hxxps://dolphin-emu[.]org/

Analysis

geolocation tags

eueuropelondonukunited-kingdom
user interaction
yes
max time kernel
900s
max time network
898s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/08/2026, 11:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://dolphin-emu.org/
Sample260814-nadvcsswft

Score

8^/10

discovery motw persistence phishing ransomware

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
572	7688	chrome.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	VC_redist.x64.exe

Executes dropped EXE 16 IoCs

pid	Process
7100	Dolphin.exe
7056	Dolphin.exe
7756	Dolphin.exe
6388	DolphinTool.exe
8056	DSPTool.exe
5956	VC_redist.x64.exe
8156	VC_redist.x64.exe
3852	VC_redist.x64.exe
2448	VC_redist.x64.exe
4264	VC_redist.x64.exe
2420	VC_redist.x64.exe
4400	Updater.exe
5444	DSPTool.exe
2748	DolphinTool.exe
6864	Updater.exe
6552	Dolphin.exe

Loads dropped DLL 42 IoCs

pid	Process
7100	Dolphin.exe
7100	Dolphin.exe
7100	Dolphin.exe
7100	Dolphin.exe
7100	Dolphin.exe
7056	Dolphin.exe
7056	Dolphin.exe
7056	Dolphin.exe
7056	Dolphin.exe
7056	Dolphin.exe
7756	Dolphin.exe
7756	Dolphin.exe
7756	Dolphin.exe
7756	Dolphin.exe
7756	Dolphin.exe
8156	VC_redist.x64.exe
4752	VC_redist.x64.exe
2420	VC_redist.x64.exe
4400	Updater.exe
4400	Updater.exe
4400	Updater.exe
5444	DSPTool.exe
5444	DSPTool.exe
5444	DSPTool.exe
2748	DolphinTool.exe
2748	DolphinTool.exe
2748	DolphinTool.exe
2748	DolphinTool.exe
6864	Updater.exe
6864	Updater.exe
6864	Updater.exe
6552	Dolphin.exe
6552	Dolphin.exe
6552	Dolphin.exe
6552	Dolphin.exe
6552	Dolphin.exe
6552	Dolphin.exe
6552	Dolphin.exe
6552	Dolphin.exe
6552	Dolphin.exe
6552	Dolphin.exe
6552	Dolphin.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0} = "\"C:\\ProgramData\\Package Cache\\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\\VC_redist.x64.exe\" /burn.runonce"	VC_redist.x64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Videos\Captures\desktop.ini	svchost.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe

Mark of the Web detected: This indicates that the page was originally saved or cloned. 1 IoCs

phishing motw

flow	ioc	pid	Process
461	https://www.freevpn.win/lps/gbox-lp/index.html?cid=185764073&kw=PA_POP_2484562	2812	chrome.exe

Drops file in System32 directory 51 IoCs

description	ioc	Process
File created	C:\Windows\system32\msvcp140.dll	msiexec.exe
File created	C:\Windows\system32\mfc140jpn.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_atomic_wait.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140ita.dll	msiexec.exe
File created	C:\Windows\system32\mfc140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcomp140.dll	msiexec.exe
File created	C:\Windows\system32\vcruntime140_threads.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfcm140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfcm140u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140deu.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140kor.dll	msiexec.exe
File created	C:\Windows\system32\mfc140cht.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_2.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_codecvt_ids.dll	msiexec.exe
File opened for modification	C:\Windows\system32\concrt140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vccorlib140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140jpn.dll	msiexec.exe
File created	C:\Windows\system32\mfc140enu.dll	msiexec.exe
File created	C:\Windows\system32\mfc140fra.dll	msiexec.exe
File created	C:\Windows\system32\mfc140kor.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcruntime140_1.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcamp140.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_codecvt_ids.dll	msiexec.exe
File created	C:\Windows\system32\vcamp140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140enu.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140fra.dll	msiexec.exe
File created	C:\Windows\system32\mfc140esn.dll	msiexec.exe
File created	C:\Windows\system32\vcruntime140.dll	msiexec.exe
File created	C:\Windows\system32\vcruntime140_1.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140chs.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140rus.dll	msiexec.exe
File created	C:\Windows\system32\mfc140chs.dll	msiexec.exe
File created	C:\Windows\system32\mfc140rus.dll	msiexec.exe
File created	C:\Windows\system32\mfcm140.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_1.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140esn.dll	msiexec.exe
File created	C:\Windows\system32\mfc140deu.dll	msiexec.exe
File created	C:\Windows\system32\mfc140u.dll	msiexec.exe
File created	C:\Windows\system32\vcomp140.dll	msiexec.exe
File created	C:\Windows\system32\concrt140.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_2.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_atomic_wait.dll	msiexec.exe
File created	C:\Windows\system32\vccorlib140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140cht.dll	msiexec.exe
File created	C:\Windows\system32\mfc140ita.dll	msiexec.exe
File created	C:\Windows\system32\mfcm140u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcruntime140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_1.dll	msiexec.exe

Drops file in Windows directory 15 IoCs

description	ioc	Process
File created	C:\Windows\Installer\SourceHash{931A2CF0-2404-45EA-82F5-345735AE6A90}	msiexec.exe
File created	C:\Windows\Installer\SourceHash{6FA797CF-6B76-4B6D-87EE-768F92008720}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI404B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3A7E.tmp	msiexec.exe
File created	C:\Windows\Installer\e603474.msi	msiexec.exe
File created	C:\Windows\Installer\e603475.msi	msiexec.exe
File created	C:\Windows\Installer\e60348a.msi	msiexec.exe
File created	C:\Windows\Installer\e603462.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4388.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e603462.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI36C4.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e603475.msi	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2812	chrome.exe
7688	chrome.exe

Checks SCSI registry key(s) 3 TTPs 16 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000041efd9123c6b0a670000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000041efd9120000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff00000000070001000068090041efd912000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a41efd912000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d41efd912000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 12 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134311795057442421"	chrome.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0FC2A1394042AE54285F437553EAA609\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0FC2A1394042AE54285F437553EAA609\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{931A2CF0-2404-45EA-82F5-345735AE6A90}v14.51.36247\\packages\\vcRuntimeMinimum_amd64\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14\DisplayName = "Microsoft Visual C++ 2022 X64 Additional Runtime - 14.51.36247"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.51,bundle	VC_redist.x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FC797AF667B6D6B478EE67F829007802\Version = "238259607"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FC797AF667B6D6B478EE67F829007802\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0FC2A1394042AE54285F437553EAA609\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.51,bundle\Dependents	VC_redist.x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8800A266DCF6DD54E97A86760485EA5D\SourceList	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\88AAB0B9F51EF1A3CA0C2B609EDD7FC1	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.51,bundle\Version = "14.51.36247.0"	VC_redist.x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\09A86F63C932FD435BC8463B1035EC53	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14\DisplayName = "Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.51.36247"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0FC2A1394042AE54285F437553EAA609\ProductName = "Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.51.36247"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0FC2A1394042AE54285F437553EAA609\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FC797AF667B6D6B478EE67F829007802\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{6FA797CF-6B76-4B6D-87EE-768F92008720}v14.51.36247\\packages\\vcRuntimeAdditional_amd64\\"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\MICROSOFT.VS.VC_RUNTIMEADDITIONALVSU_AMD64,V14\DEPENDENTS\{57A73DF6-4BA9-4C1D-BBBB-517289FF6C13}	VC_redist.x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0FC2A1394042AE54285F437553EAA609\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0FC2A1394042AE54285F437553EAA609\SourceList\Media\1 = ";"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\VC,REDIST.X64,AMD64,14.30,BUNDLE\DEPENDENTS\{57A73DF6-4BA9-4C1D-BBBB-517289FF6C13}	VC_redist.x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\MICROSOFT.VS.VC_RUNTIMEMINIMUMVSU_AMD64,V14\DEPENDENTS\{57A73DF6-4BA9-4C1D-BBBB-517289FF6C13}	VC_redist.x64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{645612FA-41A8-4F7D-8852-15B3E93BA4B9}	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0FC2A1394042AE54285F437553EAA609	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0FC2A1394042AE54285F437553EAA609\PackageCode = "0C8085736BA341746BF212F118CB3024"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0FC2A1394042AE54285F437553EAA609\Version = "238259607"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0FC2A1394042AE54285F437553EAA609\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14\Dependents\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}	VC_redist.x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A567BD6FA501A947AD1F646E53EEC14\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14\ = "{6FA797CF-6B76-4B6D-87EE-768F92008720}"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A567BD6FA501A947AD1F646E53EEC14\SourceList	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FC797AF667B6D6B478EE67F829007802\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FC797AF667B6D6B478EE67F829007802\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FC797AF667B6D6B478EE67F829007802\SourceList\PackageName = "vc_runtimeAdditional_x64.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FC797AF667B6D6B478EE67F829007802\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{6FA797CF-6B76-4B6D-87EE-768F92008720}v14.51.36247\\packages\\vcRuntimeAdditional_amd64\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0FC2A1394042AE54285F437553EAA609\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FC797AF667B6D6B478EE67F829007802\PackageCode = "7BBAFE5243E5BA648BB1E5A7E34354F7"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FC797AF667B6D6B478EE67F829007802\SourceList	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8800A266DCF6DD54E97A86760485EA5D\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0FC2A1394042AE54285F437553EAA609\SourceList\Media	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A567BD6FA501A947AD1F646E53EEC14	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\FC797AF667B6D6B478EE67F829007802\VC_Runtime_Additional	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\FC797AF667B6D6B478EE67F829007802\Servicing_Key	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FC797AF667B6D6B478EE67F829007802\ProductName = "Microsoft Visual C++ 2022 X64 Additional Runtime - 14.51.36247"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FC797AF667B6D6B478EE67F829007802\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FC797AF667B6D6B478EE67F829007802\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.51,bundle\Dependents\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14\Version = "14.51.36247"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\0FC2A1394042AE54285F437553EAA609\Servicing_Key	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0FC2A1394042AE54285F437553EAA609\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0FC2A1394042AE54285F437553EAA609\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\FC797AF667B6D6B478EE67F829007802	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\88AAB0B9F51EF1A3CA0C2B609EDD7FC1\FC797AF667B6D6B478EE67F829007802	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FC797AF667B6D6B478EE67F829007802\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\0FC2A1394042AE54285F437553EAA609	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.51,bundle\ = "{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}"	VC_redist.x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0FC2A1394042AE54285F437553EAA609\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0FC2A1394042AE54285F437553EAA609\SourceList\PackageName = "vc_runtimeMinimum_x64.msi"	msiexec.exe

