hxxps://www[.]mediafire[.]com/file/vzvch0zt8futtu8/lupa[.]zip/file

Analysis

user interaction
yes
max time kernel
1799s
max time network
1787s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/09/2026, 15:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.mediafire.com/file/vzvch0zt8futtu8/lupa.zip/file
Sample260907-tb657azflf

Score

8^/10

adware defense_evasion discovery execution persistence ransomware spyware

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Executes dropped EXE 64 IoCs

pid	Process
3976	node.exe
5528	node.exe
4804	node.exe
1620	node.exe
7160	node.exe
7008	node.exe
7020	electron.exe
2584	electron.exe
5992	electron.exe
6320	electron.exe
5784	electron.exe
804	electron.exe
1848	node.exe
5728	node.exe
2548	node.exe
1208	electron.exe
5816	electron.exe
4636	electron.exe
7028	electron.exe
6372	node.exe
1124	node.exe
1268	node.exe
2536	electron.exe
3464	electron.exe
7116	electron.exe
6376	electron.exe
4164	electron.exe
6748	node.exe
2720	node.exe
4560	node.exe
2680	electron.exe
1652	electron.exe
1876	electron.exe
3356	electron.exe
2116	electron.exe
1084	electron.exe
1096	node.exe
1420	node.exe
4636	node.exe
4056	electron.exe
4792	electron.exe
1392	electron.exe
7076	electron.exe
6168	node.exe
4980	node.exe
6684	node.exe
3884	electron.exe
6584	electron.exe
5524	electron.exe
4864	electron.exe
4768	node.exe
4420	node.exe
6060	node.exe
6540	electron.exe
3904	electron.exe
3104	electron.exe
4060	electron.exe
5980	node.exe
6384	node.exe
2416	node.exe
3076	electron.exe
3452	electron.exe
2172	electron.exe
5868	electron.exe

Loads dropped DLL 64 IoCs

pid	Process
6868	MsiExec.exe
6868	MsiExec.exe
1544	MsiExec.exe
1544	MsiExec.exe
1544	MsiExec.exe
4708	MsiExec.exe
6788	MsiExec.exe
7020	electron.exe
2584	electron.exe
5992	electron.exe
6320	electron.exe
2584	electron.exe
2584	electron.exe
2584	electron.exe
2584	electron.exe
2584	electron.exe
5784	electron.exe
804	electron.exe
804	electron.exe
1208	electron.exe
5816	electron.exe
4636	electron.exe
7028	electron.exe
5816	electron.exe
5816	electron.exe
5816	electron.exe
5816	electron.exe
5816	electron.exe
2536	electron.exe
3464	electron.exe
7116	electron.exe
6376	electron.exe
3464	electron.exe
3464	electron.exe
3464	electron.exe
3464	electron.exe
3464	electron.exe
4164	electron.exe
4164	electron.exe
2680	electron.exe
1652	electron.exe
1652	electron.exe
1652	electron.exe
1652	electron.exe
1652	electron.exe
1652	electron.exe
1876	electron.exe
3356	electron.exe
2116	electron.exe
1084	electron.exe
1084	electron.exe
4056	electron.exe
4792	electron.exe
1392	electron.exe
7076	electron.exe
4792	electron.exe
4792	electron.exe
4792	electron.exe
4792	electron.exe
4792	electron.exe
3884	electron.exe
6584	electron.exe
5524	electron.exe
4864	electron.exe

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
310	6456	msiexec.exe

Drops desktop.ini file(s) 4 IoCs

description	ioc	Process
File opened for modification	C:\Users\Public\desktop.ini	explorer.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	explorer.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	explorer.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	explorer.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\nodejs\node_modules\npm\lib\utils\allow-scripts-prune.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\promise-spawn\LICENSE	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\undici\lib\web\eventsource\eventsource-stream.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\lib\commands\trust\github.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\man\man1\npm-pack.1	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\hosted-git-info\lib\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\npm-packlist\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\tinyglobby\dist\index.cjs	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\undici\docs\docs\api\RetryHandler.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\undici\lib\dispatcher\pool.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\lib\commands\root.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\lib\utils\update-workspaces.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\tuf\dist\target.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\cacache\lib\verify.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\diff\libcjs\util\array.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\lib\utils\auth.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\protobuf-specs\dist\__generated__\google\protobuf\any.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\balanced-match\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\iconv-lite\encodings\tables\gbk-added.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\pacote\lib\util\trailing-slashes.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\tar\dist\esm\make-command.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\lib\utils\explain-dep.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\lib\utils\installed-shallow.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@tufjs\models\LICENSE	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\json-parse-even-better-errors\LICENSE.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\npm-registry-fetch\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\man\man1\npm-whoami.1	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\package-json\lib\normalize.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\sign\dist\util\oidc.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\diff\libcjs\patch\parse.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\negotiator\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\src\win_delay_load_hook.cc	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\spdx-license-ids\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\undici\lib\api\api-connect.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\lib\cli\exit-handler.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\debug\src\browser.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\lib\cli\entry.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\git\lib\make-error.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\glob\dist\commonjs\ignore.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\archy\examples\beep.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\balanced-match\dist\commonjs\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@tufjs\models\dist\utils\oid.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\gyp\docs\InputFormatReference.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\gyp\pylib\gyp\generator\ninja.py	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\undici\lib\web\fileapi\symbols.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\content\commands\npm-outdated.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\output\commands\npm-profile.html	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\protobuf-specs\dist\__generated__\sigstore_verification.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\gyp\pylib\gyp\input.py	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\lib\utils\npm-usage.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\lib\utils\validate-lockfile.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\make-fetch-happen\lib\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\socks\docs\examples\typescript\associateExample.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\query\lib\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\protobuf-specs\dist\__generated__\google\protobuf\timestamp.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\sign\dist\util\ua.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\iconv-lite\encodings\utf32.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\validate-npm-package-name\LICENSE	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\validate-npm-package-name\lib\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\metavuln-calculator\LICENSE	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\diff\libesm\convert\dmp.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\lib\download.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\corepack\shims\yarnpkg.cmd	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\arborist\bin\license.js	msiexec.exe

Drops file in Windows directory 19 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSID85D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{DC5BBE4F-0668-40DC-A913-83710DA79E35}\NodeIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1336.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF98D7AAAB123BB88B.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF4B625A354955093A.TMP	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{DC5BBE4F-0668-40DC-A913-83710DA79E35}	msiexec.exe
File created	C:\Windows\SystemTemp\~DFF7B99AFDDA75CACF.TMP	msiexec.exe
File created	C:\Windows\Installer\e5bc531.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICB5B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICDDD.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDF44.tmp	msiexec.exe
File created	C:\Windows\Installer\{DC5BBE4F-0668-40DC-A913-83710DA79E35}\NodeIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\e5bc531.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\SystemTemp\~DF51B719B5CB544753.TMP	msiexec.exe
File created	C:\Windows\Installer\e5bc533.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1970.tmp	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 28 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4180	cmd.exe
6948	cmd.exe
2136	cmd.exe
760	cmd.exe
5916	cmd.exe
4584	cmd.exe
4660	cmd.exe
3100	cmd.exe
2396	cmd.exe
908	cmd.exe
1548	cmd.exe
4732	cmd.exe
720	cmd.exe
1688	cmd.exe
5292	cmd.exe
3172	cmd.exe
1532	cmd.exe
3832	cmd.exe
2104	cmd.exe
2644	cmd.exe
3524	cmd.exe
5620	cmd.exe
6680	cmd.exe
1736	cmd.exe
6296	cmd.exe
704	cmd.exe
7112	cmd.exe
5140	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1696	chrome.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000cb7618cb91d4c6300000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801cb7618cb0000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101cb7618cb000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3cb7618cb00000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6cb7618cb00000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Control Panel 1 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Control Panel\Colors	electron.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe

Modifies data under HKEY_USERS 12 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134332701108234852"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\4\NodeSlot = "7"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell	electron.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\NodeSlot = "5"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\SniffedFolderType = "Pictures"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg	electron.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	electron.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "843"	SearchHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F4EBB5CD8660CD049A313817D07AE953\EnvironmentPathNpmModules = "EnvironmentPath"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F4EBB5CD8660CD049A313817D07AE953\Version = "403963904"	msiexec.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3 = 14001f481cffcda87848be43b5fdf8091c1c60d00000	electron.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\SniffedFolderType = "Pictures"	electron.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}\Instance\	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell\{43FED747-B357-468E-AE70-EE0CB0F46508}\IconSize = "48"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F4EBB5CD8660CD049A313817D07AE953\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F4EBB5CD8660CD049A313817D07AE953\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F4EBB5CD8660CD049A313817D07AE953\corepack	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F4EBB5CD8660CD049A313817D07AE953\npm	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F4EBB5CD8660CD049A313817D07AE953\SourceList\Net\1 = "C:\\Users\\Admin\\Downloads\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3	electron.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4	electron.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F4EBB5CD8660CD049A313817D07AE953\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	electron.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}\Instance\	electron.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	electron.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F4EBB5CD8660CD049A313817D07AE953\PackageCode = "539C581DAB7CFD548971340E7636557C"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F4EBB5CD8660CD049A313817D07AE953\SourceList\Net	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202020202	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F4EBB5CD8660CD049A313817D07AE953\NodeRuntime	msiexec.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 02000000030000000100000000000000ffffffff	electron.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\SniffedFolderType = "Downloads"	electron.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	electron.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell\{43FED747-B357-468E-AE70-EE0CB0F46508}\LogicalViewMode = "2"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F4EBB5CD8660CD049A313817D07AE953\SourceList\PackageName = "node-v24.20.0-x64.msi"	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	electron.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell\{43FED747-B357-468E-AE70-EE0CB0F46508}\FFlags = "1092616193"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	electron.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	electron.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 02000000030000000100000000000000ffffffff	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell	electron.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3986082593-3624157295-3514260330-1000\{2772E35D-106F-46EB-B341-0852D7364B1A}	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F4EBB5CD8660CD049A313817D07AE953\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{885A186E-A440-4ADA-812B-DB871B942259}	explorer.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4272	explorer.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
6036	chrome.exe
6036	chrome.exe
1716	msiexec.exe
1716	msiexec.exe
804	electron.exe
804	electron.exe
4272	explorer.exe
4272	explorer.exe
4164	electron.exe
4164	electron.exe
1084	electron.exe
1084	electron.exe
1884	electron.exe
1884	electron.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
5784	electron.exe
4272	explorer.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
824	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 64 IoCs

pid	Process
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1352	chrome.exe
Token: SeCreatePagefilePrivilege	1352	chrome.exe
Token: SeShutdownPrivilege	1352	chrome.exe
Token: SeCreatePagefilePrivilege	1352	chrome.exe
Token: SeShutdownPrivilege	1352	chrome.exe
Token: SeCreatePagefilePrivilege	1352	chrome.exe
Token: SeShutdownPrivilege	1352	chrome.exe
Token: SeCreatePagefilePrivilege	1352	chrome.exe
Token: SeShutdownPrivilege	1352	chrome.exe
Token: SeCreatePagefilePrivilege	1352	chrome.exe
Token: SeShutdownPrivilege	1352	chrome.exe
Token: SeCreatePagefilePrivilege	1352	chrome.exe
Token: SeShutdownPrivilege	1352	chrome.exe
Token: SeCreatePagefilePrivilege	1352	chrome.exe
Token: SeShutdownPrivilege	1352	chrome.exe
Token: SeCreatePagefilePrivilege	1352	chrome.exe
Token: SeShutdownPrivilege	1352	chrome.exe
Token: SeCreatePagefilePrivilege	1352	chrome.exe
Token: SeShutdownPrivilege	1352	chrome.exe
Token: SeCreatePagefilePrivilege	1352	chrome.exe
Token: SeShutdownPrivilege	1352	chrome.exe
Token: SeCreatePagefilePrivilege	1352	chrome.exe
Token: SeShutdownPrivilege	1352	chrome.exe
Token: SeCreatePagefilePrivilege	1352	chrome.exe
Token: SeShutdownPrivilege	1352	chrome.exe
Token: SeCreatePagefilePrivilege	1352	chrome.exe
Token: SeShutdownPrivilege	1352	chrome.exe
Token: SeCreatePagefilePrivilege	1352	chrome.exe
Token: SeShutdownPrivilege	1352	chrome.exe
Token: SeCreatePagefilePrivilege	1352	chrome.exe
Token: SeShutdownPrivilege	1352	chrome.exe
Token: SeCreatePagefilePrivilege	1352	chrome.exe
Token: SeShutdownPrivilege	1352	chrome.exe
Token: SeCreatePagefilePrivilege	1352	chrome.exe
Token: SeShutdownPrivilege	1352	chrome.exe
Token: SeCreatePagefilePrivilege	1352	chrome.exe
Token: SeShutdownPrivilege	1352	chrome.exe
Token: SeCreatePagefilePrivilege	1352	chrome.exe
Token: SeShutdownPrivilege	1352	chrome.exe
Token: SeCreatePagefilePrivilege	1352	chrome.exe
Token: SeShutdownPrivilege	1352	chrome.exe
Token: SeCreatePagefilePrivilege	1352	chrome.exe
Token: SeShutdownPrivilege	1352	chrome.exe
Token: SeCreatePagefilePrivilege	1352	chrome.exe
Token: SeShutdownPrivilege	1352	chrome.exe
Token: SeCreatePagefilePrivilege	1352	chrome.exe
Token: SeShutdownPrivilege	1352	chrome.exe
Token: SeCreatePagefilePrivilege	1352	chrome.exe
Token: SeShutdownPrivilege	1352	chrome.exe
Token: SeCreatePagefilePrivilege	1352	chrome.exe
Token: SeShutdownPrivilege	1352	chrome.exe
Token: SeCreatePagefilePrivilege	1352	chrome.exe
Token: SeShutdownPrivilege	1352	chrome.exe
Token: SeCreatePagefilePrivilege	1352	chrome.exe
Token: SeShutdownPrivilege	1352	chrome.exe
Token: SeCreatePagefilePrivilege	1352	chrome.exe
Token: SeShutdownPrivilege	1352	chrome.exe
Token: SeCreatePagefilePrivilege	1352	chrome.exe
Token: SeShutdownPrivilege	1352	chrome.exe
Token: SeCreatePagefilePrivilege	1352	chrome.exe
Token: SeShutdownPrivilege	1352	chrome.exe
Token: SeCreatePagefilePrivilege	1352	chrome.exe
Token: SeShutdownPrivilege	1352	chrome.exe
Token: SeCreatePagefilePrivilege	1352	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
6456	msiexec.exe
6456	msiexec.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
6556	sihost.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe

Suspicious use of SetWindowsHookEx 43 IoCs

pid	Process
3448	ShellHost.exe
6456	msiexec.exe
1716	msiexec.exe
6868	MsiExec.exe
1544	MsiExec.exe
4708	MsiExec.exe
6788	MsiExec.exe
5784	electron.exe
4272	chrome.exe
4272	chrome.exe
1196	StartMenuExperienceHost.exe
4272	explorer.exe
6528	SearchHost.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
6528	SearchHost.exe
6528	SearchHost.exe
6528	SearchHost.exe
6528	SearchHost.exe
6528	SearchHost.exe
6528	SearchHost.exe
6528	SearchHost.exe
6528	SearchHost.exe
6528	SearchHost.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
6528	SearchHost.exe
6528	SearchHost.exe
6528	SearchHost.exe
6528	SearchHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1352 wrote to memory of 5716	1352	chrome.exe	88
PID 1352 wrote to memory of 4904	1352	chrome.exe	90
PID 1352 wrote to memory of 4904	1352	chrome.exe	90
PID 1352 wrote to memory of 1696	1352	chrome.exe	91
PID 1352 wrote to memory of 3852	1352	chrome.exe	92
PID 1352 wrote to memory of 3852	1352	chrome.exe	92
PID 1352 wrote to memory of 4268	1352	chrome.exe	94
PID 1352 wrote to memory of 3824	1352	chrome.exe	95
PID 1352 wrote to memory of 4268	1352	chrome.exe	94
PID 1352 wrote to memory of 3824	1352	chrome.exe	95
PID 1352 wrote to memory of 5564	1352	chrome.exe	109
PID 1352 wrote to memory of 5564	1352	chrome.exe	109
PID 1352 wrote to memory of 1012	1352	chrome.exe	110
PID 1352 wrote to memory of 1012	1352	chrome.exe	110
PID 1352 wrote to memory of 5524	1352	chrome.exe	111
PID 1352 wrote to memory of 5524	1352	chrome.exe	111
PID 1352 wrote to memory of 1672	1352	chrome.exe	113
PID 1352 wrote to memory of 1672	1352	chrome.exe	113
PID 1352 wrote to memory of 5868	1352	chrome.exe	114
PID 1352 wrote to memory of 4840	1352	chrome.exe	115
PID 1352 wrote to memory of 2752	1352	chrome.exe	116
PID 1352 wrote to memory of 3044	1352	chrome.exe	117
PID 1352 wrote to memory of 5828	1352	chrome.exe	118
PID 1352 wrote to memory of 5828	1352	chrome.exe	118
PID 1352 wrote to memory of 1296	1352	chrome.exe	119
PID 1352 wrote to memory of 4424	1352	chrome.exe	136
PID 1352 wrote to memory of 4792	1352	chrome.exe	122
PID 1352 wrote to memory of 4424	1352	chrome.exe	136
PID 1352 wrote to memory of 4792	1352	chrome.exe	122
PID 1352 wrote to memory of 4500	1352	chrome.exe	123
PID 1352 wrote to memory of 4500	1352	chrome.exe	123
PID 1352 wrote to memory of 3364	1352	chrome.exe	133
PID 1352 wrote to memory of 3364	1352	chrome.exe	133
PID 1352 wrote to memory of 1100	1352	chrome.exe	127
PID 1352 wrote to memory of 1100	1352	chrome.exe	127
PID 1352 wrote to memory of 2868	1352	chrome.exe	128
PID 1352 wrote to memory of 2868	1352	chrome.exe	128
PID 1352 wrote to memory of 5524	1352	chrome.exe	129
PID 1352 wrote to memory of 5524	1352	chrome.exe	129
PID 1352 wrote to memory of 1444	1352	chrome.exe	130
PID 1352 wrote to memory of 1444	1352	chrome.exe	130
PID 1352 wrote to memory of 3644	1352	chrome.exe	131
PID 1352 wrote to memory of 3644	1352	chrome.exe	131
PID 1352 wrote to memory of 5936	1352	chrome.exe	132
PID 1352 wrote to memory of 5936	1352	chrome.exe	132
PID 1352 wrote to memory of 3364	1352	chrome.exe	133
PID 1352 wrote to memory of 3364	1352	chrome.exe	133
PID 1352 wrote to memory of 3560	1352	chrome.exe	134
PID 1352 wrote to memory of 3560	1352	chrome.exe	134
PID 1352 wrote to memory of 5224	1352	chrome.exe	135
PID 1352 wrote to memory of 5224	1352	chrome.exe	135
PID 1352 wrote to memory of 4424	1352	chrome.exe	136
PID 1352 wrote to memory of 4424	1352	chrome.exe	136
PID 1352 wrote to memory of 200	1352	chrome.exe	137
PID 1352 wrote to memory of 200	1352	chrome.exe	137
PID 1352 wrote to memory of 3872	1352	chrome.exe	138
PID 1352 wrote to memory of 3872	1352	chrome.exe	138
PID 4660 wrote to memory of 5888	4660	cmd.exe	143
PID 4660 wrote to memory of 6156	4660	cmd.exe	144
PID 1352 wrote to memory of 6212	1352	chrome.exe	145
PID 1352 wrote to memory of 6212	1352	chrome.exe	145
PID 1352 wrote to memory of 6428	1352	chrome.exe	146
PID 1352 wrote to memory of 6428	1352	chrome.exe	146
PID 1352 wrote to memory of 6468	1352	chrome.exe	147

