salatstealer | hxxps://tinyurl[.]com/zm43fejn

Analysis

user interaction
yes
max time kernel
405s
max time network
404s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
19/06/2026, 20:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://tinyurl.com/zm43fejn
Sample260619-zh7cescx21

Score

10^/10

credential_access defense_evasion discovery execution salatstealer xmrig miner persistence privilege_escalation pyinstaller spyware stealer trojan upx

Malware Config

Signatures

Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
stealer salatstealer
Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Detect SalatStealer payload 19 IoCs

resource	yara_rule
behavioral1/memory/4936-1839-0x00000000005E0000-0x0000000001237000-memory.dmp	family_salatstealer
behavioral1/memory/4936-1879-0x00000000005E0000-0x0000000001237000-memory.dmp	family_salatstealer
behavioral1/memory/4936-1880-0x00000000005E0000-0x0000000001237000-memory.dmp	family_salatstealer
behavioral1/memory/4936-1884-0x00000000005E0000-0x0000000001237000-memory.dmp	family_salatstealer
behavioral1/memory/4936-1888-0x00000000005E0000-0x0000000001237000-memory.dmp	family_salatstealer
behavioral1/memory/4936-1894-0x00000000005E0000-0x0000000001237000-memory.dmp	family_salatstealer
behavioral1/memory/4936-1900-0x00000000005E0000-0x0000000001237000-memory.dmp	family_salatstealer
behavioral1/memory/1756-1903-0x0000000000050000-0x0000000000CA7000-memory.dmp	family_salatstealer
behavioral1/memory/1756-1902-0x0000000000050000-0x0000000000CA7000-memory.dmp	family_salatstealer
behavioral1/memory/1756-1905-0x0000000000050000-0x0000000000CA7000-memory.dmp	family_salatstealer
behavioral1/memory/1756-1907-0x0000000000050000-0x0000000000CA7000-memory.dmp	family_salatstealer
behavioral1/memory/3456-1927-0x00000000006C0000-0x0000000001317000-memory.dmp	family_salatstealer
behavioral1/memory/5556-2011-0x0000000000DF0000-0x0000000001A47000-memory.dmp	family_salatstealer
behavioral1/memory/1756-2028-0x0000000000050000-0x0000000000CA7000-memory.dmp	family_salatstealer
behavioral1/memory/1756-2050-0x0000000000050000-0x0000000000CA7000-memory.dmp	family_salatstealer
behavioral1/memory/6036-2054-0x00000000005E0000-0x0000000001237000-memory.dmp	family_salatstealer
behavioral1/memory/1756-2055-0x0000000000050000-0x0000000000CA7000-memory.dmp	family_salatstealer
behavioral1/memory/1756-2057-0x0000000000050000-0x0000000000CA7000-memory.dmp	family_salatstealer
behavioral1/memory/1756-2059-0x0000000000050000-0x0000000000CA7000-memory.dmp	family_salatstealer

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	powershell.exe

XMRig Miner payload 9 IoCs

miner

resource	yara_rule
behavioral1/memory/5500-1871-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/5500-1876-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/5500-1874-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/5500-1872-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/5500-1877-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/5500-1875-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/5500-1878-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/5500-1890-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/5500-1891-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig

Badlisted process makes network request 5 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
241	2364	powershell.exe
242	2364	powershell.exe
243	2364	powershell.exe
244	2364	powershell.exe
245	2364	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5764	powershell.exe
2848	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
51	2548	chrome.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 16 IoCs

pid	Process
2060	7z2601-x64.exe
3608	7z.exe
4820	7z.exe
3436	7z.exe
1068	7z.exe
2888	7z.exe
2248	Unlock.exe
4936	set1.exe
3660	set2.exe
2884	se.exe
6032	se.exe
3000	lhhsgwktkatl.exe
1756	nslookup.exe
3456	nslookup.exe
5556	nslookup.exe
6036	set1.exe

Loads dropped DLL 14 IoCs

pid	Process
3204	Process not Found
3204	Process not Found
1068	7z.exe
2888	7z.exe
6032	se.exe
6032	se.exe
6032	se.exe
6032	se.exe
6032	se.exe
6032	se.exe
6032	se.exe
6032	se.exe
6032	se.exe
6032	se.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Power Settings 1 TTPs 8 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
5376	powercfg.exe
3156	powercfg.exe
3648	powercfg.exe
4336	powercfg.exe
2784	powercfg.exe
5440	powercfg.exe
5364	powercfg.exe
5372	powercfg.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\MRT.exe	set2.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\system32\MRT.exe	lhhsgwktkatl.exe
File opened for modification	C:\Windows\SysWOW64\Recovery	ReAgentc.exe
File opened for modification	C:\Windows\SysWOW64\Recovery\ReAgent.xml	ReAgentc.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3000 set thread context of 5388	3000	lhhsgwktkatl.exe	190
PID 3000 set thread context of 5500	3000	lhhsgwktkatl.exe	194

UPX packed file 39 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0003000000025fd0-841.dat	upx
behavioral1/memory/4936-863-0x00000000005E0000-0x0000000001237000-memory.dmp	upx
behavioral1/memory/4936-1839-0x00000000005E0000-0x0000000001237000-memory.dmp	upx
behavioral1/memory/5500-1871-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/5500-1876-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/5500-1874-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/5500-1872-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/5500-1869-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/5500-1868-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/5500-1870-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/5500-1867-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/5500-1866-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/5500-1877-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/5500-1875-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/5500-1878-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/4936-1879-0x00000000005E0000-0x0000000001237000-memory.dmp	upx
behavioral1/memory/4936-1880-0x00000000005E0000-0x0000000001237000-memory.dmp	upx
behavioral1/memory/4936-1884-0x00000000005E0000-0x0000000001237000-memory.dmp	upx
behavioral1/memory/4936-1888-0x00000000005E0000-0x0000000001237000-memory.dmp	upx
behavioral1/memory/5500-1890-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/5500-1891-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/4936-1894-0x00000000005E0000-0x0000000001237000-memory.dmp	upx
behavioral1/memory/1756-1898-0x0000000000050000-0x0000000000CA7000-memory.dmp	upx
behavioral1/memory/4936-1900-0x00000000005E0000-0x0000000001237000-memory.dmp	upx
behavioral1/memory/1756-1903-0x0000000000050000-0x0000000000CA7000-memory.dmp	upx
behavioral1/memory/1756-1902-0x0000000000050000-0x0000000000CA7000-memory.dmp	upx
behavioral1/memory/1756-1905-0x0000000000050000-0x0000000000CA7000-memory.dmp	upx
behavioral1/memory/1756-1907-0x0000000000050000-0x0000000000CA7000-memory.dmp	upx
behavioral1/memory/3456-1913-0x00000000006C0000-0x0000000001317000-memory.dmp	upx
behavioral1/memory/3456-1927-0x00000000006C0000-0x0000000001317000-memory.dmp	upx
behavioral1/memory/5556-2009-0x0000000000DF0000-0x0000000001A47000-memory.dmp	upx
behavioral1/memory/5556-2011-0x0000000000DF0000-0x0000000001A47000-memory.dmp	upx
behavioral1/memory/1756-2028-0x0000000000050000-0x0000000000CA7000-memory.dmp	upx
behavioral1/memory/1756-2050-0x0000000000050000-0x0000000000CA7000-memory.dmp	upx
behavioral1/memory/6036-2052-0x00000000005E0000-0x0000000001237000-memory.dmp	upx
behavioral1/memory/6036-2054-0x00000000005E0000-0x0000000001237000-memory.dmp	upx
behavioral1/memory/1756-2055-0x0000000000050000-0x0000000000CA7000-memory.dmp	upx
behavioral1/memory/1756-2057-0x0000000000050000-0x0000000000CA7000-memory.dmp	upx
behavioral1/memory/1756-2059-0x0000000000050000-0x0000000000CA7000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Lang\he.txt	7z2601-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kaa.txt	7z2601-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ne.txt	7z2601-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\th.txt	7z2601-x64.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	7z2601-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\el.txt	7z2601-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fy.txt	7z2601-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gu.txt	7z2601-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\it.txt	7z2601-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ja.txt	7z2601-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kk.txt	7z2601-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spl.txt	7z2601-x64.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\nslookup.exe	nslookup.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ca.txt	7z2601-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\de.txt	7z2601-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\en.ttt	7z2601-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spc.txt	7z2601-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fr.txt	7z2601-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ga.txt	7z2601-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\af.txt	7z2601-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bn.txt	7z2601-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ext.txt	7z2601-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gl.txt	7z2601-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tr.txt	7z2601-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz-cyrl.txt	7z2601-x64.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	7z2601-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\da.txt	7z2601-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fi.txt	7z2601-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hr.txt	7z2601-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hy.txt	7z2601-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lv.txt	7z2601-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mk.txt	7z2601-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nb.txt	7z2601-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt.txt	7z2601-x64.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.chm	7z2601-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\az.txt	7z2601-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\be.txt	7z2601-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bg.txt	7z2601-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fur.txt	7z2601-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lt.txt	7z2601-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng.txt	7z2601-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ms.txt	7z2601-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\an.txt	7z2601-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ba.txt	7z2601-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku.txt	7z2601-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nl.txt	7z2601-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tk.txt	7z2601-x64.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.dll	7z2601-x64.exe
File opened for modification	C:\Program Files\7-Zip\7z.dll	7z2601-x64.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\nslookup.exe	nslookup.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ast.txt	7z2601-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eo.txt	7z2601-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hi.txt	7z2601-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ko.txt	7z2601-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mr.txt	7z2601-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ro.txt	7z2601-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sw.txt	7z2601-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\yo.txt	7z2601-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\br.txt	7z2601-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\co.txt	7z2601-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hu.txt	7z2601-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ka.txt	7z2601-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ps.txt	7z2601-x64.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	7z2601-x64.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe

