Overview

overview

8

Static

static

3

Thundry-win-Setup.exe

windows10-2004-x64

7

Thundry-win-Setup.exe

windows11-ltsc_2024-x64

8

Analysis

  • user interaction
    yes
  • max time kernel
    211s
  • max time network
    223s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    13/08/2026, 18:19

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Thundry-win-Setup.exe
  • Size 104.9MB
  • Sample260813-wydhhawcqa
  • SHA256 de6782a7f87b12de125037969570230edc0c6c80145200a5d1230cd41df0ba96
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
credential_accessdiscoverystealer

Malware Config

Signatures

  • Uses browser remote debugging 2 TTPs 9 IoCs

    Can be used to control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer
  • Executes dropped EXE 28 IoCs
  • Loads dropped DLL 53 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Windows directory 10 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 9 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: LoadsDriver 5 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 34 IoCs
  • Suspicious use of SendNotifyMessage 16 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Thundry-win-Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\Thundry-win-Setup.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4124
    • C:\Users\Admin\AppData\Local\Thundry\current\Thundry.exe
      "C:\Users\Admin\AppData\Local\Thundry\current\Thundry.exe" --veloapp-install 26.9.3
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:3216
    • C:\Users\Admin\AppData\Local\Thundry\current\Thundry.exe
      "C:\Users\Admin\AppData\Local\Thundry\current\Thundry.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4524
      • C:\Users\Admin\AppData\Local\Thundry\current\stockfish.exe
        "C:\Users\Admin\AppData\Local\Thundry\current\stockfish.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:1472
      • C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-150.0.7871.24\chrome-win64\setup.exe
        "C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-150.0.7871.24\chrome-win64\setup.exe" --configure-browser-in-directory="C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-150.0.7871.24\chrome-win64"
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:5432
        • C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-150.0.7871.24\chrome-win64\setup.exe
          C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-150.0.7871.24\chrome-win64\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome for Testing\User Data\Crashpad" --annotation=plat=Win64 "--annotation=prod=Google Chrome for Testing" --annotation=ver=150.0.7871.24 --attachment=C:\Windows\SystemTemp\chromium_installer.log --attachment=C:\Users\Admin\AppData\Local\Chromium\ChromiumUpdater\updater.log --attachment=C:\Users\Admin\AppData\Local\Chromium\ChromiumUpdater\updater_history.jsonl --initial-client-data=0x280,0x284,0x288,0x25c,0x28c,0x7ff745300128,0x7ff745300134,0x7ff745300140
          4⤵
          • Executes dropped EXE
          PID:2824
      • C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-150.0.7871.24\chrome-win64\chrome.exe
        "C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-150.0.7871.24\chrome-win64\chrome.exe" --allow-pre-commit-input --disable-background-networking --disable-background-timer-throttling --disable-backgrounding-occluded-windows --disable-breakpad --disable-client-side-phishing-detection --disable-component-extensions-with-background-pages --disable-default-apps --disable-dev-shm-usage --disable-field-trial-config --disable-hang-monitor --disable-infobars --disable-ipc-flooding-protection --disable-popup-blocking --disable-prompt-on-repost --disable-renderer-backgrounding --disable-search-engine-choice-screen --disable-sync --enable-automation --enable-blink-features=IdleDetection --export-tagged-pdf --generate-pdf-document-outline --force-color-profile=srgb --metrics-recording-only --no-first-run --password-store=basic --use-mock-keychain --disable-features=Translate,AcceptCHFrame,MediaRouter,OptimizationHints,WebUIReloadButton,IPH_ReadingModePageActionLabel,ReadAnythingOmniboxChip,ProcessPerSiteUpToMainFrameThreshold,IsolateSandboxedIframes --enable-features=PdfOopif --user-data-dir="C:\Users\Admin\AppData\Local\Thundry\current\UserProfile" --disable-extensions about:blank --disable-blink-features=AutomationControlled --disable-dev-shm-usage --no-first-run --no-default-browser-check --start-maximized --remote-debugging-port=0
        3⤵
        • Uses browser remote debugging
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Windows directory
        • Checks SCSI registry key(s)
        • Checks processor information in registry
        • Enumerates system info in registry
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:948
        • C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-150.0.7871.24\chrome-win64\chrome.exe
          C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-150.0.7871.24\chrome-win64\chrome.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Thundry\current\UserProfile /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Thundry\current\UserProfile\Crashpad --annotation=plat=Win64 "--annotation=prod=Google Chrome for Testing" --annotation=ver=150.0.7871.24 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7fff9e4d5a50,0x7fff9e4d5a5c,0x7fff9e4d5a68
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:4752
        • C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-150.0.7871.24\chrome-win64\chrome.exe
          "C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-150.0.7871.24\chrome-win64\chrome.exe" --type=gpu-process --disable-breakpad --user-data-dir="C:\Users\Admin\AppData\Local\Thundry\current\UserProfile" --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAOAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAgAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --metrics-shmem-handle=1616,i,7054925517985520182,12369481900016248687,262144 --field-trial-handle=1904,i,9192791404080742898,7478254502622407571,262144 --enable-features=PdfOopif --disable-features=AcceptCHFrame,IPH_ReadingModePageActionLabel,IsolateSandboxedIframes,MediaRouter,OptimizationHints,ProcessPerSiteUpToMainFrameThreshold,ReadAnythingOmniboxChip,Translate,WebUIReloadButton --variations-seed-version --pseudonymization-salt-handle=1908,i,11399934223529879323,6983621736269000008,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1900 /prefetch:2
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:3920
        • C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-150.0.7871.24\chrome-win64\chrome.exe
          "C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-150.0.7871.24\chrome-win64\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Thundry\current\UserProfile" --force-high-res-timeticks=disabled --start-stack-profiler --metrics-shmem-handle=2148,i,6108157399906345899,4408180319512583690,524288 --field-trial-handle=1904,i,9192791404080742898,7478254502622407571,262144 --enable-features=PdfOopif --disable-features=AcceptCHFrame,IPH_ReadingModePageActionLabel,IsolateSandboxedIframes,MediaRouter,OptimizationHints,ProcessPerSiteUpToMainFrameThreshold,ReadAnythingOmniboxChip,Translate,WebUIReloadButton --variations-seed-version --pseudonymization-salt-handle=1908,i,11399934223529879323,6983621736269000008,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2144 /prefetch:11
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Time Discovery
          PID:2140
        • C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-150.0.7871.24\chrome-win64\chrome.exe
          "C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-150.0.7871.24\chrome-win64\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Thundry\current\UserProfile" --force-high-res-timeticks=disabled --metrics-shmem-handle=2480,i,15770810756444851846,12156064659000501533,524288 --field-trial-handle=1904,i,9192791404080742898,7478254502622407571,262144 --enable-features=PdfOopif --disable-features=AcceptCHFrame,IPH_ReadingModePageActionLabel,IsolateSandboxedIframes,MediaRouter,OptimizationHints,ProcessPerSiteUpToMainFrameThreshold,ReadAnythingOmniboxChip,Translate,WebUIReloadButton --variations-seed-version --pseudonymization-salt-handle=1908,i,11399934223529879323,6983621736269000008,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2772 /prefetch:13
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:2512
        • C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-150.0.7871.24\chrome-win64\chrome.exe
          "C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-150.0.7871.24\chrome-win64\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Thundry\current\UserProfile" --force-high-res-timeticks=disabled --disable-background-timer-throttling --disable-breakpad --enable-automation --force-color-profile=srgb --remote-debugging-port=0 --allow-pre-commit-input --enable-blink-features=IdleDetection --disable-blink-features=AutomationControlled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2864,i,9544092319038918995,18374751594947335679,2097152 --field-trial-handle=1904,i,9192791404080742898,7478254502622407571,262144 --enable-features=PdfOopif --disable-features=AcceptCHFrame,IPH_ReadingModePageActionLabel,IsolateSandboxedIframes,MediaRouter,OptimizationHints,ProcessPerSiteUpToMainFrameThreshold,ReadAnythingOmniboxChip,Translate,WebUIReloadButton --variations-seed-version --pseudonymization-salt-handle=1908,i,11399934223529879323,6983621736269000008,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=2924 /prefetch:1
          4⤵
          • Uses browser remote debugging
          • Executes dropped EXE
          • Loads dropped DLL
          PID:4196
