5d589e5b5140a87314bb3b7db9beca1cffdb3dc47390420b729060132d84cbd6

Resubmissions

10/08/2026, 14:33

260810-rw92gabl3y

10/08/2026, 14:28

260810-rs4ehs1blb6

Analysis

user interaction
yes
max time kernel
150s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
10/08/2026, 14:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SpotiFLAC.exe
Size 7.2MB
Sample260810-rs4ehs1blb
SHA256 5d589e5b5140a87314bb3b7db9beca1cffdb3dc47390420b729060132d84cbd6
MD5 ce099913b78d9477f38da50c0861a55c
SHA1 bf53db7dfa92b31fdb0e8fad2a1b305480163ac1
SHA512 d37ba3dd83fb34a4be3938e5524080e22194fcf92f9da12d5847de00e5a9fab20766289977baa271d49cd6029a0d48f2b4cfd8f9e22e69ca8f2c471bebfb0dff
SSDEEP 196608:GWvpeOIsNMRdgzyrLI1LRzJbSUiVvs9+Rmc:PlNwKn115SUCvsvc
TLSH
T1627633ECED40C47EEA0DB4B281F484AC3E55D17C9C89F70ADAFA4AB6424749B7D03498
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery spyware trojan upx

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	SpotiFLAC.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/4940-0-0x00007FF6A3FF0000-0x00007FF6A76BB000-memory.dmp	upx
behavioral1/memory/4940-182-0x00007FF6A3FF0000-0x00007FF6A76BB000-memory.dmp	upx
behavioral1/memory/4940-183-0x00007FF6A3FF0000-0x00007FF6A76BB000-memory.dmp	upx
behavioral1/memory/4940-204-0x00007FF6A3FF0000-0x00007FF6A76BB000-memory.dmp	upx
behavioral1/memory/4940-215-0x00007FF6A3FF0000-0x00007FF6A76BB000-memory.dmp	upx
behavioral1/memory/4940-218-0x00007FF6A3FF0000-0x00007FF6A76BB000-memory.dmp	upx
behavioral1/memory/4940-237-0x00007FF6A3FF0000-0x00007FF6A76BB000-memory.dmp	upx
behavioral1/memory/4940-338-0x00007FF6A3FF0000-0x00007FF6A76BB000-memory.dmp	upx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	SpotiFLAC.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	SpotiFLAC.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2124	chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134308457201746504"	msedgewebview2.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1636999435-3883760687-346127294-1000\{A87BB5F2-08BC-4D40-866E-09EEECEBD97E}	chrome.exe

Modifies system certificate store 2 TTPs 1 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	SpotiFLAC.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
2796	msedgewebview2.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3696	chrome.exe
Token: SeCreatePagefilePrivilege	3696	chrome.exe
Token: SeShutdownPrivilege	3696	chrome.exe
Token: SeCreatePagefilePrivilege	3696	chrome.exe
Token: SeShutdownPrivilege	3696	chrome.exe
Token: SeCreatePagefilePrivilege	3696	chrome.exe
Token: SeShutdownPrivilege	3696	chrome.exe
Token: SeCreatePagefilePrivilege	3696	chrome.exe
Token: SeShutdownPrivilege	3696	chrome.exe
Token: SeCreatePagefilePrivilege	3696	chrome.exe
Token: SeShutdownPrivilege	3696	chrome.exe
Token: SeCreatePagefilePrivilege	3696	chrome.exe
Token: SeShutdownPrivilege	3696	chrome.exe
Token: SeCreatePagefilePrivilege	3696	chrome.exe
Token: SeShutdownPrivilege	3696	chrome.exe
Token: SeCreatePagefilePrivilege	3696	chrome.exe
Token: SeShutdownPrivilege	3696	chrome.exe
Token: SeCreatePagefilePrivilege	3696	chrome.exe
Token: SeShutdownPrivilege	3696	chrome.exe
Token: SeCreatePagefilePrivilege	3696	chrome.exe
Token: SeShutdownPrivilege	3696	chrome.exe
Token: SeCreatePagefilePrivilege	3696	chrome.exe
Token: SeShutdownPrivilege	3696	chrome.exe
Token: SeCreatePagefilePrivilege	3696	chrome.exe
Token: SeShutdownPrivilege	3696	chrome.exe
Token: SeCreatePagefilePrivilege	3696	chrome.exe
Token: SeShutdownPrivilege	3696	chrome.exe
Token: SeCreatePagefilePrivilege	3696	chrome.exe
Token: SeShutdownPrivilege	3696	chrome.exe
Token: SeCreatePagefilePrivilege	3696	chrome.exe
Token: SeShutdownPrivilege	3696	chrome.exe
Token: SeCreatePagefilePrivilege	3696	chrome.exe
Token: SeShutdownPrivilege	3696	chrome.exe
Token: SeCreatePagefilePrivilege	3696	chrome.exe
Token: SeShutdownPrivilege	3696	chrome.exe
Token: SeCreatePagefilePrivilege	3696	chrome.exe
Token: SeShutdownPrivilege	3696	chrome.exe
Token: SeCreatePagefilePrivilege	3696	chrome.exe
Token: SeShutdownPrivilege	3696	chrome.exe
Token: SeCreatePagefilePrivilege	3696	chrome.exe
Token: SeShutdownPrivilege	3696	chrome.exe
Token: SeCreatePagefilePrivilege	3696	chrome.exe
Token: SeShutdownPrivilege	3696	chrome.exe
Token: SeCreatePagefilePrivilege	3696	chrome.exe
Token: SeShutdownPrivilege	3696	chrome.exe
Token: SeCreatePagefilePrivilege	3696	chrome.exe
Token: SeShutdownPrivilege	3696	chrome.exe
Token: SeCreatePagefilePrivilege	3696	chrome.exe
Token: SeShutdownPrivilege	3696	chrome.exe
Token: SeCreatePagefilePrivilege	3696	chrome.exe
Token: SeShutdownPrivilege	3696	chrome.exe
Token: SeCreatePagefilePrivilege	3696	chrome.exe
Token: SeShutdownPrivilege	3696	chrome.exe
Token: SeCreatePagefilePrivilege	3696	chrome.exe
Token: SeShutdownPrivilege	3696	chrome.exe
Token: SeCreatePagefilePrivilege	3696	chrome.exe
Token: SeShutdownPrivilege	3696	chrome.exe
Token: SeCreatePagefilePrivilege	3696	chrome.exe
Token: SeShutdownPrivilege	3696	chrome.exe
Token: SeCreatePagefilePrivilege	3696	chrome.exe
Token: SeShutdownPrivilege	3696	chrome.exe
Token: SeCreatePagefilePrivilege	3696	chrome.exe
Token: SeShutdownPrivilege	3696	chrome.exe
Token: SeCreatePagefilePrivilege	3696	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe
3696	chrome.exe