Launches sc.exe 14 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5212	sc.exe
5304	sc.exe
5344	sc.exe
3164	sc.exe
4612	sc.exe
1288	sc.exe
4812	sc.exe
2628	sc.exe
4820	sc.exe
5128	sc.exe
5268	sc.exe
4788	sc.exe
2976	sc.exe
1140	sc.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\7z2601-x64.exe:Zone.Identifier	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral1/files/0x000400000002a2d1-860.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	set1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ReAgentc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	set1.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2548	chrome.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 48 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134263754636365341"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension"	7z2601-x64.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 0000000001000000ffffffff	x64dbg.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell	x64dbg.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	x64dbg.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings	x64dbg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}	7z2601-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2601-x64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1	x64dbg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	x64dbg.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\Shell	x64dbg.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	x64dbg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}	7z2601-x64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	x64dbg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	x64dbg.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\0	x64dbg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	x64dbg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	x64dbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2601-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0	x64dbg.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	x64dbg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2601-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0	x64dbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip32.dll"	7z2601-x64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	x64dbg.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	x64dbg.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 010000000500000004000000030000000200000000000000ffffffff	x64dbg.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\0\0	x64dbg.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	x64dbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2601-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	x64dbg.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6	x64dbg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	x64dbg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	x64dbg.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	x64dbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2601-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip	7z2601-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	x64dbg.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	x64dbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip.dll"	7z2601-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip	7z2601-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	x64dbg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	x64dbg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	x64dbg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	x64dbg.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12	x64dbg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip	7z2601-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip	7z2601-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0	x64dbg.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 0100000000000000ffffffff	x64dbg.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0	x64dbg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	x64dbg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	x64dbg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	x64dbg.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2601-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	x64dbg.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	x64dbg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	x64dbg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\Shell\SniffedFolderType = "Generic"	x64dbg.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2601-x64.exe

NTFS ADS 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\snapshot_2026-05-27_12-11.zip:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\EZIC.NET.zip:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\7z2601-x64.exe:Zone.Identifier	chrome.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
6016	x64dbg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
4336	chrome.exe
4336	chrome.exe
3660	set2.exe
5764	powershell.exe
5764	powershell.exe
5764	powershell.exe
3660	set2.exe
3660	set2.exe
3660	set2.exe
3660	set2.exe
3660	set2.exe
3660	set2.exe
3660	set2.exe
3660	set2.exe
3660	set2.exe
3660	set2.exe
3660	set2.exe
3660	set2.exe
3660	set2.exe
3660	set2.exe
3000	lhhsgwktkatl.exe
2848	powershell.exe
2848	powershell.exe
2848	powershell.exe
3000	lhhsgwktkatl.exe
3000	lhhsgwktkatl.exe
3000	lhhsgwktkatl.exe
3000	lhhsgwktkatl.exe
3000	lhhsgwktkatl.exe
3000	lhhsgwktkatl.exe
3000	lhhsgwktkatl.exe
3000	lhhsgwktkatl.exe
3000	lhhsgwktkatl.exe
3000	lhhsgwktkatl.exe
3000	lhhsgwktkatl.exe
3000	lhhsgwktkatl.exe
5500	nslookup.exe
5500	nslookup.exe
5500	nslookup.exe
5500	nslookup.exe
5500	nslookup.exe
5500	nslookup.exe
5500	nslookup.exe
5500	nslookup.exe
5500	nslookup.exe
5500	nslookup.exe
5500	nslookup.exe
5500	nslookup.exe
4936	set1.exe
4936	set1.exe
5500	nslookup.exe
5500	nslookup.exe
5500	nslookup.exe
5500	nslookup.exe
5500	nslookup.exe
5500	nslookup.exe
5500	nslookup.exe
5500	nslookup.exe
5500	nslookup.exe
5500	nslookup.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
6016	x64dbg.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
688	Process not Found
688	Process not Found
688	Process not Found
688	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 20 IoCs

pid	Process
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	492	chrome.exe
Token: SeCreatePagefilePrivilege	492	chrome.exe
Token: SeShutdownPrivilege	492	chrome.exe
Token: SeCreatePagefilePrivilege	492	chrome.exe
Token: SeShutdownPrivilege	492	chrome.exe
Token: SeCreatePagefilePrivilege	492	chrome.exe
Token: SeShutdownPrivilege	492	chrome.exe
Token: SeCreatePagefilePrivilege	492	chrome.exe
Token: SeShutdownPrivilege	492	chrome.exe
Token: SeCreatePagefilePrivilege	492	chrome.exe
Token: SeShutdownPrivilege	492	chrome.exe
Token: SeCreatePagefilePrivilege	492	chrome.exe
Token: SeShutdownPrivilege	492	chrome.exe
Token: SeCreatePagefilePrivilege	492	chrome.exe
Token: SeShutdownPrivilege	492	chrome.exe
Token: SeCreatePagefilePrivilege	492	chrome.exe
Token: SeShutdownPrivilege	492	chrome.exe
Token: SeCreatePagefilePrivilege	492	chrome.exe
Token: SeShutdownPrivilege	492	chrome.exe
Token: SeCreatePagefilePrivilege	492	chrome.exe
Token: SeShutdownPrivilege	492	chrome.exe
Token: SeCreatePagefilePrivilege	492	chrome.exe
Token: SeShutdownPrivilege	492	chrome.exe
Token: SeCreatePagefilePrivilege	492	chrome.exe
Token: SeShutdownPrivilege	492	chrome.exe
Token: SeCreatePagefilePrivilege	492	chrome.exe
Token: SeShutdownPrivilege	492	chrome.exe
Token: SeCreatePagefilePrivilege	492	chrome.exe
Token: SeShutdownPrivilege	492	chrome.exe
Token: SeCreatePagefilePrivilege	492	chrome.exe
Token: SeShutdownPrivilege	492	chrome.exe
Token: SeCreatePagefilePrivilege	492	chrome.exe
Token: SeShutdownPrivilege	492	chrome.exe
Token: SeCreatePagefilePrivilege	492	chrome.exe
Token: SeShutdownPrivilege	492	chrome.exe
Token: SeCreatePagefilePrivilege	492	chrome.exe
Token: SeShutdownPrivilege	492	chrome.exe
Token: SeCreatePagefilePrivilege	492	chrome.exe
Token: SeShutdownPrivilege	492	chrome.exe
Token: SeCreatePagefilePrivilege	492	chrome.exe
Token: SeShutdownPrivilege	492	chrome.exe
Token: SeCreatePagefilePrivilege	492	chrome.exe
Token: SeShutdownPrivilege	492	chrome.exe
Token: SeCreatePagefilePrivilege	492	chrome.exe
Token: SeShutdownPrivilege	492	chrome.exe
Token: SeCreatePagefilePrivilege	492	chrome.exe
Token: SeShutdownPrivilege	492	chrome.exe
Token: SeCreatePagefilePrivilege	492	chrome.exe
Token: SeShutdownPrivilege	492	chrome.exe
Token: SeCreatePagefilePrivilege	492	chrome.exe
Token: SeShutdownPrivilege	492	chrome.exe
Token: SeCreatePagefilePrivilege	492	chrome.exe
Token: SeShutdownPrivilege	492	chrome.exe
Token: SeCreatePagefilePrivilege	492	chrome.exe
Token: SeShutdownPrivilege	492	chrome.exe
Token: SeCreatePagefilePrivilege	492	chrome.exe
Token: SeShutdownPrivilege	492	chrome.exe
Token: SeCreatePagefilePrivilege	492	chrome.exe
Token: SeShutdownPrivilege	492	chrome.exe
Token: SeCreatePagefilePrivilege	492	chrome.exe
Token: SeShutdownPrivilege	492	chrome.exe
Token: SeCreatePagefilePrivilege	492	chrome.exe
Token: SeShutdownPrivilege	492	chrome.exe
Token: SeCreatePagefilePrivilege	492	chrome.exe