Suspicious behavior: AddClipboardFormatListener 4 IoCs

pid	Process
7100	Dolphin.exe
7056	Dolphin.exe
7756	Dolphin.exe
6552	Dolphin.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
6620	chrome.exe
6620	chrome.exe
7436	taskmgr.exe
7436	taskmgr.exe
7436	taskmgr.exe
7436	taskmgr.exe
7436	taskmgr.exe
7436	taskmgr.exe
7436	taskmgr.exe
7436	taskmgr.exe
7436	taskmgr.exe
7436	taskmgr.exe
7436	taskmgr.exe
7436	taskmgr.exe
7436	taskmgr.exe
7436	taskmgr.exe
7436	taskmgr.exe
7436	taskmgr.exe
7436	taskmgr.exe
7436	taskmgr.exe
7436	taskmgr.exe
7436	taskmgr.exe
7436	taskmgr.exe
7436	taskmgr.exe
7436	taskmgr.exe
7436	taskmgr.exe
7436	taskmgr.exe
7436	taskmgr.exe
7436	taskmgr.exe
7436	taskmgr.exe
7436	taskmgr.exe
7436	taskmgr.exe
7436	taskmgr.exe
7436	taskmgr.exe
7436	taskmgr.exe
7436	taskmgr.exe
7436	taskmgr.exe
7436	taskmgr.exe
7436	taskmgr.exe
7436	taskmgr.exe
7436	taskmgr.exe
7436	taskmgr.exe
7436	taskmgr.exe
7436	taskmgr.exe
7436	taskmgr.exe
7436	taskmgr.exe
7436	taskmgr.exe
7436	taskmgr.exe
7436	taskmgr.exe
7436	taskmgr.exe
7436	taskmgr.exe
7436	taskmgr.exe
7436	taskmgr.exe
7436	taskmgr.exe
7436	taskmgr.exe
7436	taskmgr.exe
7436	taskmgr.exe
7436	taskmgr.exe
7436	taskmgr.exe
7436	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
7436	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 54 IoCs

pid	Process
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
7136	chrome.exe
7136	chrome.exe
7136	chrome.exe
7136	chrome.exe
7136	chrome.exe
7136	chrome.exe
7136	chrome.exe
7136	chrome.exe
7136	chrome.exe
7136	chrome.exe
7136	chrome.exe
7136	chrome.exe
7136	chrome.exe
7136	chrome.exe
7136	chrome.exe
7136	chrome.exe
7136	chrome.exe
7136	chrome.exe
7136	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1956	chrome.exe
Token: SeCreatePagefilePrivilege	1956	chrome.exe
Token: SeShutdownPrivilege	1956	chrome.exe
Token: SeCreatePagefilePrivilege	1956	chrome.exe
Token: SeShutdownPrivilege	1956	chrome.exe
Token: SeCreatePagefilePrivilege	1956	chrome.exe
Token: SeShutdownPrivilege	1956	chrome.exe
Token: SeCreatePagefilePrivilege	1956	chrome.exe
Token: SeShutdownPrivilege	1956	chrome.exe
Token: SeCreatePagefilePrivilege	1956	chrome.exe
Token: SeShutdownPrivilege	1956	chrome.exe
Token: SeCreatePagefilePrivilege	1956	chrome.exe
Token: SeShutdownPrivilege	1956	chrome.exe
Token: SeCreatePagefilePrivilege	1956	chrome.exe
Token: SeShutdownPrivilege	1956	chrome.exe
Token: SeCreatePagefilePrivilege	1956	chrome.exe
Token: SeShutdownPrivilege	1956	chrome.exe
Token: SeCreatePagefilePrivilege	1956	chrome.exe
Token: SeShutdownPrivilege	1956	chrome.exe
Token: SeCreatePagefilePrivilege	1956	chrome.exe
Token: SeShutdownPrivilege	1956	chrome.exe
Token: SeCreatePagefilePrivilege	1956	chrome.exe
Token: SeShutdownPrivilege	1956	chrome.exe
Token: SeCreatePagefilePrivilege	1956	chrome.exe
Token: SeShutdownPrivilege	1956	chrome.exe
Token: SeCreatePagefilePrivilege	1956	chrome.exe
Token: SeShutdownPrivilege	1956	chrome.exe
Token: SeCreatePagefilePrivilege	1956	chrome.exe
Token: SeShutdownPrivilege	1956	chrome.exe
Token: SeCreatePagefilePrivilege	1956	chrome.exe
Token: SeShutdownPrivilege	1956	chrome.exe
Token: SeCreatePagefilePrivilege	1956	chrome.exe
Token: SeShutdownPrivilege	1956	chrome.exe
Token: SeCreatePagefilePrivilege	1956	chrome.exe
Token: SeShutdownPrivilege	1956	chrome.exe
Token: SeCreatePagefilePrivilege	1956	chrome.exe
Token: SeShutdownPrivilege	1956	chrome.exe
Token: SeCreatePagefilePrivilege	1956	chrome.exe
Token: SeShutdownPrivilege	1956	chrome.exe
Token: SeCreatePagefilePrivilege	1956	chrome.exe
Token: SeShutdownPrivilege	1956	chrome.exe
Token: SeCreatePagefilePrivilege	1956	chrome.exe
Token: SeShutdownPrivilege	1956	chrome.exe
Token: SeCreatePagefilePrivilege	1956	chrome.exe
Token: SeShutdownPrivilege	1956	chrome.exe
Token: SeCreatePagefilePrivilege	1956	chrome.exe
Token: SeShutdownPrivilege	1956	chrome.exe
Token: SeCreatePagefilePrivilege	1956	chrome.exe
Token: SeShutdownPrivilege	1956	chrome.exe
Token: SeCreatePagefilePrivilege	1956	chrome.exe
Token: SeShutdownPrivilege	1956	chrome.exe
Token: SeCreatePagefilePrivilege	1956	chrome.exe
Token: SeShutdownPrivilege	1956	chrome.exe
Token: SeCreatePagefilePrivilege	1956	chrome.exe
Token: SeShutdownPrivilege	1956	chrome.exe
Token: SeCreatePagefilePrivilege	1956	chrome.exe
Token: SeShutdownPrivilege	1956	chrome.exe
Token: SeCreatePagefilePrivilege	1956	chrome.exe
Token: SeShutdownPrivilege	1956	chrome.exe
Token: SeCreatePagefilePrivilege	1956	chrome.exe
Token: SeShutdownPrivilege	1956	chrome.exe
Token: SeCreatePagefilePrivilege	1956	chrome.exe
Token: SeShutdownPrivilege	1956	chrome.exe
Token: SeCreatePagefilePrivilege	1956	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
4168	7zG.exe
7436	taskmgr.exe
7436	taskmgr.exe
7436	taskmgr.exe
7436	taskmgr.exe
7436	taskmgr.exe
7436	taskmgr.exe
7436	taskmgr.exe
7436	taskmgr.exe
7436	taskmgr.exe
7436	taskmgr.exe
7436	taskmgr.exe
7436	taskmgr.exe
7436	taskmgr.exe
7436	taskmgr.exe
7436	taskmgr.exe
7436	taskmgr.exe
7436	taskmgr.exe
7436	taskmgr.exe
7436	taskmgr.exe
7436	taskmgr.exe
7436	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
7436	taskmgr.exe
7436	taskmgr.exe
7436	taskmgr.exe
7436	taskmgr.exe
7436	taskmgr.exe
7436	taskmgr.exe
7436	taskmgr.exe
7436	taskmgr.exe
7436	taskmgr.exe
7436	taskmgr.exe
7436	taskmgr.exe
7436	taskmgr.exe
7436	taskmgr.exe
7436	taskmgr.exe
7436	taskmgr.exe
7436	taskmgr.exe
7436	taskmgr.exe
7436	taskmgr.exe
7436	taskmgr.exe
7436	taskmgr.exe
7436	taskmgr.exe
7436	taskmgr.exe
7436	taskmgr.exe
7436	taskmgr.exe
7436	taskmgr.exe
7436	taskmgr.exe
7436	taskmgr.exe
7436	taskmgr.exe
7436	taskmgr.exe
7436	taskmgr.exe
7436	taskmgr.exe
7436	taskmgr.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
7100	Dolphin.exe
7056	Dolphin.exe
7756	Dolphin.exe
6552	Dolphin.exe
7712	OpenWith.exe
7000	OpenWith.exe
5576	OpenWith.exe
636	OpenWith.exe
6712	OpenWith.exe
5432	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1956 wrote to memory of 2412	1956	chrome.exe	85
PID 1956 wrote to memory of 4704	1956	chrome.exe	87
PID 1956 wrote to memory of 4704	1956	chrome.exe	87
PID 1956 wrote to memory of 2812	1956	chrome.exe	88
PID 1956 wrote to memory of 5560	1956	chrome.exe	89
PID 1956 wrote to memory of 5560	1956	chrome.exe	89
PID 1956 wrote to memory of 5724	1956	chrome.exe	90
PID 1956 wrote to memory of 5724	1956	chrome.exe	90
PID 1956 wrote to memory of 5684	1956	chrome.exe	91
PID 1956 wrote to memory of 5684	1956	chrome.exe	91
PID 1956 wrote to memory of 616	1956	chrome.exe	92
PID 1956 wrote to memory of 616	1956	chrome.exe	92
PID 1956 wrote to memory of 4660	1956	chrome.exe	95
PID 1956 wrote to memory of 4660	1956	chrome.exe	95
PID 1956 wrote to memory of 3420	1956	chrome.exe	96
PID 1956 wrote to memory of 3420	1956	chrome.exe	96
PID 1956 wrote to memory of 3004	1956	chrome.exe	97
PID 1956 wrote to memory of 2108	1956	chrome.exe	100
PID 1956 wrote to memory of 2108	1956	chrome.exe	100
PID 1956 wrote to memory of 4140	1956	chrome.exe	101
PID 1956 wrote to memory of 4140	1956	chrome.exe	101
PID 1956 wrote to memory of 4520	1956	chrome.exe	102
PID 1956 wrote to memory of 4520	1956	chrome.exe	102
PID 1956 wrote to memory of 5084	1956	chrome.exe	103
PID 1956 wrote to memory of 5084	1956	chrome.exe	103
PID 1956 wrote to memory of 4508	1956	chrome.exe	104
PID 1956 wrote to memory of 4504	1956	chrome.exe	105
PID 1956 wrote to memory of 4508	1956	chrome.exe	104
PID 1956 wrote to memory of 2176	1956	chrome.exe	106
PID 1956 wrote to memory of 2176	1956	chrome.exe	106
PID 1956 wrote to memory of 5700	1956	chrome.exe	107
PID 1956 wrote to memory of 5700	1956	chrome.exe	107
PID 1956 wrote to memory of 3788	1956	chrome.exe	108
PID 1956 wrote to memory of 3788	1956	chrome.exe	108
PID 1956 wrote to memory of 3692	1956	chrome.exe	109
PID 1956 wrote to memory of 3692	1956	chrome.exe	109
PID 1956 wrote to memory of 1204	1956	chrome.exe	110
PID 1956 wrote to memory of 1204	1956	chrome.exe	110
PID 1956 wrote to memory of 5012	1956	chrome.exe	111
PID 1956 wrote to memory of 5012	1956	chrome.exe	111
PID 1956 wrote to memory of 5108	1956	chrome.exe	112
PID 1956 wrote to memory of 5108	1956	chrome.exe	112
PID 1956 wrote to memory of 8	1956	chrome.exe	117
PID 1956 wrote to memory of 8	1956	chrome.exe	117
PID 1956 wrote to memory of 4368	1956	chrome.exe	120
PID 1956 wrote to memory of 5260	1956	chrome.exe	121
PID 1956 wrote to memory of 5240	1956	chrome.exe	122
PID 1956 wrote to memory of 2240	1956	chrome.exe	125
PID 1956 wrote to memory of 2240	1956	chrome.exe	125
PID 1956 wrote to memory of 5192	1956	chrome.exe	129
PID 1956 wrote to memory of 5192	1956	chrome.exe	129
PID 1956 wrote to memory of 5084	1956	chrome.exe	130
PID 1956 wrote to memory of 5084	1956	chrome.exe	130
PID 1956 wrote to memory of 4604	1956	chrome.exe	131
PID 1956 wrote to memory of 4604	1956	chrome.exe	131
PID 1956 wrote to memory of 4412	1956	chrome.exe	132
PID 1956 wrote to memory of 4412	1956	chrome.exe	132
PID 1956 wrote to memory of 5864	1956	chrome.exe	133
PID 1956 wrote to memory of 5864	1956	chrome.exe	133
PID 1956 wrote to memory of 3336	1956	chrome.exe	134
PID 1956 wrote to memory of 6620	1956	chrome.exe	137
PID 1956 wrote to memory of 7540	1956	chrome.exe	152
PID 1956 wrote to memory of 7540	1956	chrome.exe	152
PID 1956 wrote to memory of 8156	1956	chrome.exe	164