Suspicious use of WriteProcessMemory 54 IoCs

description	pid	Process	procid_target
PID 4940 wrote to memory of 2796	4940	SpotiFLAC.exe	80
PID 2796 wrote to memory of 3980	2796	msedgewebview2.exe	81
PID 2796 wrote to memory of 4948	2796	msedgewebview2.exe	82
PID 2796 wrote to memory of 4948	2796	msedgewebview2.exe	82
PID 2796 wrote to memory of 4948	2796	msedgewebview2.exe	82
PID 2796 wrote to memory of 4736	2796	msedgewebview2.exe	83
PID 2796 wrote to memory of 3756	2796	msedgewebview2.exe	84
PID 2796 wrote to memory of 3756	2796	msedgewebview2.exe	84
PID 2796 wrote to memory of 888	2796	msedgewebview2.exe	85
PID 2796 wrote to memory of 888	2796	msedgewebview2.exe	85
PID 2796 wrote to memory of 888	2796	msedgewebview2.exe	85
PID 3696 wrote to memory of 2032	3696	chrome.exe	87
PID 3696 wrote to memory of 2124	3696	chrome.exe	88
PID 3696 wrote to memory of 2792	3696	chrome.exe	89
PID 3696 wrote to memory of 2792	3696	chrome.exe	89
PID 3696 wrote to memory of 4012	3696	chrome.exe	90
PID 3696 wrote to memory of 4012	3696	chrome.exe	90
PID 3696 wrote to memory of 5012	3696	chrome.exe	91
PID 3696 wrote to memory of 3440	3696	chrome.exe	92
PID 3696 wrote to memory of 5012	3696	chrome.exe	91
PID 3696 wrote to memory of 3440	3696	chrome.exe	92
PID 3696 wrote to memory of 2184	3696	chrome.exe	94
PID 3696 wrote to memory of 2184	3696	chrome.exe	94
PID 3696 wrote to memory of 2924	3696	chrome.exe	96
PID 3696 wrote to memory of 2924	3696	chrome.exe	96
PID 3696 wrote to memory of 844	3696	chrome.exe	97
PID 3696 wrote to memory of 1564	3696	chrome.exe	99
PID 3696 wrote to memory of 1564	3696	chrome.exe	99
PID 3696 wrote to memory of 3524	3696	chrome.exe	100
PID 3696 wrote to memory of 3524	3696	chrome.exe	100
PID 3696 wrote to memory of 5096	3696	chrome.exe	101
PID 3696 wrote to memory of 5096	3696	chrome.exe	101
PID 3696 wrote to memory of 4660	3696	chrome.exe	102
PID 3696 wrote to memory of 3936	3696	chrome.exe	103
PID 3696 wrote to memory of 4660	3696	chrome.exe	102
PID 3696 wrote to memory of 4516	3696	chrome.exe	104
PID 3696 wrote to memory of 4920	3696	chrome.exe	105
PID 3696 wrote to memory of 968	3696	chrome.exe	106
PID 3696 wrote to memory of 3416	3696	chrome.exe	107
PID 3696 wrote to memory of 3416	3696	chrome.exe	107
PID 3696 wrote to memory of 4500	3696	chrome.exe	108
PID 3696 wrote to memory of 4500	3696	chrome.exe	108
PID 3696 wrote to memory of 4620	3696	chrome.exe	109
PID 3696 wrote to memory of 4620	3696	chrome.exe	109
PID 3696 wrote to memory of 3404	3696	chrome.exe	110
PID 3696 wrote to memory of 3404	3696	chrome.exe	110
PID 3696 wrote to memory of 844	3696	chrome.exe	111
PID 3696 wrote to memory of 844	3696	chrome.exe	111
PID 3696 wrote to memory of 4032	3696	chrome.exe	112
PID 3696 wrote to memory of 4032	3696	chrome.exe	112
PID 3696 wrote to memory of 3340	3696	chrome.exe	113
PID 3696 wrote to memory of 3340	3696	chrome.exe	113
PID 3696 wrote to memory of 908	3696	chrome.exe	114
PID 3696 wrote to memory of 908	3696	chrome.exe	114

C:\Users\Admin\AppData\Local\Temp\SpotiFLAC.exe
"C:\Users\Admin\AppData\Local\Temp\SpotiFLAC.exe"
1⤵
- Checks whether UAC is enabled
- Modifies trusted root certificate store through registry
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:4940
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=SpotiFLAC.exe --webview-exe-version=7.2.0 --user-data-dir="C:\Users\Admin\AppData\Roaming\SpotiFLAC.exe\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msSmartScreenProtection --mojo-named-platform-channel-pipe=4940.2028.10040691369078085285
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:2796
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\SpotiFLAC.exe\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\SpotiFLAC.exe\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x160,0x164,0x168,0x13c,0x170,0x7ff8b28ab078,0x7ff8b28ab084,0x7ff8b28ab090
    3⤵
    PID:3980
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\SpotiFLAC.exe\EBWebView" --webview-exe-name=SpotiFLAC.exe --webview-exe-version=7.2.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1752,i,1847537378352743686,12376459996077783569,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=1744 /prefetch:2
    3⤵
    PID:4948
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\SpotiFLAC.exe\EBWebView" --webview-exe-name=SpotiFLAC.exe --webview-exe-version=7.2.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2024,i,1847537378352743686,12376459996077783569,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=2036 /prefetch:11
    3⤵
    PID:4736
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\SpotiFLAC.exe\EBWebView" --webview-exe-name=SpotiFLAC.exe --webview-exe-version=7.2.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2280,i,1847537378352743686,12376459996077783569,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:13
    3⤵
    PID:3756
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\SpotiFLAC.exe\EBWebView" --webview-exe-name=SpotiFLAC.exe --webview-exe-version=7.2.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3736,i,1847537378352743686,12376459996077783569,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=3748 /prefetch:1
    3⤵
    PID:888