Suspicious use of FindShellTrayWindow 59 IoCs

pid	Process
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
6016	x64dbg.exe
6016	x64dbg.exe
6016	x64dbg.exe
6016	x64dbg.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 492 wrote to memory of 1052	492	chrome.exe	80
PID 492 wrote to memory of 2732	492	chrome.exe	82
PID 492 wrote to memory of 2548	492	chrome.exe	81
PID 492 wrote to memory of 2732	492	chrome.exe	82
PID 492 wrote to memory of 1428	492	chrome.exe	84
PID 492 wrote to memory of 1428	492	chrome.exe	84
PID 492 wrote to memory of 2512	492	chrome.exe	85
PID 492 wrote to memory of 2904	492	chrome.exe	86
PID 492 wrote to memory of 2512	492	chrome.exe	85
PID 492 wrote to memory of 2904	492	chrome.exe	86
PID 492 wrote to memory of 1392	492	chrome.exe	87
PID 492 wrote to memory of 1392	492	chrome.exe	87
PID 492 wrote to memory of 1880	492	chrome.exe	89
PID 492 wrote to memory of 2312	492	chrome.exe	90
PID 492 wrote to memory of 2312	492	chrome.exe	90
PID 492 wrote to memory of 3144	492	chrome.exe	92
PID 492 wrote to memory of 1256	492	chrome.exe	93
PID 492 wrote to memory of 1256	492	chrome.exe	93
PID 492 wrote to memory of 1520	492	chrome.exe	94
PID 492 wrote to memory of 1520	492	chrome.exe	94
PID 492 wrote to memory of 2696	492	chrome.exe	95
PID 492 wrote to memory of 2696	492	chrome.exe	95
PID 492 wrote to memory of 1700	492	chrome.exe	96
PID 492 wrote to memory of 1700	492	chrome.exe	96
PID 492 wrote to memory of 3772	492	chrome.exe	97
PID 492 wrote to memory of 3772	492	chrome.exe	97
PID 492 wrote to memory of 3512	492	chrome.exe	98
PID 492 wrote to memory of 3512	492	chrome.exe	98
PID 492 wrote to memory of 3848	492	chrome.exe	99
PID 492 wrote to memory of 2060	492	chrome.exe	100
PID 492 wrote to memory of 1740	492	chrome.exe	101
PID 492 wrote to memory of 3952	492	chrome.exe	102
PID 492 wrote to memory of 3380	492	chrome.exe	103
PID 492 wrote to memory of 696	492	chrome.exe	104
PID 492 wrote to memory of 696	492	chrome.exe	104
PID 492 wrote to memory of 1264	492	chrome.exe	105
PID 492 wrote to memory of 1264	492	chrome.exe	105
PID 492 wrote to memory of 4952	492	chrome.exe	106
PID 492 wrote to memory of 4952	492	chrome.exe	106
PID 492 wrote to memory of 3472	492	chrome.exe	107
PID 492 wrote to memory of 3472	492	chrome.exe	107
PID 492 wrote to memory of 2956	492	chrome.exe	109
PID 492 wrote to memory of 2956	492	chrome.exe	109
PID 492 wrote to memory of 2116	492	chrome.exe	110
PID 492 wrote to memory of 2116	492	chrome.exe	110
PID 492 wrote to memory of 4196	492	chrome.exe	111
PID 492 wrote to memory of 4196	492	chrome.exe	111
PID 492 wrote to memory of 2692	492	chrome.exe	112
PID 492 wrote to memory of 2692	492	chrome.exe	112
PID 492 wrote to memory of 2248	492	chrome.exe	113
PID 492 wrote to memory of 2248	492	chrome.exe	113
PID 492 wrote to memory of 4156	492	chrome.exe	114
PID 492 wrote to memory of 4156	492	chrome.exe	114
PID 492 wrote to memory of 1520	492	chrome.exe	115
PID 492 wrote to memory of 1520	492	chrome.exe	115
PID 492 wrote to memory of 3512	492	chrome.exe	116
PID 492 wrote to memory of 3512	492	chrome.exe	116
PID 492 wrote to memory of 2504	492	chrome.exe	117
PID 492 wrote to memory of 2504	492	chrome.exe	117
PID 492 wrote to memory of 3884	492	chrome.exe	118
PID 492 wrote to memory of 3884	492	chrome.exe	118
PID 492 wrote to memory of 2884	492	chrome.exe	123
PID 492 wrote to memory of 4336	492	chrome.exe	126
PID 1716 wrote to memory of 3608	1716	cmd.exe	127

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://tinyurl.com/zm43fejn
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcf49bc728,0x7ffcf49bc734,0x7ffcf49bc740
  2⤵
  PID:1052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1448,i,1459228348654056398,10806130343915434291,524288 --field-trial-handle=2008,i,2077505970591050966,5247100605418746717,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=2128 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:2548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1652,i,9979555209252015664,10994041038139122404,262144 --field-trial-handle=2008,i,2077505970591050966,5247100605418746717,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=1944 /prefetch:2
  2⤵
  PID:2732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2364,i,480240923084816972,8843521669541563490,524288 --field-trial-handle=2008,i,2077505970591050966,5247100605418746717,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=2524 /prefetch:13
  2⤵
  PID:1428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3228,i,11756052548137398873,17061395860507484983,2097152 --field-trial-handle=2008,i,2077505970591050966,5247100605418746717,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:2512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3232,i,7994312827861970231,9399158046476656065,2097152 --field-trial-handle=2008,i,2077505970591050966,5247100605418746717,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:2904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4300,i,2299659819642346627,247929249549909663,2097152 --field-trial-handle=2008,i,2077505970591050966,5247100605418746717,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4312 /prefetch:9
  2⤵
  PID:1392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5448,i,438611158172964289,9770538069943317866,524288 --field-trial-handle=2008,i,2077505970591050966,5247100605418746717,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5452 /prefetch:14
  2⤵
  PID:1880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5592,i,9228262884555442636,16934877377485083075,2097152 --field-trial-handle=2008,i,2077505970591050966,5247100605418746717,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5612 /prefetch:1
  2⤵
  PID:2312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4764,i,5847070683435117129,3162518080974320670,524288 --field-trial-handle=2008,i,2077505970591050966,5247100605418746717,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5840 /prefetch:14
  2⤵
  - NTFS ADS
  PID:3144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5864,i,2490192756931705066,13001877812006880722,2097152 --field-trial-handle=2008,i,2077505970591050966,5247100605418746717,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5900 /prefetch:1
  2⤵
  PID:1256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6064,i,6648816972921365051,12041812968663216841,524288 --field-trial-handle=2008,i,2077505970591050966,5247100605418746717,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=6052 /prefetch:14
  2⤵
  PID:1520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6076,i,15244103900733953363,4229022198390833297,524288 --field-trial-handle=2008,i,2077505970591050966,5247100605418746717,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=6352 /prefetch:14
  2⤵
  PID:2696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5456,i,14399288290972080851,13862899776775160408,2097152 --field-trial-handle=2008,i,2077505970591050966,5247100605418746717,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=6156 /prefetch:1
  2⤵
  PID:1700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5700,i,5454191072147884005,17345252230676027262,2097152 --field-trial-handle=2008,i,2077505970591050966,5247100605418746717,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5596 /prefetch:1
  2⤵
  PID:3772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6644,i,11689041725454423670,711218576442932072,2097152 --field-trial-handle=2008,i,2077505970591050966,5247100605418746717,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=6716 /prefetch:1
  2⤵
  PID:3512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3324,i,8840143481205685503,7656164096298437999,524288 --field-trial-handle=2008,i,2077505970591050966,5247100605418746717,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3316 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:3848
- C:\Users\Admin\Downloads\7z2601-x64.exe
  "C:\Users\Admin\Downloads\7z2601-x64.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Modifies registry class
  PID:2060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=212,i,14575975163825311004,11251116587760649933,524288 --field-trial-handle=2008,i,2077505970591050966,5247100605418746717,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5704 /prefetch:14
  2⤵
  PID:1740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6928,i,4439752545036450807,17949681801379713157,524288 --field-trial-handle=2008,i,2077505970591050966,5247100605418746717,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5692 /prefetch:14
  2⤵
  PID:3952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5648,i,1491479431130149433,11424152921989371602,524288 --field-trial-handle=2008,i,2077505970591050966,5247100605418746717,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=6736 /prefetch:14
  2⤵
  PID:3380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6940,i,10352576677893709773,10948098442230148585,2097152 --field-trial-handle=2008,i,2077505970591050966,5247100605418746717,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=6924 /prefetch:1
  2⤵
  PID:696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5720,i,6915878501328420363,16069436110683207959,524288 --field-trial-handle=2008,i,2077505970591050966,5247100605418746717,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=6572 /prefetch:14
  2⤵
  PID:1264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=5680,i,5884787824586986881,6358970709342906887,2097152 --field-trial-handle=2008,i,2077505970591050966,5247100605418746717,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:4952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6096,i,12753976254089657771,1994812581992457124,524288 --field-trial-handle=2008,i,2077505970591050966,5247100605418746717,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5596 /prefetch:14
  2⤵
  PID:3472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6992,i,4168465086929317224,15925613528992724975,2097152 --field-trial-handle=2008,i,2077505970591050966,5247100605418746717,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=6980 /prefetch:1
  2⤵
  PID:2956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=6708,i,18256641323774971587,14343978524116454518,2097152 --field-trial-handle=2008,i,2077505970591050966,5247100605418746717,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=6712 /prefetch:1
  2⤵
  PID:2116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=6348,i,12432633707765130271,16431733756897932320,2097152 --field-trial-handle=2008,i,2077505970591050966,5247100605418746717,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5672 /prefetch:1
  2⤵
  PID:4196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=6788,i,1102556149603476714,392704586171238788,2097152 --field-trial-handle=2008,i,2077505970591050966,5247100605418746717,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=6620 /prefetch:1
  2⤵
  PID:2692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=4396,i,7024210400346203863,10297332151137064593,2097152 --field-trial-handle=2008,i,2077505970591050966,5247100605418746717,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4320 /prefetch:1
  2⤵
  PID:2248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=6528,i,7482580651697584343,5029247331001157282,2097152 --field-trial-handle=2008,i,2077505970591050966,5247100605418746717,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4400 /prefetch:1
  2⤵
  PID:4156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=5564,i,3185427754933592634,17074365160458199811,2097152 --field-trial-handle=2008,i,2077505970591050966,5247100605418746717,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=6752 /prefetch:1
  2⤵
  PID:1520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=6804,i,10985748398788858103,17592354777103188962,2097152 --field-trial-handle=2008,i,2077505970591050966,5247100605418746717,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=6984 /prefetch:1
  2⤵
  PID:3512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=6180,i,14040298145447873057,1213863319515801050,2097152 --field-trial-handle=2008,i,2077505970591050966,5247100605418746717,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5856 /prefetch:1
  2⤵
  PID:2504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --metrics-shmem-handle=4404,i,1948574322610310007,15998877203709572600,2097152 --field-trial-handle=2008,i,2077505970591050966,5247100605418746717,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4388 /prefetch:1
  2⤵
  PID:3884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5468,i,8849245788573649049,3811786177203955983,524288 --field-trial-handle=2008,i,2077505970591050966,5247100605418746717,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5472 /prefetch:14
  2⤵
  - NTFS ADS
  PID:2884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=3204,i,8321462509244983137,5857036310809278739,262144 --field-trial-handle=2008,i,2077505970591050966,5247100605418746717,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=6152 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4624,i,9142193292305649113,8304218858016938032,524288 --field-trial-handle=2008,i,2077505970591050966,5247100605418746717,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3100 /prefetch:14
  2⤵
  PID:196