        • C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-150.0.7871.24\chrome-win64\chrome.exe
          "C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-150.0.7871.24\chrome-win64\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Thundry\current\UserProfile" --force-high-res-timeticks=disabled --disable-background-timer-throttling --disable-breakpad --enable-automation --force-color-profile=srgb --remote-debugging-port=0 --allow-pre-commit-input --enable-blink-features=IdleDetection --disable-blink-features=AutomationControlled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2876,i,9955362630684018097,12931580829745156262,2097152 --field-trial-handle=1904,i,9192791404080742898,7478254502622407571,262144 --enable-features=PdfOopif --disable-features=AcceptCHFrame,IPH_ReadingModePageActionLabel,IsolateSandboxedIframes,MediaRouter,OptimizationHints,ProcessPerSiteUpToMainFrameThreshold,ReadAnythingOmniboxChip,Translate,WebUIReloadButton --variations-seed-version --pseudonymization-salt-handle=1908,i,11399934223529879323,6983621736269000008,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=2952 /prefetch:1
          4⤵
          • Uses browser remote debugging
          • Executes dropped EXE
          • Loads dropped DLL
          PID:5820
        • C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-150.0.7871.24\chrome-win64\chrome.exe
          "C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-150.0.7871.24\chrome-win64\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Thundry\current\UserProfile" --force-high-res-timeticks=disabled --metrics-shmem-handle=5096,i,18192067914375792327,39921636534837081,524288 --field-trial-handle=1904,i,9192791404080742898,7478254502622407571,262144 --enable-features=PdfOopif --disable-features=AcceptCHFrame,IPH_ReadingModePageActionLabel,IsolateSandboxedIframes,MediaRouter,OptimizationHints,ProcessPerSiteUpToMainFrameThreshold,ReadAnythingOmniboxChip,Translate,WebUIReloadButton --variations-seed-version --pseudonymization-salt-handle=1908,i,11399934223529879323,6983621736269000008,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=5116 /prefetch:14
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:3524
        • C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-150.0.7871.24\chrome-win64\chrome.exe
          "C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-150.0.7871.24\chrome-win64\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Thundry\current\UserProfile" --force-high-res-timeticks=disabled --metrics-shmem-handle=5324,i,11751453157871752458,3294058337747135733,524288 --field-trial-handle=1904,i,9192791404080742898,7478254502622407571,262144 --enable-features=PdfOopif --disable-features=AcceptCHFrame,IPH_ReadingModePageActionLabel,IsolateSandboxedIframes,MediaRouter,OptimizationHints,ProcessPerSiteUpToMainFrameThreshold,ReadAnythingOmniboxChip,Translate,WebUIReloadButton --variations-seed-version --pseudonymization-salt-handle=1908,i,11399934223529879323,6983621736269000008,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=5080 /prefetch:14
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:3528
        • C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-150.0.7871.24\chrome-win64\chrome.exe
          "C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-150.0.7871.24\chrome-win64\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Thundry\current\UserProfile" --force-high-res-timeticks=disabled --metrics-shmem-handle=5328,i,17456557847763995129,5860725833030570365,524288 --field-trial-handle=1904,i,9192791404080742898,7478254502622407571,262144 --enable-features=PdfOopif --disable-features=AcceptCHFrame,IPH_ReadingModePageActionLabel,IsolateSandboxedIframes,MediaRouter,OptimizationHints,ProcessPerSiteUpToMainFrameThreshold,ReadAnythingOmniboxChip,Translate,WebUIReloadButton --variations-seed-version --pseudonymization-salt-handle=1908,i,11399934223529879323,6983621736269000008,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=5344 /prefetch:14
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:980
        • C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-150.0.7871.24\chrome-win64\chrome.exe
          "C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-150.0.7871.24\chrome-win64\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Thundry\current\UserProfile" --force-high-res-timeticks=disabled --metrics-shmem-handle=5316,i,9681541873392074668,9915843673481464394,524288 --field-trial-handle=1904,i,9192791404080742898,7478254502622407571,262144 --enable-features=PdfOopif --disable-features=AcceptCHFrame,IPH_ReadingModePageActionLabel,IsolateSandboxedIframes,MediaRouter,OptimizationHints,ProcessPerSiteUpToMainFrameThreshold,ReadAnythingOmniboxChip,Translate,WebUIReloadButton --variations-seed-version --pseudonymization-salt-handle=1908,i,11399934223529879323,6983621736269000008,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=5416 /prefetch:14
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:5360
        • C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-150.0.7871.24\chrome-win64\chrome.exe
          "C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-150.0.7871.24\chrome-win64\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Thundry\current\UserProfile" --force-high-res-timeticks=disabled --start-stack-profiler --disable-background-timer-throttling --disable-breakpad --enable-automation --force-color-profile=srgb --remote-debugging-port=0 --allow-pre-commit-input --disable-gpu-compositing --enable-blink-features=IdleDetection --disable-blink-features=AutomationControlled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5492,i,4562221350675735140,7402598262449994855,2097152 --field-trial-handle=1904,i,9192791404080742898,7478254502622407571,262144 --enable-features=PdfOopif --disable-features=AcceptCHFrame,IPH_ReadingModePageActionLabel,IsolateSandboxedIframes,MediaRouter,OptimizationHints,ProcessPerSiteUpToMainFrameThreshold,ReadAnythingOmniboxChip,Translate,WebUIReloadButton --variations-seed-version --pseudonymization-salt-handle=1908,i,11399934223529879323,6983621736269000008,4 --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=5524 /prefetch:1
          4⤵
          • Uses browser remote debugging
          • Executes dropped EXE
          • Loads dropped DLL
          PID:2236
        • C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-150.0.7871.24\chrome-win64\chrome.exe
          "C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-150.0.7871.24\chrome-win64\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Thundry\current\UserProfile" --force-high-res-timeticks=disabled --start-stack-profiler --disable-background-timer-throttling --disable-breakpad --enable-automation --force-color-profile=srgb --remote-debugging-port=0 --allow-pre-commit-input --disable-gpu-compositing --enable-blink-features=IdleDetection --disable-blink-features=AutomationControlled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=4392,i,11292567911346968428,4161281785567751690,2097152 --field-trial-handle=1904,i,9192791404080742898,7478254502622407571,262144 --enable-features=PdfOopif --disable-features=AcceptCHFrame,IPH_ReadingModePageActionLabel,IsolateSandboxedIframes,MediaRouter,OptimizationHints,ProcessPerSiteUpToMainFrameThreshold,ReadAnythingOmniboxChip,Translate,WebUIReloadButton --variations-seed-version --pseudonymization-salt-handle=1908,i,11399934223529879323,6983621736269000008,4 --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=5672 /prefetch:1
          4⤵
          • Uses browser remote debugging
          • Executes dropped EXE
          • Loads dropped DLL
          PID:5744
        • C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-150.0.7871.24\chrome-win64\chrome.exe
          "C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-150.0.7871.24\chrome-win64\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Thundry\current\UserProfile" --force-high-res-timeticks=disabled --disable-background-timer-throttling --disable-breakpad --enable-automation --force-color-profile=srgb --remote-debugging-port=0 --allow-pre-commit-input --disable-gpu-compositing --enable-blink-features=IdleDetection --disable-blink-features=AutomationControlled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5628,i,1949572745412486819,14557690155558422591,2097152 --field-trial-handle=1904,i,9192791404080742898,7478254502622407571,262144 --enable-features=PdfOopif --disable-features=AcceptCHFrame,IPH_ReadingModePageActionLabel,IsolateSandboxedIframes,MediaRouter,OptimizationHints,ProcessPerSiteUpToMainFrameThreshold,ReadAnythingOmniboxChip,Translate,WebUIReloadButton --variations-seed-version --pseudonymization-salt-handle=1908,i,11399934223529879323,6983621736269000008,4 --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=5796 /prefetch:1
          4⤵
          • Uses browser remote debugging
          • Executes dropped EXE
          • Loads dropped DLL
          PID:404
        • C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-150.0.7871.24\chrome-win64\chrome.exe
          "C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-150.0.7871.24\chrome-win64\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --user-data-dir="C:\Users\Admin\AppData\Local\Thundry\current\UserProfile" --force-high-res-timeticks=disabled --metrics-shmem-handle=5948,i,11998176703573304404,6856701833004184495,524288 --field-trial-handle=1904,i,9192791404080742898,7478254502622407571,262144 --enable-features=PdfOopif --disable-features=AcceptCHFrame,IPH_ReadingModePageActionLabel,IsolateSandboxedIframes,MediaRouter,OptimizationHints,ProcessPerSiteUpToMainFrameThreshold,ReadAnythingOmniboxChip,Translate,WebUIReloadButton --variations-seed-version --pseudonymization-salt-handle=1908,i,11399934223529879323,6983621736269000008,4 --trace-process-track-uuid=3190708999430457380 --mojo-platform-channel-handle=5464 /prefetch:12