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8b2fcc728,0x7ff8b2fcc734,0x7ff8b2fcc740
  2⤵
  PID:2032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1460,i,11187791550222720150,16021646036959271210,524288 --field-trial-handle=2140,i,8022160415841552490,12552968390789069290,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=2148 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1596,i,12821036690809659509,1361538347870341173,262144 --field-trial-handle=2140,i,8022160415841552490,12552968390789069290,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  PID:2792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2372,i,6613701538929809320,2405325173680831215,524288 --field-trial-handle=2140,i,8022160415841552490,12552968390789069290,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=2280 /prefetch:13
  2⤵
  PID:4012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3232,i,5174150804580551454,12826213106510379436,2097152 --field-trial-handle=2140,i,8022160415841552490,12552968390789069290,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:5012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3280,i,12685602556658831294,16836093847883115537,2097152 --field-trial-handle=2140,i,8022160415841552490,12552968390789069290,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:3440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4336,i,11832927147302964973,16236946707814098360,2097152 --field-trial-handle=2140,i,8022160415841552490,12552968390789069290,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4356 /prefetch:9
  2⤵
  PID:2184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4680,i,9830439581853503306,8842761242598142821,2097152 --field-trial-handle=2140,i,8022160415841552490,12552968390789069290,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4676 /prefetch:1
  2⤵
  PID:2924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5512,i,12822403676596355934,13617224294668639093,524288 --field-trial-handle=2140,i,8022160415841552490,12552968390789069290,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5520 /prefetch:14
  2⤵
  PID:844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5648,i,10417917118312360619,11964982114142831992,2097152 --field-trial-handle=2140,i,8022160415841552490,12552968390789069290,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5800 /prefetch:1
  2⤵
  PID:1564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5956,i,2098912806519855607,17630194864047009735,2097152 --field-trial-handle=2140,i,8022160415841552490,12552968390789069290,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5932 /prefetch:1
  2⤵
  PID:3524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=6056,i,8976555978641045862,6092065943532790434,2097152 --field-trial-handle=2140,i,8022160415841552490,12552968390789069290,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5996 /prefetch:1
  2⤵
  PID:5096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=6072,i,3695115104549175,15863332491808653345,524288 --field-trial-handle=2140,i,8022160415841552490,12552968390789069290,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3552 /prefetch:12
  2⤵
  PID:4660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3616,i,15126219377109155184,11593819357081484261,524288 --field-trial-handle=2140,i,8022160415841552490,12552968390789069290,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=6032 /prefetch:14
  2⤵
  - Modifies registry class
  PID:3936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6208,i,17114488716552297752,5470610179108011592,524288 --field-trial-handle=2140,i,8022160415841552490,12552968390789069290,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=6244 /prefetch:14
  2⤵
  PID:4516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6224,i,7251152851673607317,1404950374020621851,524288 --field-trial-handle=2140,i,8022160415841552490,12552968390789069290,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=6260 /prefetch:14
  2⤵
  PID:4920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6340,i,18058090217670015003,11909023503090929565,524288 --field-trial-handle=2140,i,8022160415841552490,12552968390789069290,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=6372 /prefetch:14
  2⤵
  PID:968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6204,i,13608844506042238556,18384624388667928974,2097152 --field-trial-handle=2140,i,8022160415841552490,12552968390789069290,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=6276 /prefetch:1
  2⤵
  PID:3416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6384,i,3786127027679625979,14274087962202914671,2097152 --field-trial-handle=2140,i,8022160415841552490,12552968390789069290,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=6436 /prefetch:1
  2⤵
  PID:4500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6528,i,5253876641370641521,6958428573924293317,2097152 --field-trial-handle=2140,i,8022160415841552490,12552968390789069290,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=6532 /prefetch:1
  2⤵
  PID:4620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6676,i,12362157055108528926,17908358268562022859,2097152 --field-trial-handle=2140,i,8022160415841552490,12552968390789069290,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=6212 /prefetch:1
  2⤵
  PID:3404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6476,i,13830428901773843704,10316090306630981189,2097152 --field-trial-handle=2140,i,8022160415841552490,12552968390789069290,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=6808 /prefetch:1
  2⤵
  PID:844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6992,i,2676186928047694046,13318144574529515429,2097152 --field-trial-handle=2140,i,8022160415841552490,12552968390789069290,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=6020 /prefetch:1
  2⤵
  PID:4032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6088,i,16918926531391077204,2954688750548211468,2097152 --field-trial-handle=2140,i,8022160415841552490,12552968390789069290,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=6828 /prefetch:1
  2⤵
  PID:3340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=7124,i,11011411882602835312,13958783030535065792,2097152 --field-trial-handle=2140,i,8022160415841552490,12552968390789069290,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=7156 /prefetch:1
  2⤵
  PID:908

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:780

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4344

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 56ffa123f95fc6dbd7fa82c3662a53be137f1629822b1dbcd6e977ea58937e8b
MD5 47e7e0e52a3272a76381efbcd0b621fc
SHA1 6ca2a0746c187fccdc42f3d72a94da5cddede454
SHA512 8a9a7eba2b2b29f29a1115c45ba1d0951c8720ea59e11f59b33c7a5574dab7fc9c72617fefe38af99cf0b4c55e9255d68d4b084b8cf3fe7d71d92ac28892316a
TLSH
T11FE022A9CC30AC3B48FD172C60511786F704031B3A814E6F3A3C922E8FB467E458A86C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000015

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000015
Size 22KB
SHA256 a1c54426705d6cef00e0ae98f5ad1615735a31a4e200c3a5835b44266a4a3f88
MD5 3b5537dce96f57098998e410b0202920
SHA1 7732b57e4e3bbc122d63f67078efa7cf5f975448
SHA512 c038c334db3a467a710c624704eb5884fd40314cd57bd2fd154806a59c0be954c414727628d50e41cdfd86f5334ceefcf1363d641b2681c1137651cbbb4fd55d
SSDEEP 384:MoiMw+zIwqYzlalgx0o6UpggOMzMcZzCy2IcwCK3hEtSr0mBOV2D/ilyGzWqP4s2:MtOIizlalgzvpgRc9WJYaS3B62bqNzR2
TLSH
T151A2D13E5FD4ED3849D0BDA245852ED7D96B4EA32EF058497A45F922F3231E30467870
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000016