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2992

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4816

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4564

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1716
- C:\Program Files\7-zip\7z.exe
  "C:\Program Files\7-zip\7z.exe"
  2⤵
  - Executes dropped EXE
  PID:3608
- C:\Program Files\7-zip\7z.exe
  "C:\Program Files\7-zip\7z.exe" EZIC.NET.zip
  2⤵
  - Executes dropped EXE
  PID:4820
- C:\Program Files\7-zip\7z.exe
  "C:\Program Files\7-zip\7z.exe" -o EZIC.NET.zip
  2⤵
  - Executes dropped EXE
  PID:3436
- C:\Program Files\7-zip\7z.exe
  "C:\Program Files\7-zip\7z.exe" x EZIC.NET.zip
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1068
- C:\Program Files\7-zip\7z.exe
  "C:\Program Files\7-zip\7z.exe" x EZIC.NET.zip
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2888

C:\Users\Admin\Downloads\EZIC.NET\Unlock.exe
"C:\Users\Admin\Downloads\EZIC.NET\Unlock.exe"
1⤵
- Executes dropped EXE
PID:2248
- C:\Users\Admin\AppData\Local\set1.exe
  "C:\Users\Admin\AppData\Local\set1.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4936
- - C:\Users\Admin\AppData\Local\Temp\nslookup.exe
    C:\Users\Admin\AppData\Local\Temp\nslookup.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    PID:1756
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe
      4⤵
      UAC bypass
      Badlisted process makes network request
      System Location Discovery: System Language Discovery
      PID:2364
    - - C:\Windows\SysWOW64\ReAgentc.exe
        
        "C:\Windows\system32\ReAgentc.exe" /disable
        5⤵
        Drops file in System32 directory
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4216
  - - C:\Program Files\Google\Chrome\Application\nslookup.exe
      "C:\Program Files\Google\Chrome\Application\nslookup.exe" -
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\nslookup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\nslookup.exe" -
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5556
- C:\Users\Admin\Downloads\EZIC.NET\set2.exe
  "C:\Users\Admin\Downloads\EZIC.NET\set2.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:3660
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5764
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:2528
  - - C:\Windows\system32\wusa.exe
      wusa /uninstall /kb:890830 /quiet /norestart
      4⤵
      PID:1068
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:3164
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:4612
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop wuauserv
    3⤵
    - Launches sc.exe
    PID:4788
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop bits
    3⤵
    - Launches sc.exe
    PID:2976
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop dosvc
    3⤵
    - Launches sc.exe
    PID:1288
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
    3⤵
    - Power Settings
    PID:3648
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
    3⤵
    - Power Settings
    PID:3156
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
    3⤵
    - Power Settings
    PID:4336
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
    3⤵
    - Power Settings
    PID:2784
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe delete "QHRAJGDI"
    3⤵
    - Launches sc.exe
    PID:4812
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe create "QHRAJGDI" binpath= "C:\ProgramData\nalfdgwigwyg\lhhsgwktkatl.exe" start= "auto"
    3⤵
    - Launches sc.exe
    PID:2628
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop eventlog
    3⤵
    - Launches sc.exe
    PID:1140
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe start "QHRAJGDI"
    3⤵
    - Launches sc.exe
    PID:4820
- C:\Users\Admin\AppData\Local\Temp\se.exe
  "C:\Users\Admin\AppData\Local\Temp\se.exe"
  2⤵
  - Executes dropped EXE
  PID:2884
- - C:\Users\Admin\AppData\Local\Temp\se.exe
    "C:\Users\Admin\AppData\Local\Temp\se.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:6032

C:\ProgramData\nalfdgwigwyg\lhhsgwktkatl.exe
C:\ProgramData\nalfdgwigwyg\lhhsgwktkatl.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:3000
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:2848
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
  2⤵
  PID:3816
- - C:\Windows\system32\wusa.exe
    wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:5244
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop UsoSvc
  2⤵
  - Launches sc.exe
  PID:5128
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop WaaSMedicSvc
  2⤵
  - Launches sc.exe
  PID:5212
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop wuauserv
  2⤵
  - Launches sc.exe
  PID:5268
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop bits
  2⤵
  - Launches sc.exe
  PID:5304
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop dosvc
  2⤵
  - Launches sc.exe
  PID:5344
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
  2⤵
  - Power Settings
  PID:5440
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
  2⤵
  - Power Settings
  PID:5364
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
  2⤵
  - Power Settings
  PID:5372
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
  2⤵
  - Power Settings
  PID:5376
- C:\Windows\system32\conhost.exe
  C:\Windows\system32\conhost.exe
  2⤵
  PID:5388
- C:\Windows\system32\nslookup.exe
  nslookup.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5500

C:\Users\Admin\Downloads\snapshot_2026-05-27_12-11\release\x64\x64dbg.exe
"C:\Users\Admin\Downloads\snapshot_2026-05-27_12-11\release\x64\x64dbg.exe"
1⤵
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:6016

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5172

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5264

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5968

C:\Users\Admin\AppData\Local\set1.exe
"C:\Users\Admin\AppData\Local\set1.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6036

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Power Settings

T1653

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

7-zip.dll

Path C:\Program Files\7-Zip\7-zip.dll
Size 99KB
SHA256 ae3ee0b7298a9a7f9ebbd2afd516b5eb3e26cbb28cb705b29f0f55b28955d9f4
MD5 6f66eb93644f835b4a4f15458442dbfb
SHA1 ad2b89e5510c80c585ffc1c687d7c7548490983e
SHA512 bd7bfaabc22c679320169666ade14c43855dfdf2d00d5ba50e9f80438c34155e6177003b3c317e89101ed4a9a51673339e717365dd7137c0ae2299542a4d7ca2
SSDEEP 1536:D02eoxptSO1UUk06kZs5QQTKrEYdJs4Vh6z4MluFoxIUDgP:QOx/SaIUEYdJxhuXgFoxIUDgP
TLSH
T188A3E825F2A48335D073D0B9CDD2AA99EAB278419F3047CF2246A75D1E36AD6CC35732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.dll

Path C:\Program Files\7-Zip\7z.dll
Size 1.8MB
SHA256 9657871fdd714c96a3a21f59abf04abb14944516c2a10c8cb606c12a71a75957
MD5 910de767458feabfa4de2d7066e825cc
SHA1 51ecc880e3b6d1447a6f9e9fb6646278ca7a393a
SHA512 eab94840e17b38602cd0f3e40a5282adf5a1c1d8a3056162c039740d819b837802ea04f3ee052c4655d5cf3562282a838b4930469bfd9369fd039cb634cabdf8
SSDEEP 24576:NhnA9xGhdFIRw/PEhm8kvIv9hCEiptvu/DzEoFQ8Z:NBA9xadF+w/PU/kDpxboFQ8
TLSH
T1B6954B6BF6748270D0B7C075C5E2AB9AEE7134868730A6C712859B3D2F17AF5C639720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 563KB
SHA256 2bff20bd679d45166b8c2d039044a4ca16189e6d69ff9c82345b4c1306986ec4
MD5 d966f9b3019464b9447526ca4f7f5082
SHA1 436615113bcfdadb71a60d61f73f97deb655faf1
SHA512 d6a39e85c536d489ee2d9d46f6bef538017516413a59771fe58bc97c5ec23930b49430c1bd2229c647fe11fed80a426f315a26ef591e059131da75bba33ee91e
SSDEEP 12288:xVPifKt0JnH6MCg72q8qNqnI1ujaZzd06lHUV:G00JHMgyqTAh6WV
TLSH
T126C4F825F6748331D073C0BAC5D6A69AE97230865B3189CB4286C77C3F676E6C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

80b39ec7-785d-425f-8ec0-c7eaffef3f5a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\80b39ec7-785d-425f-8ec0-c7eaffef3f5a.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 74ed32ac32ed79b4239e32d7f22d516c0e952a244437e8ef11cf502d3342e7ba
MD5 780bfd8ff3b9d000dd728c5abed39814
SHA1 2c9bb2dd349b57a3a04cc3a48ba0ba61177d960f
SHA512 390460342fc8e97cf3b4d1e21dd995633e548c3bd31f944e54ffd862fdec47dfbb677d3b318e4f5ace59d3d29d3571bfc2a91b522dfcbe26167ed69d1912ab39
TLSH
T182E0E56ECC60AC7708FD071820501A46F60503173A40496F3A3C82098FB8ABA028695C
MD5 SHA1 SHA512 TLSH

Submit Download

f_00002e

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002e
Size 24KB
SHA256 f254eb93b015455a3c89aaf970631bc989fe2bd387f79e871b514992359651aa
MD5 5366c57b20a86f1956780da5e26aac90
SHA1 927dca34817d3c42d9647a846854dad3cbcdb533
SHA512 15d7127970436f2510344600f3acecc19c39a05f8e82c8a7950095386382b2e2da55883a5a9faa97b84452e67315b9ac1693b6592274c8c1c35c813dfeb543a2
SSDEEP 768:ZfRLYs8uBykIQZ6yXBeQOS9JUmBgKYTbgVec:vsbmrDXwEfUmBgKYTc4c
TLSH
T18DB2D004F02ACA26E53655B371E82BD54CB6C4CAABA9935C113520AF3ED3F48C991673
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00002f