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:1920
        • C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-150.0.7871.24\chrome-win64\chrome.exe
          "C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-150.0.7871.24\chrome-win64\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Thundry\current\UserProfile" --force-high-res-timeticks=disabled --disable-background-timer-throttling --disable-breakpad --enable-automation --force-color-profile=srgb --remote-debugging-port=0 --allow-pre-commit-input --disable-gpu-compositing --enable-blink-features=IdleDetection --disable-blink-features=AutomationControlled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5612,i,6434281151188838085,4765222439332341960,2097152 --field-trial-handle=1904,i,9192791404080742898,7478254502622407571,262144 --enable-features=PdfOopif --disable-features=AcceptCHFrame,IPH_ReadingModePageActionLabel,IsolateSandboxedIframes,MediaRouter,OptimizationHints,ProcessPerSiteUpToMainFrameThreshold,ReadAnythingOmniboxChip,Translate,WebUIReloadButton --variations-seed-version --pseudonymization-salt-handle=1908,i,11399934223529879323,6983621736269000008,4 --trace-process-track-uuid=3190709000367499229 --mojo-platform-channel-handle=6136 /prefetch:1
          4⤵
          • Uses browser remote debugging
          • Executes dropped EXE
          • Loads dropped DLL
          PID:5256
        • C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-150.0.7871.24\chrome-win64\chrome.exe
          "C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-150.0.7871.24\chrome-win64\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Thundry\current\UserProfile" --force-high-res-timeticks=disabled --disable-background-timer-throttling --disable-breakpad --enable-automation --force-color-profile=srgb --remote-debugging-port=0 --allow-pre-commit-input --disable-gpu-compositing --enable-blink-features=IdleDetection --disable-blink-features=AutomationControlled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6164,i,8773037019679747829,3670984647060454107,2097152 --field-trial-handle=1904,i,9192791404080742898,7478254502622407571,262144 --enable-features=PdfOopif --disable-features=AcceptCHFrame,IPH_ReadingModePageActionLabel,IsolateSandboxedIframes,MediaRouter,OptimizationHints,ProcessPerSiteUpToMainFrameThreshold,ReadAnythingOmniboxChip,Translate,WebUIReloadButton --variations-seed-version --pseudonymization-salt-handle=1908,i,11399934223529879323,6983621736269000008,4 --trace-process-track-uuid=3190709001304541078 --mojo-platform-channel-handle=6156 /prefetch:1
          4⤵
          • Uses browser remote debugging
          • Executes dropped EXE
          • Loads dropped DLL
          PID:1724
        • C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-150.0.7871.24\chrome-win64\chrome.exe
          "C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-150.0.7871.24\chrome-win64\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Thundry\current\UserProfile" --force-high-res-timeticks=disabled --metrics-shmem-handle=6224,i,18091903375717962714,6131685993981516496,524288 --field-trial-handle=1904,i,9192791404080742898,7478254502622407571,262144 --enable-features=PdfOopif --disable-features=AcceptCHFrame,IPH_ReadingModePageActionLabel,IsolateSandboxedIframes,MediaRouter,OptimizationHints,ProcessPerSiteUpToMainFrameThreshold,ReadAnythingOmniboxChip,Translate,WebUIReloadButton --variations-seed-version --pseudonymization-salt-handle=1908,i,11399934223529879323,6983621736269000008,4 --trace-process-track-uuid=3190709002241582927 --mojo-platform-channel-handle=6364 /prefetch:14
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Modifies registry class
          PID:2936
        • C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-150.0.7871.24\chrome-win64\chrome.exe
          "C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-150.0.7871.24\chrome-win64\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Thundry\current\UserProfile" --force-high-res-timeticks=disabled --metrics-shmem-handle=6556,i,12447366967558218008,3212968676550355063,524288 --field-trial-handle=1904,i,9192791404080742898,7478254502622407571,262144 --enable-features=PdfOopif --disable-features=AcceptCHFrame,IPH_ReadingModePageActionLabel,IsolateSandboxedIframes,MediaRouter,OptimizationHints,ProcessPerSiteUpToMainFrameThreshold,ReadAnythingOmniboxChip,Translate,WebUIReloadButton --variations-seed-version --pseudonymization-salt-handle=1908,i,11399934223529879323,6983621736269000008,4 --trace-process-track-uuid=3190709004115666625 --mojo-platform-channel-handle=6572 /prefetch:14
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:2396
        • C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-150.0.7871.24\chrome-win64\chrome.exe
          "C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-150.0.7871.24\chrome-win64\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Thundry\current\UserProfile" --force-high-res-timeticks=disabled --metrics-shmem-handle=6548,i,120966367507146942,7204069491344213065,524288 --field-trial-handle=1904,i,9192791404080742898,7478254502622407571,262144 --enable-features=PdfOopif --disable-features=AcceptCHFrame,IPH_ReadingModePageActionLabel,IsolateSandboxedIframes,MediaRouter,OptimizationHints,ProcessPerSiteUpToMainFrameThreshold,ReadAnythingOmniboxChip,Translate,WebUIReloadButton --variations-seed-version --pseudonymization-salt-handle=1908,i,11399934223529879323,6983621736269000008,4 --trace-process-track-uuid=3190709005052708474 --mojo-platform-channel-handle=6576 /prefetch:14
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:1728
        • C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-150.0.7871.24\chrome-win64\chrome.exe
          "C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-150.0.7871.24\chrome-win64\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Thundry\current\UserProfile" --force-high-res-timeticks=disabled --metrics-shmem-handle=6140,i,15855655774861768524,11661949025509385092,524288 --field-trial-handle=1904,i,9192791404080742898,7478254502622407571,262144 --enable-features=PdfOopif --disable-features=AcceptCHFrame,IPH_ReadingModePageActionLabel,IsolateSandboxedIframes,MediaRouter,OptimizationHints,ProcessPerSiteUpToMainFrameThreshold,ReadAnythingOmniboxChip,Translate,WebUIReloadButton --variations-seed-version --pseudonymization-salt-handle=1908,i,11399934223529879323,6983621736269000008,4 --trace-process-track-uuid=3190709005989750323 --mojo-platform-channel-handle=6100 /prefetch:14
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:1440
        • C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-150.0.7871.24\chrome-win64\chrome.exe
          "C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-150.0.7871.24\chrome-win64\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Thundry\current\UserProfile" --force-high-res-timeticks=disabled --disable-background-timer-throttling --disable-breakpad --enable-automation --force-color-profile=srgb --remote-debugging-port=0 --allow-pre-commit-input --disable-gpu-compositing --enable-blink-features=IdleDetection --disable-blink-features=AutomationControlled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5840,i,17072493484020609942,5363285154425058168,2097152 --field-trial-handle=1904,i,9192791404080742898,7478254502622407571,262144 --enable-features=PdfOopif --disable-features=AcceptCHFrame,IPH_ReadingModePageActionLabel,IsolateSandboxedIframes,MediaRouter,OptimizationHints,ProcessPerSiteUpToMainFrameThreshold,ReadAnythingOmniboxChip,Translate,WebUIReloadButton --variations-seed-version --pseudonymization-salt-handle=1908,i,11399934223529879323,6983621736269000008,4 --trace-process-track-uuid=3190709006926792172 --mojo-platform-channel-handle=6100 /prefetch:1
          4⤵
          • Uses browser remote debugging
          • Executes dropped EXE
          • Loads dropped DLL
          PID:1700
        • C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-150.0.7871.24\chrome-win64\chrome.exe
          "C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-150.0.7871.24\chrome-win64\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --disable-breakpad --user-data-dir="C:\Users\Admin\AppData\Local\Thundry\current\UserProfile" --force-high-res-timeticks=disabled --start-stack-profiler --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAGAAOAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAQgAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --metrics-shmem-handle=5796,i,3875972182619460040,17913947138739376968,262144 --field-trial-handle=1904,i,9192791404080742898,7478254502622407571,262144 --enable-features=PdfOopif --disable-features=AcceptCHFrame,IPH_ReadingModePageActionLabel,IsolateSandboxedIframes,MediaRouter,OptimizationHints,ProcessPerSiteUpToMainFrameThreshold,ReadAnythingOmniboxChip,Translate,WebUIReloadButton --variations-seed-version --pseudonymization-salt-handle=1908,i,11399934223529879323,6983621736269000008,4 --trace-process-track-uuid=3190709007863834021 --mojo-platform-channel-handle=6808 /prefetch:10
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious behavior: EnumeratesProcesses
          PID:2408
  • C:\Windows\system32\werfault.exe
    werfault.exe /h /shared Global\8627e48019734c54985fcaef87f07ac3 /t 3308 /p 4524
    1⤵
      PID:1196
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
      1⤵
        PID:5788
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
        1⤵
        • Modifies data under HKEY_USERS
        PID:4412