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://dolphin-emu.org/
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffb2d6ac728,0x7ffb2d6ac734,0x7ffb2d6ac740
  2⤵
  PID:2412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1680,i,4106298386471464614,4116145248677390214,262144 --field-trial-handle=1988,i,13297563366328200071,18242352343501475969,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1984 /prefetch:2
  2⤵
  PID:4704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1564,i,12676841772692590152,7759161113626936182,524288 --field-trial-handle=1988,i,13297563366328200071,18242352343501475969,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2312 /prefetch:3
  2⤵
  - Mark of the Web detected: This indicates that the page was originally saved or cloned.
  - System Time Discovery
  PID:2812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2360,i,13307180352894768895,14848516075147570331,524288 --field-trial-handle=1988,i,13297563366328200071,18242352343501475969,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2532 /prefetch:8
  2⤵
  PID:5560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3160,i,7337735720550873785,1373929518835200156,2097152 --field-trial-handle=1988,i,13297563366328200071,18242352343501475969,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3184 /prefetch:1
  2⤵
  PID:5724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3168,i,16000591622474674250,3300142004168319928,2097152 --field-trial-handle=1988,i,13297563366328200071,18242352343501475969,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:5684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4400,i,9512415127287740832,16034048604160164056,2097152 --field-trial-handle=1988,i,13297563366328200071,18242352343501475969,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3944 /prefetch:2
  2⤵
  PID:616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4704,i,4618363785588696618,11511807326473699293,2097152 --field-trial-handle=1988,i,13297563366328200071,18242352343501475969,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4736 /prefetch:1
  2⤵
  PID:4660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4880,i,3917903118206180460,11395663909323859347,2097152 --field-trial-handle=1988,i,13297563366328200071,18242352343501475969,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4744 /prefetch:1
  2⤵
  PID:3420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5684,i,8939809375337086646,14654385582561652299,524288 --field-trial-handle=1988,i,13297563366328200071,18242352343501475969,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5676 /prefetch:8
  2⤵
  PID:3004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5740,i,1528655879300189784,16755960012558011869,2097152 --field-trial-handle=1988,i,13297563366328200071,18242352343501475969,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5580 /prefetch:1
  2⤵
  PID:2108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=4756,i,1145788480830518684,7435300686941979676,2097152 --field-trial-handle=1988,i,13297563366328200071,18242352343501475969,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4820 /prefetch:1
  2⤵
  PID:4140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=3312,i,1551281145805617921,6780310974508103426,2097152 --field-trial-handle=1988,i,13297563366328200071,18242352343501475969,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:4520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6092,i,14491998496958868670,7416789604109715153,2097152 --field-trial-handle=1988,i,13297563366328200071,18242352343501475969,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:5084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=6340,i,12467005829369733486,12753277786174631954,524288 --field-trial-handle=1988,i,13297563366328200071,18242352343501475969,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6312 /prefetch:8
  2⤵
  PID:4508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6352,i,8323381631878631380,2047374104415682642,524288 --field-trial-handle=1988,i,13297563366328200071,18242352343501475969,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6256 /prefetch:8
  2⤵
  PID:4504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6676,i,13780759627619282384,12485408741553923697,2097152 --field-trial-handle=1988,i,13297563366328200071,18242352343501475969,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6644 /prefetch:1
  2⤵
  PID:2176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=4692,i,8730606557020797980,2470267789241369259,2097152 --field-trial-handle=1988,i,13297563366328200071,18242352343501475969,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4768 /prefetch:1
  2⤵
  PID:5700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=7008,i,9712301466005866568,12502958406634647999,2097152 --field-trial-handle=1988,i,13297563366328200071,18242352343501475969,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4844 /prefetch:1
  2⤵
  PID:3788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=7016,i,1541405036000126984,1384343703741831987,2097152 --field-trial-handle=1988,i,13297563366328200071,18242352343501475969,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6868 /prefetch:1
  2⤵
  PID:3692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=7156,i,12049024767641223988,16783918195315078848,2097152 --field-trial-handle=1988,i,13297563366328200071,18242352343501475969,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7196 /prefetch:1
  2⤵
  PID:1204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=7320,i,5311217899644906101,7720300815271228385,2097152 --field-trial-handle=1988,i,13297563366328200071,18242352343501475969,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7336 /prefetch:1
  2⤵
  PID:5012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=7500,i,4435162174321756464,7596354316757654036,2097152 --field-trial-handle=1988,i,13297563366328200071,18242352343501475969,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7344 /prefetch:1
  2⤵
  PID:5108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6052,i,1314213206288665544,3488150613168640403,2097152 --field-trial-handle=1988,i,13297563366328200071,18242352343501475969,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4844 /prefetch:1
  2⤵
  PID:8
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5672,i,4213727295000246789,6481566773270626146,524288 --field-trial-handle=1988,i,13297563366328200071,18242352343501475969,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6048 /prefetch:8
  2⤵
  PID:4368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5788,i,17899864763727850466,13191398000891668985,524288 --field-trial-handle=1988,i,13297563366328200071,18242352343501475969,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6688 /prefetch:8
  2⤵
  PID:5260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=7144,i,14114390203648992891,17621201253136110806,524288 --field-trial-handle=1988,i,13297563366328200071,18242352343501475969,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7324 /prefetch:8
  2⤵
  PID:5240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=4380,i,16304428854541932185,570114093311181760,2097152 --field-trial-handle=1988,i,13297563366328200071,18242352343501475969,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4512 /prefetch:1
  2⤵
  PID:2240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=4740,i,8962971417442842778,16861936936906946630,2097152 --field-trial-handle=1988,i,13297563366328200071,18242352343501475969,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7056 /prefetch:1
  2⤵
  PID:5192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=5740,i,1330053524408458431,1343451463904521729,2097152 --field-trial-handle=1988,i,13297563366328200071,18242352343501475969,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3136 /prefetch:1
  2⤵
  PID:5084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=3268,i,11710778610574691270,33560147963331685,2097152 --field-trial-handle=1988,i,13297563366328200071,18242352343501475969,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3944 /prefetch:1
  2⤵
  PID:4604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=6248,i,13132312640902082744,12353760119639003285,2097152 --field-trial-handle=1988,i,13297563366328200071,18242352343501475969,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5012 /prefetch:1
  2⤵
  PID:4412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --metrics-shmem-handle=6636,i,14015512837407249625,13729640098102261182,2097152 --field-trial-handle=1988,i,13297563366328200071,18242352343501475969,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4684 /prefetch:1
  2⤵
  PID:5864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4680,i,5540179864446040835,10506874835336885352,524288 --field-trial-handle=1988,i,13297563366328200071,18242352343501475969,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4456 /prefetch:8
  2⤵
  PID:3336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5676,i,17275153787860834211,12513269696597213410,262144 --field-trial-handle=1988,i,13297563366328200071,18242352343501475969,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6032 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=7988,i,17355134526581779709,16206835216296631004,524288 --field-trial-handle=1988,i,13297563366328200071,18242352343501475969,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1492 /prefetch:8
  2⤵
  PID:7540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --metrics-shmem-handle=7752,i,17864440681783963439,12498199308299619371,2097152 --field-trial-handle=1988,i,13297563366328200071,18242352343501475969,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5788 /prefetch:1
  2⤵
  PID:8156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --metrics-shmem-handle=3308,i,717605494829282903,10646131172001741084,2097152 --field-trial-handle=1988,i,13297563366328200071,18242352343501475969,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4504 /prefetch:1
  2⤵
  PID:4204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --metrics-shmem-handle=4592,i,18056761790234604175,4220755035565852756,2097152 --field-trial-handle=1988,i,13297563366328200071,18242352343501475969,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8044 /prefetch:1
  2⤵
  PID:364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --metrics-shmem-handle=6056,i,17289483168794760396,7372079256883644046,2097152 --field-trial-handle=1988,i,13297563366328200071,18242352343501475969,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8020 /prefetch:1
  2⤵
  PID:4652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --metrics-shmem-handle=4736,i,9512455534642181638,15375846510221806879,2097152 --field-trial-handle=1988,i,13297563366328200071,18242352343501475969,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4988 /prefetch:1
  2⤵
  PID:6900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --metrics-shmem-handle=5756,i,326888374828653899,3753104256097304876,2097152 --field-trial-handle=1988,i,13297563366328200071,18242352343501475969,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6108 /prefetch:1
  2⤵
  PID:2004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --metrics-shmem-handle=7860,i,18348533845375527455,8940803014608162439,2097152 --field-trial-handle=1988,i,13297563366328200071,18242352343501475969,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8072 /prefetch:1
  2⤵
  PID:6272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --metrics-shmem-handle=7284,i,16877259042863336450,9329631905028168582,2097152 --field-trial-handle=1988,i,13297563366328200071,18242352343501475969,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7300 /prefetch:1
  2⤵
  PID:5464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --metrics-shmem-handle=6020,i,9544222488291281650,5207534826138937394,2097152 --field-trial-handle=1988,i,13297563366328200071,18242352343501475969,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7632 /prefetch:1
  2⤵
  PID:2144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --metrics-shmem-handle=6816,i,4624548043016796777,12127112942048794715,2097152 --field-trial-handle=1988,i,13297563366328200071,18242352343501475969,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6724 /prefetch:1
  2⤵
  PID:520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --metrics-shmem-handle=6136,i,9823722654821702199,1067096047204183656,2097152 --field-trial-handle=1988,i,13297563366328200071,18242352343501475969,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7248 /prefetch:1
  2⤵
  PID:3476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --metrics-shmem-handle=7196,i,12321071632014939048,11211851859030801240,2097152 --field-trial-handle=1988,i,13297563366328200071,18242352343501475969,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7304 /prefetch:1
  2⤵
  PID:3136

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5932

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3476

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1688

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\dolphin-2606a-x64\" -spe -an -ai#7zMap24604:94:7zEvent17243
1⤵
- Suspicious use of FindShellTrayWindow
PID:4168

C:\Users\Admin\Downloads\dolphin-2606a-x64\Dolphin-x64\Dolphin.exe
"C:\Users\Admin\Downloads\dolphin-2606a-x64\Dolphin-x64\Dolphin.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:7100

C:\Users\Admin\Downloads\dolphin-2606a-x64\Dolphin-x64\Dolphin.exe
"C:\Users\Admin\Downloads\dolphin-2606a-x64\Dolphin-x64\Dolphin.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:7056

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:7436

C:\Users\Admin\Downloads\dolphin-2606a-x64\Dolphin-x64\Dolphin.exe
"C:\Users\Admin\Downloads\dolphin-2606a-x64\Dolphin-x64\Dolphin.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:7756

C:\Users\Admin\Downloads\dolphin-2606a-x64\Dolphin-x64\DolphinTool.exe
"C:\Users\Admin\Downloads\dolphin-2606a-x64\Dolphin-x64\DolphinTool.exe"
1⤵
- Executes dropped EXE
PID:6388

C:\Users\Admin\Downloads\dolphin-2606a-x64\Dolphin-x64\DSPTool.exe
"C:\Users\Admin\Downloads\dolphin-2606a-x64\Dolphin-x64\DSPTool.exe"
1⤵
- Executes dropped EXE
PID:8056