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.mediafire.com/file/vzvch0zt8futtu8/lupa.zip/file
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffeaa5fc728,0x7ffeaa5fc734,0x7ffeaa5fc740
  2⤵
  PID:5716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1596,i,6277875971194479830,13768635515944044931,262144 --field-trial-handle=1896,i,10290649702658950108,3013970430152351637,262144 --variations-seed-version --mojo-platform-channel-handle=1892 /prefetch:2
  2⤵
  PID:4904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1456,i,1329119365286805182,9215710779990875592,524288 --field-trial-handle=1896,i,10290649702658950108,3013970430152351637,262144 --variations-seed-version --mojo-platform-channel-handle=2172 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2320,i,17064637849585666436,18420714769957633783,524288 --field-trial-handle=1896,i,10290649702658950108,3013970430152351637,262144 --variations-seed-version --mojo-platform-channel-handle=2712 /prefetch:13
  2⤵
  PID:3852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3188,i,8167922612685399113,13252151289241204246,2097152 --field-trial-handle=1896,i,10290649702658950108,3013970430152351637,262144 --variations-seed-version --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:4268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3192,i,8701474175787803474,6757106010336109069,2097152 --field-trial-handle=1896,i,10290649702658950108,3013970430152351637,262144 --variations-seed-version --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:3824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=5028,i,3616645318400507063,10073451092160204055,2097152 --field-trial-handle=1896,i,10290649702658950108,3013970430152351637,262144 --variations-seed-version --mojo-platform-channel-handle=4936 /prefetch:1
  2⤵
  PID:5564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5132,i,4808071278647382456,14344015523540794866,2097152 --field-trial-handle=1896,i,10290649702658950108,3013970430152351637,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:1
  2⤵
  PID:1012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5368,i,8146947427041239924,11889965843633795150,2097152 --field-trial-handle=1896,i,10290649702658950108,3013970430152351637,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:1
  2⤵
  PID:5524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5084,i,9927932836298606642,9533697966570412768,2097152 --field-trial-handle=1896,i,10290649702658950108,3013970430152351637,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:1
  2⤵
  PID:1672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5096,i,13579203408579293911,17216029842427420952,524288 --field-trial-handle=1896,i,10290649702658950108,3013970430152351637,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:14
  2⤵
  PID:5868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5228,i,13338255444762889626,12562966626121437856,524288 --field-trial-handle=1896,i,10290649702658950108,3013970430152351637,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:14
  2⤵
  PID:4840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5212,i,711919495369866266,12286960022103188012,524288 --field-trial-handle=1896,i,10290649702658950108,3013970430152351637,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:14
  2⤵
  PID:2752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5952,i,16980451819319242444,10542460625181921532,524288 --field-trial-handle=1896,i,10290649702658950108,3013970430152351637,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:14
  2⤵
  PID:3044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6032,i,10211549981594740453,7721922234049681696,2097152 --field-trial-handle=1896,i,10290649702658950108,3013970430152351637,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:1
  2⤵
  PID:5828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5944,i,4378748314407655224,11586226331786162061,524288 --field-trial-handle=1896,i,10290649702658950108,3013970430152351637,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:14
  2⤵
  PID:1296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6248,i,5812411860728168609,10094091998434916679,2097152 --field-trial-handle=1896,i,10290649702658950108,3013970430152351637,262144 --variations-seed-version --mojo-platform-channel-handle=6504 /prefetch:1
  2⤵
  PID:4424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6520,i,11752985343797915769,14614609368374247622,2097152 --field-trial-handle=1896,i,10290649702658950108,3013970430152351637,262144 --variations-seed-version --mojo-platform-channel-handle=6540 /prefetch:1
  2⤵
  PID:4792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6832,i,961739171186187164,9108447154912304932,2097152 --field-trial-handle=1896,i,10290649702658950108,3013970430152351637,262144 --variations-seed-version --mojo-platform-channel-handle=6568 /prefetch:1
  2⤵
  PID:4500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=4732,i,16141451782285136927,12358358418527077854,2097152 --field-trial-handle=1896,i,10290649702658950108,3013970430152351637,262144 --variations-seed-version --mojo-platform-channel-handle=6520 /prefetch:1
  2⤵
  PID:3364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=4836,i,12180908156060973187,15364485286194546183,2097152 --field-trial-handle=1896,i,10290649702658950108,3013970430152351637,262144 --variations-seed-version --mojo-platform-channel-handle=6584 /prefetch:1
  2⤵
  PID:1100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6756,i,17741597040384817477,18139232853819110505,2097152 --field-trial-handle=1896,i,10290649702658950108,3013970430152351637,262144 --variations-seed-version --mojo-platform-channel-handle=4768 /prefetch:1
  2⤵
  PID:2868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=4844,i,5865990499268887114,5365454883594949376,2097152 --field-trial-handle=1896,i,10290649702658950108,3013970430152351637,262144 --variations-seed-version --mojo-platform-channel-handle=4836 /prefetch:1
  2⤵
  PID:5524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6528,i,1769322035297887367,14193375975939175915,2097152 --field-trial-handle=1896,i,10290649702658950108,3013970430152351637,262144 --variations-seed-version --mojo-platform-channel-handle=6756 /prefetch:1
  2⤵
  PID:1444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6948,i,7780989207444607907,5711891330503157127,2097152 --field-trial-handle=1896,i,10290649702658950108,3013970430152351637,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:1
  2⤵
  PID:3644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=6988,i,15210999942821884502,12309961904962192654,2097152 --field-trial-handle=1896,i,10290649702658950108,3013970430152351637,262144 --variations-seed-version --mojo-platform-channel-handle=6980 /prefetch:1
  2⤵
  PID:5936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=6740,i,8033727141070491790,13042254117675385018,2097152 --field-trial-handle=1896,i,10290649702658950108,3013970430152351637,262144 --variations-seed-version --mojo-platform-channel-handle=6796 /prefetch:1
  2⤵
  PID:3364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=6524,i,12566030642478730717,17358527222631873358,2097152 --field-trial-handle=1896,i,10290649702658950108,3013970430152351637,262144 --variations-seed-version --mojo-platform-channel-handle=4764 /prefetch:1
  2⤵
  PID:3560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=4692,i,2617791572109057202,3238417887317685208,2097152 --field-trial-handle=1896,i,10290649702658950108,3013970430152351637,262144 --variations-seed-version --mojo-platform-channel-handle=7308 /prefetch:1
  2⤵
  PID:5224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=7256,i,18437857199814088029,6699816206484901189,2097152 --field-trial-handle=1896,i,10290649702658950108,3013970430152351637,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:1
  2⤵
  PID:4424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=7108,i,17915669004367989206,10080029364782705633,2097152 --field-trial-handle=1896,i,10290649702658950108,3013970430152351637,262144 --variations-seed-version --mojo-platform-channel-handle=6908 /prefetch:1
  2⤵
  PID:200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=6072,i,7514563721314185137,3850252119109712994,2097152 --field-trial-handle=1896,i,10290649702658950108,3013970430152351637,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:1
  2⤵
  PID:3872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=5724,i,11800839196213614698,859669927996624310,2097152 --field-trial-handle=1896,i,10290649702658950108,3013970430152351637,262144 --variations-seed-version --mojo-platform-channel-handle=4992 /prefetch:1
  2⤵
  PID:6212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --metrics-shmem-handle=5932,i,3085081586587826594,17866331805826945683,2097152 --field-trial-handle=1896,i,10290649702658950108,3013970430152351637,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:1
  2⤵
  PID:6428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --metrics-shmem-handle=6076,i,16444577995273849606,16712264977676918907,2097152 --field-trial-handle=1896,i,10290649702658950108,3013970430152351637,262144 --variations-seed-version --mojo-platform-channel-handle=6760 /prefetch:1
  2⤵
  PID:6468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --metrics-shmem-handle=5048,i,15796631086960531974,18167838657465464222,2097152 --field-trial-handle=1896,i,10290649702658950108,3013970430152351637,262144 --variations-seed-version --mojo-platform-channel-handle=7280 /prefetch:1
  2⤵
  PID:6624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --metrics-shmem-handle=7020,i,612080049231998611,9513038857567969555,2097152 --field-trial-handle=1896,i,10290649702658950108,3013970430152351637,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:1
  2⤵
  PID:6632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --metrics-shmem-handle=6124,i,11803680073899271865,11426198197342151104,2097152 --field-trial-handle=1896,i,10290649702658950108,3013970430152351637,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:1
  2⤵
  PID:6756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --metrics-shmem-handle=7520,i,3419970873038319058,13577418519175124237,2097152 --field-trial-handle=1896,i,10290649702658950108,3013970430152351637,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:1
  2⤵
  PID:6908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --metrics-shmem-handle=6108,i,14393931926279750972,2185499485703634520,2097152 --field-trial-handle=1896,i,10290649702658950108,3013970430152351637,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:1
  2⤵
  PID:6972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4744,i,8703996905230069727,18247754647372728409,262144 --field-trial-handle=1896,i,10290649702658950108,3013970430152351637,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4820,i,13164290822211361075,16759520343970417680,524288 --field-trial-handle=1896,i,10290649702658950108,3013970430152351637,262144 --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:14
  2⤵
  PID:4776
- C:\Windows\System32\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\node-v24.20.0-x64.msi"
  2⤵
  - Badlisted process makes network request
  - Enumerates connected drives
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:6456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=6728,i,120332000037738737,16715415104891210692,524288 --field-trial-handle=1896,i,10290649702658950108,3013970430152351637,262144 --variations-seed-version --mojo-platform-channel-handle=4648 /prefetch:14
  2⤵
  PID:6388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --metrics-shmem-handle=4872,i,14787662240397455717,13268229625178442130,2097152 --field-trial-handle=1896,i,10290649702658950108,3013970430152351637,262144 --variations-seed-version --mojo-platform-channel-handle=3004 /prefetch:1
  2⤵
  PID:4920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --metrics-shmem-handle=7152,i,16445305160786916915,9664203915501630657,2097152 --field-trial-handle=1896,i,10290649702658950108,3013970430152351637,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:1
  2⤵
  PID:6248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --metrics-shmem-handle=6768,i,5126966948098500645,13856171738336870781,2097152 --field-trial-handle=1896,i,10290649702658950108,3013970430152351637,262144 --variations-seed-version --mojo-platform-channel-handle=780 /prefetch:1
  2⤵
  PID:6588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --metrics-shmem-handle=6584,i,9666360218712558795,17515637868286485409,2097152 --field-trial-handle=1896,i,10290649702658950108,3013970430152351637,262144 --variations-seed-version --mojo-platform-channel-handle=4752 /prefetch:1
  2⤵
  PID:3364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --metrics-shmem-handle=6056,i,9315081861977801712,6460693419568120526,2097152 --field-trial-handle=1896,i,10290649702658950108,3013970430152351637,262144 --variations-seed-version --mojo-platform-channel-handle=7508 /prefetch:1
  2⤵
  PID:6228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --metrics-shmem-handle=7676,i,12135304090848515791,16089637518972233199,2097152 --field-trial-handle=1896,i,10290649702658950108,3013970430152351637,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:1
  2⤵
  PID:6960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --metrics-shmem-handle=4672,i,2621461977800338365,5234424911173576119,2097152 --field-trial-handle=1896,i,10290649702658950108,3013970430152351637,262144 --variations-seed-version --mojo-platform-channel-handle=7732 /prefetch:1
  2⤵
  PID:6352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --metrics-shmem-handle=7556,i,2549909791514447079,163269167929466638,2097152 --field-trial-handle=1896,i,10290649702658950108,3013970430152351637,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:1
  2⤵
  PID:6588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --metrics-shmem-handle=7564,i,11654016481152302281,253093824434308970,2097152 --field-trial-handle=1896,i,10290649702658950108,3013970430152351637,262144 --variations-seed-version --mojo-platform-channel-handle=7716 /prefetch:1
  2⤵
  PID:480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --metrics-shmem-handle=7508,i,5545339512233727057,3300491263676661258,2097152 --field-trial-handle=1896,i,10290649702658950108,3013970430152351637,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:1
  2⤵
  PID:4436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --metrics-shmem-handle=6784,i,9751997163402994959,14340498532906535938,2097152 --field-trial-handle=1896,i,10290649702658950108,3013970430152351637,262144 --variations-seed-version --mojo-platform-channel-handle=7264 /prefetch:1
  2⤵
  PID:3472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=7696,i,1623948622936444748,15223062978040074192,524288 --field-trial-handle=1896,i,10290649702658950108,3013970430152351637,262144 --variations-seed-version --mojo-platform-channel-handle=7776 /prefetch:14
  2⤵
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:4272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=7696,i,16950774693945652320,12720779212437017202,524288 --field-trial-handle=1896,i,10290649702658950108,3013970430152351637,262144 --variations-seed-version --mojo-platform-channel-handle=7600 /prefetch:14
  2⤵
  PID:7056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --metrics-shmem-handle=3876,i,4439380687783489222,9901398467444027543,2097152 --field-trial-handle=1896,i,10290649702658950108,3013970430152351637,262144 --variations-seed-version --mojo-platform-channel-handle=7744 /prefetch:1
  2⤵
  PID:3816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --metrics-shmem-handle=4892,i,6049953396499081029,10370416637270386427,2097152 --field-trial-handle=1896,i,10290649702658950108,3013970430152351637,262144 --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:1
  2⤵
  PID:7084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --metrics-shmem-handle=6716,i,2965391279601019621,8324473662659156589,2097152 --field-trial-handle=1896,i,10290649702658950108,3013970430152351637,262144 --variations-seed-version --mojo-platform-channel-handle=7636 /prefetch:1
  2⤵
  PID:7064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --metrics-shmem-handle=5732,i,9322477947958675838,17295676560091818787,2097152 --field-trial-handle=1896,i,10290649702658950108,3013970430152351637,262144 --variations-seed-version --mojo-platform-channel-handle=7516 /prefetch:1
  2⤵
  PID:6224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --metrics-shmem-handle=7788,i,604276619793625697,6601752908102955243,2097152 --field-trial-handle=1896,i,10290649702658950108,3013970430152351637,262144 --variations-seed-version --mojo-platform-channel-handle=7092 /prefetch:1
  2⤵
  PID:6188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4872,i,16715110289995107927,3005254209378655457,524288 --field-trial-handle=1896,i,10290649702658950108,3013970430152351637,262144 --variations-seed-version --mojo-platform-channel-handle=7824 /prefetch:14
  2⤵
  PID:6096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=5040,i,4975288292798762595,11348478581907678538,524288 --field-trial-handle=1896,i,10290649702658950108,3013970430152351637,262144 --variations-seed-version --mojo-platform-channel-handle=7812 /prefetch:12
  2⤵
  PID:1052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --metrics-shmem-handle=7816,i,6701409899030031416,11607547263520842660,2097152 --field-trial-handle=1896,i,10290649702658950108,3013970430152351637,262144 --variations-seed-version --mojo-platform-channel-handle=6704 /prefetch:1
  2⤵
  PID:1096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --metrics-shmem-handle=8056,i,9381872232347189668,5807360290583363751,2097152 --field-trial-handle=1896,i,10290649702658950108,3013970430152351637,262144 --variations-seed-version --mojo-platform-channel-handle=4716 /prefetch:1
  2⤵
  PID:2192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --metrics-shmem-handle=8236,i,11091690016163536036,2390929937223106779,2097152 --field-trial-handle=1896,i,10290649702658950108,3013970430152351637,262144 --variations-seed-version --mojo-platform-channel-handle=8068 /prefetch:1
  2⤵
  PID:1660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --metrics-shmem-handle=8168,i,8865222895682784131,14751394338707046028,2097152 --field-trial-handle=1896,i,10290649702658950108,3013970430152351637,262144 --variations-seed-version --mojo-platform-channel-handle=8376 /prefetch:1
  2⤵
  PID:3044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --metrics-shmem-handle=8316,i,1027857291149823262,10809457817687730950,2097152 --field-trial-handle=1896,i,10290649702658950108,3013970430152351637,262144 --variations-seed-version --mojo-platform-channel-handle=8500 /prefetch:1
  2⤵
  PID:1584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --metrics-shmem-handle=8660,i,7990099528685416379,4345202674984580432,2097152 --field-trial-handle=1896,i,10290649702658950108,3013970430152351637,262144 --variations-seed-version --mojo-platform-channel-handle=8640 /prefetch:1
  2⤵
  PID:7148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --metrics-shmem-handle=8672,i,10491581126691894757,18407006639917711591,2097152 --field-trial-handle=1896,i,10290649702658950108,3013970430152351637,262144 --variations-seed-version --mojo-platform-channel-handle=8688 /prefetch:1
  2⤵
  PID:1576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --metrics-shmem-handle=8716,i,14855695478118071502,9232289040844369860,2097152 --field-trial-handle=1896,i,10290649702658950108,3013970430152351637,262144 --variations-seed-version --mojo-platform-channel-handle=8744 /prefetch:1
  2⤵
  PID:1252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --metrics-shmem-handle=8404,i,17050495559256897300,10254364628565814013,2097152 --field-trial-handle=1896,i,10290649702658950108,3013970430152351637,262144 --variations-seed-version --mojo-platform-channel-handle=8168 /prefetch:1
  2⤵
  PID:5788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --metrics-shmem-handle=9224,i,14685396664789209920,4528729427068132065,2097152 --field-trial-handle=1896,i,10290649702658950108,3013970430152351637,262144 --variations-seed-version --mojo-platform-channel-handle=9248 /prefetch:1
  2⤵
  PID:4244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --metrics-shmem-handle=8748,i,17361550588299664174,8493140526976364971,2097152 --field-trial-handle=1896,i,10290649702658950108,3013970430152351637,262144 --variations-seed-version --mojo-platform-channel-handle=8404 /prefetch:1
  2⤵
  PID:5924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --metrics-shmem-handle=9056,i,12224271209293262494,4489237416597582531,2097152 --field-trial-handle=1896,i,10290649702658950108,3013970430152351637,262144 --variations-seed-version --mojo-platform-channel-handle=9008 /prefetch:1
  2⤵
  PID:6740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --metrics-shmem-handle=9500,i,16275313090365114829,7945481555808857287,2097152 --field-trial-handle=1896,i,10290649702658950108,3013970430152351637,262144 --variations-seed-version --mojo-platform-channel-handle=9516 /prefetch:1
  2⤵
  PID:4496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --metrics-shmem-handle=8272,i,9394820848750553888,3177652057174175555,2097152 --field-trial-handle=1896,i,10290649702658950108,3013970430152351637,262144 --variations-seed-version --mojo-platform-channel-handle=8052 /prefetch:1
  2⤵
  PID:7156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --metrics-shmem-handle=8336,i,18312982939209255630,3578534598873020273,2097152 --field-trial-handle=1896,i,10290649702658950108,3013970430152351637,262144 --variations-seed-version --mojo-platform-channel-handle=8224 /prefetch:1
  2⤵
  PID:4396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --metrics-shmem-handle=8228,i,13140960019334173934,9448218451264163280,2097152 --field-trial-handle=1896,i,10290649702658950108,3013970430152351637,262144 --variations-seed-version --mojo-platform-channel-handle=8216 /prefetch:1
  2⤵
  PID:2364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --metrics-shmem-handle=8824,i,11503847733908112337,8952678300226427007,2097152 --field-trial-handle=1896,i,10290649702658950108,3013970430152351637,262144 --variations-seed-version --mojo-platform-channel-handle=9620 /prefetch:1
  2⤵
  PID:3280