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            hyph-nb.hyb
            • Path C:\Users\Admin\AppData\Local\PuppeteerSharp\ChromeHeadlessShell\Win64-150.0.7871.24\chrome-headless-shell-win64\hyphen-data\hyph-nb.hyb
            • Size 141KB
            • SHA256 c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            150.0.7871.24.manifest
            • Path C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-150.0.7871.24\chrome-win64\150.0.7871.24.manifest
            • Size 226B
            • SHA256 6893309c5e9d5e02f22bda86fa71640b8d5efc0eda081e6ca8cd5c6e50fb72c6
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            ABOUT
            • Path C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-150.0.7871.24\chrome-win64\ABOUT
            • Size 257B
            • SHA256 122b32f3ee3f1e8d65c774f5257fc6cc2127b666148ced0ce2efa3ea57e1d93c
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            D3DCompiler_47.dll
            • Path C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-150.0.7871.24\chrome-win64\D3DCompiler_47.dll
            • Size 4.5MB
            • SHA256 a05f99734f7c4822fefc12b367af21fd0976ed6608752fb1e1e80b6ece7ecbbb
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            First Run
            • Path C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-150.0.7871.24\chrome-win64\First Run
            • Size 8B
            • SHA256 839adbaaca1c43dd4575c502ada96ebb4651f1a69b6fc5e42679beb47584181e
            • MD5 SHA1 SHA512
            Submit Download