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002f
Size 22KB
SHA256 9c4f02f38678f2628292d66c4f7a1a6a06af7ffac4d279359b09074e7d0f1fe0
MD5 9e38e04780525a20f28d6c455901b2cf
SHA1 9a8514b5e462d06a2b6a4f31e60b97c48272f58c
SHA512 15efa4e8efdb92442e270606f13948aecbf4902a7ccba2fd186bb0bea52feb59530fc922eb4ab603c70cb8cdd26b5d5b2d8318d0cf61f26a96099df38dc694dd
SSDEEP 384:Wnkgg5ugJYnmChrWRPP8mVjX23owWnt4Powv5/cwR2TkqOOCjc/V:WkgY2mcmVzhwK6AAkwRbpeV
TLSH
T18FA2D0EF49DFF985CA334058F4FF0CB982365178E7AA60EF1194969660888F24432BD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000030

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000030
Size 24KB
SHA256 a3cf4861c7d0c966f0ed6564f6aad6b28cbd3421a9ca4f60e2246848d249f196
MD5 344ee6eaad74df6b72dec90b1b888aab
SHA1 490e2d92c7f8f3934c14e6c467d8409194bb2c9a
SHA512 2a9a9162d610376512a8fae2cf9eb7e5146cc44c8ebde7a12e9a3985da1718c62ae517c25b00de7c0269efab61b4850a0becfbf04382a25730dbe9cf59825a62
SSDEEP 768:RMxowxdaCb0WaY4P8keYUej86bykBRWIsna:RM1r0NY4P80j86bHtqa
TLSH
T1EEB2E0EEEE552E4CE2F059B4962B734B8A46F022191F947832E7844E8F494C24EDE477
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000031

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000031
Size 76KB
SHA256 60c92efd672a4dc0d5f0f15149214e4af3702ed4cc33b3f826ba2a35918b2d90
MD5 4584da567a4220e8bef1895142d7e234
SHA1 d0f22539e708f190bb910222131aaf042dd6ec90
SHA512 3199430deea31463d07be3577953e616ae4fe82de1fb438ef61579da0264c324049ec4a92d3db67eaf100b47178ffa02c5636eedfaabb3d8aebb39880c076a49
SSDEEP 1536:NP2s592WtuNCVIlOm2dOYDT43dCoU+k9/2oPD624+My7Xqd71jC:N9592yEC6yOsM3ta2ou2tXC71O
TLSH
T1D97302BA71538B3B82A1999F2DCF29281108AB354F54B947704DFB90C1C64D3AF9A678
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000032

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000032
Size 21KB
SHA256 6f32da94d4f26e98cb6ccd97034d306aa38945322c816f54a93c7d15dc0905b8
MD5 2c20035257a126aec473203c38baf276
SHA1 cea71b90976aab1ed5d2c1324bb4b09be960e15d
SHA512 c94fb11cae0ed5a7870ac53453e1917fa4e09dde68048a48071798b03c395e97efbd55b45a0360775525bbfd2a24e6d81ea0cb9ccf0569716735ea4d02b50465
SSDEEP 384:X7cRxmywBqrZEV4zWI1TdquIrkzoCu6DzCgpGhH7P2kqwV3fofML:X7cRYdMWI11gZC/o72kqwV3fofML
TLSH
T1D0A2D055FBA8B200E768257A25EC85D9C8B83F318599BF0DCA6B40C60D73DBF06CD192
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000033