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
PID:7136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffb2d6ac728,0x7ffb2d6ac734,0x7ffb2d6ac740
  2⤵
  PID:1064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2092,i,10086066805626239163,11557342600339077304,524288 --field-trial-handle=2076,i,7484639650171228959,3600275740001639040,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:7688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1728,i,17428714326328300132,619150827944080776,262144 --field-trial-handle=2076,i,7484639650171228959,3600275740001639040,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2064 /prefetch:2
  2⤵
  PID:7808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2444,i,6936273855415051458,1742084132499878354,524288 --field-trial-handle=2076,i,7484639650171228959,3600275740001639040,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2632 /prefetch:8
  2⤵
  PID:7980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3268,i,16123588083531731501,12798330636334410442,2097152 --field-trial-handle=2076,i,7484639650171228959,3600275740001639040,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:7676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3272,i,10714977683191317755,9422874330276887424,2097152 --field-trial-handle=2076,i,7484639650171228959,3600275740001639040,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:8084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4484,i,8510377918319533359,529577567896222031,2097152 --field-trial-handle=2076,i,7484639650171228959,3600275740001639040,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4528 /prefetch:1
  2⤵
  PID:7376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5296,i,2449648328920086187,960303975985384342,524288 --field-trial-handle=2076,i,7484639650171228959,3600275740001639040,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5300 /prefetch:8
  2⤵
  PID:5188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5328,i,2764202932808561723,6646930286775246489,2097152 --field-trial-handle=2076,i,7484639650171228959,3600275740001639040,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5292 /prefetch:1
  2⤵
  PID:1216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5816,i,17842484416923011787,11394781825221112359,2097152 --field-trial-handle=2076,i,7484639650171228959,3600275740001639040,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:6368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5312,i,13631941160275796054,6631934338472164113,2097152 --field-trial-handle=2076,i,7484639650171228959,3600275740001639040,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4640 /prefetch:1
  2⤵
  PID:4412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6008,i,8084975322879820636,6787157649949323395,524288 --field-trial-handle=2076,i,7484639650171228959,3600275740001639040,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6028 /prefetch:8
  2⤵
  PID:1844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=6012,i,5269892140708886384,4955799095797443321,524288 --field-trial-handle=2076,i,7484639650171228959,3600275740001639040,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6004 /prefetch:8
  2⤵
  PID:1548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6104,i,16681005390103513206,3107373240527579872,2097152 --field-trial-handle=2076,i,7484639650171228959,3600275740001639040,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6140 /prefetch:1
  2⤵
  PID:2008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5740,i,3003955217041661405,243406416422774584,2097152 --field-trial-handle=2076,i,7484639650171228959,3600275740001639040,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5696 /prefetch:1
  2⤵
  PID:3740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=4612,i,9538049261261143459,11959435817829706881,2097152 --field-trial-handle=2076,i,7484639650171228959,3600275740001639040,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4616 /prefetch:1
  2⤵
  PID:4640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6384,i,12558001175461696271,5215768529844078574,2097152 --field-trial-handle=2076,i,7484639650171228959,3600275740001639040,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5884 /prefetch:1
  2⤵
  PID:3860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5792,i,1098025016674791969,766820815355578740,2097152 --field-trial-handle=2076,i,7484639650171228959,3600275740001639040,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6380 /prefetch:1
  2⤵
  PID:6660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6592,i,17983739208584742465,651071640098992439,524288 --field-trial-handle=2076,i,7484639650171228959,3600275740001639040,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6492 /prefetch:8
  2⤵
  PID:3336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6584,i,16238069184653366008,5331676488759082619,524288 --field-trial-handle=2076,i,7484639650171228959,3600275740001639040,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6596 /prefetch:8
  2⤵
  PID:8140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6580,i,5402756614853626146,10006668830787733492,524288 --field-trial-handle=2076,i,7484639650171228959,3600275740001639040,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6540 /prefetch:8
  2⤵
  PID:6644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6480,i,15947959133415684818,10860110324900199753,2097152 --field-trial-handle=2076,i,7484639650171228959,3600275740001639040,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5908 /prefetch:1
  2⤵
  PID:4040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=5876,i,3045444014772091135,12725843520584946746,2097152 --field-trial-handle=2076,i,7484639650171228959,3600275740001639040,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6268 /prefetch:1
  2⤵
  PID:468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6664,i,8756387040225262943,10433273697411017281,2097152 --field-trial-handle=2076,i,7484639650171228959,3600275740001639040,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6376 /prefetch:1
  2⤵
  PID:5664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=6336,i,11334863302201267485,373576931070581630,2097152 --field-trial-handle=2076,i,7484639650171228959,3600275740001639040,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5980 /prefetch:1
  2⤵
  PID:7408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=6556,i,10321366055613651188,14811895856725711433,2097152 --field-trial-handle=2076,i,7484639650171228959,3600275740001639040,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4540 /prefetch:1
  2⤵
  PID:6456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=5808,i,5716765740018097570,14327565067710909914,2097152 --field-trial-handle=2076,i,7484639650171228959,3600275740001639040,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5968 /prefetch:1
  2⤵
  PID:5780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6504,i,2507312916351737714,17252299174796686077,524288 --field-trial-handle=2076,i,7484639650171228959,3600275740001639040,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6808 /prefetch:8
  2⤵
  PID:7000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=6900,i,17128153711213095770,7589127261850161894,2097152 --field-trial-handle=2076,i,7484639650171228959,3600275740001639040,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6824 /prefetch:1
  2⤵
  PID:5832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5908,i,2008364836077103828,16978394538385686226,262144 --field-trial-handle=2076,i,7484639650171228959,3600275740001639040,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4620 /prefetch:8
  2⤵
  PID:5848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=5856,i,18393718216182802962,237677433566323568,2097152 --field-trial-handle=2076,i,7484639650171228959,3600275740001639040,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6560 /prefetch:1
  2⤵
  PID:1972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5808,i,15129505153176713311,6568415783395610591,524288 --field-trial-handle=2076,i,7484639650171228959,3600275740001639040,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6912 /prefetch:8
  2⤵
  PID:5764
- C:\Users\Admin\Downloads\VC_redist.x64.exe
  "C:\Users\Admin\Downloads\VC_redist.x64.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5956
- - C:\Windows\Temp\{869EF2BF-171F-418F-A92E-29839A80DAFA}\.cr\VC_redist.x64.exe
    "C:\Windows\Temp\{869EF2BF-171F-418F-A92E-29839A80DAFA}\.cr\VC_redist.x64.exe" -burn.clean.room="C:\Users\Admin\Downloads\VC_redist.x64.exe" -burn.filehandle.attached=584 -burn.filehandle.self=720
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:8156
  - - C:\Windows\Temp\{F50FBC82-5317-44CA-A7BB-7C6201A94C0E}\.be\VC_redist.x64.exe
      "C:\Windows\Temp\{F50FBC82-5317-44CA-A7BB-7C6201A94C0E}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{C6641B3C-064B-4C3D-84F2-2FA185CA9C1A} {AFE92738-BD4D-40EF-A244-A96D31E4312C} 8156
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:3852
    - - C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={0e3bb569-69d6-4c34-bff9-c2f81db5e5f0} -burn.filehandle.self=1100 -burn.embedded BurnPipe.{9B230C90-518D-49A9-8909-2AC18F61D538} {8FDAFBBB-28EE-4AD2-8114-3C75BB303536} 3852
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2260
      - C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=544 -burn.filehandle.self=564 -uninstall -quiet -burn.related.upgrade -burn.ancestors={0e3bb569-69d6-4c34-bff9-c2f81db5e5f0} -burn.filehandle.self=1100 -burn.embedded BurnPipe.{9B230C90-518D-49A9-8909-2AC18F61D538} {8FDAFBBB-28EE-4AD2-8114-3C75BB303536} 3852
        6⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:4752
        
        C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{DA2860A8-ED08-44BA-AC06-55BA6373601C} {88DA3F5B-9218-401A-9764-040999F11139} 4752
        7⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3788

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4000

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4520

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:8052

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
PID:6160

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
PID:2588

C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe
"C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe" /burn.runonce
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2448
- C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe
  "C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260814121948.log"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4264
- - C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe
    "C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe" -burn.filehandle.attached=520 -burn.filehandle.self=540 /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260814121948.log"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:2420

C:\Users\Admin\Downloads\dolphin-2606a-x64\Dolphin-x64\Updater.exe
"C:\Users\Admin\Downloads\dolphin-2606a-x64\Dolphin-x64\Updater.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4400

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\dolphin-2606a-x64\Dolphin-x64\build_info.txt
1⤵
PID:1212

C:\Users\Admin\Downloads\dolphin-2606a-x64\Dolphin-x64\DSPTool.exe
"C:\Users\Admin\Downloads\dolphin-2606a-x64\Dolphin-x64\DSPTool.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5444

C:\Users\Admin\Downloads\dolphin-2606a-x64\Dolphin-x64\DolphinTool.exe
"C:\Users\Admin\Downloads\dolphin-2606a-x64\Dolphin-x64\DolphinTool.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2748

C:\Users\Admin\Downloads\dolphin-2606a-x64\Dolphin-x64\Updater.exe
"C:\Users\Admin\Downloads\dolphin-2606a-x64\Dolphin-x64\Updater.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:6864

C:\Users\Admin\Downloads\dolphin-2606a-x64\Dolphin-x64\Dolphin.exe
"C:\Users\Admin\Downloads\dolphin-2606a-x64\Dolphin-x64\Dolphin.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:6552

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:7712

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
PID:6472

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:7000

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:5576

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:636

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:6712

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:5432

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e603467.rbs

Path C:\Config.Msi\e603467.rbs
Size 19KB
SHA256 52d18f69706c0a8753af9241cd216d5d1e896d965ee69568963e50605343698c
MD5 afc4949b0dff820559064dbf3b560f30
SHA1 658014d26ba175adec3e9a2062d589363ab97b76
SHA512 af4ab772ce2f55928baeba0390dc36234ca1503b7326fd0cbadc80848fdb94485e9692aeaedc1d315ef7f30106abba0517830101962987d668926e0c7e221861
SSDEEP 192:WeRs1kR815dXcFUADIc1L+W+y4+agPuY97:WeRs6R8TeC81L/c097
TLSH
T160920D426680C9E3D8766B30CD631B693B76DBD5A350438B50DC94708F93BCA2F9D68E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e603473.rbs

Path C:\Config.Msi\e603473.rbs
Size 19KB
SHA256 8c8db2b50316950c84caafc40091f0b228d28747f890daeeb89c03ad12049494
MD5 cd998cc3a6ea78a2d871db03ebebe1c2
SHA1 10955d83631c6e46769f76b6dc218feef2bc16b5
SHA512 df68d5a9adabca8be7a463727390074e4cbd92ce61a52702ba0d3e8a33b284cebb2b668775c05e4266ac4c39947e275783ea59b618d4e34a6a7d3e9da43de896
SSDEEP 384:pVhpsucPI+wHORW6NrhiIR9J34J3jrP2F:pVhpsucPI+wHORW6NMIVWTCF
TLSH
T1A9922E01BA44C5E3D4A62B30EE5B27243B35D7D9A721674B84DCC1308F877C5AF9E68A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e60347a.rbs

Path C:\Config.Msi\e60347a.rbs
Size 21KB
SHA256 bb64b9a41f101cbf720a59b9237a5a23d67e8b17c1c3eb51dabbf7fedfa3c12f
MD5 597a5e856669d36ae698f73519ac1f42
SHA1 fd4df7082ff898a0153ad7b45daa76c14266a2a7
SHA512 f7ced360ad817fbe80b1a040abd343bc53487d9acf945d994bca25d87b679b2a400fbaa9a954d6698cbb60a4e9a5389e21c49cc734a46827a74f7eac5d078041
SSDEEP 384:pERZGR1nAKxNAUhUC7xJjrMNYPVIbS/y4wzSeZCbAJnkP:p4IJAKhCsX
TLSH
T1FCA20C03768099E3D86227B1CD671BA93B73D7D99354434B10ACD1384F633C72F9AA9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e603489.rbs