            chrome.exe
            • Path C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-150.0.7871.24\chrome-win64\chrome.exe
            • Size 3.7MB
            • SHA256 333634cfd69be8beec3f8d025c872dcde2e82a1884c138976b845189bc16f2a9
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            chrome_100_percent.pak
            • Path C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-150.0.7871.24\chrome-win64\chrome_100_percent.pak
            • Size 682KB
            • SHA256 2c308858519e844bae975fbb959ab8c649ae09fe919d7d892a1d8fb15ce40116
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            chrome_200_percent.pak
            • Path C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-150.0.7871.24\chrome-win64\chrome_200_percent.pak
            • Size 1.1MB
            • SHA256 512dc3e25dd133414e426ebf26540aee0688395eb4d36f556c91fb7f7fa3faf5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            chrome_elf.dll
            • Path C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-150.0.7871.24\chrome-win64\chrome_elf.dll
            • Size 2.5MB
            • SHA256 737edb7e6ca7ebba6797ada482c566ee8e3cd1c0f8d6ef485a066f45fe575f6e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            chrome_proxy.exe
            • Path C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-150.0.7871.24\chrome-win64\chrome_proxy.exe
            • Size 2.4MB
            • SHA256 08c19817d135f61bd1527f31ffd83b9d15964a210858d0b83975eac23b098a02
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            chrome_pwa_launcher.exe
            • Path C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-150.0.7871.24\chrome-win64\chrome_pwa_launcher.exe
            • Size 2.6MB
            • SHA256 e6b387de0ef6100b8c8b56dca550b4741f31bb1d8609ef979cf6f47751caf052
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            chrome_wer.dll
            • Path C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-150.0.7871.24\chrome-win64\chrome_wer.dll
            • Size 105KB
            • SHA256 da8a092cff76ce0869f52bd91523fe16ca568637607f82738dff42d830b95130
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            dxcompiler.dll
            • Path C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-150.0.7871.24\chrome-win64\dxcompiler.dll
            • Size 24.4MB
            • SHA256 de09f45aa54e6e4492274862deaa416b8455087ddda1c8d08b20beac1cd19d47
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            dxil.dll
            • Path C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-150.0.7871.24\chrome-win64\dxil.dll
            • Size 1.4MB
            • SHA256 77e039c905030a641e53658a008b74e90635a5ea9b6b79eabd0f2003bdfca59a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            elevated_tracing_service.exe
            • Path C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-150.0.7871.24\chrome-win64\elevated_tracing_service.exe
            • Size 4.1MB
            • SHA256 c4a6f8ac12a37a83228d9cfe191971c985e9c6f071941820806f3e9734b5cf41
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            elevation_service.exe
            • Path C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-150.0.7871.24\chrome-win64\elevation_service.exe
            • Size 3.7MB
            • SHA256 9532cabf1e4ac01a3dbfa774c03e287a1480c15fedfc593a7d27889809b68456
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            hyph-af.hyb
            • Path C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-150.0.7871.24\chrome-win64\hyphen-data\hyph-af.hyb
            • Size 70KB
            • SHA256 5487ee44a4cd706d0086522e90c59c76cdf2ac68ce506fd3eae6054b9220c0cf
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            hyph-as.hyb
            • Path C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-150.0.7871.24\chrome-win64\hyphen-data\hyph-as.hyb
            • Size 703B
            • SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            hyph-be.hyb
            • Path C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-150.0.7871.24\chrome-win64\hyphen-data\hyph-be.hyb
            • Size 5KB
            • SHA256 25b7cfa039f82ac92990e1789de40988d490db9b613852fb24036b38ff87893c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            hyph-bg.hyb
            • Path C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-150.0.7871.24\chrome-win64\hyphen-data\hyph-bg.hyb
            • Size 3KB
            • SHA256 7593f0395081e3eeb2d8516d10746608afd826cffd4e7e37d53936993d200a13
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            hyph-cs.hyb
            • Path C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-150.0.7871.24\chrome-win64\hyphen-data\hyph-cs.hyb
            • Size 62KB
            • SHA256 97a4755fe9e653a08969f1933e3db19c712078b227bd5aa6799093abc5a0edc3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            hyph-cu.hyb
            • Path C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-150.0.7871.24\chrome-win64\hyphen-data\hyph-cu.hyb
            • Size 51KB
            • SHA256 2baee19d5024ff87dcf3a1b9d0da1b3ac5a1e506adeead3b96a4de5395d0290e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            hyph-cy.hyb
            • Path C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-150.0.7871.24\chrome-win64\hyphen-data\hyph-cy.hyb
            • Size 35KB
            • SHA256 4d0569fe2f4b41b3164cf610310e1d996fd2c553cc39de6062e50f4e033cc207
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            hyph-da.hyb
            • Path C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-150.0.7871.24\chrome-win64\hyphen-data\hyph-da.hyb
            • Size 6KB
            • SHA256 86fdfc8db62cdaa11f615dad3712da1f4708294e029a4aad0fc285d4ea16c4bd
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            hyph-de-1901.hyb
            • Path C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-150.0.7871.24\chrome-win64\hyphen-data\hyph-de-1901.hyb
            • Size 118KB
            • SHA256 8c5fa4b29519d17593e923bc6a9a284df7a6d07fac42f897110b8fb2e0baeef5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            hyph-de-1996.hyb
            • Path C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-150.0.7871.24\chrome-win64\hyphen-data\hyph-de-1996.hyb
            • Size 117KB
            • SHA256 d673805547a0228d2f57a5ad551b8760cfcc521f38c49284ed3976e3515bca49
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            hyph-de-ch-1901.hyb
            • Path C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-150.0.7871.24\chrome-win64\hyphen-data\hyph-de-ch-1901.hyb
            • Size 117KB
            • SHA256 8223a912160354e05735522fdb339dc59b353ad5d1e4f4cfa94898dc348e748f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            hyph-el.hyb
            • Path C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-150.0.7871.24\chrome-win64\hyphen-data\hyph-el.hyb
            • Size 4KB
            • SHA256 76ae3454fb0045adb83094832578aa4749ce4dc694c4edcf85b419c1e2d9bcd3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            hyph-en-gb.hyb
            • Path C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-150.0.7871.24\chrome-win64\hyphen-data\hyph-en-gb.hyb
            • Size 45KB
            • SHA256 ae4b78009d18e849d87458677151ee3aad1608ad72ec050dfd2421d22e7d031f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            hyph-en-us.hyb
            • Path C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-150.0.7871.24\chrome-win64\hyphen-data\hyph-en-us.hyb
            • Size 58KB
            • SHA256 03727cd6f4aa71b203c4c74ca6987ac7d87f13037337ac6f4b6996c2a0dc5f8c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            hyph-es.hyb
            • Path C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-150.0.7871.24\chrome-win64\hyphen-data\hyph-es.hyb
            • Size 14KB
            • SHA256 137461792537a2e56a6475e81e2b9ad7a2bdabf1f4738fae186dca3022357349
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            hyph-et.hyb
            • Path C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-150.0.7871.24\chrome-win64\hyphen-data\hyph-et.hyb
            • Size 20KB
            • SHA256 10079c66014dd2e6abfef5a018e6553fd5a036afb96bd2a235440a188f88b15e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            hyph-eu.hyb
            • Path C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-150.0.7871.24\chrome-win64\hyphen-data\hyph-eu.hyb
            • Size 665B
            • SHA256 e2778a4fc7b8f064a32b6a44bc29f10e264d9d6214b8edb8ebd1f5f6d68e2eb2
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            hyph-fr.hyb
            • Path C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-150.0.7871.24\chrome-win64\hyphen-data\hyph-fr.hyb
            • Size 7KB
            • SHA256 00bd8b2d398d77575da2bfbbc5ec641aad7f2a87d4a31186ec169e85a27de5b7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            hyph-ga.hyb
            • Path C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-150.0.7871.24\chrome-win64\hyphen-data\hyph-ga.hyb
            • Size 34KB
            • SHA256 1e3043f395bfb2a4c43d0480ba2f168ed622881cc3482359ca6e99821e983be8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            hyph-gl.hyb
            • Path C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-150.0.7871.24\chrome-win64\hyphen-data\hyph-gl.hyb
            • Size 9KB
            • SHA256 89d98eff14e2cf1c2314efdf392339e62d7e786f100202a7377bf7b22095a0c5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            hyph-gu.hyb
            • Path C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-150.0.7871.24\chrome-win64\hyphen-data\hyph-gu.hyb
            • Size 655B
            • SHA256 af0edb67c2219b803c3eb6c1dee6f2d41a3fe00468a9da8be8ef5056d701abf3
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            hyph-hi.hyb
            • Path C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-150.0.7871.24\chrome-win64\hyphen-data\hyph-hi.hyb
            • Size 687B
            • SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            hyph-hr.hyb
            • Path C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-150.0.7871.24\chrome-win64\hyphen-data\hyph-hr.hyb
            • Size 2KB
            • SHA256 d5f066a5657f1d7c39d053956df204b7926f40d2fe4f69573af09d909066e26c
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            hyph-hu.hyb
            • Path C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-150.0.7871.24\chrome-win64\hyphen-data\hyph-hu.hyb
            • Size 309KB
            • SHA256 8b3a16268cc932b226c17ff405b3cfb6eb38a9511a2043d653dc03729efceac1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            hyph-hy.hyb
            • Path C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-150.0.7871.24\chrome-win64\hyphen-data\hyph-hy.hyb
            • Size 605B
            • SHA256 9b34dfca85cb27546829f104f137757efb274934c1e9d4991f55ad564962a76a
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            hyph-it.hyb
            • Path C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-150.0.7871.24\chrome-win64\hyphen-data\hyph-it.hyb
            • Size 2KB
            • SHA256 f9c027d7fd44b01cd5e1cdf802e20c63560673098af18bea0930ba9af334e0f7
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            hyph-ka.hyb
            • Path C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-150.0.7871.24\chrome-win64\hyphen-data\hyph-ka.hyb
            • Size 9KB
            • SHA256 2472271c7955c67e9fdb86d0cd3c5d88f5e598da4f44b6741284b2bbcb2e4d52
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            hyph-kn.hyb
            • Path C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-150.0.7871.24\chrome-win64\hyphen-data\hyph-kn.hyb
            • Size 711B
            • SHA256 2b999d0a152f804601aa8f38ff0d3a6e5949977bf1daa76fa888acae21526287
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            hyph-la.hyb
            • Path C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-150.0.7871.24\chrome-win64\hyphen-data\hyph-la.hyb
            • Size 1KB
            • SHA256 fd4b6f36135cd3b932e350ec2017dfd89d2e36ac226f54e4c8f2e4bc6db0593d
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            hyph-lt.hyb
            • Path C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-150.0.7871.24\chrome-win64\hyphen-data\hyph-lt.hyb
            • Size 7KB
            • SHA256 6fe2da26a96834fb9aecbe586d40f728df0ef676a4f235450054e66841b9e2ca
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            hyph-lv.hyb
            • Path C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-150.0.7871.24\chrome-win64\hyphen-data\hyph-lv.hyb
            • Size 37KB
            • SHA256 65962ccb5055e4c693e5ac493d6affdc810ec168eb2942f5705b7f4e464f9993
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            hyph-ml.hyb
            • Path C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-150.0.7871.24\chrome-win64\hyphen-data\hyph-ml.hyb
            • Size 776B
            • SHA256 90572db8f49b01ec6a102732cdf14fc3f07d363cbe0d261103e583043164e888
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            af_NEUTER.pak
            • Path C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-150.0.7871.24\chrome-win64\locales\af_NEUTER.pak
            • Size 18B
            • SHA256 ca73097bd968b363b7145e86b64f3c595e533808b0763dc8863a27fc363cfa51
            • MD5 SHA1 SHA512
            Submit Download