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000016
Size 30KB
SHA256 7d757e510b1f0c4d44fd98cc0121da8ca4f44793f8583debdef300fb1dbd3715
MD5 888c5fa4504182a0224b264a1fda0e73
SHA1 65f058a7dead59a8063362241865526eb0148f16
SHA512 1c165b9cf4687ff94a73f53624f00da24c5452a32c72f8f75257a7501bd450bff1becdc959c9c7536059e93eb87f2c022e313f145a41175e0b8663274ae6cc36
SSDEEP 768:zNePW8CKHEJc0lU7tr69V4gg2UA+TcXw5Wjgpa:RWW3KHEO0argIaXwTpa
TLSH
T1B0D2F13C574C5608600A0EBD9BCDBA481A6FABDEAD7620E970297952C4FD08A517268E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000017

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000017
Size 77KB
SHA256 7f4d3fd0a705dbf8403298aad91d5de6972e6b5d536068eba8b24954a5a0a8c7
MD5 b15db15f746f29ffa02638cb455b8ec0
SHA1 75a88815c47a249eadb5f0edc1675957f860cca7
SHA512 84e621ac534c416cf13880059d76ce842fa74bb433a274aa5d106adbda20354fa5ed751ed1d13d0c393d54ceb37fe8dbd2f653e4cb791e9f9d3d2a50a250b05f
SSDEEP 1536:ogXevisOzyu5r4HjEIe9vyJFdiTCHnegAZ64RPmF17k+GbpJ0VxZrtbz:oTvissyu5eb0ciORAZ64Qrk+0Mzbz
TLSH
T16B7302C68D4AE504C87E0DAA36B5A96651BE9FC5720E4DF6E8700CBCF1F12DC0266D19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000018

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000018
Size 74KB
SHA256 5d9190292acdd48ba0fc35080f7e7448f3cdf0d79199a4d23f0f49b5341fdf29
MD5 a06da7f0950f9dd366fc9db9d56d618a
SHA1 509988477da79c146cb93fb728405f18e923c2de
SHA512 b53d839c5464f7a2904cabcd1e7d6456e2ed1702254450833fc586f4b3a4e6dc07c24f443415a2710e241af8d2dda1b9c17f050045e76501e9b5aa2cb4801ea8
SSDEEP 1536:y2zPXSmtLX9JNsnZVJakesPqIqI9Fz7s4HiUljj7Gu:y2zvxtLXs9e2zYa7Zj7
TLSH
T1977302D0A153149AF2B02645F91EA4527C19B93C97DCF2643A3AFF726ED480FD294F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000019

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000019
Size 157KB
SHA256 7c3d3525e548e340629777a2c2850742487c50cf5fbb0dfde155634fbacd7f04
MD5 bdf893201dde40aeb48014f0ece6c751
SHA1 1fdb43d28cdbdc8e0e0a2ca97a8c31be91a0a555
SHA512 119cdab6fac2ec617449d864f23508eba3ea32b53b18587efb85efa93026ac967602faefe30c5fd66cb540fec92ba265de6b7a21dda65852fa5d52d889503df3
SSDEEP 3072:g7dRlk8UDxNHMfcqI3mGMXF2/SCqX4mICLH2bikckjTONmc0bjs:QfSDsctmGMXoaCXfCj2b/T4mc0/s
TLSH
T157F3122E231D601E3BD99571061A6854CC97BAB02BAE367D0C2F7EF3B01FC055915E7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

02aecf8da6f8f2af_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\02aecf8da6f8f2af_0
Size 246B
SHA256 ae3eba26e81e6f0f3f55385676f929e6193c08ff9455c951555556fbe2ec61ed
MD5 40c213be3f255e6a28944979841ca7f6
SHA1 ee071d55b22235abc087fe12277a8ca8120ddd75
SHA512 04bbed0ac62ee89fbc56594e7a43167bd65d0a22b84d37e47a799c808af13bb9ffc3a5def5fb32e098aaf9f3e6a6d70ef23252edfa508ec68a3be7d9adceb370
TLSH
T114D0979BCC1A283AD827927CDBAE9402A712A09145D9A03480AAD9223D1013AB902028
MD5 SHA1 SHA512 TLSH

Submit Download

24a37706d3ab219b_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\24a37706d3ab219b_0
Size 249B
SHA256 d11baaa5851fc3d3e20c1c429b8e9a963f1b055ca00d9d17794884099b0d4639
MD5 67c0cc932ae16aa00ecd14e1d05b4072
SHA1 a8ff6f84725a033cf8fbbf1fdf11b0af7ce7c169
SHA512 892e10d42bac6b13725a93fe7bc5f137e74ae02b24b546d87922a5be2d30613867d0599cbc01f46d65e7cf9718ab10689633ff8e57d690f9f314b6479ee1e83d
TLSH
T169D097A7281A1839E03881F0D7A6B284D9E2D0160AAA4401A84B2B3308A7273E0030AC
MD5 SHA1 SHA512 TLSH

Submit Download

32e842b801ea6b20_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\32e842b801ea6b20_0
Size 116KB
SHA256 8d400ef5d6861101c60c815e69e916584c5b1198c7539cbf1bb9fe2548bec87e
MD5 a306f3dc9426112eb3b0c386ea9cc310
SHA1 9ed82d918b8ca965694ea92370473a7f0ddc4b69
SHA512 da8318dfc69b7aa7490260c7514ff565a122e95b9503e95d9bd14249cd32d20e46b32f5551be25e490a071c25a661fdf280d81f73ffda6195309a1919bfdf1b8
SSDEEP 1536:ODda6BPdDrhsYXeSnwlhzAvP7rKv8eKkzOrC61cJyist9RIT2tZwCREwoaI:EvnDVPX1nIhzAvv8KkCrl1RTHR3qwoz
TLSH
T163C3F8256B609CA5CE3647F541738927773284483EC3D31FA2F8A2352C5D6ED1FA688B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

41a4ebffd069515d_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\41a4ebffd069515d_0
Size 259B
SHA256 0b05dd7102316353684b362cc68e2f40f126dec85cb07243a6c300e02cf1030b
MD5 e437c693fee534bc342ba28a175c10f6
SHA1 4b8d1888de0ffcdff63d8643ca35c61e905808af
SHA512 564b760abfb1a9b809bfe9a56d65ad5139de8ccd985b19e942d65e1f7393c8d8b7b143768bc8a7ababe031cc4d25281cff446e04a1fc73b58f00198836014161
TLSH
T1BDD097D3852E5470D21E9AF0A796C20A573320906E6D9F420888AC281C000B2C0A0691
MD5 SHA1 SHA512 TLSH