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4620

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:2628

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004EC 0x00000000000004F8
1⤵
PID:1648

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DevicesFlow -s DevicesFlowUserSvc
1⤵
PID:3668

C:\Windows\System32\ShellHost.exe
"C:\Windows\System32\ShellHost.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:3448

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4620

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:3540

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1684

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\lupa\lupa\abrir-lupa.bat" "
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4660
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:5888
- C:\Windows\system32\where.exe
  where node
  2⤵
  PID:6156

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1716
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 8EA6C7E60F665BCC8F0EBBA213366F29 C
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:6868
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:2416
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 51A2D28C96DC12ECD7F142EE061EC809
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:1544
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding DAA5D01AA6279C585CA384C7594F1A06 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:4708
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding B885AED720AEA5A4826089669AB0BD75
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:6788

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:7076

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\lupa\lupa\abrir-lupa.bat" "
1⤵
- Executes a command shell one-liner
PID:3100
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:3176
- C:\Windows\system32\where.exe
  where node
  2⤵
  PID:5704
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c CALL "C:\Program Files\nodejs\\node.exe" "C:\Program Files\nodejs\\node_modules\npm\bin\npm-prefix.js"
  2⤵
  - Executes a command shell one-liner
  PID:4732
- - C:\Program Files\nodejs\node.exe
    "C:\Program Files\nodejs\\node.exe" "C:\Program Files\nodejs\\node_modules\npm\bin\npm-prefix.js"
    3⤵
    - Executes dropped EXE
    PID:3976
- C:\Program Files\nodejs\node.exe
  "C:\Program Files\nodejs\\node.exe" "C:\Program Files\nodejs\\node_modules\npm\bin\npm-cli.js" install
  2⤵
  - Executes dropped EXE
  PID:5528
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c node install.js
    3⤵
    - Executes a command shell one-liner
    PID:7112
  - - C:\Program Files\nodejs\node.exe
      node install.js
      4⤵
      Executes dropped EXE
      PID:4804

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\lupa\lupa\abrir-lupa.bat" "
1⤵
- Executes a command shell one-liner
PID:720
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:6900
- C:\Windows\system32\where.exe
  where node
  2⤵
  PID:6536
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c CALL "C:\Program Files\nodejs\\node.exe" "C:\Program Files\nodejs\\node_modules\npm\bin\npm-prefix.js"
  2⤵
  - Executes a command shell one-liner
  PID:1688
- - C:\Program Files\nodejs\node.exe
    "C:\Program Files\nodejs\\node.exe" "C:\Program Files\nodejs\\node_modules\npm\bin\npm-prefix.js"
    3⤵
    - Executes dropped EXE
    PID:1620
- C:\Program Files\nodejs\node.exe
  "C:\Program Files\nodejs\\node.exe" "C:\Program Files\nodejs\\node_modules\npm\bin\npm-cli.js" start
  2⤵
  - Executes dropped EXE
  PID:7160
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c electron .
    3⤵
    - Executes a command shell one-liner
    PID:5292
  - - C:\Program Files\nodejs\node.exe
      "node" "C:\Users\Admin\Downloads\lupa\lupa\node_modules\.bin\\..\electron\cli.js" .
      4⤵
      Executes dropped EXE
      PID:7008
    - - C:\Users\Admin\Downloads\lupa\lupa\node_modules\electron\dist\electron.exe
        
        C:\Users\Admin\Downloads\lupa\lupa\node_modules\electron\dist\electron.exe .
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:7020
      - C:\Users\Admin\Downloads\lupa\lupa\node_modules\electron\dist\electron.exe
        
        "C:\Users\Admin\Downloads\lupa\lupa\node_modules\electron\dist\electron.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\lupa" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1928,i,16099486492010624645,6345799281645753558,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1920 /prefetch:2
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2584
      - C:\Users\Admin\Downloads\lupa\lupa\node_modules\electron\dist\electron.exe
        
        "C:\Users\Admin\Downloads\lupa\lupa\node_modules\electron\dist\electron.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\lupa" --field-trial-handle=2216,i,16099486492010624645,6345799281645753558,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2212 /prefetch:11
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5992
      - C:\Users\Admin\Downloads\lupa\lupa\node_modules\electron\dist\electron.exe
        
        "C:\Users\Admin\Downloads\lupa\lupa\node_modules\electron\dist\electron.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\lupa" --app-path="C:\Users\Admin\Downloads\lupa\lupa" --no-sandbox --no-zygote --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=2500,i,16099486492010624645,6345799281645753558,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2496 /prefetch:1
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:6320
      - C:\Users\Admin\Downloads\lupa\lupa\node_modules\electron\dist\electron.exe
        
        "C:\Users\Admin\Downloads\lupa\lupa\node_modules\electron\dist\electron.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\lupa" --field-trial-handle=3028,i,16099486492010624645,6345799281645753558,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3144 /prefetch:14
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies Control Panel
        Modifies registry class
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of SetWindowsHookEx
        
        PID:5784
      - C:\Users\Admin\Downloads\lupa\lupa\node_modules\electron\dist\electron.exe
        
        "C:\Users\Admin\Downloads\lupa\lupa\node_modules\electron\dist\electron.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --user-data-dir="C:\Users\Admin\AppData\Roaming\lupa" --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=3008,i,16099486492010624645,6345799281645753558,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3160 /prefetch:10
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        
        PID:804

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
PID:6556
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Drops desktop.ini file(s)
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:4272
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\lupa\lupa\abrir-lupa.bat" "
    3⤵
    - Executes a command shell one-liner
    PID:5140
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:5596
  - - C:\Windows\system32\where.exe
      where node
      4⤵
      PID:6580
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c CALL "C:\Program Files\nodejs\\node.exe" "C:\Program Files\nodejs\\node_modules\npm\bin\npm-prefix.js"
      4⤵
      Executes a command shell one-liner
      PID:4180
    - - C:\Program Files\nodejs\node.exe
        
        "C:\Program Files\nodejs\\node.exe" "C:\Program Files\nodejs\\node_modules\npm\bin\npm-prefix.js"
        5⤵
        Executes dropped EXE
        
        PID:1848
  - - C:\Program Files\nodejs\node.exe
      "C:\Program Files\nodejs\\node.exe" "C:\Program Files\nodejs\\node_modules\npm\bin\npm-cli.js" start
      4⤵
      Executes dropped EXE
      PID:5728
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c electron .
        5⤵
        Executes a command shell one-liner
        
        PID:2104
      - C:\Program Files\nodejs\node.exe
        
        "node" "C:\Users\Admin\Downloads\lupa\lupa\node_modules\.bin\\..\electron\cli.js" .
        6⤵
        Executes dropped EXE
        
        PID:2548
        
        C:\Users\Admin\Downloads\lupa\lupa\node_modules\electron\dist\electron.exe
        
        C:\Users\Admin\Downloads\lupa\lupa\node_modules\electron\dist\electron.exe .
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1208
        
        C:\Users\Admin\Downloads\lupa\lupa\node_modules\electron\dist\electron.exe
        
        "C:\Users\Admin\Downloads\lupa\lupa\node_modules\electron\dist\electron.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\lupa" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1744,i,12763181475377418253,18424472666251259296,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1736 /prefetch:2
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5816
        
        C:\Users\Admin\Downloads\lupa\lupa\node_modules\electron\dist\electron.exe
        
        "C:\Users\Admin\Downloads\lupa\lupa\node_modules\electron\dist\electron.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\lupa" --field-trial-handle=2200,i,12763181475377418253,18424472666251259296,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2196 /prefetch:11
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4636
        
        C:\Users\Admin\Downloads\lupa\lupa\node_modules\electron\dist\electron.exe
        
        "C:\Users\Admin\Downloads\lupa\lupa\node_modules\electron\dist\electron.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\lupa" --app-path="C:\Users\Admin\Downloads\lupa\lupa" --no-sandbox --no-zygote --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=2532,i,12763181475377418253,18424472666251259296,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2528 /prefetch:1
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:7028
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\lupa\lupa\abrir-lupa.bat" "
    3⤵
    - Executes a command shell one-liner
    PID:2644
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:3428
  - - C:\Windows\system32\where.exe
      where node
      4⤵
      PID:1536
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c CALL "C:\Program Files\nodejs\\node.exe" "C:\Program Files\nodejs\\node_modules\npm\bin\npm-prefix.js"
      4⤵
      Executes a command shell one-liner
      PID:3524
    - - C:\Program Files\nodejs\node.exe
        
        "C:\Program Files\nodejs\\node.exe" "C:\Program Files\nodejs\\node_modules\npm\bin\npm-prefix.js"
        5⤵
        Executes dropped EXE
        
        PID:6372
  - - C:\Program Files\nodejs\node.exe
      "C:\Program Files\nodejs\\node.exe" "C:\Program Files\nodejs\\node_modules\npm\bin\npm-cli.js" start
      4⤵
      Executes dropped EXE
      PID:1124
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c electron .
        5⤵
        Executes a command shell one-liner
        
        PID:3172
      - C:\Program Files\nodejs\node.exe
        
        "node" "C:\Users\Admin\Downloads\lupa\lupa\node_modules\.bin\\..\electron\cli.js" .
        6⤵
        Executes dropped EXE
        
        PID:1268
        
        C:\Users\Admin\Downloads\lupa\lupa\node_modules\electron\dist\electron.exe
        
        C:\Users\Admin\Downloads\lupa\lupa\node_modules\electron\dist\electron.exe .
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2536
        
        C:\Users\Admin\Downloads\lupa\lupa\node_modules\electron\dist\electron.exe
        
        "C:\Users\Admin\Downloads\lupa\lupa\node_modules\electron\dist\electron.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\lupa" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1788,i,9659906424226781430,11330149542003455817,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1780 /prefetch:2
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3464
        
        C:\Users\Admin\Downloads\lupa\lupa\node_modules\electron\dist\electron.exe
        
        "C:\Users\Admin\Downloads\lupa\lupa\node_modules\electron\dist\electron.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\lupa" --field-trial-handle=2208,i,9659906424226781430,11330149542003455817,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2204 /prefetch:11
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:7116
        
        C:\Users\Admin\Downloads\lupa\lupa\node_modules\electron\dist\electron.exe
        
        "C:\Users\Admin\Downloads\lupa\lupa\node_modules\electron\dist\electron.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\lupa" --app-path="C:\Users\Admin\Downloads\lupa\lupa" --no-sandbox --no-zygote --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=2508,i,9659906424226781430,11330149542003455817,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2504 /prefetch:1
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:6376
        
        C:\Users\Admin\Downloads\lupa\lupa\node_modules\electron\dist\electron.exe
        
        "C:\Users\Admin\Downloads\lupa\lupa\node_modules\electron\dist\electron.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --user-data-dir="C:\Users\Admin\AppData\Roaming\lupa" --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=3492,i,9659906424226781430,11330149542003455817,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:10
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        
        PID:4164
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\lupa\lupa\abrir-lupa.bat" "
    3⤵
    - Executes a command shell one-liner
    PID:1548
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:1560
  - - C:\Windows\system32\where.exe
      where node
      4⤵
      PID:6264
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c CALL "C:\Program Files\nodejs\\node.exe" "C:\Program Files\nodejs\\node_modules\npm\bin\npm-prefix.js"
      4⤵
      Executes a command shell one-liner
      PID:5620
    - - C:\Program Files\nodejs\node.exe
        
        "C:\Program Files\nodejs\\node.exe" "C:\Program Files\nodejs\\node_modules\npm\bin\npm-prefix.js"
        5⤵
        Executes dropped EXE
        
        PID:6748
  - - C:\Program Files\nodejs\node.exe
      "C:\Program Files\nodejs\\node.exe" "C:\Program Files\nodejs\\node_modules\npm\bin\npm-cli.js" start
      4⤵
      Executes dropped EXE
      PID:2720
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c electron .
        5⤵
        Executes a command shell one-liner
        
        PID:1532
      - C:\Program Files\nodejs\node.exe
        
        "node" "C:\Users\Admin\Downloads\lupa\lupa\node_modules\.bin\\..\electron\cli.js" .
        6⤵
        Executes dropped EXE
        
        PID:4560
        
        C:\Users\Admin\Downloads\lupa\lupa\node_modules\electron\dist\electron.exe
        
        C:\Users\Admin\Downloads\lupa\lupa\node_modules\electron\dist\electron.exe .
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2680
        
        C:\Users\Admin\Downloads\lupa\lupa\node_modules\electron\dist\electron.exe
        
        "C:\Users\Admin\Downloads\lupa\lupa\node_modules\electron\dist\electron.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\lupa" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1744,i,8033104371057506748,8915740533523453034,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1740 /prefetch:2
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1652
        
        C:\Users\Admin\Downloads\lupa\lupa\node_modules\electron\dist\electron.exe
        
        "C:\Users\Admin\Downloads\lupa\lupa\node_modules\electron\dist\electron.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\lupa" --field-trial-handle=2092,i,8033104371057506748,8915740533523453034,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2088 /prefetch:11
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1876
        
        C:\Users\Admin\Downloads\lupa\lupa\node_modules\electron\dist\electron.exe
        
        "C:\Users\Admin\Downloads\lupa\lupa\node_modules\electron\dist\electron.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\lupa" --app-path="C:\Users\Admin\Downloads\lupa\lupa" --no-sandbox --no-zygote --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=2520,i,8033104371057506748,8915740533523453034,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2516 /prefetch:1
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3356
        
        C:\Users\Admin\Downloads\lupa\lupa\node_modules\electron\dist\electron.exe
        
        "C:\Users\Admin\Downloads\lupa\lupa\node_modules\electron\dist\electron.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\lupa" --app-path="C:\Users\Admin\Downloads\lupa\lupa" --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3192,i,8033104371057506748,8915740533523453034,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3316 /prefetch:1
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2116
        
        C:\Users\Admin\Downloads\lupa\lupa\node_modules\electron\dist\electron.exe
        
        "C:\Users\Admin\Downloads\lupa\lupa\node_modules\electron\dist\electron.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --user-data-dir="C:\Users\Admin\AppData\Roaming\lupa" --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1276,i,8033104371057506748,8915740533523453034,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2476 /prefetch:10
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        
        PID:1084
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\lupa\lupa\abrir-lupa.bat" "
    3⤵
    - Executes a command shell one-liner
    PID:6680
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:2020
  - - C:\Windows\system32\where.exe
      where node
      4⤵
      PID:3404
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c CALL "C:\Program Files\nodejs\\node.exe" "C:\Program Files\nodejs\\node_modules\npm\bin\npm-prefix.js"
      4⤵
      Executes a command shell one-liner
      PID:1736
    - - C:\Program Files\nodejs\node.exe
        
        "C:\Program Files\nodejs\\node.exe" "C:\Program Files\nodejs\\node_modules\npm\bin\npm-prefix.js"
        5⤵
        Executes dropped EXE
        
        PID:1096
  - - C:\Program Files\nodejs\node.exe
      "C:\Program Files\nodejs\\node.exe" "C:\Program Files\nodejs\\node_modules\npm\bin\npm-cli.js" start
      4⤵
      Executes dropped EXE
      PID:1420
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c electron .
        5⤵
        Executes a command shell one-liner
        
        PID:3832
      - C:\Program Files\nodejs\node.exe
        
        "node" "C:\Users\Admin\Downloads\lupa\lupa\node_modules\.bin\\..\electron\cli.js" .
        6⤵
        Executes dropped EXE
        
        PID:4636
        
        C:\Users\Admin\Downloads\lupa\lupa\node_modules\electron\dist\electron.exe
        
        C:\Users\Admin\Downloads\lupa\lupa\node_modules\electron\dist\electron.exe .
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4056
        
        C:\Users\Admin\Downloads\lupa\lupa\node_modules\electron\dist\electron.exe
        
        "C:\Users\Admin\Downloads\lupa\lupa\node_modules\electron\dist\electron.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\lupa" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1744,i,6026906016570276974,5769933897171201202,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1740 /prefetch:2
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4792
        