            setup.exe
            • Path C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-150.0.7871.24\chrome-win64\setup.exe
            • Size 5.5MB
            • SHA256 2ad652ab049ca03bbea5b3d2006d438c8bd75fa065d00024ba814860d37d6de7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Thundry.exe
            • Path C:\Users\Admin\AppData\Local\Thundry\current\Thundry.exe
            • Size 46.5MB
            • SHA256 8e648b55c3e15f808456e0cfec8d8fbbbf43e13664ea73e3e4133dc0a4b2af80
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            69ae6b18-a45e-4196-81cc-113d6d682135.tmp
            • Path C:\Users\Admin\AppData\Local\Thundry\current\UserProfile\69ae6b18-a45e-4196-81cc-113d6d682135.tmp
            • Size 983B
            • SHA256 921eea9bb81b5b0c33a4621ae4a5479fc329c29bac57b7bd794e57e03bc4a6ed
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            1dd13cbc-4863-4358-8f18-ec4b86b76487.tmp
            • Path C:\Users\Admin\AppData\Local\Thundry\current\UserProfile\Default\1dd13cbc-4863-4358-8f18-ec4b86b76487.tmp
            • Size 6KB
            • SHA256 295d7cecadf34d28b3065a2d12cb0b5c4d8614ea7d1f4bb29f9d5ce0e40cdd14
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            data_2
            • Path C:\Users\Admin\AppData\Local\Thundry\current\UserProfile\Default\Cache\Cache_Data\data_2
            • Size 8KB
            • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            data_3
            • Path C:\Users\Admin\AppData\Local\Thundry\current\UserProfile\Default\Cache\Cache_Data\data_3
            • Size 8KB
            • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            a9c9cc8f-8732-42b2-8135-594a9394f6be.tmp
            • Path C:\Users\Admin\AppData\Local\Thundry\current\UserProfile\Default\Code Cache\js\index-dir\a9c9cc8f-8732-42b2-8135-594a9394f6be.tmp
            • Size 48B
            • SHA256 daaf40b5712dbea6cfc5ee8d125fc1d5610e8aec5a17732d6b4c3867251fe5c6
            • MD5 SHA1 SHA512
            Submit Download