Path C:\Config.Msi\e603489.rbs
Size 21KB
SHA256 278d453be95cdc2d36f00d520f398263b95ed4b587fa10505d0ba04a612cd8e0
MD5 e9a96cfee43f6599b98a7257959fea11
SHA1 1007a289e4338148d4f75aa5496cfc75e54ab753
SHA512 27c698267e3dc602b4b41fadaaf0964004c53650c7e539ff339690ed77d02b92d52fb335215f30c2e841aadf916de36cf48b9f0bd87abc309af53cb088431404
SSDEEP 384:44OphE89gMipMzZjr4/mUBsalckU72eC6JKK5saMgXJu4JuC6cesUp:44OphE89gMipMzZ3umUFKiatFP6c/0
TLSH
T180A2B802BA049593D8A72B70DD9B1B543BBAD3D99791534B04CDC0305E837CB2F9EA9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 5a8e6ff32f6bb6427cc0998fb314ff95032429cb54b3783865bbb1b06bf3a624
MD5 265e8a637128e13bedd26cb6ea29215a
SHA1 506e234cbc82bb4f90f406f0de318dd61285d40f
SHA512 bd40a74648a5cf88b68bad0eb66885aaf33cc08534b9d26f2fe7ee59d19dd0e4778b4ea0a1c80b6e6a5af14c3c6d0bdde483ecce38be9f60002d94f04ba83a6f
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 ae48875364d88757a8c0fe4f09b63186aa5ff2dbd4694d1bc13271fca539fac8
MD5 05e56b99152605f1fa1bac621beaa6af
SHA1 b267eda8110f05a7b19898e069fabc83c73f3edc
SHA512 74856bf28e3d6b9f4fb864373f91c5505280fba6633d61d7ebb05785ab8c1b918594e486fa45f77090e03ebeec1174b90151104e5fdaa53103ba6d56d835d1e9
TLSH
T1B6E022AAC962EC370CFD272DA094074AFB5513573A40858B3E3CA9198FB563A4396C5C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 81f4cbc27a14f58ef0f5c8eb462bf0a0ddb4eec2a7face94137e5a1b649fee72
MD5 6e84fdb348910fe6d7b7394b612e7117
SHA1 693df7037455ca3f471f220f12568bf53cf314b1
SHA512 c56d65589503963ff1c54c9bcef16cf4a76762f706d02af98d589e245d98b85fd7099299adff0c088a724b2d95ef00b697471808f53bef7533199cf41068e3bb
TLSH
T10751EB17F9DABC29DFC4A5B688CA4C28367DE64A0E130F9B63825C35A467FE5C01D106
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 4da1cdf0ac08db5e907c7c9b8fc9f1cecef8a95d16a5b3af8d89f8192ae655ad
MD5 8efeef3d4b05018f361b7f3116fb3ac0
SHA1 4a57a269498d9b0c7cc107fa387c9e244b13d6be
SHA512 40b22272f33313d70cfa0448d38b673ddf3cb1068ce334568f870c82c9a197e242611e4bc3d846e638be65bd83c0f830e931d7a85585fa3225436d9af1dd5b7a
TLSH
T12C712D06E9DB7C66CF85F4B68AC65C2960BED49B0A070FBF13824C386577EE5801D229
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 d860b6ffd8768d30a45cb9f86d2e6f5108a5c7d85fefeb8c9483c54131043eee
MD5 0f7535057df954a6e76ce9b22e261364
SHA1 b84f343ceb3971e8c3fa62a5ef977a4e81bc7af5
SHA512 fb60412a8c5293a2a70bc3938fb5a68899a33adf2c9eae906efa29f14012275b3cf4fc79ae49137c2610c4ff4eab2210cf687a4f2d62e5a7abfd556eefad52cb
TLSH
T15D613007F8CABC2ADFC5A5B588C68CA9217DE64B0A030FDB63C15C30A177EF5841D019
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\File System\000\t\Paths\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\File System\001\t\Paths\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.aliexpress.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 24KB
SHA256 f308eb43d805f9851c2d77f92b527f367a5d33b96f493c8cdc2782071587b3b4
MD5 6d71432e46fa417b7e1a73e8eb076eb4
SHA1 28e8a7c0922649767256b2210336d9adf6b33f39
SHA512 6d4cde70bf813d0d67e69860eb3478b19ad66302544e9b23daa03aa1265d64d27432169ee7ba8e4addd9a47a5d01ccd3bc6b9ac0ae06fde76c4f6c8ccb1fb607
SSDEEP 384:DQVk0uitJJHWVW7j5JqLXxZ2U/nOj/o8zcEwkXvQ+aanrDSZcDaNSfqBTGMFIREk:K9VU0Y7KmXLDD+
TLSH
T190B2ADF783A4862DD91256F0AB146E1FCE6D0828432C7DB6C9E5AE1B93E3472E14174F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 25KB
SHA256 8cb0870ac5483fd866aa22ee5cdf4a6d2d3699bf5489b7f7a3314c38ceeaf355
MD5 da729525212a7edf12d8489c092e763a
SHA1 f0af1f5b9bb059130dab574bd64c1da5e4880c28
SHA512 aab309040daa77c4db2b0f7a2c1facabcc6017a5497ed1abc693413561116e91bebcb1876475b53878d5dca842ad4fdc1bf02f99d16bffbb9d4dac9a285aa446
SSDEEP 384:DLiQe8TqqJMxwVHNnJswHDAhhx0i2XwQV2Faanii8dyDJPcDaNTfqBTcMFIREBVP:dv4dYlKmI4so
TLSH
T1B3C2CEF7C3E4862DD802A6F4AB146E1BCE6D0928432C3D66CDE5AE5B53E3471D24168F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 24KB
SHA256 e99c43ea7ace318dae735b530d1aa88caaf80d8f9889bcbdc8951ba3680a2f74
MD5 87763dcb527ee30287b277031561b77d
SHA1 9a6a4f2df1421aa7967e3b39ab1d0c18288e08de
SHA512 4ce45e13a0410518b30f9f074d72acd12976cf9270dbfb6b9869236c6cb3beaceb302b967b56eb51d57c2367e0fbd2a562bcb33e602e6520fb97d1ce7f51ace8
SSDEEP 384:DQVk0uitJJHWVW7j5JqLXxZ2U/wnOj/o8zirPeXTaanrDSZcDaNSfqBTGMFIREBI:K9aA0Y7KmXLEWw
TLSH
T19DB2BDF783E4862DD91256F0AB146E1FCE6D0828432C3DA6C9E5AE1B93E3472E14174F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 3KB
SHA256 66b4c636051756a30d79d8906bf40d3f1a182f8c8cd10fe790838d078f355f45
MD5 dc37a92133c2fa4a7f6f55355884cd39
SHA1 124d3af9621189365f28f066416cc6f2948aca2f
SHA512 8c3b0534a22eb34e75595c914da3b65bcafc321c2ee847545a4e69e78f8bf8c56fb4bd511b8d2d3a64a5732433bf1bc4554815ccf737bd7f752669430c73cc69
TLSH
T12E719EA7D2BDB46B607D69AB1E09FC0929BAA432019364F0DF5741ACB0D09F707534B7
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 16KB
SHA256 69755b18e4baf8c5b17cf6b6bcb8eee0bc4bdc5f36df9cedf0064a18020eb3f6
MD5 521bd333ef5b8e4050a44c0081df4204
SHA1 812ef4146ef2599e758b9b7a9c424027ce8d5481
SHA512 361c53625b0b5bd68b7e6d749b63602c41f06a6f84eeece3743144554190f60db3dd1d3daec27139416795560ef37622c73ed7eeda574375026b894b800d473b
SSDEEP 192:cR0cBnxomvJ6Llv77hp8PRpCq0kfDRr3UPq4Oo92Hsb+WN+T06CnIPE3EiWV16Wg:cR0mnxjQLVvh4XS3QwbwmG2xspE
TLSH
T15A72B85BA5202DBB9DEBE226F811BB1BE3F0206561D01E84FBFCC92C14D7ADD2117506
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 18KB
SHA256 cca92ed26c0d8a3211dc5fcfc3316d96f9db3ce13f02fc4d90dad01958ea1daa
MD5 2eb7d9a1ddb6b5b727d4dfe46efc4651
SHA1 b81c110382bcfc51d747519aeadcb5609783db42
SHA512 85c291a2a783df1382b2ae7f4e9ba2b34df0196fc8d5fbfbf9f5df70ebdbe7deb2955a7d5d095316fe2868c669524129e21747b22524f1e1f432b07cc9b00001
SSDEEP 384:OR0mnsjbyKvh4XH1Vd/GNQwT4+7oGjucqmjoO2JsKe:nmnsSmh7QwT4+7oBU
TLSH
T1FB82965BA4602EBBDDE7E22AF811BB1BD3F4206165D05E84EBFC8D2C14D76DD3112906
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 c976ebde1c77803e774fef82ab46041d77a18a8dadac7ca6b3da1304f761c3a0
MD5 85ac5587b0e98c6e6886af3b80f2f2bd
SHA1 91939913330073bb9e46365a657d3de93d559831
SHA512 b79542d2cb3668812f01c735b8d770546e39fed6097741042625c8322e6f8927b3703c61c7c70c7ab8e739dfae469693b80c1d1a8bd1e6837754bc3a5cd4cc2c
SSDEEP 192:cR0cBzhAmvJ6ulv77hpAPRp2FaTv4D92Hsb+WNqriWVPr+H72W6EpVMrVyIsnAUp:cR0mzhrQuVvhUX8QwUVO2ps0e
TLSH
T13352D66BA92039BB9DD7E22AFD517B17D7F0102121E41E84EAFCC92C14E76CD2227507
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 17KB
SHA256 9913092a9081a4e9d317b3b6ce2e5a95a3dafacd7e9d95bfe8889e820ae95451
MD5 73609aa34e47c86663bb5110829b689a
SHA1 649d4aa034aab6831d92a59c440308cd73aafbc9
SHA512 3f3db569f83e0a4c641a51ac0771ea188e2759f9f41682888d81c510c4338f949fbd0eb494fd90acf91bb068629494dd8246437f492b9bbc6c34befc22982adc
SSDEEP 384:sR0mnxjbyZvh4XSfQwTadHjnp9rO2usKe:9mnxSphDQwTglH
TLSH
T17C82A66BA5602DBB9DE7E22AF811BB1BD3F0206161D05E84EBFCC92C14D7ADD3117906
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 567f4a6e76b240e3faefed1f2a708c805c0325d146619dcadd2cb8c7900986e3
MD5 4738376b56658e3cc7ee320d62b16267
SHA1 3828325316a34aea7547bc6b1a0af373e5c400c9
SHA512 278820c2bf71ccb5938b02ba729232e84c5ce398b5f2f11baad4e80a927c448340dfd4250e62ab5c6d3f8353dc45ad5ef3abe5358245d71b5c4f94b3632ae3d3
SSDEEP 192:cR0cBnxomvJ6elv77hp8PRpCqVd0Dkr0nq4O892Hsb+WNMKiPlPE3EiWVPr+H72L:cR0mnxjQeVvh4X9kQwWVO2/spE
TLSH
T11F72A5ABA5202DBB9DEBE22AF811BB67D3F0206165D01E84FBFCC92C14D76DD2117506
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 c291f243da4e0ea3383beb816cac9a63cb75b78e2d438a1f5171863604c98c72
MD5 6536cee45627c06db242b0429b314b90
SHA1 d96b4da20d8f28ab6162323f548d94f6a7a8510c
SHA512 535be914cb933b47794a851c3b35edb31d2a7cc9ea6c9b2767d96c9ac47c98d6bbe3f322a0956e52a1cbe9a28a727c7eec43301703fdf6c6221ea1354f238fca
SSDEEP 192:cR0cBnhAmvJ6ulv77hpAPRp2FaTbB4D92Hsb+WNNPE3EiWVPr+H72R6EpVM+VyI4:cR0mnhrQuVvhUXaQwlVO24sPE
TLSH
T19452C66AA92039BB9DDBE22AFD517B17D7F0106121E11E84EAFCC92C14E76CD2227507
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 17KB
SHA256 6f0957ddf9f2bbf22413bb2908e48766ed73f6009edbfe923c7fd1aded149991
MD5 12c3b1b123f6f30d1d3d05dc63c84417
SHA1 f386ce655a07977b416b0c118778f99cdf9c9b2e
SHA512 3ba2d6265be5fb5c14d66cc86ee404dc0b5049c2942e72c64b6f3ae97dce6d1978777b62b8b686216bbc1378334b3bf875957c07a0c309107955e0ab1a1bbf1f
SSDEEP 384:OR0mnxjbyZvh4XH1KGNQwT4+7o9o6qmrO2xsKe:nmnxSphuQwT4+7oX8
TLSH
T12282A49BA4602DBB9DE7E226F811BB1BD3F4206160D05E84EBFCCD2C14D7ADD3116906
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 86625ab47e1d831ce92fa0bfc598cef5b11c75b94bdecc70e26538df5905800c
MD5 bbb4aaa7216420ec985416a668245447
SHA1 c2b5172754a64a24db31b96dc3233891f5f794c1
SHA512 e04c27235c43f0ef4ebc93581743597fec2476a1e8bedd91bfde6c3c2c52214220adf9c81c71f0d428ee1e401a6a824b31fc64df2ee50261cc9a431c6e33baaa
SSDEEP 192:cRkhAmvJ6ulv71hpAPRp20z92Hsb+WNniWVPr216EpVMrVyIsnAUge:cRkhrQuVBhUXhQwTV28s0e
TLSH
T18642D62AA910797B9DDBE22AFD627B53D7F0102531E11E84EAFCC92C14E75CD222710B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 32d32c2aff297f15bd0615336b32dae29c6fe6c3ae39d9ab8a1739493ca6efa5
MD5 cc484146c89d9e67e7b92f17c8ebccbe
SHA1 3117e5c83531dd7506c440c7c3b92d322d6f4784
SHA512 f52572b47b65982d91a18a6ff30128f6b28c3c87daeb4496e8ce346a2ea40c24ec5ddaae6323a84f35e802d0c6fe9732ae666a4564f653973daa7412eeebef58
SSDEEP 192:cR0cBnxAmvJ6elv77hpAPRp2qVd0Dkr0nq4O892Hsb+WNMKiPlPE3EiWVPr+H72W:cR0mnxrQeVvhUXpkQwWVO24sPE
TLSH
T14362A5ABA5202DBB9DEBE226F811BB27E3F0206161D01E84EBFCC92C14D76DD2117506
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 17KB
SHA256 78b86fd2b8a31c7881788a1a3718d40d008b7546615ac2064017f25151940de9
MD5 c5ddcec17f6d129f95dd0de44fe735a1
SHA1 6a880518f64535184954036150ae80f7ee0f61bd
SHA512 8c253e4bce7706231d8a9bdb5e457d7744af538d351577c714be2d9922f1681e583c758408569292be6600cee1961d26c312d25a745a1b7f7b8b678b5e0d2750
SSDEEP 384:OR0mnsjbyZvh4XH1Vd/GNQwT4+7oXucqmjxO2YsKe:nmnsSph7QwT4+7ofZ
TLSH
T1C182959BA5602EBBDDE7E226F811BB1BD3F4206261D05D84EBFC8D2C14D76DD3112906
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 17KB
SHA256 257d5fc384f0ceb784edb197754d6e3ffae1e72867d10dafb36b9ced371269d0
MD5 2b743f4fc398bf064841fac15a157e01
SHA1 2c7c5e488c43396350f5f15ffd451eee07555fa0
SHA512 c27a24380e644e3bc9b6bcf7192af242b5a246f66bd8d9268a9befb40c7be3f837d4b0ae63931cfdb99e7d19ef2aee7bbebf633bd605b3a23aabcffc12b5901d
SSDEEP 384:ORHmnsjbyZvh4XH1Vd/GNQwT4+7oXucqmjoO2qsKe:+mnsSph7QwT4+7o8j
TLSH
T10182955BA4602EBBDDE7E226F811BB1BD3F4206165D05E84EBFC8D2C14D76DD3112906
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 3d3afaa1601dd94afbddfc3bc67deaa6f8882b4ea2c56b7516b75aecd98b4951
MD5 11f5289a3f5bd32865d5dd47026e9cdd
SHA1 6bbd16c8e823645f5e5633c5fdf55be00ffc4d0f
SHA512 0d2730afa17531f77b9f2e4b1e5a44502ba4ac3e3ca5ae0c9b778e154199cfa0fb6fd114b0464698a005a6bedfc7e19c4116a7796f3b7eccfeb97dd55a48d0f5
SSDEEP 192:cR0cBnhAmvJ6elv77hpAPRp2qVd0DkT0nq4O892Hsb+WNMKiPlPE3EiWVPr+H72W:cR0mnhrQeVvhUXpEQwWVO24sPE
TLSH
T10962A5ABA5202DBB9DEBE226F811BB27E3F0206565D01E84FBFCC92C14D76DD2117506
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 18KB
SHA256 f5cce5f9bb222b3c2053a360bf4dc7fbd18bd758ec08172b26214434d13cd474
MD5 87304e143443bde59cbbbb781684280b
SHA1 773b52622b6977694d2cec99048c88e72d8b27b1
SHA512 8e750d066d237802a4ac02aacbdbdf350067e1d6d29cbfebc82404461b46a476c18643e02ea89f9fc35d3a260369641a8ad9f522fec61239e6c87c8e858fe8df
SSDEEP 384:OR0mnsjbyKvh4XH1Vd/GNQwT4+7oR7ucqmjoO2IsKe:nmnsSmh7QwT4+7oGJ
TLSH
T1CF82A55BA4602EBBDDE7E226F811BB1BD3F4206265D05E84EBFC8D2C14D7ADD3112906