Submit Download

6567dd9789073190_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\6567dd9789073190_0
Size 706KB
SHA256 1fee7700c98f625bef5471b88429555262b9bf876c186c8908e75b8b662cd447
MD5 baed7f0e6ab2fb45694661956592563d
SHA1 35dc9c19c1c08eb84c5d931597580a7cdacbbcb0
SHA512 7ff0778c185af4a821ceb84b9893ca07be490f2475138aa2d1ba213cbc23e59d8b497ae9091a48c8883cf5bee485d27a304a38b33b70a9a3184054b1dc0ee1a2
SSDEEP 12288:hoNfXKxQz4UBwvMNhOiIF/oQkZNyn/yPk:hufXKf2gSy/yP
TLSH
T1C0F49500DF917F72CFB647F942D3C5A73235414A2E93914352A0AA2A2C1E1EE6E97D4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8c6d5177c7b586fc_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\8c6d5177c7b586fc_0
Size 53KB
SHA256 d1529ed98f9ebed6d675116b6cad15790ae14c292d2358d49f10dd49262d27ee
MD5 97005e41cab3fbbf63710ce5085d14bb
SHA1 6a5ea0ebfcdca1f80fc4a6852d6c14b5858da72b
SHA512 6421f988e316896ae5f0f50d78e36d542c4a82b0381841ea6153a351acbbb8b91a1dac416aa0984c66c30618a8c6789aa955b309f589b216ec54b1b430b3c68b
SSDEEP 768:u9cYr3Ik6z1tAdvdxqhTkFM4wer33RJjVDRdtlTLGiKubXRNXzuiz2NZFPWZi:u9cYr3kzYdrqhTkt9BZDLo2XfmFPWZ
TLSH
T1FF33C5553784ADA1CF7697F101634667733189C83DC29327A2F8F23A1D0D1E92E9698F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 840B
SHA256 cd24e7b9eb620180ebb0bbbec9ade7de2102468efc0082c269cad47d2c3bdd7f
MD5 c6ce9fbf3d80fce227eb4e5f1a7d8342
SHA1 535f05f596b5ad7660269ba3c271a6d9b6b3b2b3
SHA512 3da903a528a617d53dde1abfc6ab4b53f0ed9df945f65dfedf375637c806829ac94abdf9f68c55f4a6b1349a06a2340fa8d61fc4f38c8de44713979fa41c8dad
TLSH
T16901DD1561D599A2FF453B7474E31C96237319A150331B8B6A40DC79B4C73F4113B601
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 ffe0bf06e7176f6ab14c4498b12375ce33fbff45f943dbf5382c2800ddc8b6c0
MD5 9ef9f213e3d8c34c25ac1ae1d04d654f
SHA1 9959649f64b5d5c5602a978a415186c0ce570c62
SHA512 91128c8b453e5fc00a73b9ec752c18c5d40a461c4fff58d9d81346db0823a7e74e1ea5bc5bd3cfcbf032f1863d65f7519b428b416a7a20a8e23856faafe78e9c
SSDEEP 192:DeFmX/jxVe6aI9wkTu0m45beNP/EaPCILVQ7thNXn:DeFmX/jxVe6aI9wkTu0m45beNHEaaIZC
TLSH
T10EF19EF3C3E8863DC85156F4AB256F1FCE2D0A18432C3C56C9D8AE5B93E2471D251A8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 53bf869c5c373da9c76710707f7a832b8bdb4c62bca27190d1b42d8644e539cf
MD5 ef9425f01ed99b098f7d44bd8f2f2baa
SHA1 c91625ff677c4c8c21026b1d2d3028d8585dba21
SHA512 19e13d94d094ea8cfc117114994adf628c74fc7f97c2771c893fbe24db0153cb7599fc6655301aca647c22d1344922acf810c762b92de7dbd973a239f4f96cc8
SSDEEP 192:HRrcBzvvM5sbXbC7v7ppAPRp245hP9uHsb+WNlDbmbZd6+Nq24M2eQ36wmmp8yI6:HRrmzvvEsCD1UXRUw5QmX2f836wge
TLSH
T14852E82EA920697B5CDFD215F9227B67D3F5102721D51E84EAFC993C05EB5CC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 dc899492643a9d3766329ddebcd7f7a08f4094c96c33a449f918c704e935e887
MD5 9ade0c98e3be7f180fa0eb78c3cbc6c7
SHA1 2e5936415895963880ce5e3b14dbe2171d7c4a26
SHA512 bd37807774e37a820b31dd0555f2ffa87620749192dc3b44708c8b9addb87276439a15602f69b3a129c8b0aa82f5acb572721c182f0da2372c67667821b45361
SSDEEP 192:HRrcBzvvM5sbXbS7v7+pAPRp24CP9uHsb+WNnbmb4Nq2JM2eQ36wmzpVyIsnAUg8:HRrmzvvEsSD6UXmUwbQJ2a836wi8
TLSH
T17D52E72EAA20797B5CDBD225F9627B63D3F5102721D52E84EAFC993C06D75CC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 7249534a1c66baf2aca4daffc0813b80fd0ee25b062d45fba2204f5662257c4e
MD5 8e1daff8ab11bda039f3304ffd9ebb6f
SHA1 4793ad2fd09d811ccc9be262617f2afe698ee479
SHA512 bbf1c8e34441dc19423190291091bd960c56983540e4256317af479b41d059142da92ff8ef8dbb7fa4fc2b40684b8ab25b9d96f65bfc8325d7b3e6d1e32506cb
SSDEEP 192:HRrcBzvvM5sbXbS7v7ppAPRp245KP9uHsb+WNlDbmb4Nq2JM2eQ36wmzpVyIsnA4:HRrmzvvEsSD1UXQUw5QJ2a836wi8
TLSH
T1A352E72EAA20697B5CDBD329F9227B67D3F5102721D51E84EAFC993C06DB5CC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 87abfd6483e055ddeb2f8fc2f483f91af443de3130ad7f6cceeeecc94a6c2511
MD5 04c2655e775a571e3b09dcdcd782d924
SHA1 84dda5dbd4088a2a3591384e8279d568339c383c
SHA512 38ea57f7244c49bbd8e846e3f0d5342b6c186f24c011ef661cc6a4f6836da0e0f816f76146075af79a69abcd50476432db60bf14c0daf6c81fe144ac588ce833
SSDEEP 384:fFjLm7KxkXqKf/pUZNCgVLH2Hfgsl+27pLuLcSjBsXODLi+ErU3ZSHG7Ep83wCv:fVLm7KxkXqKf/pUZNCgVLH2Hfgs427p+
TLSH
T18C7208676C4C9E370F94D6C8D8267B4FADB5024B65DD886493FA982903D4BCF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 d23da99ffcd21db7970ca43878dacb70f8c7e48eff716787e250e7ddef774f92
MD5 5f05938533b28e3e4b3190da26000bbc
SHA1 d3b6669654b8185365b85181e3b0ff0c42426c01
SHA512 904843b29d7648c8ed94f543612709459248e1740023fda9d2bde9917b292c74188273a14e4cafda1f7d857de19af237a1b87054afea3eee5f6ce9450e21b3a8
TLSH
T1CDB012408001D151C80302FC1942649872149F29F60E170143E06A3288A95508825150
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe595c20.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe595c20.TMP
Size 96B
SHA256 1cd980797a0a48a21ba173301f686880dd37882f042d2546792ad103c780f922
MD5 1add713cf64ac91657e61c2d2e003d6e
SHA1 a4b9cb0f6c70340d89082d325b54aa211d346791
SHA512 7d725ac9255cd3cb37266b7a286b7147ebcc392a368d2535e72eed93dcc4210b923e0ba01fecd7c930e61fd3606f9baeb2f9f7659b4b69cd57b593ec96bef55d
TLSH
T153B02202C0022222C00A03B028F880CCB030CF3AC3032202E2E00E32ECA22A08820030
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 49eb9e699a21abaeb27b6c5b964d11caa81ef7cee3521d3b951f4dd2c1da65f1
MD5 8ffe06863c99a6e8d6cc1ccbfd0e127e