            the-real-index
            • Path C:\Users\Admin\AppData\Local\Thundry\current\UserProfile\Default\Code Cache\js\index-dir\the-real-index
            • Size 2KB
            • SHA256 c43031185227944a7c9f244531258e1aa75fbdebec36438f4e7233699ad3bca2
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            000001.dbtmp
            • Path C:\Users\Admin\AppData\Local\Thundry\current\UserProfile\Default\Extension Scripts\000001.dbtmp
            • Size 16B
            • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
            • MD5 SHA1 SHA512
            Submit Download

            6ab73406-dc23-4608-aeca-197d103ccbf1.tmp
            • Path C:\Users\Admin\AppData\Local\Thundry\current\UserProfile\Default\Network\6ab73406-dc23-4608-aeca-197d103ccbf1.tmp
            • Size 59B
            • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Network Persistent State
            • Path C:\Users\Admin\AppData\Local\Thundry\current\UserProfile\Default\Network\Network Persistent State
            • Size 6KB
            • SHA256 ef619684fef8b20346bd3143325aae2b84370c16ad09dbc47d749b92a6beb541
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            SCT Auditing Pending Reports
            • Path C:\Users\Admin\AppData\Local\Thundry\current\UserProfile\Default\Network\SCT Auditing Pending Reports
            • Size 2B
            • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
            • MD5 SHA1 SHA512
            Submit Download