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000033
Size 41KB
SHA256 7ebc69a424ffb75011318c198462706b8baf5d3d9e0f15e36a0ced3be6c642ea
MD5 4c73b923cf2bb46fc4e458d1e998b449
SHA1 8b13f93a53d3c71d80ad6ca892e6db120db27a9f
SHA512 028cf22da40301e68e4123fae5aab90893580c7a3732c29d4f080ba3127016589ca4fc3180622d4a0175c26636496d52cb76307e6608ce4cbb93a873100418dc
SSDEEP 768:aS1GIh+o3q6EIwPh56ZSYiZhLhaGc3P6KzNaCplR+5jW4OFMgh5QS1e5hVu5bQQD:aq9/EIwPh0ZSYiZhlaJP6oNCg/dMhVu1
TLSH
T17A13E1D728EE5D55C58F445382B0705284BCCA1B4CCEC36DDA743E4E9A344222AFBEA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 432B
SHA256 9b558e8aaf573ef096f3706a6f75c0a822a9d156bd27f17c29bb1d709bdcc224
MD5 27479fe442e828e9cc0193fcb979b850
SHA1 542d1ea5e9b322992f5e75c65990114f50618c49
SHA512 d693479d9f122783c4b8826e7b6499f5b3669a73cd0262747cbac3bf39b28c01cbdd8cb8cba951a36df485aea3762e4ae6ec7ea271eaaea67d8cb25c02cef256
TLSH
T162E0869730CE0451EF996FB844819681AFD5F52148433E0B6D98949CD3976741D56542
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 ccf0d41fed298529d63974dc9effae95ece2763d1df9b9fd8c546e6ff4a119e7
MD5 c69e02e402e548d416e20df03c646910
SHA1 c543a57416833d3ceae875358c1c614e3210799b
SHA512 50c111dccbdf03018292b320fa85db59ae80072a66246ca979db9a39614b259c2583842dccb153a21ba59dfa4ec71f8c714f180d9c2cd9786403fe21cc0ba34c
TLSH
T1EF41EAD7E18A2C1CDF48197470CB5984EBB1E12C7E23AF671A848C696B47FB2244649D
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 585fb7a9af813b7ecec25ca79568b2429151753b51b5ad6eaebf295f07c9fe6a
MD5 561db246d2142a96515fd82eb5318f48
SHA1 b3fd235ad2d88873d40c08fc0c062f3be3dbfcdd
SHA512 c1cef543097a8e14c272c43a6f04a19a5e465c195afbd02a1285c9eedfcde3435cc2311dd529c528b2015a826684ab66fcf2fc7fa6067d391fe92a0c96a3de59
SSDEEP 3:MsEllllkEthXllkl2zEflNSW+:/M/xT02z2+
TLSH
T1304404457FC10445D50031304073C7507370D5103513575335D105335DD7D411C00001
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 17KB
SHA256 8bfdc93a50a4dcd780fdea53f80df2c6b17f5c3f2755c8515204d5c3aceb6b8c
MD5 ac3b1a0f333479ce14c1efedd3bac685
SHA1 080b52877317898bf3048c71e9b4d97f63e41ca3
SHA512 d0887a0fd87e31f5b30afed9acc05a5d504080fae2a506113a26ef0c1e6079883ca0cf4c7504b5adcd5704e53e7251473cb570941324f8dbe6772f0a3e62e2c2
SSDEEP 384:DY0utixwNZm5JkGdtMIaU0rvXr16aItl/+UoCUmtzEd7SqZuNQaqofqKSATnw+QP:xpHP7M/zX
TLSH
T17A82DEF7C3E4C56D892256F5AB146F1FCE690624431C3C7689E5BE0BA3E2471E24174E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 18KB
SHA256 8f059d6a9b35e36ce92316a3441e9738828b1f230622f84bc958a5d1f4b58019
MD5 05ac3d4d70b4df3423590f58af00a8ac
SHA1 e428893cc64ae372ea250c0d635046507ac75322
SHA512 266d4cf3269a95db97bae38bd8ab4f603833e971dab3ad39337a716ac48f5914d2c572587c6364974ab19639a22d9d825aa85a7af446b1cad60bcd48f3950c30
SSDEEP 384:DL6SoNnMgnsLJCMO1MIaU0rvLaItl/+UoCUmtJE9axN4nRIwNQaBKofOK+Annw+F:TtXYPBbunIB
TLSH
T1F182DDF7C3E8C62D896216F5A7246F2ECE590A24431C3C76C9E5BF4B93E2471E20164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 264c8958dbe27f0a92cc72243e9007183f01c01c3ee9c0d0daedaddfbed3a6a1
MD5 a3a0e50a908f1e76abbae2081d8aaf75
SHA1 bcdc1f859f9afe17e944a135154984a2683f32df
SHA512 ece82401703d39e81615c7b367ce64498602c9c3c6582a276d3e9a8bdc840494beb396125bf1db29c66bff8c1ae13870de17271ba73ea622280bde8ad6d790a4
SSDEEP 192:JRQcBzgPtaQgqv7+pAPRp24PCb9uHsb+WNxwtCt4Rm2Ef7kwa3haVyIsnAUge:JRQmzg1wm6UXuUwewn2y7De
TLSH
T10352D72FAA646A7B5CDFC329F9217717D7F5112231901E84E6FC8A2C14DB9CD2227427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 4994ac13247b4a2d787c12b2c28611aaa7c6dc6cd709b33148a82405efae4220
MD5 17bdf90abd51e5c97fb52ed61a199def
SHA1 eec5e208ecdc22dbffa76952d4c27f94ec60947d
SHA512 dbfad99cf2236db7803bf9304ed09f93af83b6d20ffd386ab9c16b912ba5c3aed95477c53e390227a0007bc9da1d2b33bf1c9cb5293570ae805a768b76593f2b
SSDEEP 192:JRQcBzjPtaQGhv7+pmPRpwEqYCAzM9uHsb+WNxZReB9CW0f7kwa3SaVyIsnAUgE:JRQmzj1Wx6iXkUww2Wi7wE
TLSH
T11A62B56FAA542A7B5CDBD329F922BB17D7F5102231901E88F6FC8A2C14DB9CD2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 eb6f71652f3885907a6087775e80e64f4b92559878859b3089834ceb0bd206b0
MD5 5cf419fe162459e7a01eb1497a0c90d6
SHA1 d2ea4d361bc3367bfe0dc3d4ea33beb21a7c473c
SHA512 a4924124d7fa5d8c175e48fb979a384ee9ab6110350abd745b82657f85c387527fc1ceb7ed62dd56c903ce8eabf52f680820a39ae07499b06215e57efd5edcde
SSDEEP 192:JRQcBzpPtaQglv7+pAPRp24PCb9uHsb+WNxwtCt4Rm2Ef7kwa3haVyIsnAUge:JRQmzp1wV6UXuUwewn2y7De
TLSH
T1E752C62FAA646A7B5CDFC329F9227717D7F5112231901E84E6FC8A2C14DB9CD2227427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 7c1e1e0112b52fba85fc0fb4e3778be129d4696f9acb38c82101c8f4b82c401c
MD5 b1be7f6f08e991af300f83e34a1a974a
SHA1 82bda16784287179354ac1046a0a857227cff674
SHA512 f1a0925cc59b99810a9ca60b41948745d23f846e282b792b61dd72637a1c30e5a28bd728f76272b57504c4b53e24e28104f531e7c702d1f298f17f5c0ef3ddef
SSDEEP 192:JRQcBzjLtaQGhv7+pmPRpwEqYCAUM9uHsb+WNxZReB9CW0f7kwa3SaVyIsnAUgE:JRQmzjpWx6iXZUww2Wi7wE
TLSH
T1F362B56FAA502A7B5CDBD329F922BB17D7F5112231901E88F6FC8A2C14DB9CD2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 af597f9b6eaf1e9bb85da519a698dbaee67d6043653efdad5a99ffca88fb6a38
MD5 1a6e3a2739b5da0e88b847cdabe55849
SHA1 edda83b4002ca2d74ed1247c5f7c001046a8d928
SHA512 9006761067593a1280e1555f2242101539dfafac056976b9f036addb364b9c047509b7994d8ef44f74bd5937cdcdc6bf7f5b96ca248ca92ee547ee552df7a80b
SSDEEP 192:JRQcBzgPtaQGhv7+pAPRp2EqYCA6M9uHsb+WNxZReB9CWcf7kwa3oaVyIsnAUgE:JRQmzg1Wx6UX9Uww2WK7sE
TLSH
T13052B52FAA542A7B5CDBD229F922B717D7F5112231901E88F6FCCA2C14DB9CD2227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 7d6a2ad63d3c0d8863418c49b697058804d03a72b6c42e2ce5dc897a3bfa8299
MD5 0faf13385def881874ba53ffab17417b
SHA1 c02408e0ddee240de8d64bab19b5619172599dab
SHA512 416160e481e157dcf308cb0f9bf9137659545a1148a634323cf6209da2da00826eb1bbe5edf137d39bcd25f47d9d4916fffc5c05e9bf84ed4d4be60712d64897
SSDEEP 192:JRQcBzgPtaQ9hv7+pAPRp2EqYCAaM9uHsb+WNxZReB9CWcf7kwa3oaVyIsnAUgE:JRQmzg1Nx6UXBUww2WK7sE
TLSH
T1DE52B52FAA542A7B5CDBD229F922B717D7F5112231901E88F6FCCA2C14DB9CD2227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 87abfd6483e055ddeb2f8fc2f483f91af443de3130ad7f6cceeeecc94a6c2511
MD5 04c2655e775a571e3b09dcdcd782d924
SHA1 84dda5dbd4088a2a3591384e8279d568339c383c
SHA512 38ea57f7244c49bbd8e846e3f0d5342b6c186f24c011ef661cc6a4f6836da0e0f816f76146075af79a69abcd50476432db60bf14c0daf6c81fe144ac588ce833
SSDEEP 384:fFjLm7KxkXqKf/pUZNCgVLH2Hfgsl+27pLuLcSjBsXODLi+ErU3ZSHG7Ep83wCv:fVLm7KxkXqKf/pUZNCgVLH2Hfgs427p+
TLSH
T18C7208676C4C9E370F94D6C8D8267B4FADB5024B65DD886493FA982903D4BCF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 2e7f97f65edb485006f1b8f5018ecdc6bdefe55502b6e2cf68245f3f807dff13
MD5 5fdc5a43a04caeaa7394ae4e3192c5ec
SHA1 aefb08b218a9d9950a6888c7b0f3eec4a0ce68b6
SHA512 d19c35b5e631b26d4bd19784b9d0b6332648cb07ac83b76e7d0d9751b2cbd3ad23a1f70ac833f3af62d732026e9c411cbc24903f96e33f3579e0da6e3f8a150f
TLSH
T196B012008042D121C16222B01146549871245F22A60F170197E4B922C839161C014051
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe586637.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe586637.TMP
Size 96B
SHA256 67686ff52425e60f72c893b9c1f4de66f0bfd7d621869888c50345e473abb058
MD5 9a5d4dca546b4824917afab176dbf06e
SHA1 20f21ab5b0db1d0fd1b1e1b6b40067d5d954dc28
SHA512 a4788ff1b0ad5454f25426f8679b9eabc53621dfd459526883fbcdcd8c4d3ea3e54c27e0fe2e41d9c6714d9af49f588d1d73ad5f4b4c0729ee44f2cbb3d8917e
TLSH
T1B4B00295D142A212D48703B839A996D8B1E1DF26CB07271296E05E6EDC2A6B24525160
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 01daab5f94ce61d93d3c3eb2cdd120f5718c11c5960be08bcd84da3866faa10b
MD5 18aa5cbe87ea375c62a31c5730a9b2c3
SHA1 e01a6d4298d125f5db99ba76492498310614105a
SHA512 f477f3f06ca8f9c568ba5b59bd43f4b9f651758729d5c43277022a1e6499ecc7665ba36973cab46fa2b1caa52f2091cca81e2dd428f4e80af152cb04468e51a1
TLSH
T1FCA0025556C50C52D9800672A29102C06711D9A00706CB0799D04184DC525825911288
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 6cacd942c1a01f55e17cb7d9d324f4b5a27e8947d03e62673a7ab409c81cfe88
MD5 fda2da282d5a4f6e5af047049ee0146b
SHA1 4458d5e0f1f7b1ace4c17cc1705e0f0e123a4741
SHA512 40616f8b4d2561ef9dd77cafe263438d38c63b5f1042538a1d0cc210bc4a6b8a640b5d3938ed4b599a9f6502c2cd1a2479199700f91db39ad251bb6697b02856
SSDEEP 3072:Pp8uwLcXcgVXruSixWgL0rF6jh9JDvexqw/w5nP:PvwCcmXKegIh6jh9JvexhQ
TLSH
T106C3125A282B3DA68CFD7DB370473782869213A26C09F04EA4C8DF0A45DDDF915EB4B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 b655a33e686285172cf8f931771fac3f1b6fb42d700e70c45fd2dad2f08887c8
MD5 ee78a23542c777a4b88b333262d994bd
SHA1 edcbc7f7d34a68e42937033a6621b646daefb567
SHA512 513bf40aa97d1f23bdbb4688c9a28e77dbb075ab2470a8805b31720a2653528504f9ac8c0359675fb999e7d189ca007bba100f3e521051f635165861f46a0129
SSDEEP 3072:T8uwLcXcgVXruSixWgL0rF6jh9JDvexqw/w5nP:lwCcmXKegIh6jh9JvexhQ
TLSH
T15BC3125A28273DA68CED6EB3B44733828AA213E66D05F14E90C8DF0B45CEDB515EF474
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 c9d84391862cf21e21f3a712867f2ad8e6329cef72fca6625fef9348ce916edc
MD5 c9a77cafde1ea13977c6c9c95c5dd919
SHA1 cfd02160d5daf0e2b2c2f407625c72bac9a30e59
SHA512 2f1276eff94cd0f50d92ec5399d4c053006e6c9b5330db1046979af69ad900dd33b16d6c946ddc2bd62d37c60d9640da3eb6d13c397fa00eb9d2c351580c8c13
SSDEEP 3072:jp8uwLcXcgVXruSixWgL0rF6jh9JDvexqw/w5nP:jvwCcmXKegIh6jh9JvexhQ
TLSH
T15DC3125A282B3D968CFD7EB370473782869213A26C09F04EA4C8DF0A45DDDF915EB4B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 32cf17641cf9a8fcbb176575e3ba6f95319db102bcf65435d401a7eafb119779
MD5 40eca5ba125bda6fd30d70a1912aa7d2
SHA1 359ec9f06fa4a30006ad1704b5f3ad30759bb971
SHA512 e5173bb573b37dcc82fbab2b1a7f148d0611b5be9ae2b0f368f2d5df8fe3c3ba46a36e8a43dc9930984cf7b2d66903da7f2415cdc43884e5db9afb701f97a7d7
SSDEEP 3072:i8uwLcXcgVXruSixWgL0rF6jh9JDvexqw/w5nP:0wCcmXKegIh6jh9JvexhQ
TLSH
T1F5B3125A28273DA68CBD6EB37453338286A353A26C05F14E90CCDF0A45DEDB415EF8B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 2dcf505d28160f37ca6c6ef130e07a756aee0bf953058fbc02b78350632fe2d0
MD5 29381c59ed94ad488d638d1e2d34ccaf
SHA1 dd1681ded5431603beb1162847a6955a94600e22
SHA512 22ec0ac7bd78533dc975f3314b2a241f75d4215990f8f1e57c9614374e5febd0277632ef6c6dd761129986144f67933a802a3b20b8ad756d94000be5c2bee7b7
SSDEEP 3072:u8uwLcXcgVXruSixWgL0rF6jh9JDvexqw/w5nP:YwCcmXKegIh6jh9JvexhQ
TLSH
T150C3125A28273DA68CED6EB3B44733828AA213E26D05F14E90C8DF0B45CEDB515EF474
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 c0380d045af9f1b57d41dfd0e12026349901b6acb19b812de86b9081d293ef7d
MD5 2e8e047c75032b77bf738f17a0be0d86
SHA1 8ba2a5a94d6523e18531e4d01ce081cf1ec5ad19
SHA512 82b6fb721f4a352c9ea3d0c955af9df4a52f6e4a69c2e88ad2532cd927c736144255b15b322d9a15ca506167f602250c48d51add8aee26d0e964541d4a7a9027
SSDEEP 3072:u8uwLcXcgVXruSixWgL0rF6jh9JDvexqw/w5nP:YwCcmXKegIh6jh9JvexhQ
TLSH
T1B7C3125A28273DA688ED6EB3B44733828AA213E66D05F14E90C8DF0B45CEDB515EF474
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3488029535