SHA1 05b9ebaf71ffeb2b378e0ee85bc40693099849f7
SHA512 0f166c452be8bd7d9d9094326e1fafea4e09ca05972976e344a096f031f2b3dd8c49801c23f6522a04e6780077f035fcf30ea605887d25cd1d3d94d41913428e
TLSH
T1D1B0240514001C11CF11537410D1C04331353C01454345411074405C400375053D3134
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt
Size 88B
SHA256 7702052bd95d25ac7a71c899e9a990faf0d505f5eab07a8c057ee45f1d5497df
MD5 f73d22b9b1e3d8a2b912446db29ee595
SHA1 5e0ee42e03131ff29631c1466cca72daf1d35b87
SHA512 a7ee4666e264080246e33bea78d5b4ef012669a02d2ec8eb3f5ec512cb84f5831ffb7d0c9f135fdc672dc5bf034cf847e35374b9c599c6ee4f847b94bc84f0e4
TLSH
T1E1B002BF044155F25EA134F7400531DDC43332D85D90DB5C8475605436104BE5106D38
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5949e0.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt~RFe5949e0.TMP
Size 175B
SHA256 a38da47d590dcae079ff5b185fe9e07e0019c31050ab69ebf7915226ce5ea8f6
MD5 b91dfeccdd213118c26ebb832b39823e
SHA1 838e2f4b5dcb788e4c839dbcde9fb9aa2be26a1c
SHA512 030522fce5b4508d8e66f0ee9916284ac60769fc9aa4f243e1cb3d8cff2464c92e59b97fa25d8141e157ebaaf6a9d522d16f713b75e5521f06efc29bb1650b60
TLSH
T15DC0807F44809A722F9454EB615532C4CD333FC48DC0964C4C3130057130C555309924
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 d3acbb970e0c045c25646e9294e53143422bdc5fe569a303c249b4b4130ee47f
MD5 b012f1721b6d4ecae4d0f25fed4b5200
SHA1 ff1c6e52b122e1c107bcfade3b011730f689f520
SHA512 22681e2f542c9db736cd584ffcae538ef833c747ff73df108ea6d379abe0d71e6792e3f9578c45d1459275aabf92711ece68cd7ca4067f370c12fd7dc2bdaa90
SSDEEP 6144:X8QGnRUUf0ZwVW6OHCFPn6s01WwwCcmXKegIh6jh9JvexhL:ZGnRUUlVW6OHsn0wCHHgVUxl
TLSH
T1B434139A0D733D91489DF9B2718B63C7CA9B07E29905F09E50C49F46CACCCF616DB924
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 79458cb8d93c4cc4c5c143c7bef793d6c90c91fbd21378e48d2a636462f53d4b
MD5 dfb53713e2d3bfaf46cb07f54fe4b7d5
SHA1 5d48d6519b2aebe9220b061ea79b33c87da9bb65
SHA512 0edbf5a09fdaa6afcb78f462a8156dcf3a1ad97f4603405d5c3b934add53ce4fccef25df8fe008e93fdfdaab3210e1da9d127a364dfd2a6d5ec4b9a207ba7ee8
SSDEEP 6144:08QGnRUUf0ZwVW6OHCFPn6s01WwwCcmXKegIh6jh9JvexhL:+GnRUUlVW6OHsn0wCHHgVUxl
TLSH
T1483413B61D733C9648ADF972318B63C2CE9A43E39905F48E50C89F4686CCCF656DB924
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 da6077491f38cb55ac7c4413bd03d29f2961c99cf3758712ec34e7e991893e37
MD5 b4fcd5f32678130359e2a7e5f2e74851
SHA1 8117e7650d3dabf18a5c6d6773feace240318937
SHA512 e35c5dc66414c3d1828afebbcedbedc77d34b82bb0667a41e813bc36e73b38a07a9bed30c30f909a8d8e74faf2eac2fd430a7049164c059b8aac34e5445b2155
SSDEEP 6144:n8QGnRUUf0ZwVW6OHCFPn6s01WwwCcmXKegIh6jh9JvexhL:JGnRUUlVW6OHsn0wCHHgVUxl
TLSH
T10134139A0D733D91489DF9B2718B63C7CA9B07E29905F09E50C49F46C6CCCF616DB924
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 293a9fd4fc0e3f82442b565f1987fd29b2ce0ebf228df6979cd30befefe839d0
MD5 aa1a75d2229b217069f1b5026ea4f040
SHA1 20e4eab94fb70449aacc4469a47a56260ec724fd
SHA512 d3df9e82cc58e470a242d3ad2c2091f27cdb91dfd4c1d7400984bfbd15feb41f000e4ca65fbbec8bd84b47bc35a53fa87b29f65f1447dae8e9f8a8618508bc7d
SSDEEP 3072:k8uwLcXcgVXruSixWgL0rF6jh9JDvexqw/w5nP:ywCcmXKegIh6jh9JvexhQ
TLSH
T140B3125A29273DA68CBC6EB37457338286A353A26C05F14E90CCDF0B49DDDB415EB8B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 4e24f0c98a899fd37086280e8c64802092e870fbf57e3a7e9d01a95b103911fb
MD5 c5302bd1b5becfa0dbb6a1f567a583c9
SHA1 716f474a5cbe99670e3a9bf5a3c92cabdd689fa7
SHA512 6a098c537f2421ba93a3abd3e2f50a384424fbdfd27b03b6b07dd278dd638f1e2d699908f5190d3e4c71470a0bd8cdecd0a953f41dfeeb13104afe62700b7680
SSDEEP 6144:I8QGnRUUf0ZwVW6OHCFPn6s01WwwCcmXKegIh6jh9JvexhL:yGnRUUlVW6OHsn0wCHHgVUxl
TLSH
T13E34139A0D733D91889DF9B2718B63C7CA9B07E29905F09E50C49F46CACCCF616DB924
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\SpotiFLAC.exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 feee521c92a4dd4760c8cec103849a60d257c4a2b295995abce95fd891bb4849
MD5 9fb62d709cdbc7bd91766c493f2ccf42
SHA1 e73121af198999a0761e21f8f84b89e852ea022e
SHA512 35dcc6db199653721afd03bd59d9cffe9d4c4f49034a856bb6ae12ed45c059e2eea80ec73ed1f23d05ef84ecfa9f0f5f06711ce5ee7cc88c2f10ac3c0fdbadea
TLSH
T165D0121636230274C020A033060376081400D21F4005415968298D1D1E244500912442
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\SpotiFLAC.exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 86a8b4495fd758ee178f4fc0131a8cbf5d40863870b03b8732e4fdb3cf525c55
MD5 49565e2c532fcc6e9d93d0bff02c6e57
SHA1 b37c10283cc073da2852d9985ef15c1acfb2fdb7
SHA512 19e11bfde1786b07ef6190812e4374cf48eb16a0b87fb4a5b09108661cd1803a55bc0d74e5c6739a277da18e9358ee296df45bd9751beaeb85a9ce0b10865afa
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Roaming\SpotiFLAC.exe\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\SpotiFLAC.exe\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 64d6e08ec3f68b44a463fd15ddec0aae06d1c9a6364c5beaa79a096edf697122
MD5 a8472201ddf7aee68b86c3052e8ade60
SHA1 5542c0157b61af24db433d70ecfc2d2ea36ebc66
SHA512 b8a2b26429a727ed4419c1c5510dd5b890f6a2e52ef8e05849faad955535915a6602c48f5970c2436eb965f8f2ba1fa67737d9e24a4f395e5e32d910575223eb
TLSH
T16FB00154864A4482CB154B7CA8D16D897272CCAB66922712819B8979AE2E3844E81640
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe588f0c.TMP