            Preferences
            • Path C:\Users\Admin\AppData\Local\Thundry\current\UserProfile\Default\Preferences
            • Size 7KB
            • SHA256 2d40bee811cd0f97984460825d934dffcfc0266549e2cdfa659b946f1337eb07
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Preferences
            • Path C:\Users\Admin\AppData\Local\Thundry\current\UserProfile\Default\Preferences
            • Size 8KB
            • SHA256 a3ac3d4a2478ab60a8df8d6951917559c8eb2faf67c0a3df894716f6dc95c201
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MANIFEST-000001
            • Path C:\Users\Admin\AppData\Local\Thundry\current\UserProfile\Default\Sync Data\LevelDB\MANIFEST-000001
            • Size 41B
            • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
            • MD5 SHA1 SHA512
            Submit Download

            data_0
            • Path C:\Users\Admin\AppData\Local\Thundry\current\UserProfile\GrShaderCache\data_0
            • Size 8KB
            • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Local State
            • Path C:\Users\Admin\AppData\Local\Thundry\current\UserProfile\Local State
            • Size 4KB
            • SHA256 ca38d351c1f1c71a21e3fd2d7737df3afd0ed196fb85feccd0c59a0063a88dc2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Local State
            • Path C:\Users\Admin\AppData\Local\Thundry\current\UserProfile\Local State
            • Size 4KB
            • SHA256 2052a6acd105e11f5d2853de0779b26aa05fc71dfa443c0b0cfde3e5c95ad713
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Local State
            • Path C:\Users\Admin\AppData\Local\Thundry\current\UserProfile\Local State
            • Size 7KB
            • SHA256 5ad07c5b525a45953a834cd0cea310051cbf98dd0452159eac322f1caf207781
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Local State
            • Path C:\Users\Admin\AppData\Local\Thundry\current\UserProfile\Local State
            • Size 7KB
            • SHA256 928a1f2986f5db53214cc9c08d2de2ca895f662e90718d988c80d8d61559a394
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Ruleset Data
            • Path C:\Users\Admin\AppData\Local\Thundry\current\UserProfile\Subresource Filter\Indexed Rules\38\9.70.0\Ruleset Data
            • Size 244KB
            • SHA256 d19af57302067e100dab38b3660f65383215f66d310de71eaec3731b720663e2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            metadata.json
            • Path C:\Users\Admin\AppData\Local\Thundry\current\UserProfile\component_crx_cache\metadata.json
            • Size 13B
            • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
            • MD5 SHA1 SHA512
            Submit Download

            metadata.json
            • Path C:\Users\Admin\AppData\Local\Thundry\current\UserProfile\component_crx_cache\metadata.json
            • Size 236B
            • SHA256 72b0b88e7a255d0ae8ff33e78eaff4f770f2edf47a4949a2754d51ccf90e2f17
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            metadata.json
            • Path C:\Users\Admin\AppData\Local\Thundry\current\UserProfile\component_crx_cache\metadata.json
            • Size 124B
            • SHA256 92c3f697b387ce1a909a160758f3d0d04a6f665f43e86dfcf75fa025fb95a917
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            av_libGLESv2.dll
            • Path C:\Users\Admin\AppData\Local\Thundry\current\av_libGLESv2.dll
            • Size 5.1MB
            • SHA256 53191a77fe783cd757ca7767077c2a64a662e7043777a5b4ab74980d4a0b73e3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libHarfBuzzSharp.DLL
            • Path C:\Users\Admin\AppData\Local\Thundry\current\libHarfBuzzSharp.DLL
            • Size 1.7MB
            • SHA256 145ade963eba427027d5e1381db5d51a0ef9e98e9fef9efbfa6074ca20da246f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libSkiaSharp.DLL
            • Path C:\Users\Admin\AppData\Local\Thundry\current\libSkiaSharp.DLL
            • Size 11.1MB
            • SHA256 7dec3ba900ab353491e6446f0083739924c6f8dd668832e2f09d38ebffdbbe1c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            sq.version
            • Path C:\Users\Admin\AppData\Local\Thundry\current\sq.version
            • Size 468B
            • SHA256 84d4362b948e55d7d7be05e4b786af1df617ad50d81f008bde22b2ec8cf35345
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            velopack_Thundry.log
            • Path C:\Users\Admin\AppData\Local\velopack\velopack_Thundry.log
            • Size 1KB
            • SHA256 c6dd9f6032d46fe3865d830fa8eb7344e67d5f97f7f784358fcf0cfedce1a0a3
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            thundry-20260813.log
            • Path C:\Users\Admin\AppData\Roaming\Thundry\logs\thundry-20260813.log
            • Size 5KB
            • SHA256 ebd33d1f4c53899bf0593449884fef7d5d3036f803d189dcd7c2ac1d2d8f3d2f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            memory/1472-42-0x00007FF67AF50000-0x00007FF67BF50000-memory.dmp
            Download

            memory/2408-2054-0x0000026DB0280000-0x0000026DB0281000-memory.dmp
            Download

            memory/2408-2056-0x0000026DB0280000-0x0000026DB0281000-memory.dmp
            Download

            memory/2408-2065-0x0000026DB0280000-0x0000026DB0281000-memory.dmp
            Download

            memory/2408-2066-0x0000026DB0280000-0x0000026DB0281000-memory.dmp
            Download

            memory/2408-2064-0x0000026DB0280000-0x0000026DB0281000-memory.dmp
            Download

            memory/2408-2063-0x0000026DB0280000-0x0000026DB0281000-memory.dmp
            Download

            memory/2408-2062-0x0000026DB0280000-0x0000026DB0281000-memory.dmp
            Download

            memory/2408-2061-0x0000026DB0280000-0x0000026DB0281000-memory.dmp
            Download

            memory/4524-29-0x0000023E129F0000-0x0000023E12A00000-memory.dmp
            Download