Path C:\Users\Admin\AppData\Local\Temp\3488029535
Size 138KB
SHA256 ccdffa787cf26b18586fc2b1f962f1bb13c7889e0641fc8715939a71bc20626f
MD5 6f5e4d4d233a1e7e002afe91ef8d133a
SHA1 a7c97bddcfce221646c3f0bb89f6a6b522275ad5
SHA512 a20fe98b06c65c2145113094cf79fcd06420cc000738d11840b7251ed554f6c54d919b31f3adbc106cf43f9949ab8dc794500d9c9c8dde12c927a83b09e519a1
SSDEEP 384:jeuvBnhJsueMEGvIW1DcP242Rs3gaVumrlm6:1nbZeMrv/hG5kswSlm6
TLSH
T1A0D3984B3AB43102DDE69A721CF051BB5E3CB17D8F5195D428B620588EF2963A23D4BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI28842\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI28842\base_library.zip
Size 1.3MB
SHA256 ed580f10d055c2287572895e090ff693178ed0c5c8f50b8147d99856cf839006
MD5 b2735f340e8a789c28631679d219ebe7
SHA1 878eded5ecfc288c5d45a1fd136945267098449c
SHA512 80e5a24184a6f698b0f392366115c240bfb62ccfa0761b02ee2f1f52ec8351d1b2ef8d15f3b01a994a63429a547015e8ca7776cb9e7d488b68e50838adf299fd
SSDEEP 12288:cy6qxi2cPPdxhYgbiML+DNR/uOBa80201jwCVRDVoioSYBEW7Wp7wt9b4tYzGNcN:cg5cPPdxhYjzV7Wp7w5SeT1HqJdZs
TLSH
T16D551992B9527953FF64F37B80B7484CF31E86A2EF00C207355E42661EFE6B09E59588
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python313.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI28842\python313.dll
Size 5.8MB
SHA256 0565965617d94274d7f2c2958d0bef33392cd9d2f346f99d8e1bedbdf264ee85
MD5 5acd4d4f35e13ef79c883ace05c4eaf5
SHA1 03a2944b87b8a6fe0bff5336978ed6558deda5a2
SHA512 f1bb13fac80f28e2419479ee14e41dbcba8fbdc0ca3698d01a8ccddf2bc2fe3a4cf90acf2fd42e4a2f1ec49751d0c66cbc7b59fb8a43fc4dcb7b892cae76e525
SSDEEP 98304:GlKJHA/wful8vHGtFjX/LTv4HDMiEJZIPcR:GlLhl8kDioIPcR
TLSH
T102568D16729E41ACC97B8078CA03864BFBB27C417FA0534B61E6BB5D2F73362466E705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_boldqcl2.reh.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_boldqcl2.reh.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

se.exe

Path C:\Users\Admin\AppData\Local\Temp\se.exe
Size 10.0MB
SHA256 c4b7bf11af4556da8ec0f52d40f6e789e0165005064e815ee4af3a21213386cc
MD5 116f02e5bcf6cdf888a7467b4a4720ff
SHA1 623ea893c99c6e85a0bc03d79cbcea9ea43d57ec
SHA512 607fe905b9fbc570d5737078bdfc0cd9e77b2d7fc97918d839751ef76f30aab20df5726d931449474af039cb2a50eb3aa0d7431e32c26163adba7f76cf943b84
SSDEEP 196608:nQ90W8UAltAhurH0D9BKG+5fc2S/ErXKEtw+J4Jkz9Rwpr2Zwl6RoFmWPMsqfNmB:nlW8FahuQDvV+53SM8+JLwq4kDC
TLSH
T150B633987BD505F8E4AAF23EC9C48C266391711207A1CA875BF44D720CB71E8FE75B62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

set1.exe

Path C:\Users\Admin\AppData\Local\set1.exe
Size 3.4MB
SHA256 1dc6503392fb39ca1b9f7a69e0cfcc5708da0f3ec29f2b1ecf0197f7f56f489e
MD5 b981e6824728e2f1ceee13f223efc383
SHA1 4bab677a8cc3e8be1b25b105a99afce7823b56f1
SHA512 68c29cc554b5d7b596081af654a8fec7b78a126a500a979b368af70f762f4d390af49bc07733d613b2a5edc1bf5479a873a6b369ee8bc55db67593d048537f1e
SSDEEP 98304:q2l6WNcP1jRF+Rk+5QaTNjVada6WO34MiHotQ:qEKQDQaRV96j31FG
TLSH
T1A2F53327CE297177FD061434260A9868C6F84DA17F97C023D0ACF87E176F3A7A751289
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z2601-x64.exe:Zone.Identifier

Path C:\Users\Admin\Downloads\7z2601-x64.exe:Zone.Identifier
Size 980B
SHA256 080bed1314adc4dcd49f50df04bfdec65e8b2be81f130ad72acf4a7c08110c12
MD5 e7458a76b031f79fa4a33c7fbb464e35
SHA1 18befe4f9fceb708b1330d8af3d27c60693afd83
SHA512 5c20287d24878d3f9d4d885c10554d091a56b55d542f773e41215e71924323a53659017bd21478e15d8abc48690402be22fee958c28ff53b6cb84930fc727697
TLSH
T1071154F6D025A64F1F0AB5B18D6C9D6EA137A4C646C7070E945AD0CDC5C05BA63D383B
MD5 SHA1 SHA512 TLSH

Submit Download

EZIC.NET.zip.crdownload

Path C:\Users\Admin\Downloads\EZIC.NET.zip.crdownload
Size 18.4MB
SHA256 1ce58526da3a59f1866fe9ff6038306d00fc7ddddbc5877ccc08140376c13173
MD5 fb5fcd820b6891b875556b1eba3a2751
SHA1 d18a400bf71e8aec424f59d2c776ea61cc635c44
SHA512 6bf96e77b3b63914fb23d6ad6b75121e4e1f8a746085dc11c98337f8b152951155ad4a72fa7efe73402e369a46d9d1fae96707fa405d5fbcebd71bbef5aff182
SSDEEP 393216:H1QrTODOHu/Z00Xz6J1YVO2XNkEhVUTM7ndz4f1li/QL6ZuX/lL:VQrTCOH81zO5QNkvY7nd8dM5ZuX/9
TLSH
T12317331CFFCA559DCA05EF92C1C10F2712E692EFEC9281A012D47A545CF886DCEEE526
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EZIC.NET.zip:Zone.Identifier

Path C:\Users\Admin\Downloads\EZIC.NET.zip:Zone.Identifier
Size 271B
SHA256 25ebfc079bb644f062a423762989f11caef536e7da225e79b49393be9fd32f95
MD5 b6258ca3ef806ee60456acaf11883a5d
SHA1 76a21fdc901c8b554a19fef75fbd4077ff3aa1fd
SHA512 d42a54810fe5ddb3beace39cd7686296f1e58becd4dcb93ab2e9b75781b5773903b3516da50eb288af238d3585df3ed4044e618029344ba967e0ab0168105cb7
TLSH
T19BD02B6AE5A20409117DA2C8008D182C7035E221583A5003BDF183BE97C65D6869D777
MD5 SHA1 SHA512 TLSH

Submit Download

Unlock.exe

Path C:\Users\Admin\Downloads\EZIC.NET\Unlock.exe
Size 18.4MB
SHA256 b0d52146decd4f82264dddd0df1e99a5e4362a1c6f0afed5281224b6c12300cf
MD5 133e3ba024fc1beff6b95c781a829cbd
SHA1 477fb8fd3c652a3d2780017a5d45f0f8f6ab77fd
SHA512 34caad9301be95981b036677150dc90c4d9c1019c3ba8565828397f74321e53a8a7ac24f86e9e465bc35a237dc052dc5044ce47f592770442c4299de98d0d46f
SSDEEP 393216:U+d2TcYfaN4OtKitnmkKZqHyhhlD46TJmWq7LrOOQxSzBadI1g9uuu8QgfkgonBY:U+d2T33emkacHHiTIzB5Wuuu8Qg8BY
TLSH
T1AA1733D8AB364AF1D1980B357136E5DFFF6C8262CAEAF8A0F5C707195414742C28627E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