        C:\Users\Admin\Downloads\lupa\lupa\node_modules\electron\dist\electron.exe
        
        "C:\Users\Admin\Downloads\lupa\lupa\node_modules\electron\dist\electron.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\lupa" --field-trial-handle=2088,i,6026906016570276974,5769933897171201202,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2084 /prefetch:11
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1392
        
        C:\Users\Admin\Downloads\lupa\lupa\node_modules\electron\dist\electron.exe
        
        "C:\Users\Admin\Downloads\lupa\lupa\node_modules\electron\dist\electron.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\lupa" --app-path="C:\Users\Admin\Downloads\lupa\lupa" --no-sandbox --no-zygote --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=2516,i,6026906016570276974,5769933897171201202,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2476 /prefetch:1
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:7076
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\lupa\lupa\abrir-lupa.bat" "
    3⤵
    - Executes a command shell one-liner
    PID:6296
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:6468
  - - C:\Windows\system32\where.exe
      where node
      4⤵
      PID:2532
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c CALL "C:\Program Files\nodejs\\node.exe" "C:\Program Files\nodejs\\node_modules\npm\bin\npm-prefix.js"
      4⤵
      Executes a command shell one-liner
      PID:6948
    - - C:\Program Files\nodejs\node.exe
        
        "C:\Program Files\nodejs\\node.exe" "C:\Program Files\nodejs\\node_modules\npm\bin\npm-prefix.js"
        5⤵
        Executes dropped EXE
        
        PID:6168
  - - C:\Program Files\nodejs\node.exe
      "C:\Program Files\nodejs\\node.exe" "C:\Program Files\nodejs\\node_modules\npm\bin\npm-cli.js" start
      4⤵
      Executes dropped EXE
      PID:4980
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c electron .
        5⤵
        Executes a command shell one-liner
        
        PID:2136
      - C:\Program Files\nodejs\node.exe
        
        "node" "C:\Users\Admin\Downloads\lupa\lupa\node_modules\.bin\\..\electron\cli.js" .
        6⤵
        Executes dropped EXE
        
        PID:6684
        
        C:\Users\Admin\Downloads\lupa\lupa\node_modules\electron\dist\electron.exe
        
        C:\Users\Admin\Downloads\lupa\lupa\node_modules\electron\dist\electron.exe .
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3884
        
        C:\Users\Admin\Downloads\lupa\lupa\node_modules\electron\dist\electron.exe
        
        "C:\Users\Admin\Downloads\lupa\lupa\node_modules\electron\dist\electron.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\lupa" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1792,i,6410548874374964513,15270891187278028371,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1784 /prefetch:2
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:6584
        
        C:\Users\Admin\Downloads\lupa\lupa\node_modules\electron\dist\electron.exe
        
        "C:\Users\Admin\Downloads\lupa\lupa\node_modules\electron\dist\electron.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\lupa" --field-trial-handle=2340,i,6410548874374964513,15270891187278028371,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2212 /prefetch:11
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5524
        
        C:\Users\Admin\Downloads\lupa\lupa\node_modules\electron\dist\electron.exe
        
        "C:\Users\Admin\Downloads\lupa\lupa\node_modules\electron\dist\electron.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\lupa" --app-path="C:\Users\Admin\Downloads\lupa\lupa" --no-sandbox --no-zygote --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=2640,i,6410548874374964513,15270891187278028371,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2628 /prefetch:1
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4864
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\lupa\lupa\abrir-lupa.bat" "
    3⤵
    - Executes a command shell one-liner
    PID:704
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:2656
  - - C:\Windows\system32\where.exe
      where node
      4⤵
      PID:6132
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c CALL "C:\Program Files\nodejs\\node.exe" "C:\Program Files\nodejs\\node_modules\npm\bin\npm-prefix.js"
      4⤵
      Executes a command shell one-liner
      PID:760
    - - C:\Program Files\nodejs\node.exe
        
        "C:\Program Files\nodejs\\node.exe" "C:\Program Files\nodejs\\node_modules\npm\bin\npm-prefix.js"
        5⤵
        Executes dropped EXE
        
        PID:4768
  - - C:\Program Files\nodejs\node.exe
      "C:\Program Files\nodejs\\node.exe" "C:\Program Files\nodejs\\node_modules\npm\bin\npm-cli.js" start
      4⤵
      Executes dropped EXE
      PID:4420
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c electron .
        5⤵
        Executes a command shell one-liner
        
        PID:2396
      - C:\Program Files\nodejs\node.exe
        
        "node" "C:\Users\Admin\Downloads\lupa\lupa\node_modules\.bin\\..\electron\cli.js" .
        6⤵
        Executes dropped EXE
        
        PID:6060
        
        C:\Users\Admin\Downloads\lupa\lupa\node_modules\electron\dist\electron.exe
        
        C:\Users\Admin\Downloads\lupa\lupa\node_modules\electron\dist\electron.exe .
        7⤵
        Executes dropped EXE
        
        PID:6540
        
        C:\Users\Admin\Downloads\lupa\lupa\node_modules\electron\dist\electron.exe
        
        "C:\Users\Admin\Downloads\lupa\lupa\node_modules\electron\dist\electron.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\lupa" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1868,i,10605685158073799099,2729846977090170516,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1860 /prefetch:2
        8⤵
        Executes dropped EXE
        
        PID:3904
        
        C:\Users\Admin\Downloads\lupa\lupa\node_modules\electron\dist\electron.exe
        
        "C:\Users\Admin\Downloads\lupa\lupa\node_modules\electron\dist\electron.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\lupa" --field-trial-handle=2516,i,10605685158073799099,2729846977090170516,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2512 /prefetch:11
        8⤵
        Executes dropped EXE
        
        PID:3104
        
        C:\Users\Admin\Downloads\lupa\lupa\node_modules\electron\dist\electron.exe
        
        "C:\Users\Admin\Downloads\lupa\lupa\node_modules\electron\dist\electron.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\lupa" --app-path="C:\Users\Admin\Downloads\lupa\lupa" --no-sandbox --no-zygote --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=2532,i,10605685158073799099,2729846977090170516,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2524 /prefetch:1
        8⤵
        Executes dropped EXE
        
        PID:4060
- - C:\Windows\system32\notepad.exe
    "C:\Windows\system32\notepad.exe"
    3⤵
    PID:2372
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\lupa\lupa\abrir-lupa.bat" "
    3⤵
    - Executes a command shell one-liner
    PID:5916
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:3580
  - - C:\Windows\system32\where.exe
      where node
      4⤵
      PID:1092
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c CALL "C:\Program Files\nodejs\\node.exe" "C:\Program Files\nodejs\\node_modules\npm\bin\npm-prefix.js"
      4⤵
      Executes a command shell one-liner
      PID:4584
    - - C:\Program Files\nodejs\node.exe
        
        "C:\Program Files\nodejs\\node.exe" "C:\Program Files\nodejs\\node_modules\npm\bin\npm-prefix.js"
        5⤵
        Executes dropped EXE
        
        PID:5980
  - - C:\Program Files\nodejs\node.exe
      "C:\Program Files\nodejs\\node.exe" "C:\Program Files\nodejs\\node_modules\npm\bin\npm-cli.js" start
      4⤵
      Executes dropped EXE
      PID:6384
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c electron .
        5⤵
        Executes a command shell one-liner
        
        PID:908
      - C:\Program Files\nodejs\node.exe
        
        "node" "C:\Users\Admin\Downloads\lupa\lupa\node_modules\.bin\\..\electron\cli.js" .
        6⤵
        Executes dropped EXE
        
        PID:2416
        
        C:\Users\Admin\Downloads\lupa\lupa\node_modules\electron\dist\electron.exe
        
        C:\Users\Admin\Downloads\lupa\lupa\node_modules\electron\dist\electron.exe .
        7⤵
        Executes dropped EXE
        
        PID:3076
        
        C:\Users\Admin\Downloads\lupa\lupa\node_modules\electron\dist\electron.exe
        
        "C:\Users\Admin\Downloads\lupa\lupa\node_modules\electron\dist\electron.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\lupa" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1756,i,10796299787982176458,5926245384343084371,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1748 /prefetch:2
        8⤵
        Executes dropped EXE
        
        PID:3452
        
        C:\Users\Admin\Downloads\lupa\lupa\node_modules\electron\dist\electron.exe
        
        "C:\Users\Admin\Downloads\lupa\lupa\node_modules\electron\dist\electron.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\lupa" --field-trial-handle=2140,i,10796299787982176458,5926245384343084371,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2136 /prefetch:11
        8⤵
        Executes dropped EXE
        
        PID:2172
        
        C:\Users\Admin\Downloads\lupa\lupa\node_modules\electron\dist\electron.exe
        
        "C:\Users\Admin\Downloads\lupa\lupa\node_modules\electron\dist\electron.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\lupa" --app-path="C:\Users\Admin\Downloads\lupa\lupa" --no-sandbox --no-zygote --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=2456,i,10796299787982176458,5926245384343084371,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2452 /prefetch:1
        8⤵
        Executes dropped EXE
        
        PID:5868
        
        C:\Users\Admin\Downloads\lupa\lupa\node_modules\electron\dist\electron.exe
        
        "C:\Users\Admin\Downloads\lupa\lupa\node_modules\electron\dist\electron.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\lupa" --app-path="C:\Users\Admin\Downloads\lupa\lupa" --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3268,i,10796299787982176458,5926245384343084371,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3136 /prefetch:1
        8⤵
        
        PID:4188
        
        C:\Users\Admin\Downloads\lupa\lupa\node_modules\electron\dist\electron.exe
        
        "C:\Users\Admin\Downloads\lupa\lupa\node_modules\electron\dist\electron.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --user-data-dir="C:\Users\Admin\AppData\Roaming\lupa" --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=3492,i,10796299787982176458,5926245384343084371,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:10
        8⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1884
        
        C:\Users\Admin\Downloads\lupa\lupa\node_modules\electron\dist\electron.exe
        
        "C:\Users\Admin\Downloads\lupa\lupa\node_modules\electron\dist\electron.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\lupa" --app-path="C:\Users\Admin\Downloads\lupa\lupa" --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3248,i,10796299787982176458,5926245384343084371,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3236 /prefetch:1
        8⤵
        
        PID:1260

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1196

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:6528

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3524

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2564

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:5208

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5036

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\43419b06ea244881911d5cfaf600ebce /t 3704 /p 1352
1⤵
PID:4464

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5bc532.rbs

Path C:\Config.Msi\e5bc532.rbs
Size 812KB
SHA256 f11d64fab3424ea3410c47b8365613c6013eb81404181d940f96d5b1e5879df4
MD5 49a8b7a581b69edd822276c65dc96521
SHA1 b805fe1f356daf4d7ee3e266a329e4a4e3dd9148
SHA512 d5bf80673832edea7d8ab3ae28b29e33521aeed0243eee38c4405f0471c256a09af2a3a3b23839e79cae5b69b4fba3709b01601c2e0f924805e4e9ec893c5fab
SSDEEP 12288:rX6IAjA+S59nDPNWMrhl9Kmf3pZ8x03TAT+erw27WHdwLGu38M0YV:wSTACd27WH+BsM0YV
TLSH
T1400584906DF144FAEA4A2471B6D071709AEDAFCA3B50883D274CC7FABD6C57012F8A54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

npm-prefix.js

Path C:\Program Files\nodejs\node_modules\npm\bin\npm-prefix.js
Size 864B
SHA256 673f620e40137c295f2cf057364468bf3a71653dfc0973be895ebf7a8c368c2e
MD5 92dd1b5a463374142271ff420cb473a5
SHA1 a9f946c6a8c6f273f837703acc74c367b7781a99
SHA512 5e0a6e4a9cff4b37acbece070a592a65ed044a78e1b104517eb5bb233d4398f67140b44e986e7a2de16bfb65b0ab7609e831341efea2a6f583258b6a85f70e01
TLSH
T123110017109F8AA265328ED2E78F1900F253DBEB26339041B47D9A8E8A692016033DCB
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\tuf\LICENSE
Size 11KB
SHA256 7b0ce3425a26fdba501cb13508af096ade77e4036dd2bd8849031ddecf64f7c9
MD5 dfc1b916d4555a69859202f8bd8ad40c
SHA1 fc22b6ee39814d22e77fe6386c883a58ecac6465
SHA512 1fbe6bb1f60c8932e4dcb927fc8c8131b9c73afd824ecbabc2045e7af07b35a4155a0f8ad3103bf25f192b6d59282bfc927aead3cb7aaeb954e1b6dbd68369fa
SSDEEP 192:qf9qG4QSAVOSbwF1wOFXuFJyQtxmG3ep/7rlzKfHbxc+Xq0rhlkT8cHfH2:kOu9b01DY/rGBt+dc+aclkT8cH+
TLSH
T1B932722BBA4903771AF20162AB4764CEF31EA03F37591525315CC1682F7B96183FB69E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

shared.types.js

Path C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\verify\dist\shared.types.js
Size 79B
SHA256 ef1f170ad28f2d870a474d2f96ae353d770fff5f20e642cd8f9b6f1d7742df13
MD5 24563705cc4bb54fccd88e52bc96c711
SHA1 871fa42907b821246de04785a532297500372fc7
SHA512 2ce8d2cf580623358fef5f4f8925d0c9943a657c2503c80048ca789bf16eacdb980bfc8aaaa50101a738e939926fcf2545500484dcad782c700ee206d8c6f9b9
TLSH
T1C4A01201A934C5F1038000C44525E0C1A0C10432006528A55BA84D65440088C5050001
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Program Files\nodejs\node_modules\npm\node_modules\bin-links\LICENSE
Size 754B
SHA256 45e433413760dc3ae8169be5ed9c2c77adc31ad4d1bc5a28939576df240f29a0
MD5 d2cf52aa43e18fdc87562d4c1303f46a
SHA1 58fb4a65fffb438630351e7cafd322579817e5e1
SHA512 54e33d7998b5e9ba76b2c852b4d0493ebb1b1ee3db777c97e6606655325ff66124a0c0857ca4d62de96350dbaee8d20604ec22b0edc17b472086da4babbbcb16
TLSH
T1DC01208FB2E52AD454D19BA53DA1EC8961C9F0773D43AA0430B4E34CCBB780F98AB404
MD5 SHA1 SHA512 TLSH

Submit Download

package.json

Path C:\Program Files\nodejs\node_modules\npm\node_modules\common-ancestor-path\dist\commonjs\package.json
Size 28B
SHA256 58b55392b5778941e1e96892a70edc12e2d7bb8541289b237fbddc9926ed51bd
MD5 56368b3e2b84dac2c9ed38b5c4329ec2
SHA1 f67c4acef5973c256c47998b20b5165ab7629ed4
SHA512 d662bff3885118e607079fcbeedb27368589bc0ee89f90b9281723fa08bda65e5a08d9640da188773193c0076ec0a5c92624673a6a961490be163e2553d6f482
MD5 SHA1 SHA512

Submit Download

package.json

Path C:\Program Files\nodejs\node_modules\npm\node_modules\common-ancestor-path\dist\esm\package.json
Size 26B
SHA256 1bf0e53fc74b05f1aade7451fbac72f1944b067d4229d96bae7a225519a250e4
MD5 2324363c71f28a5b7e946a38dc2d9293
SHA1 7eda542849fb3a4a7b4ba8a7745887adcade1673
SHA512 7437cf8f337d2562a4046246fbfcc5e9949f475a1435e94efbc4b6a55880050077d72692cbc3413e0ccd8f36adf9956a6cc633a2adc85fbff6c4aa2b8edac677
MD5 SHA1 SHA512

Submit Download

LICENSE

Path C:\Program Files\nodejs\node_modules\npm\node_modules\json-stringify-nice\LICENSE
Size 780B
SHA256 3f24d692d165989cd9a00fe35ca15a2bc6859e3361fa42aa20babd435f2e4706
MD5 b020de8f88eacc104c21d6e6cacc636d
SHA1 20b35e641e3a5ea25f012e13d69fab37e3d68d6b
SHA512 4220617e29dd755ad592295bc074d6bc14d44a1feeed5101129669f3ecf0e34eaa4c7c96bbc83da7352631fa262baab45d4a370dad7dabec52b66f1720c28e38
TLSH
T1D501418FB2A12A8414D09B643DA1EC8971C9F03B3C43AA153074E258C7BB80F947A400
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmsearch\LICENSE
Size 730B
SHA256 2ef361317adeda98117f14c5110182c28eae233af1f7050c83d4396961d14013
MD5 072ac9ab0c4667f8f876becedfe10ee0
SHA1 0227492dcdc7fb8de1d14f9d3421c333230cf8fe
SHA512 f38fd6506bd9795bb27d31f1ce38b08c9e6f1689c34fca90e9e1d5194fa064d1f34a9c51d15941506ebbbcd6d4193055e9664892521b7e39ebcd61c3b6f25013
TLSH
T1C001D08FA2D12AD454D59F643DA1BD4861C9F17B7D43AB043074E358DB7744F986A404
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE.md

Path C:\Program Files\nodejs\node_modules\npm\node_modules\minipass-flush\LICENSE.md
Size 1KB
SHA256 865576de51d520f97c8869b9b9f96caf8efd69b82bb6e575fc00b0964dc7a3ca
MD5 236eea678a0baae4690b3fee5f11cd6d
SHA1 0d97e894b9fe7f7a8e74bb99619e415a65726a40
SHA512 e7e720da4ec95a289fdc5acb7d9d06fbab28b15476e1eb51155e0a131a0222d5e44794bd49088230ae602173ec3c49c789b6c2e28a3146778624f4b9244c1d8a
TLSH
T1AC31E02F665E975302D041066F43A0BFF51A457D966E02F23496905833F6B2246BB8BC
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE.md

Path C:\Program Files\nodejs\node_modules\npm\node_modules\npm-profile\LICENSE.md
Size 818B
SHA256 733dcbf5b1c95dc765b76db969b998ce0cbb26f01be2e55e7bccd6c7af29cb04
MD5 2916d8b51a5cc0a350d64389bc07aef6
SHA1 c9d5ac416c1dd7945651bee712dbed4d158d09e1
SHA512 508c5d1842968c478e6b42b94e04e0b53a342dfaf52d55882fdcfe02c98186e9701983ab5e9726259fba8336282e20126c70d04fc57964027586a40e96c56b74
TLSH
T14301128A62E62A9055D19F956DA2B89E61CCF0673903681430B4E24CDA7704AC07E414
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Program Files\nodejs\node_modules\npm\node_modules\promzard\LICENSE
Size 763B
SHA256 1fccd0ad2e7e0e31ddfadeaf0660d7318947b425324645aa85afd7227cab52d7
MD5 7428aa9f83c500c4a434f8848ee23851
SHA1 166b3e1c1b7d7cb7b070108876492529f546219f
SHA512 c7f01de85f0660560206784cdf159b2bdc5f1bc87131f5a8edf384eba47a113005491520b0a25d3cc425985b5def7b189e18ff76d7d562c434dc5d8c82e90cce
TLSH
T14701F18FB2A16A9454D19B653DA1ED8961CDF0373D43AA143075E258C77780FA46A404
MD5 SHA1 SHA512 TLSH