Path C:\Users\Admin\AppData\Roaming\SpotiFLAC.exe\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe588f0c.TMP
Size 48B
SHA256 cf0c93371127131166514815ed4fb7af02c9fdb24e625ce78a16849dfde4886d
MD5 ca7ab8e5a4ad80963e580ae59dc411da
SHA1 a6f8389fa70bd3b4ed9e6b9396b92a4bc8c7c298
SHA512 23563e2a02fa36e5fc00129fde9479c6458f025a711fa36d7cd67da491e8584edd13d70a79a699e29c2215c4a6788b9f5e338d684324e932e959ce93399977cc
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Roaming\SpotiFLAC.exe\EBWebView\Default\DawnGraphiteCache\index
Size 256KB
SHA256 a6e5a3c042b27c35c37071b95a42bd27b551d412ac9fa87aa67322eb11c80e7c
MD5 dab08badbd43743474fef51fbec41b86
SHA1 3b898dd293b5b0b8095d51f09f4e23ebf29b8624
SHA512 ea8196cb332ba2800e41084083c7287ace9f74ccffa2136e3d37628a1e56a9b138d3964d5863b683b48eaae392db16e0c9d531fd385f80d063b4c3d4d0122dac
SSDEEP 3:LstlNllkll/l63Kll/l:LsX3lEt66ltl
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\SpotiFLAC.exe\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\SpotiFLAC.exe\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\SpotiFLAC.exe\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\SpotiFLAC.exe\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\SpotiFLAC.exe\EBWebView\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\SpotiFLAC.exe\EBWebView\Default\Network\Network Persistent State
Size 949B
SHA256 ef99deedc89fc454493f7b8d7febebf621e6ef6242181992b50a028c519d6de8
MD5 d81388cb9d55888a7f125bb8e60cc7f4
SHA1 c2afc00005e98d066b62b8ae25aac3b92899c5dd
SHA512 2b6c049b90d59c58c2287f65be41083cb5eb3a9a7189947c6ec701917b598e0696ad59ef8ef4b2e7c291ee14344755c362602f6715f7f3eb13753451fb591ffe
TLSH
T17B119EB2C3E4C67D891152E427243913CD2E011952282967CEEAEBEA5FF2472D700A4E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe58ff1c.TMP

Path C:\Users\Admin\AppData\Roaming\SpotiFLAC.exe\EBWebView\Default\Network\Network Persistent State~RFe58ff1c.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Roaming\SpotiFLAC.exe\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\SpotiFLAC.exe\EBWebView\Default\Preferences
Size 6KB
SHA256 1e9061a3ebb871c17a94525c79f4d55435e1dc456c52c5117a3fa79b053aa0fc
MD5 5211e6d6656d32bc1a40534708e36686
SHA1 99ecda38b6f761d1a0a89b3b436cb3e8c795bd85
SHA512 dbd9f094780a3e3c4e4d9bbb33faf5e87c9005ff91b82e75576eeeb063004d479621f4adfc880f7b65ea1ebc7db315f8dfb6da814f30ee2655917fa505b1bec6
SSDEEP 192:stI+0tb61DQfuDZ8pajUP/S+WiQ44wYU+F4ZqPMC:stotmDQDz/VgwFC
TLSH
T1DAE1B8025E386D774CCBF6197A35BB52E2FA106361D51E58EBFC861C05EB6CC620790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe58d4a1.TMP