set2.exe

Path C:\Users\Admin\Downloads\EZIC.NET\set2.exe
Size 5.0MB
SHA256 b82fbdcb127d7761b7a31780b9cf2e17b3594301a54db9a87f79f649e1cb482d
MD5 13578ee56b6a1120af9da2ae03312245
SHA1 80ff285978e647fe0eb84d3ff3016e1e46b32272
SHA512 1d59b527e86cb1f3d946245ca58b174eceadfecbde44a8558d522c2c5570f69fc6e669bec6b9f892b48467a2447308d444040b5ca4481b49ee4eedcbde182aab
SSDEEP 98304:pku0jjAzp1IUL4xxrEawiTngK6zRyJbtsT+1eYzurkmmnSHILJ+QTarbSdKBEz:pkbjUzp1/SNE9iTngt0K+1eYzuvkSAJj
TLSH
T10B3623181B0EED1DD66940FF88393AABB3187AD323C40DE779D53E1275706AE65C0AC6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unconfirmed 507285.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 507285.crdownload
Size 1.6MB
SHA256 d64a0468f5b5b0b0fc5b2188450bcd655b70809d97b1c4535f2884635094377d
MD5 bed0747071a866109d26eced6c7751e0
SHA1 625e395ad8bd099a311c72e0d8e65d1c3bd6628a
SHA512 e52d5050c8fe4c0a09bd482d36eb1377cf342c4739060d94094c4acb5aab1e53fa3842f64dec7b5df3b3bdc7394a8bc9a9cd7a88808342c1136dd9ce9fe5a0a2
SSDEEP 49152:4VX0/V4ZUBGxZ+wfHXf6JIOGZKU5sc+ug2ksehzmh1TDR:4VXCVQlxkwfHXf6JIOGMc+ugswzmbTDR
TLSH
T135753353F3AC22B6C1D29638CE14534ADBDB78BC47A1DA1E10C29C211E93690FDE5776
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

read-first.txt

Path C:\Users\Admin\Downloads\read-first.txt
Size 342B
SHA256 93a4dddb9015a19c05aeb600fb3c00a07d9f494bb51f0e8d8484e196843974d1
MD5 5343dcd568a528bdd8fc3fe23a3c1fb6
SHA1 a7e6fb153636518fe553ff64e3d6cfc81c4cfcc2
SHA512 30a6025e61b87f6fb7f8250cb19d340c38ff87e4ee6302cc0a898de705838667bd12377527ae542315f91b056451b6dac95ca781106188bee7f53ac0a816ad7e
TLSH
T133E020897433B7B51A431F6AC72E06D27B33D59C807751960066D224355761583D31C2
MD5 SHA1 SHA512 TLSH

Submit Download

snapshot_2026-05-27_12-11.zip:Zone.Identifier

Path C:\Users\Admin\Downloads\snapshot_2026-05-27_12-11.zip:Zone.Identifier
Size 202B
SHA256 de830abd8b444e231bdf4bb8ed68172813fda79ea10d99fc2c33277e6a621d47
MD5 69e600298fef5e2998bb3f99bdadc574
SHA1 f0a15d6aab63dd964ffdd02e0ae1d9b25be238af
SHA512 993236f617ab4137449b97c761caed5aa6c9b7fb6ec3e36e1a6fd12a8d56b57177599cb7f9688f00cc5ada0a57abffc76fd586209f3cdb6844dd388ffa02c7f3
TLSH
T1C4D023C38D14D02D472475C4176CEB1C601F7E05455C5074F6108007544407054D1B07
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1756-2059-0x0000000000050000-0x0000000000CA7000-memory.dmp

Download

memory/1756-2050-0x0000000000050000-0x0000000000CA7000-memory.dmp

Download

memory/1756-2055-0x0000000000050000-0x0000000000CA7000-memory.dmp

Download

memory/1756-2028-0x0000000000050000-0x0000000000CA7000-memory.dmp

Download

memory/1756-2057-0x0000000000050000-0x0000000000CA7000-memory.dmp

Download

memory/1756-1898-0x0000000000050000-0x0000000000CA7000-memory.dmp

Download

memory/1756-1907-0x0000000000050000-0x0000000000CA7000-memory.dmp

Download

memory/1756-1905-0x0000000000050000-0x0000000000CA7000-memory.dmp

Download

memory/1756-1902-0x0000000000050000-0x0000000000CA7000-memory.dmp

Download

memory/1756-1903-0x0000000000050000-0x0000000000CA7000-memory.dmp

Download

memory/2248-836-0x0000000000A90000-0x0000000001CFE000-memory.dmp

Download

memory/2364-1918-0x00000000050A0000-0x0000000005106000-memory.dmp

Download

memory/2364-2024-0x0000000007310000-0x000000000732A000-memory.dmp

Download

memory/2364-2046-0x0000000008570000-0x0000000008B16000-memory.dmp

Download

memory/2364-2045-0x0000000007440000-0x0000000007462000-memory.dmp

Download

memory/2364-2040-0x0000000007420000-0x0000000007428000-memory.dmp

Download

memory/2364-2039-0x0000000007430000-0x000000000744A000-memory.dmp

Download

memory/2364-2038-0x00000000073D0000-0x00000000073E5000-memory.dmp

Download

memory/2364-2029-0x00000000073C0000-0x00000000073CE000-memory.dmp

Download

memory/2364-2027-0x0000000007380000-0x0000000007391000-memory.dmp

Download

memory/2364-2026-0x00000000074B0000-0x0000000007546000-memory.dmp

Download

memory/2364-2025-0x0000000007360000-0x000000000736A000-memory.dmp

Download

memory/2364-2023-0x0000000007940000-0x0000000007FBA000-memory.dmp

Download

memory/2364-2014-0x0000000070810000-0x0000000070B67000-memory.dmp

Download

memory/2364-2022-0x00000000071E0000-0x0000000007284000-memory.dmp

Download

memory/2364-2021-0x00000000071C0000-0x00000000071DE000-memory.dmp

Download

memory/2364-2013-0x0000000070580000-0x00000000705CC000-memory.dmp

Download

memory/2364-2012-0x0000000007180000-0x00000000071B4000-memory.dmp

Download

memory/2364-1970-0x0000000006180000-0x00000000061C6000-memory.dmp

Download

memory/2364-1929-0x0000000005DB0000-0x0000000005DFC000-memory.dmp

Download

memory/2364-1928-0x0000000005D60000-0x0000000005D7E000-memory.dmp

Download

memory/2364-1924-0x0000000005880000-0x0000000005BD7000-memory.dmp

Download

memory/2364-1917-0x0000000005030000-0x0000000005096000-memory.dmp

Download

memory/2364-1916-0x0000000004E80000-0x0000000004EA2000-memory.dmp

Download

memory/2364-1915-0x0000000005250000-0x000000000587A000-memory.dmp

Download

memory/2364-1914-0x0000000002520000-0x0000000002556000-memory.dmp

Download

memory/2848-1855-0x00000213D9620000-0x00000213D96D3000-memory.dmp

Download

memory/3456-1927-0x00000000006C0000-0x0000000001317000-memory.dmp

Download

memory/3456-1913-0x00000000006C0000-0x0000000001317000-memory.dmp

Download

memory/4936-1884-0x00000000005E0000-0x0000000001237000-memory.dmp

Download

memory/4936-1888-0x00000000005E0000-0x0000000001237000-memory.dmp

Download

memory/4936-1900-0x00000000005E0000-0x0000000001237000-memory.dmp

Download

memory/4936-1839-0x00000000005E0000-0x0000000001237000-memory.dmp

Download

memory/4936-1879-0x00000000005E0000-0x0000000001237000-memory.dmp

Download

memory/4936-1880-0x00000000005E0000-0x0000000001237000-memory.dmp

Download

memory/4936-863-0x00000000005E0000-0x0000000001237000-memory.dmp

Download

memory/4936-1894-0x00000000005E0000-0x0000000001237000-memory.dmp

Download

memory/5388-1860-0x0000000140000000-0x000000014000E000-memory.dmp

Download

memory/5388-1865-0x0000000140000000-0x000000014000E000-memory.dmp

Download

memory/5388-1861-0x0000000140000000-0x000000014000E000-memory.dmp

Download

memory/5388-1862-0x0000000140000000-0x000000014000E000-memory.dmp

Download

memory/5388-1858-0x0000000140000000-0x000000014000E000-memory.dmp

Download

memory/5388-1859-0x0000000140000000-0x000000014000E000-memory.dmp

Download

memory/5500-1873-0x0000024CF0570000-0x0000024CF0590000-memory.dmp

Download

memory/5500-1866-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/5500-1875-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/5500-1890-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/5500-1877-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/5500-1891-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/5500-1874-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/5500-1872-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/5500-1878-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/5500-1876-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/5500-1867-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/5500-1870-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/5500-1868-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/5500-1871-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/5500-1869-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/5556-2011-0x0000000000DF0000-0x0000000001A47000-memory.dmp

Download

memory/5556-2009-0x0000000000DF0000-0x0000000001A47000-memory.dmp

Download

memory/5764-1835-0x0000019E3E3D0000-0x0000019E3E3EA000-memory.dmp

Download

memory/5764-1817-0x0000019E3DD50000-0x0000019E3DD72000-memory.dmp

Download

memory/5764-1834-0x0000019E3E270000-0x0000019E3E27A000-memory.dmp

Download

memory/5764-1831-0x0000019E3E060000-0x0000019E3E113000-memory.dmp

Download

memory/5764-1832-0x0000019E3E030000-0x0000019E3E03A000-memory.dmp

Download

memory/5764-1836-0x0000019E3E280000-0x0000019E3E288000-memory.dmp

Download

memory/5764-1837-0x0000019E3E3B0000-0x0000019E3E3B6000-memory.dmp

Download

memory/5764-1838-0x0000019E3E3C0000-0x0000019E3E3CA000-memory.dmp

Download

memory/5764-1833-0x0000019E3E290000-0x0000019E3E2AC000-memory.dmp

Download

memory/5764-1830-0x0000019E3E040000-0x0000019E3E05C000-memory.dmp

Download

memory/6016-1881-0x00007FFCDED30000-0x00007FFCDF285000-memory.dmp

Download

memory/6016-1885-0x00000000701C0000-0x00000000701D5000-memory.dmp

Download

memory/6032-1816-0x00007FFCFD6A0000-0x00007FFCFD6C9000-memory.dmp

Download

memory/6036-2054-0x00000000005E0000-0x0000000001237000-memory.dmp

Download

memory/6036-2052-0x00000000005E0000-0x0000000001237000-memory.dmp

Download