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 c54836683d23f9fee57c69a9d42002f448a01bbb5b6b38437c5fcac9744adcc4
MD5 97aacfb3977979cfbf9d8a6c4d36d689
SHA1 28c462804fa985bea43aac67e658ae60025ec226
SHA512 ac229055b177234c91f43061b9900ff41ba000713f4120fbf08cb18c16d47d484d5415a198c6f1896335d53e2a7e2f4dc407a06b90151f49d9994124c8990d05
SSDEEP 384:+wjKJ7KxkXqKf/pUZNCgVLH2HfgslU697pLuLcSjwxXODKh+ErU3wZJHG/A1YTPB:+0KJ7KxkXqKf/pUZNCgVLH2HfgsG697U
TLSH
T192720A676C488E770F94C68CEC177F4FADB5024B65E9886483FA982903D5BCF11462EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 bf6f74ec9907dd3c20af70be931c9baa4025d17e47f96b2fc0e920b5a5b0c6a1
MD5 b660d7b18524902d59a642f887051141
SHA1 38303c6afb70c62098241c521aafd00790e34cb6
SHA512 a232b1ff2d8710f2c6a85ff8331422b7daebe69d6b6cde27b25ef03fa009fc88313bb5a7cd9d783c8ee377cdf29f83822f077ed33f460ed13310105ea072f200
TLSH
T157B0120080225902C44303B41142259D71189F259F0B570143F07922DC251618118050
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58e191.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58e191.TMP
Size 96B
SHA256 d2959b4a2943938cd9f81c4acc2d1bbe77f93d1a66ca445c72d78145f69ae83a
MD5 68c0c7e658009e3d5d37cc90448fbc53
SHA1 a309923b984c7257eb2d45a4471d7645dd698418
SHA512 4f7aeaa9675f52b8c9e270b9990504ac976e3da09bdef1c3d77b585869951d1210fa9236c30838861ca40f79b84e38568e025d53e4583c4a8f7e2b8af03222f8
TLSH
T1A1B02208C2023A02C00203B0308280FA3020CF22C3032223C2E02A32CCA023008280A0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 b7719248acc6ea879fe3fcf3136370a4fe84691bd66bda73cf92709fa709b641
MD5 6136802e6db9bf71ee465b112efc4ee2
SHA1 36bf6878fd41d661e0276c30e4961b2ab459a116
SHA512 127d3319049bb35be79ecbc994196fcf9b6d0958a4d3010c17f65073d9286cf0105327461a23e3ca624f07cd0f9abfc99c2e7a00c7160f4c729af84cd646c9aa
TLSH
T13CB00215C6541D5ED219637390D20FD533328D9822835243D5A58B6698206406DE981A
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 0257a50b3502b7075b2a6ebf729187bd1f134caac1e57c37a10e69deff5ebd43
MD5 e8153e0656e773f59da19715951c354b
SHA1 c870c34e719430f2a1fc11899c6a93b70e52552a
SHA512 b9e6ab49721d367863a05017011cf53d1faad956b854651b9dac06074b759cdf0210db9459686d1a532d5c8d3f1db28357e686b17444b8e1b24b5edb9fb389ab
SSDEEP 3:MsEllllkEthXllkl2zEkzS+//:/M/xT02zzz7//
TLSH
T1AC440414FFD01415C50070714311D3D00774F4D005555FC334D70C135CC5D551C04300
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 117KB
SHA256 e563f3815606a6fb20c7ce2dc1fdce2b3f7ebc7d4075867b0a40e14f09083e1f
MD5 4586e71dae9e7751e87cef10eab0d7e8
SHA1 a0b504020156537554d3eb1d47c5358f3c811b6a
SHA512 fce0ed3dc566cd0e6e94624fb2ace5d7a4c141e891c0a93a0d8e29ef2dddd2aa3510ba9cae9d9cc384524c96d7272a21b3808a80cbc90cd571a8525c7f3b14c3
SSDEEP 3072:w7Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrM3:wim7Rkm1tYpBeh2BAo3
TLSH
T1B0C3123B4D75A8375DB9BB0EB08E0B1F1EF14AA7C8209E52C8D86A0423FD7CC1A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 151KB
SHA256 2c3c75022669db6ff950f23fa89dcb92078af3a4b99992f4dbc5d5d0e4ddd5ed
MD5 4f9b17ce8172ee055e838a9bb1e29e65
SHA1 a8a442c60ad0b170829809f294687eb5b3f6672e
SHA512 99d9012c953727b6074aa1e6a00b38a06c849b64cbe2d906fefce3dffcca338bfcb996d770922225a73de75f7f6d570214ffcac2c87e36b6e8d0bca8854d0b1c
SSDEEP 3072:epG3x+3Op+RGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM3:Dvm7Rkm1tYpBeh2BAo3
TLSH
T10CE312671DB8AC335E78B36FB64F0B1F1DF1496298345647C8E46F042AEE7880A56A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 117KB
SHA256 0084ef810a57f7f9562e6fe25913351abedf3f49546baad71a860baf0ea0efbd
MD5 98d306cd688c5f31f9371024a4f84bdb
SHA1 115b0e0c0e98ddede13b64e8d1dae5b655932325
SHA512 e2caf6aa8a203c2f7785a34cf8d963a1b1c509eb2b62251eec3eb0cefaef457fafa607b43d21819183ee1d7d16523aed2c28804bfcc9ba04d532cf286654c603
SSDEEP 3072:27Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrM3:2im7Rkm1tYpBeh2BAo3
TLSH
T1BAC3123B4D75A8375DB9BB0EB08E0B1F1EF14AA7C8209E52C8D86A0423FD7CC1A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 273KB
SHA256 0a5e143ada2b8ce1ac3773c76a90f093092df43022dac87c295a68ad3a343d6d
MD5 90906b1241b8a97257aa71d2d5f342ad
SHA1 01d5d5f2a41940522113d2f6a1ae43b98337610c
SHA512 64d58e095a4f93cdf7975f890fa6283a8754326bb1dbb455736ea0d46de746f26fafee98a20dadc74faa3aac72303c70f860e189464533c5ae2a22d17877cd92
SSDEEP 6144:2xNSaAKIZbPCHFSg6F0m7Rkm1tYpBeh2BAog:CSKIZcFSg6F39oBGcAog
TLSH
T17D5423976D7C5D390E2DA25E7B4A0A0B1DF108939438466BCCE46B053BDA7EC0636F38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 273KB
SHA256 cb367144dacd7f4530aff16e89032959ab38fac338492a4607694a4c9aa47de6
MD5 caa60a8e10c8af658b92412f26fe3cca
SHA1 b8e988b2b185638c636a8041431b10cc59381304
SHA512 8a1812dabf00af748101dd1d3fa730ed1f15f2fc1a6d14db141b52b28ea811ff304ab954a7ea7a21f94294070749c1c5967edd28eb9b014fbc8cfa6b0b700f06
SSDEEP 6144:txNSaAKIZbPCHFSg6F0m7Rkm1tYpBeh2BAog:nSKIZcFSg6F39oBGcAog
TLSH
T1F25423976D7C5D390E2DA25E7B4A0A0B1DF108939438466BCCE46B053BDA7AC0636F38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 275KB
SHA256 7e11d03d98492d144196acc2bd9cc057aaa10a73df7616a1e0370f8d0583038c
MD5 ab81fadf6ab61ea36acf8e235d5720e8
SHA1 2356febaa5a6d97d61f4a311df0004016effe1ed
SHA512 685328db01a003dcce02eb8fba5ecdf99e4152de4493f83ac3d14db1e6d44bbfd0cd6b8e223f0155f6331d4242e3ce8f27696a6d57c59cd62d3fe26f78975061
SSDEEP 6144:G9NSaAKIZbPCHFSg6F0m7Rkm1tYpBeh2BAog:aSKIZcFSg6F39oBGcAog
TLSH
T1285423B76D3D5D390E39624E7B4A0A0B0DF15993A438861ACCE86B0537DA7EC0636F34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 240KB
SHA256 b5b6b683733c56d9479828a497dc0610660fe45c91a38f6d87bbde26044087b3
MD5 0931dd2269f9a0765c7466334cd1d6c0
SHA1 d86dd555ade7d45a2d34cf8c99f43a5263c59c3b
SHA512 f01c2d55a81f212a989495e5e7a826976da3306e5ecb4f6217cf04cedd315187c4a439157d4b07dc42f7bdaf7f1780ab8d164a4b2bcda4b4b906890ade9326a7
SSDEEP 6144:mNSaAKIZbPCHFSg6F0m7Rkm1tYpBeh2BAog:mSKIZcFSg6F39oBGcAog
TLSH
T1D93423377D396A3D0E7A664D764D490B0DF119E3A428CE25CCD86A0937EA7EC0625F34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 4a9d0235d8256006caa2505792c5490764750ec20bfe46df87e659a796aebbb7
MD5 1d0f30eb94c91e936dc2ad9ec3a5a84b
SHA1 c02e47860ee1efa3b6c194446d29f96f3a95b176
SHA512 ed749a392d2474a59564ed7376c05a4a292193308a04c72f99d53b9ed2ffeb187a4611487374c6ceeecf71cf8fa10b6f72f456d0129ed65900b47bc3d493d62c
SSDEEP 3072:7Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrM3:im7Rkm1tYpBeh2BAo3
TLSH
T166C312275E71A9375D79BB0EB08E0B1F1EF14AA6C930DE92C8D86A0437E97CC1A05934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 a386a05442e755daf24094696882adc90f757117e755a15d7a25995607489ea6
MD5 6b11f06390f8dabf3611b2dc2e8beb17
SHA1 b420af89b3ddcc30c4da377af344fc9a6220a1b9
SHA512 abceeb322ab6db6b43de38b75691a7c7598ac166426f96ace98e66bbd4de23decb509ae9cb49e7ccbeaf944224e74cc727d3028a9c7a979b28ef613de1ec7449
SSDEEP 3072:P7Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrM3:Pim7Rkm1tYpBeh2BAo3
TLSH
T151C3123B5D75A8375DB9BB0EB08E0B1F1EF14AA7D9209E92C8D85A0427ED7CC1A44934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 3fec74aeead481a2625c729d250200cb0b0a6ffd29b1273f8343244e14ffc902
MD5 580849d97a2edb965fc701968e086413
SHA1 44c59ffa5c1e191b835bab4b76047c6641595c83
SHA512 3feebeed2b9a086e08699ae4b659fd7663969066544354b6b9ded994a4e4409f11b5fb31e92e257d5aaab9b45a39b79b3a87b5a855d7ba03003126d5a993401b
SSDEEP 3072:2Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrM3:Bm7Rkm1tYpBeh2BAo3
TLSH
T1AAC3123B5D75A8375DB9B71EB08E0B1F1EF14AA7C820DE92C8D45B0423EA7CC0A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 273KB
SHA256 9138e455a2c1407dde2f07e77dc20a428887e404869001d52b9e96caefa2a076
MD5 a23367c551010735580a76d7d0362f5d
SHA1 cbae80e89cd1218e9d212ca54c24dc4574b213ab
SHA512 cc46f208495ddc62f5e69fe32245082a7eb5ca6c359feffe63dc7f3a422024cd6f722c2f7ee6535f8feacf1cc1eee6adec2359336abe3512eb47992f6eea4dfe
SSDEEP 6144:cxNSaAKIZbPCHFSg6F0m7Rkm1tYpBeh2BAog:wSKIZcFSg6F39oBGcAog
TLSH
T1E95423976D7C5D390E2DA25E7B4A0A0B1DF108939438466BCCE46B053BDA7AC0636F38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 240KB
SHA256 868b2c843cf93be8ab8e8b980010b72dc8edc89173e5d5167b0bbb72adf29263
MD5 932769e8c0b804ff693ae83d1963e73c
SHA1 147343be8ea4d622b1554d4badbee347d04964e4
SHA512 aa82ad20e50c37f8b7b73b9b65553b9d6216a1e7b979502be98ff83e20cf1133b77c1cc0c7929fb35a9ec5f1944b6efbeeff5905cf7ea45a179eaa3c783947e9
SSDEEP 6144:tNSaAKIZbPCHFSg6F0m7Rkm1tYpBeh2BAog:tSKIZcFSg6F39oBGcAog
TLSH
T1D43423377D396A3D0E7A664D764D490B0DF119E3A428CE25CCD86A0937EA7EC0625F34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 ce4cdf8cd30289e6bd1d304837e2fc52f845879c94be853c21948842c030a21a
MD5 4d5e8390212dad6f0114437c3388f3b0
SHA1 6f7cf73cf68ceb59e4a192c51f655ef8df9bf49f
SHA512 d71585f7455470985e6247ca14b46ad2b658db763040333eff6719ec69b0c34795ff4d028fa0a0cbb3f12241ba00c3dac9396ba1c938f60e92853035dc97f800
SSDEEP 3072:UGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM3:Xm7Rkm1tYpBeh2BAo3
TLSH
T1B4C312375D75A9375DB9B71EB08E0B1F1EF149A7C920DE92C8D45B0423EA7CC0A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 117KB
SHA256 40974cd53942a885cb34db88a7c22d2be8bfce7178769062ea1ed574f040399e
MD5 4a592c00b1d9530d6a1207504c47829a
SHA1 fc6a088b03fcc5de49c430a9d24ce8cfadd2d85b
SHA512 affc7c064a69b98d6e143b480719e090a010603afd8fbb2f2171eb798bb16905515f233e3b324a82aba7f38d2c8553dd80f47948b2fd769c8aa26086d443beaa
SSDEEP 3072:z7Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrM3:zim7Rkm1tYpBeh2BAo3
TLSH
T163C3123B4D75A8375DB9BB0EB08E0B1F1EF14AA7C9209E52C8D86A0423FD7CC1A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5d696d521de238c3.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5d696d521de238c3.customDestinations-ms
Size 8KB
SHA256 342836cd09f10c7555da17bca55b0b3b864ebe064af8005a5e2c7259bf4df408
MD5 feeda6331123580cc019989ea30e86d8
SHA1 fe27f3c394022bd4d617b49372d56ba22c08df2f
SHA512 5ca25e005e87f59ce9bd7f7a4ec63d868386255f2ece118af09ed1c7ac394f84849d6a2f8179900b9a5ce8b6e15d5f725a8240f86ee20a24b3d585b6aad09a20
SSDEEP 48:m2d9b5RzJuZeVMTZUkUx1MKqeVMKpBVc2d9b5RzJLM3ANtc2d9b5RzJLM3ANtV28:mKbMCFkqMvKQ1KQMKSrKg4W
TLSH
T1A802C90527FB2655F0F78A32B8727B119F3BFC028E559A4E61C0834A0DA5B16599CF3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5d696d521de238c3.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5d696d521de238c3.customDestinations-ms
Size 6KB
SHA256 50abbdb8343576bbfc7faf1a8763db85be363c6a6418d3201162b23329d28d26
MD5 de100c1a1966e9e077b28a8e1f866920
SHA1 f9fae84d07b14e423bc29b10f826f27d7598ab1f
SHA512 1707714d096534483a29ebc47234ea6b36d8959bb5a07c642e273b8cee76e38dc80cb940684d6dd43b0a8444b06f2ce0703ab5d78b56ca901f9b908d4ab1a442
SSDEEP 48:d2d915RzJLM3ANt02d9b5RzJLM3ANtt2d9b5RzJ6dAKR+/KRXlpB2d9b5RzJgud0:d8QNKQEKSrKg4W
TLSH
T180D1AD0527FB2659F0F3CA32A47277119F3BFC028E558A9E61C093860DB5B12555CB3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unconfirmed 373724.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 373724.crdownload
Size 17.9MB
SHA256 843068991daaa1f73ad9f6239bce4d0f6a07a51f18c37ea2a867e9beca71295c
MD5 8da7373f3ec287fe1c3ad72a7b2922f0
SHA1 46adcdfbe9aebe767657b7a802cc366f827ced77
SHA512 c42c82cfd5eaa2165b600f6109cb14ff4308cdf4cff656a1375b4a933f1630bfe54c99c4d0fb9ed3bea4dc4e4fdaa3db8e7c58356cca07c2954f4c297757d62d
SSDEEP 393216:rCpQ/hbBWGW1tkWSz61gUM0SOm53TgypRvlxoMtBpMw4OrW:rCpQpbQ1tBj1gR0SP53tRvlLpM2K
TLSH
T133173332A4742132F6F16437F968F1307E3CA72863D09D99D3C8AD99396488267F725B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dolphin-2606a-x64.7z.crdownload