Submit Download

package.json

Path C:\Program Files\nodejs\node_modules\npm\package.json
Size 6KB
SHA256 44ff936daa5cd7f9f99120d5db7c2e5e21283125433e61d1b42912aefe8b1bc6
MD5 ce3479414e6f0379681439a95c8cc058
SHA1 79eee5b19d58064e6f6eab5208c060f61f0b86ea
SHA512 3797d41151d29257bba8cfc4c7ae0601d126e4be5612f52c33146745223f4e8526d2a338a6ff66c7be805057378b230399c665de78ceb2a55619b603b831b4ce
SSDEEP 192:Tqv/QFQP66/GBXK9dryayoeZ20l/ZT0Ybb7k:Tq3QFQP1oX6ZyhZ20/bo
TLSH
T194E1DB33CD69CEA32EBA9A9EBCB44102F128435F6105D44F32FC9B8D4F72667056A725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

npm.cmd

Path C:\Program Files\nodejs\npm.cmd
Size 538B
SHA256 21b46c69ad6e2f231f02a9e120f4ba6c8e75fef5a45637103002eab99f888ab8
MD5 6895fc6423c97fbf721a71333137d1ca
SHA1 e0a531a3a869f2c3bb1ea91801a8a386d6aaf73e
SHA512 0cdaa6bbeefeabf676839d88e96a096b13b9176bd936e11665ebf01e57540e131981a7bee4f113d2b5bd6858656f7cb689d29ee81d9f9e8d7f87d2d91e041ac0
TLSH
T1A0F0F6B6F8E94EECB11B0F613C76482574CBB4573C6610E6262C8514C7E46E004C235B
MD5 SHA1 SHA512 TLSH

Submit Download

Node.js website.url

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Node.js\Node.js website.url
Size 133B
SHA256 afaa6c6335bd3db79e46fb9d4d54d893cee9288e6bb4738294806a9751657319
MD5 35b86e177ab52108bd9fed7425a9e34a
SHA1 76a1f47a10e3ab829f676838147875d75022c70c
SHA512 3c8047c94b789c8496af3c2502896cef2d348ee31618893b9b71244af667ec291dcb9b840f869eb984624660086db0c848d1846aa601893e6f9955e56da19f62
TLSH
T1CEC09BAD49098155D3424547C071FC48DC4E79D14CDFD45D5294DD9F5D84091C854569
MD5 SHA1 SHA512 TLSH

Submit Download

F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

Path C:\Users\Admin\AppData\Local\D3DSCache\162f0fe603346339\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
Size 4B
SHA256 7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba
MD5 f49655f856acb8884cc0ace29216f511
SHA1 cb0f1f87ec0455ec349aaa950c600475ac7b7b6b
SHA512 599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8
MD5 SHA1 SHA512

Submit Download

63a61f31-2bfd-47fb-9a9b-e1236eb52d66.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\63a61f31-2bfd-47fb-9a9b-e1236eb52d66.tmp
Size 5KB
SHA256 2a9b43bd1ebf073472ba35b18949e4ecb119721741f64dc864ff1c545db3b3d7
MD5 0bf201a360765bdeae4cf9740adf5817
SHA1 037980f01c2c292e4c622fb2fbaf4f112cd45de0
SHA512 ae320416cd58a75a9227fa4994374457c90641e60896bb3654e3726090f7cab20e8e9c886b84ca42845bfd39ff2846f3e1bc857ca78b89332fae8f912a7548c0
SSDEEP 96:ubJod+x7oIU1fXfBVULgnSl8h4otop57uDOB6uGGwvLX21CRCORNC39ISyVNFD48:utoG7/qfflliU20ujv021CRCOuCjT
TLSH
T1FBC1F970945D9D2B5DF2A449B2032953CEA960AB6914BE18E9EE1F0902E65ED1383923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 e25db8bd0e15f32c0b5222151ce6cee34f5deec9decc42b90281755337be1497
MD5 7a607af3b1a12e26bdf1738d90c863b5
SHA1 ea47b654b7b772b3662683d5bd60c94c6461cc21
SHA512 f86f11f5e185c9cdb6f80d214b233e1e85b706fc42d7f7d91bf26d4fccf704c20f67a8db75e6434e6d3d84ce7ee3c7706ca3e029e6268de7066cb30d2fc69a85
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000035

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000035
Size 73KB
SHA256 f3d2fda12260ccf193da50e70fe5efb8b89d3c5d4e246eaa053f2cbf4fb07ca4
MD5 345c1023e3d262fb90bd367013335e0f
SHA1 30fd5c4da80ace38caa4fc0da1c950b6ea210787
SHA512 9ae18642326e9e10579bf7b137e14cf5da51953fd2884db14dc6050c4734ec9ad58f7afa35e1d9ee2d0672827845fba2a076bf25069ad40a31de93179c76c842
SSDEEP 1536:gJJpWKEN0+OUU0C2XYIyfDqHbs9hB09CfZlKMVOSUFV+qnCQalSYnUxMv:cjW1b1U09DGyQPKzSUFVXCQalSYntv
TLSH
T1D87312C66BCE83A9791BCF3D0D254488AB74C4F0329AEFC3957AA08D7515134B1C63A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000036

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000036
Size 62KB
SHA256 29e3c6c1aec37ac2af49f0a0318d6a4c0653e8e26ef8b3ee91b923073dd3c197
MD5 23793defc1323ea3f3e0b105e70803b2
SHA1 6239daff26359661097ec66f68636b5f3035dea2
SHA512 d699386dfee45ca8c6dfcecd8aec0dfecaa8822afad038e26f56c933712ae7ff9e55db567fcf275d8f2a29d98cd1734d93a9cbc1461d1dda39d1a7fa097cc63e
SSDEEP 1536:mXPI7rkkzxzCH6NGIvaSNXkkFRPvk9VkPf8z:swPzCa9kelvkfYUz
TLSH
T1215302F1179EBEEE6619A648DFCB720A4CFC5F17123531AE5D08991DF1B07672293810
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000039

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000039
Size 158KB
SHA256 60072b4eb6fc5f1f1214a34fcd55b3cbd1d05eddf778f85611f9b352c4c6452d
MD5 83266658f29f5cb762001d5d9f6985a7
SHA1 9ff52157193e1e798944e6a3172d938183f5e550
SHA512 60b2a8749bb597b71c6cb7113c4ea6c430ab90c6f6a5f78a36ab5fbd2676fbc173ade236be939e862569c786fbdc8e0aa984f1ae4263e91de2ba681cc8ce5d66
SSDEEP 3072:pqj6fcYjfI87fn/NWUEu+Y4rwgnWSPrrGh9SC2VRvkQdv45cf+Fg:pTvjg87fnVTEu+W3rSC2VRpBf+y
TLSH
T196F3232CABB1EF2298ADD32D789EF491C870553AC097303BB84FDF8575154348A7684E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00003e

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00003e
Size 72KB
SHA256 55e1d7280ec5140499544d5f3933ac9db28308ce54c72ef8f55947858a3f326d
MD5 c863b7a0576cf90cafdeb009c9a8ac04
SHA1 91029976e3ffb7a540a8091c33fedc49500d4a63
SHA512 b9b8d76c4b4860e1c6105d8603bd88f0c5574e53d00023f111d47ec8741ee6a09ccfb8aa748976aa7b1adc07fdd9bac239b6e449b9f6a434224e51f280926ddb
SSDEEP 1536:D2LnYSPdZDumhZtO67G1XcMJx+DY/agu5oUQP2/v7dIUgVVv:DonYSPdduoOEwDUY/af56e/aUg7v
TLSH
T1607312B6B7F2691C6887F6528075889CCEC062E8A7B3CC57E11113E15532DEE9B23CB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000057

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000057
Size 38KB
SHA256 7165713d3e1a610399471a5e93d5677508f62ef072c1151e72273bf4bd54f916
MD5 9436affc97843765a966b3568fa7e5ec
SHA1 7bfda74bb30589c75d718fbc997f18c6d5cc4a0b
SHA512 473ec3a843c33e18d6d194651fe11353fcd03a7959225faeabf8c77484155ea6a7bccb72dbaf2093ed53c408faa3be9f6fc907f7a5ddf8223375f9d09b504456
SSDEEP 768:eUEh2+iKBVQbBhu8vjenqz2Ez6Y/AxHLEaP72sV9qKYbDblXqhP8qwFSE3uk:eUEEoBVQDjeQaLnP2pfZTqgSEB
TLSH
T11703F112148F7FA1C244F224A4EFE416ACC3F565ABA15E6980B8B7C7010E3C657A46FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000059

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000059
Size 509KB
SHA256 e246b979376f619c5dfd9006ae1847df50678e7c1e00233580ea44a9965bfdcb
MD5 8e92c3816d7a3f40eb0b5b330c925424
SHA1 fdd5a7c7e586ec622eff859d2fc4abb29a43bae0
SHA512 4a5ce3a3e55b0b1306b776000e54d925bb7f6e39ae443a49177703facc9d7c583f398182b13ffce80b898cc7a3ef96ff651f727d0e49f52dc4b385f0f09cf4a4
SSDEEP 12288:J8ELlagEH4NhsFI55j7ft5ShD/IkoPFtfPjwv92C58Otc/Mx7pI49e:JNLlagW2P5vft0hD/IkMFtfPjwFq6cEA
TLSH
T1AEB423C3CB8A34814190C39E65E88C1E78E6535CB5599AE86D0AE0325BD7A34B1F3F7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00005a

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00005a
Size 86KB
SHA256 93ad550a052f8791f2b4193306cb131c4ddd2a2da0ba788b6a7fb04124fd7f29
MD5 ed307dc4615526e5655c6d10e2ab7348
SHA1 267db7e04ee8cd7fc888e8a5034cfea617652fdc
SHA512 52a7d52919790e87045fb68555a9f8d545881cd099357d27896586ef83cdea9c782387063103fc617347a57f8a52f3742b5000dc7fc762d75295c2a38c4458f0
SSDEEP 1536:RHMdUHWNCh/p80Xx933jj4dbOgHGIQthJqjpxBirjI3gLJQ96zmarDYIzGzc:RH+NCNWS9jjJLIayjZirk3yJQ934Gc
TLSH
T14C9312F1DDB1EC5044611538DBE1BE0FB2771DC17A2DA4B2E0EFE0D22D1A89579AA342
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00005b

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00005b
Size 437KB
SHA256 a451b8791f9183f16a2b30959f9f69e20f35117f8ca6e34e463916869328f3c8
MD5 15d9ce7fe8b446c91cc0598983dde50a
SHA1 b2ad1e9b11a41f5176e3cc495dac68aa26e0955f
SHA512 39e14f23bbde8278b586057eeb648777afc1e6d11b71f3e5529688341f7868b61d0d7ef43cc925189a70def4a6b53e863a06fc8d36e7551c9a50745be6607529
SSDEEP 12288:9SyJNj5Vy52pw6eyroMIW3/dJhlzOH7pVUa0Uiku:9vJzV1pw/yroMfCIUfu
TLSH
T10B9423CFDB2108E7FE76C411CDAD9FE8049BA554056D8CB35BB6066D825A0808636FEF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00005c

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00005c
Size 65KB
SHA256 bb4ac87d7d85308f99aab12213a4459b119c3d5f23601176193b8295c5856eab
MD5 9be56932df6c4ae909ba76a01393ba3c
SHA1 1fdc0c7e8b55bf246998643c7138739d1281ff4c
SHA512 c6a291065c76eb9d0207f683862cd5d0243938a9a2e4abb9fc33c6b5da71f378353a395ec7d9b420689386d4f9abe6870e32983247718ef8339b800ec1200737
SSDEEP 1536:EYvv1jjVZuwBqSSYRbcPKkcFdO0q4kGnriqRG3MeDDbE:EYH1X7RB/UISJ5qRLKbE
TLSH
T1CC53024674D2626F65D9DFE813AFC5C481820D033BC52BB7AEA02E502933D1DEF4929E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00005d

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00005d
Size 51KB
SHA256 06686a9b64dc0599287c1970d2cb7ae62df15c2370028397e5f88523c04fe117
MD5 4097ee1f3adfd5780fa9644504fe935f
SHA1 8090fc33edb97ade5b7b5cbe8088b62d6d7216fa
SHA512 25ce640305246eda8b10dacdff6997628d775f2f61de223088025d1d8bdbbd00ef02a656c56220bce7119d4602336c54db6f0dbb0377f8dd600068b1a2bde90b
SSDEEP 1536:CCAjraOnYVgF5NPKTUVNldbZLh5MbZBTf2WV:qjr5nhFKT+RtwTf2k
TLSH
T1993302A17E96D862FD18F23656BA211208FCA4153740B38D4989753764C675CFEE8FA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00005e

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00005e
Size 57KB
SHA256 9ee92b22caa367f9168e2a21e3fc7af1c620ae04fc0b320bc616afcb5cd8e74f
MD5 ac4156d5389a9b20320d197052e88aa6
SHA1 195e015e35ab7f2108a5738ef98cb9799666f003
SHA512 7a3385f2d0627fdf821299addbcaadf908e719e56fe98d0d7e29e7e3e5f3c0dd46bebeb0f7bd8350d5bbef06cf17603e10a46bb4c6f6a92c92d177cc0f38a9b5
SSDEEP 1536:yiCTn7nVbi0XeWYmDEx6E+EWPPjDj9C3I8xNmmGI3KyK:Krx7zYFxfLUjlorNmVI6/
TLSH
T1D143021FF0CA968C3EE6462C1A84D0E715A8E48DC49A16CFDD4540D288BFB554E6CFCE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000067

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000067
Size 21KB
SHA256 59f691d7b5709a0381af9a8744c3b6c0b68336134225e2c0411a91b9c099964f
MD5 d67a9717357706dafc9b8010cdc6e9a4
SHA1 506331b686f75fb15d75fc52b836cf08b99577e0
SHA512 d8892734cd16ac85050a311de6652b47735f7b62304c9fc55d948f9159be2733faa0c4c5ffa1d9edf88580418437662d78d193722cc02447a2532217f1fecb55
SSDEEP 384:MEGZoJTz+pBySJirwVz95+Cj2Wlj0UHnNAESrAbRFeXZmrmZOdb3ME+yPuxyS/Dt:M9OJGpBySY8x5+i2WZtbSrkjCoIyOBZ
TLSH
T1AFA2E1394CE4185E02AA26DE9601CCD055D14BC467EB340EF5EE8A0BE76EE87432B8D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00015f

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00015f
Size 82KB
SHA256 545ff328d1b42c99d48944aceabe93891eeef83b35fa3070befa5e9c339692fd
MD5 486163793df594045e838788bad5c0a5
SHA1 f462070054cf27864e2e0bf4cfaaa777945f4d59
SHA512 a3fd667265d63da0fe9986cdb4d60945ae06cfcc5fc958759ab233f38e0de658d9338cfedfbe33a47ef131fe86847a6ec6031cf134f5099c15ec587258f0404c
SSDEEP 768:0R9TREcSvF9ytVw86APWQ7vvvvV3KmSPA31oWWz0062nu0:0RtW926AX7vvvvV3KmSPA31opA9y9
TLSH
T13A838DE1D3555422FCFF33B34E0B1E26C4943E7229D693E103A19891C9B43A76E4A97D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000160