Path C:\Users\Admin\AppData\Roaming\SpotiFLAC.exe\EBWebView\Default\Preferences~RFe58d4a1.TMP
Size 6KB
SHA256 9462be52246c654c3a319ef0ff2c16e0ed3663aa7a6a3983432023e4b6d5a482
MD5 cb6b46f648fd3e8dfb23a5178d403608
SHA1 4643ea7347fe3b39bfd2a09e8fa9f9ccf975c1db
SHA512 ea9dfe7591861d6a26ec5562983e95981dd3a139030cca646edcb849fdd90ace8627a2516f58c707d4f938f05816e79a5d5252b04ce57e8d421c345ee507accd
SSDEEP 192:stI+0tb61pQfuDZ8pajUP/S+WiQ44wYU+FkZqPM8:stotmpQDz/Vgwv8
TLSH
T19BD1C8025F38A97B4CCBE3197A35FB42D2FA106261D51E58EBFC851C09DB2CC620790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\SpotiFLAC.exe\EBWebView\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\SpotiFLAC.exe\EBWebView\Local State
Size 1KB
SHA256 ad46c2380e4d159672cf5e2928b749e2aaf170c23a36c677142466150685208d
MD5 f338b7598c070c648fe679e80543a64f
SHA1 5f087a8012b37e0ab74e4d06ea6d4c823874b8d4
SHA512 531e679ad373b56bc308a43701f19c4d294f76407de4ec49748f2ae2f08e238e99d0172ba130094fb6b5ee38591563e43db1330643d325f2e2bf1568cd3f470f
TLSH
T1403162B2A8A47B765C825A8171437B9B6E31102EC4A28E1496DE0B1E07EF28C5226C33
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\SpotiFLAC.exe\EBWebView\Local State
Size 2KB
SHA256 5aa9c68a2ac66183551c6da7f9566b4d87fbdddac191843875f4d740ce15c0b7
MD5 ca8b10c8eba1b223bd8c16622a443534
SHA1 f46b0d5195c66594aa7290e650517ab1e0206491
SHA512 1992f1b1a0397a1fc434c435f2bf4ea260778327024156ef751c85479a5ea87d7614d235776e1454c7cc58a1081f2781181a9cfa92d0125b404c0fa7a93b4105
TLSH
T1B251D8727C58BA7749E39A44784A3F63AE395069D9A22F60CADD1B0D03DF25C2302C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\SpotiFLAC.exe\EBWebView\Local State
Size 3KB
SHA256 dbab19a40db5365ed1b118168e481ee7a79b8a02adcb97ffe2a94526f4c28deb
MD5 162ec99d523d466d36e4243514375244
SHA1 8816d7f3b4196f3e381f61976d17f6824fd5e6f0
SHA512 a81260869af16b48b2b02f3a1fc9bcf60e9aef9e268c0b9d0baaf6600dff90d6780d9056eae141c0581fe337234944b360e9a77fe177b1841f6c1b6a62ea10c6
TLSH
T13E71A66668A8A93B4DE3DE40B8862B16BA755127E4D13FA5CAED0F0D02DF3881342C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\SpotiFLAC.exe\EBWebView\Local State
Size 16KB
SHA256 6cb1d9a5d19a227d46df63545d89a37ffb7cde30586de6d71b069c40b4b5d31c
MD5 e5a1e6f5335963240b8fe90fb2d5e94a
SHA1 ffd6defbf204f9836df4de456901f38fef837424
SHA512 b7431a93e3b469a881fe08d5b64b07720850e9396d5aebc601e66dffab89af01cfd8c419ecc89ef533a8ae3a9dbe67822b8f66974aa1c3a1009d0b56ba8e7a3f
SSDEEP 384:zb+aQikB+z/xvxjg/qhEwNbx1urKIZE9zj:W/UxvxjgC+nDZEFj
TLSH
T1A6729D2B55787E2755F7FA04794D0B9BDBB9847280C12AB88AED1F0E078B3941342C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\SpotiFLAC.exe\EBWebView\Local State
Size 16KB
SHA256 08add43b24fa1f457444c04f1878df2e13b6a3bc81599dc067081da49c169e7f
MD5 212946234eee373d5d75ceb92e862588
SHA1 41f541dbfc178374908b1b12903ce731ebf29633
SHA512 8db6d39c4019943a1fd04223face797db755a697461ab4275f810ec48879c5607ae624afa7c5e1ea953b490a7b3f334285ee853e74cf3ddb5513d30918ab9d2d
SSDEEP 384:zx+aQikB+z/xvxjg/qhEb3Nby1HeKIWE9zj:Q/UxvxjgC+bdDWEFj
TLSH
T1EC728D2654787E2794F7FA04795D0B9BDBB984B690C16AB88AED1F0E078B3941342C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe583534.TMP

Path C:\Users\Admin\AppData\Roaming\SpotiFLAC.exe\EBWebView\Local State~RFe583534.TMP
Size 1KB
SHA256 95b4a7f308e41c227ff48f116e742fae0cde8913451c37a152f2457fc2e7c60d
MD5 f96f3fcb290dca6adcbe854f4ab10544
SHA1 4b9ba0fd55f87a0a17af41f90b6045c48f20c5b1
SHA512 a84be2b59e6e49f768730a04faf1b0fc6d9d5207f10e02db873a56bd37e1831a5ab56f725f28019cbaa9d4e002733436e79a370fa07637f1340fb83918e9d92e
TLSH
T1072162B2DCE87A76688249807143BBCB2E31512ED5A58A18D6DE175F07EF1884326C33
MD5 SHA1 SHA512 TLSH

Submit Download

memory/888-150-0x00007FF8D0BF0000-0x00007FF8D0BF1000-memory.dmp

Download

memory/4940-183-0x00007FF6A3FF0000-0x00007FF6A76BB000-memory.dmp

Download

memory/4940-338-0x00007FF6A3FF0000-0x00007FF6A76BB000-memory.dmp

Download

memory/4940-237-0x00007FF6A3FF0000-0x00007FF6A76BB000-memory.dmp

Download

memory/4940-0-0x00007FF6A3FF0000-0x00007FF6A76BB000-memory.dmp

Download

memory/4940-182-0x00007FF6A3FF0000-0x00007FF6A76BB000-memory.dmp

Download

memory/4940-218-0x00007FF6A3FF0000-0x00007FF6A76BB000-memory.dmp

Download

memory/4940-204-0x00007FF6A3FF0000-0x00007FF6A76BB000-memory.dmp

Download

memory/4940-215-0x00007FF6A3FF0000-0x00007FF6A76BB000-memory.dmp

Download

memory/4948-199-0x0000025044CE0000-0x0000025044D8F000-memory.dmp

Download

memory/4948-26-0x00007FF8D0BF0000-0x00007FF8D0BF1000-memory.dmp

Download