Path C:\Users\Admin\Downloads\dolphin-2606a-x64.7z.crdownload
Size 18.0MB
SHA256 4c58045f9821cb63913f4df08ea86ece3cdda9f9e646154516000fa1547e0c37
MD5 4a8cbaf9f6f2f1077721f920829ef8a3
SHA1 3b4e240f6dca2cec7f17b313398a9166400f2c20
SHA512 f265a9ca5580c52c0d9fd6ba7a0fd9258292338338da5a1075f79e6e3a916fb314d00d4b2a9f4f6aec70e946701815619ef4b80c8c30b3c40ec055698674fda1
SSDEEP 393216:3SmCnckpr/3lamsBkPvDMWai1eCPEEpEFOygH1uIecezhFoWPcPq2LUwo:Bopr/kPBknDMWT1eCzP83cezhFzES7
TLSH
T1BB1733503E6F3F69B358904602B603AC6476920BF6B064BEE6485F03CBE87BDE744576
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DSPTool.exe

Path C:\Users\Admin\Downloads\dolphin-2606a-x64\Dolphin-x64\DSPTool.exe
Size 259KB
SHA256 3463505fe999ac7048d7bbcc6b9982b0b89e21673469b827942e5b74cd100532
MD5 b1678c7ebff20c9033afdc657524eb40
SHA1 a746e710ac745bc02f404d7e1bf531e3c0e18fc5
SHA512 907caf61bd4e990547a2923d005ab5ae41b86c7c0b022cc1fdcd8de3482487bbcd4fc0da2c80f9c651170cc2637a553de7d3ce917b0cb4322d5d2e7ba8c70f8e
SSDEEP 6144:g4M6pz7AG7wCNosnW5mtSYhJNCRO2UOt0f7v3Jr2:EMz7AG73ltSYcROv7x
TLSH
T1B4444B3A7B451CE8DDBAC1BDC642CA41E771BC460390EBCF179149961E27AE4AE7B301
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dolphin.exe

Path C:\Users\Admin\Downloads\dolphin-2606a-x64\Dolphin-x64\Dolphin.exe
Size 21.7MB
SHA256 d2bc0da070540c31227d934b75903005c96f30ac1d200cfe65e7d85783a0efce
MD5 45211e9f25719dc51ce5a74cc00d2ca7
SHA1 52b68f8efbc2f7527679ab78c723779c1ef5b451
SHA512 14c3494386d714e51ebd477f62ceed997cfae40016a8c3c630b68db04d5a4e5b022bc9a170edf5b6964e072286a1b0fff6c13577d3d0d34e30962d5c4fc05e0f
SSDEEP 393216:mRz+APhheT9DJcZoWQAuBNXDrhsE3XtQzHtC3cvjUHpH+O7DcS12:GzVPh+I8YG2
TLSH
T10637AE6A72A140E8E07BC0B9CA569957F7B1385A03306BDF15A057B62F3BBE01D3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DolphinTool.exe

Path C:\Users\Admin\Downloads\dolphin-2606a-x64\Dolphin-x64\DolphinTool.exe
Size 11.2MB
SHA256 98f0a7d2e711eeb53a3504d453eb970f4178e48dcb4c745e3d8fa24d8d90a6bc
MD5 04a4e2ffee682f01056206b59f5f7bd1
SHA1 cc73c5de4103510c3493705bb9910c18d1d3e41b
SHA512 353c5049e8fcc70039620d21e29856ca896c3481055afb9445566bc54f1fd48cc2f5d7aa15e652b6dacea517a4a7d8b8eb44b72f0d182c466174f2e48b776e3e
SSDEEP 196608:s+QZkiUobDIiKyMChAredEuAPCKHjT49oXF5dT7yf5E1XhwW8:sZkijfjKyMChAredEuAPz49oXF5dT7yn
TLSH
T117C6AE2672A541ECD0B7C078CB629957F7B1384903206AEB66E066692F33FF45E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

it.mo

Path C:\Users\Admin\Downloads\dolphin-2606a-x64\Dolphin-x64\Languages\it.mo
Size 361KB
SHA256 ea30348b28e6bd93428bed7790b6b4e019c03edc9ac39c3cb87c02cc503dbaab
MD5 5297cf61e4cc4b7c79975869d868bc51
SHA1 6579ebd2acbe8267b22f9839e80598824ea485a1
SHA512 dbd65cb5680e8a6745d7ea96f745547002c3e69002390ee408f7c0201c15eff5a86b9ba8a91e3daee82503b1c0abda3fba7e25dd27e5dfec70286ec28edde94c
SSDEEP 6144:v2kKaRtwuVXG+uE/iRjlugVVXgZhCNeY/bcl3xF8M3c3t8tI:7uF
TLSH
T151745A7F95C01A31D833037B99627855BB39D4DCB7109318506D522C32EF898ABAFBAD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt6Core.dll