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000160
Size 817KB
SHA256 cd49babac36b8da07472ea87de27ca1909f57ccbbf3df38a10ce16bbcd50e3aa
MD5 a2c30dbb8136451755df4f0d1c30ce17
SHA1 975a66944d3926b3940dbf746ad34f5a16ce05bb
SHA512 0f8e81b9c4d4948b4e8f83b6671a29dfa9c7180ee7868906599326a7008b1c814adf0bc7149383be77a40b05579aa452e80215c4a376b0d4ead49c6720341e5e
SSDEEP 24576:LXrT/y/WVlPRMiC1M3GbRv93h5xUX/Lx2eKDnhV07W7f+WPS:LXn6c5RMl1MWbRv93h5xIV2NDnhV0iWl
TLSH
T16B0523BE49CED96FC063783DE82B576874A0F98B0178DDF9B4A08D09759C34A1A6C335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3af6c0841bf96d3c_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\3af6c0841bf96d3c_0
Size 269B
SHA256 1db2354d8e77a776509074f142391086e0df392d5666a8e79131c2b8c42957cc
MD5 7d795ddb9adea7854c6d38e7b18a6187
SHA1 0f46d1c23889b39dd1e7dd08e2693a75c3aa6cf3
SHA512 7400c99dea2475b995918221c4cf5546b70ed354dd2a136e80136959e673bc6a638c72a172d16e2cb6b452deb47000a4b91246b00b21e0af8f7b633bc579c357
TLSH
T143D02BF790101411C5BE55F586A99275831340844C1A94501412B09137006B5A2872E0
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 8KB
SHA256 3a2eddab3a63af610d8f18f6a8aa2466e840e07cd7a443ab4779791973a5af64
MD5 0da5dabcde88a83b3f519b52f1ba1401
SHA1 36ecce67126e25742b616a08b3c34c3594252aac
SHA512 e4e2cccd78e02da15893d506bb94b650e77927ea202657c4fda301c411660c9cbdbf0428301fde1b5c736b4f8a42f2941b89995cd1bd2e9fed2df25ab49cb2c4
SSDEEP 192:H92B1dOf7OGM4LoJ+5YcgSgQaP6SJJtVEUAk:HIzo/M4L9Kcgz1B5
TLSH
T13E021B9D14833428EF583EBAA9E39D067DF5545BC28B0FBB0345D6722FD3794A03A508
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 8KB
SHA256 ec8223344ee21ced4951cbbf650ac41abbcb85dce901f1e617ba3738d38d10c6
MD5 56eeb7583e9d37dccfdbf84ee2114e5a
SHA1 7e37ab7ad9dec36f18bbf267eaa2c2a11a2df946
SHA512 a25211a5b041451859bc4fc58b7f8a04ea12d8b6634e83601397d098daf79a92758dba60e2f771490b3e82a886cbf34606273253ebc9342869d0ea38f848055f
SSDEEP 192:z92B1qOf7OGq4LoJ+5YcgSgQaU6SJJbVEGAk:zIMo/q4L9KcgQ1Hv
TLSH
T135020ACD14833428EF183FBAA9E29D0679F5945BC2870FBB0355D6712FD3798A03A608
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 b1da41f7feb115655bcadc1a5526d9fc534ad3efe7d5c3f701b372d4bdf8cdc1
MD5 07222fea9c7502de9a4ceb0cb394a01f
SHA1 ce0f5145f29d3077f6efb575150d9e8c2475225f
SHA512 6955c9f2aa3c3ca1b9893a9e11467a7777972c5feca6f516d8e320f547f311b1f3dc8f69e884c4ca344accd71b68b657f5d064d5e67a792f229e558cc91e40db
TLSH
T15E51999120833124FF291FB6E8E10C07B9B48966D7C71FEB06A8D6722FD379D5274A49
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 a49f4cab9d823762473ef714aa0b4f4a35580f5b5d00a320d9070a5372e8a948
MD5 4f0ae66655ce53eae282598c5745fbf8
SHA1 fa3e2810321d912dc8befbb6fa91ef8779e6f02d
SHA512 954a5ce65083f470ac0f5b5b94fa0572fe08ffe7a1215ad2180e943cde9ae87549a57f53eb7958ae5a1a604c6acd74cdba0d18d32f1a90f3fa327ca0ae966fae
SSDEEP 96:aYRK9sR/P+MOkNdfiOW+dx9ZJ+NPG9Y2hmdakYttEBdJ8pkRh43WMbdHB5OFn:M9iP3OjOW+t3sVdak6gJR6UF
TLSH
T105B1238614473838EF6D2FBA9EE7DE027871506BC68B0FFA0754D6312BC23A84138608
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 e6091a5ff2cf91c5484db3465b544bd5026869f2f80c37a5d7dbf9c9d525adfa
MD5 d86a030c3d799827de2d462b9e82ac02
SHA1 313b2af28c57a864eeb985df47da821c711f87b7
SHA512 d55c61427a695aa81fd763db13d86014d5e54673dce13c233b1682306f2c1d06a35960f99132df053865a59eb0a172316f5cb74339f153dc916859be41aa7fed
TLSH
T12E51A89120833124FF290FB6E8E14C07B9B48865D2C76FEB06A8DA722FD379C5135A08
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 8KB
SHA256 2b16a6cea3d1a8a68c05ee92c15dcd58a73efdb2999e15f6397ad9e0d883f271
MD5 155fb280f5f77b0dc1d7034f05eb7ebe
SHA1 1a0fb1e283cbc1aea791e8c300211495abde0875
SHA512 d4158fdc6bcea031899236ed65b6bf9d7a08a751fb768e9a2bf82ef9af5e8c849f86e6d771c81fa06cca4032a74392a742fb2b64fe7e6ffcb1699db447ec0ef3
SSDEEP 192:W92B1qOf7OGq4Loi+5YcfSgQak6SJJXVEiA2:WIMo/q4LEKcf41Tx
TLSH
T1D1021ADD14833428EF183FBAA9E29D0679F5945BC28B0FBB0355D6712FD3794A03A608
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 8KB
SHA256 0113f8186aa0082d305fc0be947be9103560593f2e5de214c672e676a8654dde
MD5 15169f6c82ed65da5e87cde728197ced
SHA1 3b4aeffc220e330e433b3f6793367a6643afaee2
SHA512 e366137186378cd45a21c86350508b32c0b91f64402190866e2f978db059d0e293cb5fbbc5872187ebc9e635e7365231b28b2b783ab61b2c132bd476309d4d25
SSDEEP 192:u92B1qOf7OGq4LoJ+5YcgSgQaU6SJJbVE8Ak:uIMo/q4L9KcgQ1Hp
TLSH
T1F9020ADD14833428EF583FBAA9E29D0679F5945BC2870FBB0355D6712FD3798A03A608
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 8KB
SHA256 b0e364f624ec1a61ffadb1f78998d737dc6bea73879d3258b09370ee1ebf1dcf
MD5 e445dc3f1ff5b8b467649b4829acc0ce
SHA1 a624b7eef4b2967d0978a28ca96ef0320837b1d9
SHA512 8bbff97ae07de0f1db4b0bf84d4425a341237d9991fb1080e136fc6f32c3c2d60fe067b5c83b3da83e0fc2ecaefad7720e6dac2104d92a8e3858cd9f4161a889
SSDEEP 192:c92B1dOf7OGM4LoJ+5YcgSgQaP6SJJJVEUAa:cIzo/M4L9Kcgz1dL
TLSH
T1F5022C9D14833428EF583EBAA9E39D067DF5545BC28B0FBB0345D6712FD3794903A508
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 408bab9d14294189a15973b6d0d4389dab6b749ffccef0ef47cc49a3353a0797
MD5 bcc3753f8f4c27ba8d122ee69a216951
SHA1 6e8233a0e564a61da5fc7daf6d9a75fd82cfeb65
SHA512 b341acf40bc5bdd59f33150c3bb7f7de21b504af13b1eacb7d591e600602a311e45968a0834ef9758190da9ede4164d06eda8ea881bb8594dc8b8308cd4ff4e6
TLSH
T11851999220833414FF281FB6E8E10C07B9B44966D6871FEB06A8D6712FC339C9274A48
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 43b42ee15efac34aa98f76c0b427346eda77551a531860fc89a2843285fa820c
MD5 542c66e27bd4f5ea71810d97d2ea66b7
SHA1 9c7a078838e587c10b5823e960fe944e218e6c0c
SHA512 92ad623da9553f4d894a690f7e9a12f558d6abdc7989f1986348c8f66495a8d52bb9ceda094917193093cb4358e15e6123b8c381c4c8c7b0ed7da07078458ed4
TLSH
T1F341659120833525EF151FB7E8E20C07B9B04869E7C76FEB09A8D8702F8238D9275A08
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 29KB
SHA256 8f6c4cb887ddffecf3729b7187f275174ea95524354a100f6dc1e7a1be42d8db
MD5 93f919beb498528ad8c592e3d8131502
SHA1 655e86e08891e94d0e6da22123291cde97f0c39b
SHA512 50081c35b2b86a469c932e8595ff924c7ccde98ba84df9197a738e2c6b840f24bbfb344ee200bf8a69769a4d9876d2201f90b3f271a9cecdb06f937f6b25cce1
SSDEEP 384:DHljL2APEpkek33g3UUBeui/e+RJ9JaBepAVJlOK+we6aaEIde0Cy4IP/+4ECYKX:CavUguMU+IgSYXir8Ugk5FP
TLSH
T1B6D2A9F383E5D96E891166F85A146E1BCF1C0615432C3C2988E5BE47E3F2473E16A64F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 34KB
SHA256 55441e5a98b9282cc23482d0af30568a4a3765e126ef77177b71948f1eb6049c
MD5 509dc5d292d7c27c8564b2c0557ece1b
SHA1 0842c81ea2dc62eff36920e2983a7c1e67232c3a
SHA512 c0c6c769e21a25bc0a1d06db933ae289eefb77e625c1a9cb43ad2509ee6adbc2420a8473ad7b6e1470935818854036f8f859218c56b95716c9c825bc29f06a77
SSDEEP 384:DdPll0f+tm4eO33g3UUBeui/e+RJ9JaBepAVJlOK+weC/WH2PjBV6aany4IP/kCG:aavU8NUZIdSYXir8UgdK2h9
TLSH
T16EF299F383E5D96E8A1156F85A14AE1BCF1C0719432C3C2589E5BE47E3E2073E16A64F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 35KB
SHA256 6f42256c9f725e553162eec3c1f173d86200270c090ee87e737f77998e01b100
MD5 761bb36674d32ba505457077693134d5
SHA1 7087f9cb74dfcc543cf170d63c20a64cdd02bdc3
SHA512 0584ff49e8ae8807ed50e6097bed8b813fb0fb5495b58447f3aedeb73e65827d4b04a4786e4216ef38cca8ac9c4ee5692350a89a44478f7669f6f164a64b30fa
SSDEEP 384:DdPll0f+tm4eO/J5mwpBeYoeQRJhJlBe6b7r7t/RW/0u1J1KStuQ15JNJJZhxE18:ncTnyloNUZIcSJXorOOpe1zyB2L8V
TLSH
T105F2AAF793A1D96E8A0157F89A14AE1BCF1C0625432C3C2589D5BE47E3A2033E16E75F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 37KB
SHA256 a512de7b64119a3d4f189e1484e982ce97916dc4c154c47464d70029ea442202
MD5 a27b0c0fbcd86f43534a542f193a1fc8
SHA1 a82d7bd9d61c0f39cff531ce4da22da5cde653ae
SHA512 a9ce08e3219b0baf6a265d98b458d4cff5a81127e349365e452233b10b02e2a54e9f68ad0389f7302bfcee1417dc4f4a282b80c184f193f2511a2bd58d629dba
SSDEEP 768:ndTnfdENUZIcSJXorOOpe6aYFTA9mjmJf:IC5AumJf
TLSH
T1C103BBF393E1D96E8A015AF89A14AE1BCF1C0719432C3C2589D5BE47D3E2073E16A65F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 5KB
SHA256 cb048421b8cefffdd5412bfa1a0963ba686103af73833ce431310dd134dd5884
MD5 ff0034f25ae6cbb2440ac38ab30b592e
SHA1 da939bf935ebbf0c8d2fc8cb2069ce14d306346a
SHA512 393df2a48c77054a1db238ef70578e492c4918a4ac698146de124fb1fd3c9d546b6942ff3adf654c66195a9a6a147e190d45f712a793eb99e5507e2a04d34cd6
SSDEEP 96:SUEGUVUEYAUiUUU4UBMieUYdsU2UaTU8vU6UUU9UnUofUidUcUiUyarU7UojUgUa:SUEGUVUbAUiUUU4UiUssU2UgUoU6UUUU
TLSH
T142B18DA7C57EB81B203DADB71D48B8291B7AB435018168F8DA97C36CB0964F727170A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 6KB
SHA256 744699fd8f99b39260d28509f3a4267a1a70ae6a96ff8f751aa4d86d979610d1
MD5 8de66ba14a91149edb78cac0522e2c56
SHA1 2c7d5efae462ed34b0a24fbfd98fda99368f8d90
SHA512 1951161dfbb7d45058175ee2f42a0e9b822202b50cb9087b495d4a28bad68bc3485b7d02586d7e34f19f1243595869a5fe72140cdf5cc72fdfc342004d7bce20
SSDEEP 192:fUIUEGUeU0UGCU0AU4iUuUUU4UjUPsUW2UeUDU6UUU9UUUWUiUnUTUiU10UPKUz2:fn2zFIDAot7r62sG7ITpujXd+cT/kK02
TLSH
T1FCE1C2A7857EB81F203DADB71E89B8151F7AB8350251A8F4EF57C27CB0864F72712066
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 d551ffe243e1aecad7e76bbf1115142534a3f8b42e5afbf8624c5480d65f58fb
MD5 2ddc3dcd6787d8b7a0ffd3d4eb6a7e46
SHA1 1abddf0b9952e3ea7719ba95ae3e159c8dcc0323
SHA512 0458895cb7b06751aaf5663206903b9960a8d69bfabd011eb8884c5817f112044fb93b7ad641229088218cbcefb043a90953143092f27902f65cc39950cd5376
SSDEEP 192:uRCcBhKP3/v7O+PRpRCIg+jWYsyu9ZHsb+WNZQJa0eNKIO9+zgdVSE4verZZ/ArQ:uRCmhKPXZX+bwo7x6EFZtqaN8E
TLSH
T18D62D66AB9646A7B5DDAC219F921B756D3F6106620D02E84FBFCCD2C15D7ACC3213403
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 c30327421642090ab095562fb029b0b66227b92a67d350f8cc441fff32a23ef3
MD5 a1cd4b3e907a317e4b124c8f46fd8a8e
SHA1 7e3f62ce2564c3db11109910415592115111b1e1
SHA512 ef2fedfbf680ffd115716e656ac81090f284e440791230fbe0db5f5de9115f660c1bb33247af96a2520736c01903d3e285d8bbbe7068f594a7c3eeab21cbd9ac
SSDEEP 192:uRDcBhKP3/v7O+PRpRCIg+jWYsyu9ZHsb+WNZQ5D0eNKIO9+zgdCJY2verZZ/ArQ:uRDmhKPXZX+bwL7xmYzZtqaN8E
TLSH
T1DA62C76AB9646A775DEAC219F921BB56D3F6106620D02E84FBFCCD2C15D7ACD3113403
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 e7be710d8abdea95645080660538f1fcbeb1e95c7805d6c4db31e2063f49f7b4
MD5 7eb58432f08949273d1f58bf754bcee3
SHA1 c78f1ed44a0520662e2fac85cb1560b4ced206b2
SHA512 8de329f4e3f5f284bdd4adc0d9a9c178efae543e3123b87055690626681a9adfc02f0d9dec23be9997c5fffb3ee075407355848877fa13bab357307d9dd9292d
SSDEEP 192:pRF6PHfv76vAPRp2BB9ZHsb+WNnR1oKh2dqerZZ/AramYVyIsnAUgR:pRF6/3G6Xgbwj72BZtqam8R
TLSH
T13E32C62ABE54693B6DDAC229FA217753D7FA103231942E84EBFC892C15D79CC2227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 d9a4234c5b958ca6e0ba5ac13d70d6c58461cbe7e3a85b98679b352941369d8f
MD5 30bb9bea8e073a7529e538c57c9e60b6
SHA1 d6858c7f66c6d62dc7f5c0c552c6cb06a60c34a3
SHA512 6307a91d816934297ca457dd5b91479b3d9a5b1a0e4d93dab7c4a5d734556a4c8dd543afee9a8a26966cba7ba361799f036d98e613919aac46e3473527ddacde
SSDEEP 192:mRDcBhKPv/v7T+PRpRCIg+jWYsyu9ZH2DHsb+WNZQJa0evdrdO9+zgdVSEeverZF:mRDmhKnXwX+irwprqx6ELZtqaN8E
TLSH
T11262D66BB9646A7B5DDAC219F921BB56E3F6102621D02E84FBFC8D2C15D7ADC3113403
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 81958dc3f28d85e9dfceb062d4520c03f798a1f092bddf1aec590735dd4c1fb2
MD5 88fa24c1bb47a8af6e51a1e8f2d26e46
SHA1 9595a3f52fa154285f9ba247b539c8adfcc6c8b0
SHA512 edc7db82fb25c49ec21ac298203b48d2e6afe053fe81de8dfb1a22ad5e8c8f4a005b656a0eb8c9add07fa656902c552835d7d02a012b838647e97c43e44ecf19
SSDEEP 192:mRDcBzKPv/v78+PRpRstIi+i6WYsyu9ZH2DHsb+WNZQJ10evdrdO9+7KnVSEZvef:mRDmzKnXrXsirworqPYEgZtqaN8E
TLSH
T1BD62D66BB9642A7B5EDAC219F921B756E3F6102620D02E84FBFC8D2C15D7ADD3213403
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 3fa7564c74fc2a76116aacf21ad7af6f059398f29087f798acc1dace5d717b79
MD5 e4801410c673108ea60ebcad8a124a6b
SHA1 e819ef69907e1fb6dd7c76f7eff3486138cc91d9
SHA512 f131deff62ad0fedf3125ecf9757805023a3a1141ebac9ac4c2cda56a3d3948d5d48106060f24dc67abf00d9cb02f47f5df709621881346649eb073604156d1b
SSDEEP 192:mRDcBzKPvtv78+PRpRstIi+i6WYsyu9ZH2DHsb+WNZQJ10evdrVNwwO9+7KnVSEj:mRDmzKnNrXsirworwjPYEPZtqaN8E
TLSH
T10172C66BB8642A7B9EDAC215F921B756E3F6202660D01E84FBFC8D2C15D7ADD3213403
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 65fa3377c1897238f6d894069ddd6bb902d975e21d022f60ddc1a6f0128d6441
MD5 099f9f1ed6e45e2974312137360ad34b
SHA1 843b37df2821b71f4d33ad5ac910f95a1e715d74
SHA512 c6f55479206247b14a66a17130b25131b0f91b5c5cdb2fe6fb727e59096c523245224b7966e7d541b4abbdbbe8d8ddfb4f62b9c7b380aa0ea53ed34c6f83bfc4
SSDEEP 192:/RDcBzKPvtv7z+PRpRstIi+i6WYsyu9ZH2DHsb+WNZQJ10eOlzNwwO9+7KnVSELZ:/RDmzKnNQXsirwdujPYEqZtqaN8D
TLSH
T19572D86BB9602A7B9EDAC215F921BB56D3F6202660D41E84FBFC8D2C15D7ADD3213403
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 f97f99899f96feead003df932dd55bacae285b51d95fe49939a1fe7a0b9b38ec
MD5 6096cf5433d3a261e55c828fc092c54d
SHA1 24232dfa01b66a7ad281d670af81f2e2b928f812
SHA512 b990745ae07738cd7d7f76902e59cdd66c57178e0bf117ec0eb000b5a332215f2eeba7b57f286517c6db8f94fd49881ffb3ee7d47dd317b3dc8f24e1e7840f2c
SSDEEP 192:OR/xPyfv7Q+PRpRCfHWYsyu9ZHsb+WNZQR0ekbdO99CJYxqerZZ/AraNYVyIsnAI:OR/xK3XXlbwLqGYdZtqaN8E
TLSH
T13462D66AB9646A7B6DDAC219F921BB57D3F6106631D02E84FBFC892C11D7ACC3213407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 dc8ecc4bfd2b3005b63b442feea7a7ebead24dac3333e8a1040ef2a7fd86e749
MD5 c4162b79f2bf8473e11acd3b2a0008fc
SHA1 69df2f550772f0d6dbe0ce5066d6edeaec93a7ce
SHA512 d623f98dc918840dc84ea9fc27f430fb0e21c41cfc72ab9f61d2b789fa1cc9cb5c0eea67b2250b8e9944ec29465f4e70fc6f7f281165911196cf9d4404baceb5
SSDEEP 192:SRDcBzxPefv7t+PRpRCIw+AWYsyu9ZHsb+WNZQR0euVcO9+ET9CJYNqerZZ/Ara1:SRDmzxG3+XPbw73VGYxZtqaN8E
TLSH
T1E762C56AB9646A776DDAC219F921BB56D3F6106620D02E84FBFC8D2C11D7ACD3217403
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 875f80f56d48a5efbd821388da95eeee90f3cb9f584e5747d4edf4f871f1b087
MD5 926cd4252722dcd2f9b24b02d3212f9c
SHA1 71bdd94067afab2952248b03fe70466ca93c5d5a
SHA512 69a2e18fcbe8b6999defe29c23b37d118dc04c818b0662971a55e5ad3480d09a00af974861338a18f68e0c517ae3df0c490a96388a1f77a9ae835d58f61ef358
SSDEEP 192:mRCcBzKPvtv78+PRpRstIi+i6WYsyu9ZH2DHsb+WNZQJ10evdrVNwwO9+7KnVSEj:mRCmzKnNrXsirworwjPYEPZtqaN8E
TLSH
T1DF72C66BB8642A7B9EDAC215F921B756E3F6202660D01E84FBFC8D2C15D7ADD3213403
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 dc21aee163ec16a22a6b84d51b8d6873567f5c95a4d5562763abb74198756728
