-2163-0x000002511DE60000-0x000002511DE72000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/3996-2162-0x000002511DDB0000-0x000002511DE5F000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/3996-2161-0x0000025104060000-0x000002510406C000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/4152-1950-0x000001C997DA0000-0x000001C997E4F000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/4220-1748-0x0000020A376B0000-0x0000020A3775F000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/4596-1683-0x0000000001270000-0x00000000012EB000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/4596-2107-0x0000000001270000-0x00000000012EB000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/4828-2779-0x000002D939350000-0x000002D939403000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/5324-2092-0x0000000001750000-0x00000000017CB000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/5324-2091-0x0000000000FB0000-0x0000000001027000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/5348-2070-0x0000000140000000-0x0000000141E02000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/5348-1695-0x0000000140000000-0x0000000141E02000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/5348-2078-0x0000000140000000-0x0000000141E02000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/5348-2170-0x0000000140000000-0x0000000141E02000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/5532-2112-0x0000023AAFB30000-0x0000023AAFBDF000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/5628-2122-0x0000026EC5E40000-0x0000026EC5EEF000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/5628-2123-0x0000026EC5FA0000-0x0000026EC5FAC000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/5804-1713-0x0000000000D20000-0x0000000000D9B000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/5848-2125-0x0000000001100000-0x000000000117B000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/5920-2126-0x0000000001720000-0x000000000179B000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/6028-2141-0x0000019AFC810000-0x0000019AFC8C3000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/6028-2158-0x0000019AE4380000-0x0000019AE442F000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/6028-2157-0x0000019AE3F20000-0x0000019AE3F2C000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/6028-2159-0x0000019AE4440000-0x0000019AE4452000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/6068-2098-0x0000000000FB0000-0x0000000001027000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/6068-2099-0x0000000000DA0000-0x0000000000E1B000-memory.dmp
                                                                                                                                                  Download