Path C:\Users\Admin\Downloads\dolphin-2606a-x64\Dolphin-x64\Qt6Core.dll
Size 5.7MB
SHA256 21cc245c29b673e49e7fc7c606510aed4eeb52cd92668288997d89409914825a
MD5 210eb8868000270a4b6526d029b439fa
SHA1 882f984e5f4a6019ad999580f71cf1d3dad91bda
SHA512 326cab5145798483795895372d87a87fb32e0e2b1fc96b725010085b126d462dfaa456871495ef1b6e91c712f109db362ef974d73a0f771b7f60628cec222880
SSDEEP 98304:pmWItZze/ETd510XKFdu9CwJsv6tSkI/3pVPT:4WItZzoEX12KFdu9CwJsv6tSkI/3pl
TLSH
T125568D5362FA0051D8BAC139CA6B9603EBB37C1643219BDF01A4A6156FB3BF5193F325
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt6Gui.dll

Path C:\Users\Admin\Downloads\dolphin-2606a-x64\Dolphin-x64\Qt6Gui.dll
Size 7.2MB
SHA256 fb3eacd5c99a9de5b51ddb676c9c02675640164cc23432f7c24356d04a2ad108
MD5 a821ebb82335187a4c14421a29c2ed78
SHA1 a14b17c24f2c3a05c2c3943d6b584450c6db5f0f
SHA512 ae1339146dcbf08f2939a30629577a582b206dc3b5c9732472de7077bdb84f09212737af7018cda41652c1e0b1c2d77d8aedbbf237baf04779278e586589b07c
SSDEEP 98304:b38y4MF3MN0Veq0+xC6lixS0GzXBKqkvhkbpY:L8y4MF3MNdV+c6llkO
TLSH
T10D768D57B3E911D8C47BD13D8B9B8517E7B2705503229BDB02A48A593F23BE12ABF311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt6Widgets.dll

Path C:\Users\Admin\Downloads\dolphin-2606a-x64\Dolphin-x64\Qt6Widgets.dll
Size 5.8MB
SHA256 afb9b6d440aa36ca55951c13cd912a17ff9f2ba0fa9d4254351d40dff3826018
MD5 4d3af12226571e84d41bd78aaad0db2e
SHA1 547c95fcd8d1cca207df5834f2cd1cf19ffbaf49
SHA512 15bdd7789b5a3184e3bf9d261362d4c73915d17aea97f28f35e171e9009b22eed8c4269963aaac7134513dba83c6d345a5c4cd28d3df6cb022d1aaf8f11e8c7b
SSDEEP 49152:PyqFICD32S8isl1F7qNy3g5g+czOX/lihxx9zl/bo6Xoq2g0q7X3QC35aeNjmajT:oO6XH2g0q7X3TPj1ZDrln7T/5kN
TLSH
T1CE567C8773E90199C5ABD13CCB4B8A13EA72744543228BDF02698A592F737F11E7E364
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qdirect2d.dll

Path C:\Users\Admin\Downloads\dolphin-2606a-x64\Dolphin-x64\QtPlugins\platforms\qdirect2d.dll
Size 810KB
SHA256 67ae3e6a62301b5f348c026e112100cc44019e4266c0fe50e25fd5468bcfd879
MD5 8503ac739e36713371727793f28aa8f4
SHA1 c2ae21a6e76f54360e3c4e40eb95304b3de0489f
SHA512 a96434c47398c7f2e56c1b876eb7dcab82ed8a99af746deb4f44ad6938909c00f2de8b4ab5875e4af4cb20d149ec9ddbd3083a1d539d4e164f42315ea08ed1c2
SSDEEP 12288:Ysub2iQgeq+Ejp4CUqYdSNPDdk9d1iWqETYO8sM:buSiQgeREt9UqQSNPm9dI6YOP
TLSH
T1FC055B1BA7BC0285D47FC13D874B8A26EBB3701013929BCB4161CA59BF377D2297AB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qwindows.dll

Path C:\Users\Admin\Downloads\dolphin-2606a-x64\Dolphin-x64\QtPlugins\platforms\qwindows.dll
Size 739KB
SHA256 6a90bd2bccb77f736745c76a1c5a29845e261925b1914d5bf8c6da633cdb715b
MD5 4c2916e02850bfefe935d3c42bf966fe
SHA1 d8a3f21cf179f8dd68b0daaad7ca1580ac125ef1
SHA512 55edcd09cf4f7c7faab451159ec4b2a714d6cd5e4b67b9efcc9ab6e0f8f41a1ee38e22cd84b73a6e016f56f95137f518d33cdebfaa2879fdc4c2af31eaa4a5e6
SSDEEP 12288:JqwhgcWGrFAqtckqQNLejn/N6FGbvGW8SPK3oeJz1EZPwKj:lhgcnGqtckqQNLerN6Qb/nC4e+wK
TLSH
T15EF43A56ABB80285D46FC13E874BCA16F7B3741003928BCB4161CE6A7F337D22A79B55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qwindowsvistastyle.dll

Path C:\Users\Admin\Downloads\dolphin-2606a-x64\Dolphin-x64\QtPlugins\styles\qwindowsvistastyle.dll
Size 135KB
SHA256 650723e3165d68dbf82e56e779c873b2bf337d8c61e17cc1b8d35e7cb0ff0125
MD5 a94b6933c7509e362d17d7133b3fcbbc
SHA1 c4928d2bba464dfdefe54905d99778fec374717d
SHA512 971b5ff775813b681529b2c452b4de2682c57cd717a909c048c32d049debbba6fa8205caff7502511fe4fa5f073a58c4acc55749f85525e6b6c8f3be0d078136
SSDEEP 3072:s6Ym2tUq5rkgsjwErER4v1zSfdOXWQNiOYJNti4TH6JkIJO4edTxiRk:BgUqj2wcERcc+YVi4TH6uIJO4edViR
TLSH
T1ADD31943729612D2C527D2B8C6AF0213E773706503169BFF05A6CAA42F532D6BE3E791
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qt.conf

Path C:\Users\Admin\Downloads\dolphin-2606a-x64\Dolphin-x64\qt.conf
Size 32B
SHA256 a0bc182fdf815d9b42602057077e4a25ef94f9c2fea0518569da7439c97a0d0f
MD5 bf55d7b6dcc1915558d09b9bd3274059
SHA1 9b04a925b9f67b95f51cfba689735ead558b4232
SHA512 13166645988165927e01727dbe7285ea93f27c57ee4bd4320d1bce35513b2e0e6a7965a184c506814de0836bc5c2d2f63aacd01626ec2a9b58f02a9c95b9bc59
MD5 SHA1 SHA512

Submit Download

desktop.ini

Path C:\Users\Admin\Videos\Captures\desktop.ini
Size 190B
SHA256 86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
MD5 b0d27eaec71f1cd73b015f5ceeb15f9d
SHA1 62264f8b5c2f5034a1e4143df6e8c787165fbc2f
SHA512 7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c
TLSH
T11EC0121892F93224A1728D12BD7460119AB1F4217C16CA9D1380508F08A1601E631B53
MD5 SHA1 SHA512 TLSH

Submit Download

e603474.msi

Path C:\Windows\Installer\e603474.msi
Size 208KB
SHA256 bab5d0257e6a18a4a008e683442e3077b38172dd61af3cb1c588b46724a714e2
MD5 929579267bee38006631f56eff1d4366
SHA1 1bda1592ce7edca6c30421c2c8a00ba3ddf448d8
SHA512 ea52b41f16c06a53e1b9f8d2d4268b2dfaf89968bfd97e033f13bd26ee44bfb3e6b377c873900224ab6e4e3b0b7dcb5037ae0f46c77d3afd6266b4f1dffac44d
SSDEEP 3072:K9laht5Xel69YGnfxC2WB/bEPcefrKROjibDPxriTE:0laZeKFxCnBheIdlu
TLSH
T1F324AF12B5808033DAFE1A350578DB615F3DBE608E544A9B6364B6AC1E717C0CF36AB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wixstdba.dll

Path C:\Windows\Temp\{83A2AC18-959F-4D59-A701-3AA3ABD5E995}\.ba\wixstdba.dll
Size 215KB
SHA256 e921f69b9fb4b5ad4691809d06896c5f1d655ab75e0ce94a372319c243c56d4e
MD5 f68f43f809840328f4e993a54b0d5e62
SHA1 01da48ce6c81df4835b4c2eca7e1d447be893d39
SHA512 a7a799ecf1784fb5e8cd7191bf78b510ff5b07db07363388d7b32ed21f4fddc09e34d1160113395f728c0f4e57d13768a0350dbdb207d9224337d2153dc791e1
SSDEEP 6144:K6EZdi6e93SuDeTKZxQfsRy26BqbUHYJe:K62i6eNSYeuZ2sRDK
TLSH
T15E24AF12B5D0907AEBFB19305939E5216DBDBA210FA0C9CE5348AD2B2E705C1DB36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logo.png

Path C:\Windows\Temp\{F50FBC82-5317-44CA-A7BB-7C6201A94C0E}\.ba\logo.png
Size 1KB
SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
MD5 d6bd210f227442b3362493d046cea233
SHA1 ff286ac8370fc655aea0ef35e9cf0bfcb6d698de
SHA512 464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b
TLSH
T1CF312CF34748B7A7D30581351471819AD242FFD8F9CE291E35CD5307664018115C75CF
MD5 SHA1 SHA512 TLSH

Submit Download

VC_redist.x64.exe

Path C:\Windows\Temp\{F50FBC82-5317-44CA-A7BB-7C6201A94C0E}\.be\VC_redist.x64.exe
Size 615KB
SHA256 dbcc159853d8b83c1df0a0a698127ab98e926af1b6dee86e96f541dc94b34948
MD5 2de7a2a87f61fd6ead5276047feaf36c
SHA1 d9a03aa94dfb0f485a9fd281d89d2edd499408f7
SHA512 ea8dac8d0cf79b2d8302a4405ba2d44be8dbca316038d90f19bce6d0760685105771e87b1e905ff58e6ee10e154ec9ad6c00fc575dd8c82ea4eed856fb5569ac
SSDEEP 12288:73mgqnIZuYfCYqFet4CovkM7RVYnE2EwCeYG1LM7d:73WnIZuMCxezot7rgd4e2d
TLSH
T1AAD48D32A5614033FBF105B3B928A6303E7CE728275188A9D7D4BD1D7EA84C1A7F7256
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2260-6768-0x0000000000190000-0x0000000000207000-memory.dmp

Download

memory/3788-6765-0x0000000000190000-0x0000000000207000-memory.dmp

Download

memory/4752-6767-0x0000000000190000-0x0000000000207000-memory.dmp

Download

memory/6552-6798-0x00007FFB03800000-0x00007FFB03DCC000-memory.dmp

Download

memory/6552-6799-0x00007FF7FAF00000-0x00007FF7FD8DA000-memory.dmp

Download

memory/7056-5927-0x00007FF7FAF00000-0x00007FF7FD8DA000-memory.dmp

Download

memory/7056-5926-0x00007FFB09D10000-0x00007FFB0A2DC000-memory.dmp

Download

memory/7100-5889-0x00007FF7FAF00000-0x00007FF7FD8DA000-memory.dmp

Download

memory/7100-5891-0x00007FF7FAF00000-0x00007FF7FD8DA000-memory.dmp

Download

memory/7100-5890-0x00007FFB09D10000-0x00007FFB0A2DC000-memory.dmp

Download

memory/7436-5940-0x00000297CC540000-0x00000297CC541000-memory.dmp

Download

memory/7436-5938-0x00000297CC540000-0x00000297CC541000-memory.dmp

Download

memory/7436-5937-0x00000297CC540000-0x00000297CC541000-memory.dmp

Download

memory/7436-5936-0x00000297CC540000-0x00000297CC541000-memory.dmp

Download

memory/7436-5932-0x00000297CC540000-0x00000297CC541000-memory.dmp

Download

memory/7436-5931-0x00000297CC540000-0x00000297CC541000-memory.dmp

Download

memory/7436-5930-0x00000297CC540000-0x00000297CC541000-memory.dmp

Download

memory/7436-5939-0x00000297CC540000-0x00000297CC541000-memory.dmp

Download

memory/7436-5942-0x00000297CC540000-0x00000297CC541000-memory.dmp

Download

memory/7436-5941-0x00000297CC540000-0x00000297CC541000-memory.dmp

Download

memory/7756-5955-0x00007FFB093F0000-0x00007FFB099BC000-memory.dmp

Download

memory/7756-5956-0x00007FF7FAF00000-0x00007FF7FD8DA000-memory.dmp

Download