MD5 df3739f057fe6c75a87a0010130511a8
SHA1 4b8b1565b08cd2a782cd6978377631f826ff98a6
SHA512 14dea0b98fce438187312956325f31dc155c1fda677a77f2eaad463b2178ce4dfec71d0139e3d31b1996eed82efb469c5eac71c8eb5599a0fa5f0ca4540a19d2
SSDEEP 192:uR/xPyfv7j+PRpRCfHWYsyu9ZHsb+WNZ80eGlcO99CJYPqerZZ/AraNYVyIsnAU3:uR/xK34Xlbwj3GYLZtqaN8E
TLSH
T1E152D76AB9646A7B6DDAC219F921BB57D3F6102631D02E84FBFC892C11D7ACC3217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 0b68bce771918f46cd1519bf44d4ca5b629cdf2dd405b8c0be7540024aaabf4e
MD5 9b11ed1a16df4f4449a083c0e48aff4c
SHA1 a2cd5a417a2f5962dcfebc90bc33bf61532cb640
SHA512 a30bec212a8dbf08c7f200bf0fdba4147a9e9a4cf0d6f97cf0663ea158524a5fbfc4c5babd813f7b501c96911613ad4633e0bfb9bd41e181e1a8d514c1e8c10e
SSDEEP 192:uR/8PBfv7j+PRpRCfH9syu9ZHsb+WNZ80eGljCJYbqerZZ/AraNYVyIsnAUgE:uR/8534XnbwjkYfZtqaN8E
TLSH
T1B452B76AB964697B6DDAC219F921BB57D3F6102631D02E84FBFC892C11E7ACC3217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 16KB
SHA256 8a5d12b3747bb3e3080e3e34bfb95f27066f01cc469eaaa5aba95ba952166f29
MD5 32b723d017ae848e34e252a47adccbcf
SHA1 79883a52f304268d053fc1f7a747a7e61492a46b
SHA512 fe12f5292ffb7b78af290d85258156b62fda255693e3c439421bad7558d1e1d13dd8490532845f232a9cc5278c3688c794511f7db74fc26905d9f62af34e3d89
SSDEEP 192:/RDcBzKPRtv7z+PRpRstIi+i6WYsyu9ZH2DHsb+WNZF4JZq0eOVMNwwO9+7KnVS3:/RDmzKJNQXsirw6vjPYEBZtqaNQfD
TLSH
T19F72C86BB8601A7B9DDAC225F921BB56E3B6206660D41E84FBFC8D2C15D7ADD3213403
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 cf64f8f45a86f16c2851380cdc4a54d010230059369f4b612517560cb1945aec
MD5 2744d324d1d817cee9868ca46a0a729e
SHA1 5ee1833decab9a92a5e2ff80580d1098e8bf9553
SHA512 ab24cb7e04f3b64d05ed6e63e30eade58d87754003f4001c7d39df17bd7cedce9dbb2060e00bb568c868ab0391b92032cf1e3462bce94db1b9f5f5ce0474f587
SSDEEP 192:pR/8PHfv76vAPRp2CfHCyu9ZHsb+WNZ6R1o1aeMqerZZ/ArajYVyIsnAUgE:pR/8/3G6XCbwYfemZtqaj8E
TLSH
T1CE42C76AB954693B6DDAC219FA217B53D3F6102631942E84EBFCC92C11E7ACC3217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 e7c8b414de0cdea52ce7349daef3d11e3380c98c9676e277d7c0549a4959eaa8
MD5 fa4d5b65543d20f28442cc77422ae06b
SHA1 b7a1ff6d39e7c18859be35c72e09037e910d3b8a
SHA512 44a493579ce6d5d734f6200f7616ce028287dbddea4ab307b6e3cd5da9ba4eef772977bdcf602c2d30a357a0b635c439619485624d6a3b31ab032d824a327691
SSDEEP 192:pR/8PHfv76v+PRpRCfHCyu9ZHsb+WNZ80eR1oCJY3qerZZ/AraNYVyIsnAUgE:pR/8/3GoXNbwoXYzZtqaN8E
TLSH
T1BF52C86AB954697B6DDAC219F921BB53D3FA102631902E84FBFC892C15E76CC2217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 21bba29e3b6d9be195ec403c6d0fd2c5cfadbbb9dcfe457131c3b9c887a93192
MD5 ef8b005011c45adb3da73355113b9904
SHA1 000c6125eac0ea45a6138424a772d6dd1553d755
SHA512 7e922a3c8f4cf1ab54a22c33fe5e4bc4bb3cb232b5ffcea18e6dcb5ec96530824c01cded21afa8a2c30bf5022586d239d20a53a2c46255f8f6f5034089eba6d1
SSDEEP 192:uRDcBhxP33v7O+PRpRCII+gWYsyu9ZHsb+WNZQ5D0eNKIO9+ET9CJYYqerZZ/ArQ:uRDmhxPfZX7bwL7VGYKZtqaN8E
TLSH
T11362D66AB9642A7B5DEAC219F921BB56D3F6106620D02E84FBFCCD2C11D7ACD3213403
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 9cadfe649db211251961abd5aa98a6e627e971039fc67e690052e383f7885981
MD5 13f4de481965b71b545277fb18fcaff3
SHA1 4f7743199235a69e2e1a78458995bafc90ce9f1e
SHA512 5818e0b0c2d52aaf9e64a335b94a1c3ed1cbdc11c67a3d0e54cfbeea668983fd0842e771d4efdef8e4e602a9fffe01a096cf227397e4f5684e17a109181ed1bc
SSDEEP 192:ecv4K6WE7KxkXqK4I40pUZNCgVLHrKHfFKslEYUWXzKD/ls+ErUkKN9iBWepdsrq:ZvjNE7KxkXqKf/pUZNCgVLH2HfgslGWZ
TLSH
T1DA32C727A88E9A3B4FD8D50CDC166F8BADA542937678092493FF9D0403A57CE114A1F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7a1069ccedacd93d_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\7a1069ccedacd93d_0
Size 63KB
SHA256 85408823a08e7c0e43b1d191ab089a65d90ed019bbf6b3859af4105215791822
MD5 a310702313308d3a056418f1be645698
SHA1 d8b2fb075def8a24452a53007fd3e61d1d482900
SHA512 620e70edec10cd10d5c97943c1c3dc8e7b3e5327b0a8fd217410d3d0b100cf0440abdefeb15cfe0533fe085a742d8562b63dee9069b445e6475e6af1a5117f44
SSDEEP 1536:xmy3ZRdiKuQ8hviJCQAyRi73bA4Fqt1xDYPi/4i3io96:xmy35iBnhYACi7384gii
TLSH
T175535A963321B4B3837BA1B1906F1307713FE1A7F40485E8A198DDF15A94AA9427BF7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a1041c4c1a6088df_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\a1041c4c1a6088df_0
Size 63KB
SHA256 b6bd8d46f58705ab2ec9d2b2815c6d595c5b6828e2bd5255d1ec3e2835c436e7
MD5 1b46a157ef72450d28db2ca07e3f5ccd
SHA1 89a2bc4e2a2f0808ffb64429ec0c7258476302c7
SHA512 a09fe6540c955da52d713bccaf517c9afece287cc9108974f792db3c91ecba261ee8da908493281570fa5e1e75b0b96f144220125f42709a3e4b2d7d02212d6b
SSDEEP 1536:Qmy3ZRdiKuQ8hviJCQAyRi73bA4Fqt1xDYPi/4i3io96:Qmy35iBnhYACi7384gii
TLSH
T1F0535A963321B4B3837BA1B1906F1307713BE1A7F40485E8A198DDF15A94AA9427BF7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 144B
SHA256 fcb83d7b2060c00a3b7fb0cef7481c10785d8b8efe6f4a2065232c3e6a1ad2ef
MD5 5ca1c049f30d840c2cac6ea8ae708695
SHA1 a5e8c8e9b63139eccdce8b0d4688c155e2544d6a
SHA512 45c7e21b67eb6e48fd90df066190af0ed8c9a8d7f8b015bcf60823862a8c55f7d9375153a889043c22f42c749d22fa5e0261c1f6974a8019933bfb771816d224
TLSH
T106C01205CC813801DC503DB0E7E1A8E45B143F141303040F50C2E0899E16443130B3A4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 75908a8529e79e392752ac3dbd417387ae22bec109b3712e2b4b82d2f8633113
MD5 9671ef2b0e90f0a1d5541bbfc83a6f7e
SHA1 adf6b80afed84e6bc324d921922b9c2b1a950f38
SHA512 b0f6479ccd502e02a993693d3f1ffe72904445274c8dbf9eebc6c8ab120aab93f7c0a05064ddcd64a9f11a0c689802de1bf1dd10fd2e51b462069f0a06f9c3c6
TLSH
T17FA0023146853515D80056F45BC605E1271059540389074980E0E04CC958553F166200
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 120B
SHA256 bc1cdc1b4b00a598f6796547de023c96b29763e0af707b1bb9428a26cc6dab53
MD5 56653c2d2b2eeb3d6198ae7b2115df9a
SHA1 114757431d37bb55837878d4e6ce2408a63c38a1
SHA512 dfd339dae1c7f90c9ea5748df76e3d6fb40c3c4c93e9faa443023580d5f68b61caef4c9b8ab21ea95644855deafa59d1246f72cf5d9517d72fbe5c1e396d176c
TLSH
T165B012068C843D01D8200E719BC180C0531067041302851750D2D0888A031834205300
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt
Size 150B
SHA256 d3d75b5bf5905d2fe69fef722ca92960f6637eb5e0262b6ffd30b80215528dce
MD5 91dc3879744984e0676f6982092a7ff1
SHA1 30f24fef02e2632ae03481c052399ce72deca194
SHA512 a0751be106f6724f5ee22718ef18ee43437930b8356a19a3a791781f6d35094188c7e118e77242aeb6c038b54c4cde36bee79e14bb4d9e178cc72411fce1f7e4
TLSH
T15CC08CE32420499B0A30EFE82028B21EED0F424C4CC0CCE8A008504720389264001A39
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe6a22be.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt~RFe6a22be.TMP
Size 157B
SHA256 1730210f4dce9372ec010d12c3e74f0115194d91301d896f8ba4c0b3bc5d541a
MD5 c93e2a7187f24b98a7364fd4f253e6e7
SHA1 de36f504f8e8dbae71fd743f7f526631cf9aeaed
SHA512 7266f3e22ae6ca80117855862025484facb2d04fcec0282e97dba812045eacccfd8392bfe4719c7f4c0564a31dc035a2755463c622df99ca4b79ef5587063880
TLSH
T185C04CE72564499B4B70AEE52038761ED91F8D9C5CC4CDE8A54A704721789274411A79
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 00651338ba9863930801082e64a31e2fc7ce8d31f952cd357382930ae227c6dc
MD5 3e4ee4df331ee20199849f56e8db29ea
SHA1 b685b6b71dcd5fba2b001e29d16b991a1728d06c
SHA512 9faad0718ccb9f04d3dcc46cf49a9a864327aee87d9209024e8337721ec245c259d70c21c0c401ef54809422dc622168ab9f57ee3e4a51bfcb743fbdb853b8d4
SSDEEP 96:ubJod+x7oIU1fXfBVULgnSl8h4otop57ZDOB6uGGwvLX21CRCORNC39ISyVNFD48:utoG7/qfflliU2lujv021CRCOuCjT
TLSH
T170C1F970945D9D3B5DF2A449B2032953CEA960AB6914BE18E9EE1F0902E65ED1383923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 3f359992556935bad46cc3204809d36bdc66df448ba9ee2d30ac30a676b059cf
MD5 45e7b2980e4e76e9bc4ff29c08a71922
SHA1 bad5b2b6826af82a0e191b2cebd4637f29f13857
SHA512 dcfb1c769de8994abd613f22c5d6151d3ade046833de6b9ab23a308c015e6654734455dddbd2c905def609e49937959b341a1d98c63373d6afb02da41d23f9a7
SSDEEP 96:ubJod+x7oIU1fXfBVULgnSl8h4otop57XDOB6uGGwvLX21CRkORNC39ISyVNFD48:utoG7/qfflliU2/ujv021CRkOuCjT
TLSH
T148C11970941D9D3B5DF2A049B2032D53CEA960AB6810BE18EDEE0F0902E75EC1383933
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 5073c36e3560e9046f7071badcc368226aac55c2337481d070af3245164332dd
MD5 370b3b5996acdeef8d76b6ab4c6a543e
SHA1 f68cc9e7f2cfe842b8cdb678111f4476dd5bba35
SHA512 3788582ce9c7e25049b38f3ea5134a19fd88ce1365168e46ceda3ecac54d9f801968045c76313d9b168bcc5ef41c05e24e1ff183e082090bfaa69d9b50f82c2e
SSDEEP 96:ubJod+x7oIU1fXfBVULgnSl8h4otop57cDOB6uGGwvLX21CRkORNC39ISyVNFD48:utoG7/qfflliU2eujv021CRkOuCjT
TLSH
T12FC11970945D9D3B5DF2A449B2032D53DEA960AB6914BE18EDEE0F0902E75ED1383933
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 788acbd15464ec8a08c974da1665bb5e79c34d0d5a1edd85360518875945b39e
MD5 8f58231443a31ea054a4c7ec270141ef
SHA1 92e1589fcc14b1f369d97bb8389518629cf005a0
SHA512 0cae22d9fa546291b4b828428f9f5472781bea65795e74b08652513fdf90a648a0b8487588d4b4b3862df4cbc3f582d5267faa1a97bcfed6049c4bb5353ff103
SSDEEP 96:ubJod+x7oIU1fXfBVULgnSl8h4otop57FDOB6WGXvLX21CRkORNC39ISyVNFD4LA:utoG7/qfflliU2xuij21CRkOuCjT
TLSH
T150C11970945D9D2B5DF2A449B2032D53DEA960AB6914BE18EDEE1F0902E75EC1383933
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 6KB
SHA256 ba920379bca4e1c3b811e202f658d503ad75f7e20fdff91c9126b4d595174b5c
MD5 b24c2060f27fe8578756894454ecaae6
SHA1 f51c312da46771a03b989921c5031b0400c91d41
SHA512 d166248a8f5845d818948de8d6ca889b95cfdc00125743a386a77fbef65824cdb28c3214be999eb0fd2802c56647b2f81abbf4366a70fc9341717a4037f3b832
SSDEEP 96:ubJod+x7oIU1fXfBVULgnSl8h4otok570DOB6WGXvLX215RkORNC39ISMVx9ouo8:utoG7/qfflliUDWuij215RkOu8x9XD
TLSH
T10CD10971985D5D675DF2A089B2032D53CEA960AB6910BF1CEDEE0F0902E65ED13C3933
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 3710f67273cb7275ed6f0da76ac6941679161b27bd1794e6b3960c4c54f28d43
MD5 e74b57b2e4b4f572dfd69b2ea62078db
SHA1 0b6848545e298c4cd338610ced4e0620c946492a
SHA512 8bac51c72493bcce9a4586854612138c882e086a012e700b503fb643a8e851bd6f2a8218fdb2c4b5389a20930ba9efc3327ca29b510341d8a43674c53f6a7782
SSDEEP 96:ubJod+x7oIU1fXfBVULgnSl8h4otop57CDOB6uGGwvLX21CRCORNC39ISyVNFD48:utoG7/qfflliU24ujv021CRCOuCjT
TLSH
T1C2C1F970945D9D2B5DF2A449B2032D53CEA960AB6914BE18E9EE1F0902E65ED1383923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 9c88a6e4e678433014c92b896b977ddaa44eb5c8c15b66b20675a55fd1871755
MD5 4e211f557413588a5e082818b4c4fd29
SHA1 0d96981248ded0d8458de80cd2296185708250cf
SHA512 221f168ef9bba66021c039c25324ec1f4ed2cbf5670120c83e3b8bfb15e476f5e2e25f0d2ca89558487f3f18eb92d766546e7c03d0d4e337650b284adf922ea3
SSDEEP 96:ubJod+x7oIU1fXfBVULgnSl8h4otop57bDOB6uGGwvLX21CRCORNC39ISyVNFD48:utoG7/qfflliU2jujv021CRCOuCjT
TLSH
T1CFC1F970945D9D2B5DF2A449B2032953CEA960AB6914BE18E9EE1F0902E65ED1383923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 367fe9ecc94980a38f9e340d11d5149f572ae195c1fcfa6c311fba029dbe17d7
MD5 e5740a06ca827ab105fcdbc98ffa26eb
SHA1 d256be2e248574b2c96c1cead82845434376379c
SHA512 21dc2c193da4442b33637bbb1c93d4b2c08f2ab2c265300bdb0dc8fb3240f4ed5ba2dad49ccd8c4b120b7162d565b017d6659422319d7414c3cbd949d89d9a4c
SSDEEP 96:ubJod+x7oIU1fXfBVULgnSl8h4otop573DOB6uGGwvLX21CRCORNC39ISyVNFD48:utoG7/qfflliU2nujv021CRCOuCjT
TLSH
T12BC1F970945D9D2B5DF2A449B2032953CEA960AB6914BE18E9EE1F0902E65ED1383923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 dd53af6b554a867354302190fae199c5f0472f044d45181a1e08423d71062a10
MD5 6fd1a92194c237754ca95290b0f52b0f
SHA1 83b54b3f43c39745ba92e37b06dcad62eae089b8
SHA512 6a61b2e1a20c99f09ad7a3940bf3400125f5204f4f35c2c3e121f6ab77529d29a6dc80ea9d0c3c6f2ebc03410a11c16bd56ee017cdbf81a73ce293de50e7fbb0
SSDEEP 96:0C0d+x7oIU1fXfBVMLHRDotok57dDOB6nGyvLlACZbdOv4a:0C0G7/qffEDUDZuvcACZbe
TLSH
T1DAA11A31A42D8D3759B6D489FA466A53DFB970A76920AF44EDDE1F0801FB1EC1383923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 b7a2842cbed275d998a3575efea5fc7f896ad16a5676f7bc19f0091c3058eab3
MD5 c56649683658f5e7f5e118efbd79a4cd
SHA1 587bc8008322bfad0135302a10ce90c78faa9bfe
SHA512 6dae60d61df6e83541282bc4c4b4afc8c73f98c0099e7d0c666445ea3a3e1a7f9658f78c1eb995ca25a1158099288a02badc361a5c8ecfd3dda422820add4039
SSDEEP 96:cC0d+x7oIU1fXfBVULgnSl8h4otop578DOB6cGyvLXwqxwz/663RC90j9IrLIrbz:cC0G7/qfflliU2Wucu5xU3RC9UF
TLSH
T1F2C13D70A46D6C375AE3E455F6022957CFA921976910AF54EEDF0F0902EB0EC13C3922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 0474457d1574bdb055148fd2bd9182229a19a254204140755a9e4cad46ec71f5
MD5 d7ea8ccc7c8d702544738d499cc76996
SHA1 14c0b92f096185ce89cdaac64bd276b156214566
SHA512 ce996f8677d3049146e7c1f5d537e64756e4953a6cf82565d0a136168dc70471dbdb8bd59291ebf062e3e893c503d947fc01844910fdfaf7c897bb87dd228f0a
SSDEEP 96:ubJ0d+x7oIU1fXfBVULgnSl8h4otop573DOB6uGGwvLX21CRCORNC39ISyVNFD48:ut0G7/qfflliU2nujv021CRCOuCjT
TLSH
T12CC10A70945D9D2B5DF2E445B2032D53CEA960AB7924BF18E9EE1F0902E75ED1383933
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 41KB
SHA256 d9d85548458865342b2ec01b0d28ce01fb0129528af79b247d6a454132056fa7
MD5 d86d233af4e9faccbf4562ad40f4072e
SHA1 7cbfc1520ee935a151fd1527a994a879d405b71a
SHA512 fcb9ecfab164aa3a465418cc0cd19e296845576876d3b941bfc0e128d81010b9af14982d2c68e5461e4d043c67431b21c7441713abedb00c3a96a5510865fccf
SSDEEP 768:oT2VyrLM0i5YMYk4uCrNB9JrYhIWCg0Soa+YzskbyGmF8JlclGFk:Av+pjsNVr8IWf0S+YTbJ8Slcl5
TLSH
T11F13F160FCDD5C7E892858EC6E03BD23C6B046FB39053B84E3D57E49006A2CE6707129
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 bbde516b871aff1e2338d97cf15f44e86d5c11292a3a08f762e7671c3f23b9c0
MD5 b97c8d9af85e19eb4dbdcf958c91f8c5
SHA1 598bc990f3fb1c96d61381dfebe0fabdd63a847d
SHA512 61a0291f2f357cf5cf54b17b6038d47ab6f32be614b270e92989630cc08865e0582fe5d6f3fecd944c95722b1c18ace3effee9a4b14d5be828ab31a489b3baea
SSDEEP 96:ubJ0d+x7oIU1fXfBVULgnSl8h4otop57ODOB6cGwvLXwqxwz/6V8RC90j9IrLIrf:ut0G7/qfflliU28uc05xH8RC9UF
TLSH
T1AEC13B70A46D6C375AE3E459F6022957CFB961975A10AF54EEDF0F0902EB0EC2383923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 607B
SHA256 be6b74e52e5eef1f1c27c0976bf3bf1bfa99958c00bbef2898a602f691be6dae
MD5 76b78ed7ff6273215b134d6a6488035d
SHA1 9e7a11ffb68d027036302eccd4c22315054843a9
SHA512 9919504cd4d8c0757abff8da4bbad1c4b6532f81d290c736fc5624ef66de45e6a9e29a8290854ae554d5bdfc5291f1ea81ae62d1b25846bfbcf1515e2ec3e4f1
TLSH
T174F0DC53CBD6536BD527223CC8E207E1FA70E2719E81212386106F2D6CB77241E474B4
MD5 SHA1 SHA512 TLSH

Submit Download

microsoftwindows.client[1].xml

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\3E7KEOFP\microsoftwindows.client[1].xml
Size 1KB
SHA256 691d12261c6857ba0c568680612245e128a63b4e0b5b8a6b00d180a96897a164
MD5 0f4c777a221609913716d60d755cae8f
SHA1 bd55ce3cf2f42719dba09173b2d0581d813d4662
SHA512 ab99b95a523f72fd9f8bd0bd39f1acde528757e9af0e3d7c3eaffd01820dee6c824cab0fff09a02ad849b82124c51d77b98680b4c36fe0dbe8d83f46a8ebf631
TLSH
T11131C66DDAF34F2E6C1CB43AE6842398678FD30B95E837EC1CAC3DC863489095117465
MD5 SHA1 SHA512 TLSH

Submit Download

MSI18A5.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI18A5.tmp
Size 142KB
SHA256 73d7c5847f74fe13563c46e58dd577ddd32988896aa83243b6ee0acf5929df89
MD5 d02201cecfedbc535d3bb98733d3d445
SHA1 be46968db270386db50daac100e10e827ac887c7
SHA512 a20884d78c8d85c959e942f040ce30f4328e6a0e7f3f3b10cde9228dff6b3d2a1b1d4018732dec6b33c33c4471c59d4fb50aef3686c2d9638a650bc4a5f9acd2
SSDEEP 3072:cqrbMw7g/wrO6sMgpZEHinwCJkLBrSYfS/:prIrdHEHiUf0
TLSH
T195E35B1BB3A500BBE1B78239C9670A45E772785117609BEF03A443662F273E49D3FB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI19DE.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI19DE.tmp
Size 390KB
SHA256 6ad2dc761ef5e3f2048148e390cf314c3a2a47c75be57917eb0b66783424bf8b
MD5 476928c3c78e75cef1c141de94922c63
SHA1 254e46ff1e15aec93356301ad15a1cdff9655f46
SHA512 c833eb6dc6d56ce06c5aaf0e1300d8d8b85bd87e76736a9d35dec8957140ab21ba86770c92932dba30abf53fd8218fb8cd95beb3f75cb1c4812e7d25d9d5f681
SSDEEP 6144:O3TAWENBGWFraHfbz27n/e6yHdb0lLGuyI8MMggT5:O3TAT+erw27WHdwLGu38M0N
TLSH
T18B846B29F7E418EDD5B68276C4A68534FF75748C3320D5AE47A8852D1F3BAA070BB701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a9fd7f5f1aa54d9b328156c0d820eb43fb3d6db9ecd5ef42c18dd0acb7d4eabbbea5b27bd1899ea84e27359fefc12305fa4031803bde0f3783764800efb7

Path C:\Users\Admin\AppData\Local\npm-cache\_cacache\content-v2\sha512\11\d7\a9fd7f5f1aa54d9b328156c0d820eb43fb3d6db9ecd5ef42c18dd0acb7d4eabbbea5b27bd1899ea84e27359fefc12305fa4031803bde0f3783764800efb7
Size 6KB
SHA256 a389b049d80469568280b906a8c6d210c7f7f1d2070d3e55cff9d59b526f69a4
MD5 2dd1b4e541b5771f47b0e6f98bb28568
SHA1 3ce74d89885136be1535341f8c3d4425c29a5cab
SHA512 11d7a9fd7f5f1aa54d9b328156c0d820eb43fb3d6db9ecd5ef42c18dd0acb7d4eabbbea5b27bd1899ea84e27359fefc12305fa4031803bde0f3783764800efb7
SSDEEP 192:3p3OarHlrx2Qw8/tZlpv0JhTcIMgww3kB9sW7eU6:Z3Oa5rx2t8/xpcn9hD49z7eV
TLSH
T13DE19E8D499114F3E4901C06FB6D6ABE008D1ADA32BF9991E4D0ADA08D1FAA37312577
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d652c9e74fa9fe35493a799abbef37857695b62d60f33facc51ab09b1d789836e9790f3aa4d871d0e6e147d83356e576e9f3e8d5cda78db7de2cb04125e3

Path C:\Users\Admin\AppData\Local\npm-cache\_cacache\content-v2\sha512\56\08\d652c9e74fa9fe35493a799abbef37857695b62d60f33facc51ab09b1d789836e9790f3aa4d871d0e6e147d83356e576e9f3e8d5cda78db7de2cb04125e3
Size 12KB
SHA256 d81817ecf72de3c8c5d3724407752d943c9e1a42af5c437d9cb923be8a72c648
MD5 8175bf5c67629e7cd3bdc771458e4b5f
SHA1 580c88f8d5445f2bd6aa8f3cadefa0de79fbd69e
SHA512 5608d652c9e74fa9fe35493a799abbef37857695b62d60f33facc51ab09b1d789836e9790f3aa4d871d0e6e147d83356e576e9f3e8d5cda78db7de2cb04125e3
SSDEEP 192:mWabZ+QaGN6pOvBPZzy45OCnu6uqUnL/NwIlMAlCGCazMF9ssDn1ZiEQ5wUuOTvx:mdZibpgBP134NqcLuSzzMDssbTwwWvx
TLSH
T10242C08EC9417EDB4FB6E0DC1BF514018A1F76A17307D0E30684CC269A4F0CA9AC7518
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5296f26e207d1371c8f95bf082321237691bc5e5db64b66d0ffd6ffa99ab

Path C:\Users\Admin\AppData\Local\npm-cache\_cacache\index-v5\46\d9\5296f26e207d1371c8f95bf082321237691bc5e5db64b66d0ffd6ffa99ab
Size 7KB
SHA256 6e38427993c46d03547dd8b0678458f2533c607c8d6c32fe64b7c15d40eeb79f
MD5 639802a37c0976177b380ae365961ec5
SHA1 ed870505c563e0a9e7561bf5d168f602fb4085c0
SHA512 ca7c6540eab327cf6efc6d23a254230ab6809b8d30df31251355cdf0d3d96ad6117fd64bf1986c2d9862eb3f1f7c4939acf0529db707d5f49debb8228b4189b3
SSDEEP 96:nNdHnDThjcbDH8cEijDS8cxDf8c62DS8cOnDf8cqDu8cOCcDb8ceDfzxcJDfJuxt:NtnDTGDKED6D7DbnDwDCcDgDf4DfwDfH
TLSH
T16EF135F27F6248B3AF51A9EC9C097B068B86411BDBC04521F9C5EADDC1E55DA228F03D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7f2a8bd190f22671c866441ba3c09df2b7cc1088ad65bfa1ff1f42906fe4

Path C:\Users\Admin\AppData\Local\npm-cache\_cacache\index-v5\a0\bf\7f2a8bd190f22671c866441ba3c09df2b7cc1088ad65bfa1ff1f42906fe4
Size 7KB
SHA256 4839657992f381a4ce7a9dc36fbab1c9ac8675c8d068665c3953ba5506e8e922
MD5 d62dc00c50012e15802c6fe51301445b
SHA1 c6e7b24314abe103fdab3e2f04f26ce0c9bf4e67
SHA512 b2b3506cefa33f18db211a7e70420e22c363b0b1e5c171d870b9b77f843da30a0fb594cb7c98b856e5107677bcc14d36bf04f10cffe654293410fc1dcf65b487
SSDEEP 192:KEwUo7y9WdlxK7zHIAjb7nvD57Zd4Wg83:KfNxKRJvZ
TLSH
T129E102E35E1666639FE3FDDCCA4DAE4183439027C198981765C5EADCC1E40E4364F46B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7d0ac147818ea1892350f9c3f49b22c27f3d1f279ead6de0f28c314c285d

Path C:\Users\Admin\AppData\Local\npm-cache\_cacache\index-v5\fd\08\7d0ac147818ea1892350f9c3f49b22c27f3d1f279ead6de0f28c314c285d
Size 5KB
SHA256 c11bdaa3dfe79cd34ff6a07d3cc042910a6dd5462bbefbaee35544613a57ba7b
MD5 1910c31f3f45bfdacd7ba318b592c0f9
SHA1 f18837213cf43593d56f322f6059d4b9ca55222e
SHA512 ccfcde15a2d6bf7ac6f778dd081853eb265f507e9907ab0876bf245ee3370a7ed1f1071890aaae4ac84231e848b234d5f6b96c315ef9e2f9bae229cf495bf6c3
SSDEEP 96:PKJpj8KJ68SKJC82KJo89KJv85bKJLxxAnKJa8e4sKJP8P:PPrryF9/D
TLSH
T12BB113B76F7764A2FF92EAEC890CAE3387C1543B84A84C1A65D8DCCC84D41D46A8F525
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

60b4a3ab-3ade-42dd-8aef-a8c2c250114f

Path C:\Users\Admin\AppData\Local\npm-cache\_cacache\tmp\60b4a3ab-3ade-42dd-8aef-a8c2c250114f
Size 2KB
SHA256 7d07313bb61836a12f0ba5485e67673334a3ee955e7aefb3c4b3fc5a1b7b7865
MD5 2880bb62dcf805936b6d5753cc058ec9
SHA1 168efc2180964e6386d061e094df61afe239b18d
SHA512 829b4735082120d9dcfef4c6224d12385185357c3b255ae5454b42a2725196f6b0e83b97d303b925e928f6c5ab301861f8fb18019ee85c088e9dffd42a88328b
TLSH
T14A411AD680819C69B2801C676ACC5D28804A73FD4B1C6AC8E4DAC1531431CFB45AAD63
MD5 SHA1 SHA512 TLSH

Submit Download

c10c0d31-3a21-4114-bdfd-a02636babdfa

Path C:\Users\Admin\AppData\Local\npm-cache\_cacache\tmp\c10c0d31-3a21-4114-bdfd-a02636babdfa
Size 16KB
SHA256 50aa67852e866bb06b35c23f83fd07fc21b06c21ac96283956d0480922971fea
MD5 22465e0d5f48db0dbf9ba9f7785fae7f
SHA1 02873cfbc4084dde127eaa5f9905eef2325d1abf
SHA512 a115c0a6ae78113463e1e3221731a71d61b2fb3a39adab9d8eec4dd1bf07eecfd1536a16d16becc7d3b400244dfe446af44f15bbf45eb24181e68de38be1731d
SSDEEP 384:7wIKtbODzvQT+MKcrVklFO2BmoPv0GD6fgQyc83dqicKTn:8IKtzDdrViO2BmoH0RgQg5cKTn
TLSH
T17672E1E1C583F1658A618CDD94E36C6084DA53BF0A07EB40E563F2D72835368C09D8F5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d6687371-b2d4-4b61-bdbe-e586b9e28053

Path C:\Users\Admin\AppData\Local\npm-cache\_cacache\tmp\d6687371-b2d4-4b61-bdbe-e586b9e28053
Size 3KB
SHA256 6c1ae1dbfc6c518b10858d2e37c31d31e1fb39eaf32d77c10f1d84c573540d36
MD5 5cc8e80b3802e057c988750543f0b843
SHA1 b6e31717f22cc37330b081ce0051ed5de53af2f6
SHA512 cf039374bdeb150fe545d0679ed295397ea4e5c289c047351dd8a54fbd41584bbb278d605c8076311a7ebf176e3d2c1924f581c44cefe321f5c182c91941d7e1
TLSH
T1AB715DDB15E0B3497B3F662F1095D116B94182E8C72E475DFB09903A46B93A9FF08842
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini
Size 83B
SHA256 384d63847d60b0612904dbde266eea1026c7c44efc8582a3ec18d2f49ca22805
MD5 5739ddee167d55bbc4e313d778724a2b
SHA1 c0bff8120f033ed78dcbb8729fc7a42f015e878e
SHA512 85a84e5d900e6b58bb4c0ff77f33ff41c355932f3f2bf4d13b4dfd4e41c7a0671404731a5d4d3cc3fb15acf838516620f1d9c1f896f3e068279b8da00807b29f
TLSH
T12AA0124A42038950E14910188810011F501D200940009524C4A17391F05000D0338CA0
MD5 SHA1 SHA512 TLSH

Submit Download

default.exc

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

5d696d521de238c3.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5d696d521de238c3.customDestinations-ms
Size 14KB
SHA256 d08ffe124d432993e174a38ade57f3399f8bec79efb406179ea7facd6e0a17c8
MD5 cb8b8f953ae769c3198915a699e49e03
SHA1 96864062d0ff2fb9cc542fcb99563ae50fd90cb0
SHA512 b0ad32178c63a5da9bffec226d24ddaddd35fcba5603980a32ed056a90b1f98263ff621a5c460ae3ff5c9df6f29074ccbfbed00aa3cbe65f37a51498ae07e8d7
SSDEEP 96:8QC4PhFRlQC4PP53QC4PcZO3m7e1FSqfyQC4PI7ZWdCwmmgcUQC4PkvnFikvZ/Q8:481z8PX8cZeOh8aZWdCwhA8Y98GG8f
TLSH
T1FB621F017AF61905F2F39D72EBB237524F3AF9029E1C990E5181830A5D31E249DA9F7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5d696d521de238c3.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5d696d521de238c3.customDestinations-ms
Size 9KB
SHA256 6b2d6d449ed35c0e2adcf54c5c5ab2f24e3fb1495d7970fea0b305004179a602
MD5 930ebb78f414e0722d339ab7c56b9352
SHA1 a7185ea55e1d9e1f5213381eb10eb378b356e626
SHA512 14b2336a626ec59197e3ec0306b737eaef41e6704534e8e87439c5bb65f998e21d5963ddf76d3ce9d8139006edb7e4158aa8200b6b92d5bdc1564721126ecab6
SSDEEP 96:eE4PhFRpC4PP5RC4PkvnFikvZjC4PG81C4Pg18:x81s8Py8YO8GF8f
TLSH
T121120F02B7F61E05F2F38D72AA7237110F7AF8128A1CDA0E518593495C71A245EADF7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5d696d521de238c3.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5d696d521de238c3.customDestinations-ms
Size 11KB
SHA256 b8c04994db80adbd6e149bf47c0f41d54663031da65b185360195a8ae83f682e
MD5 e93ef48bcd089f882de5f6111780265a
SHA1 37676dd3481a1004299eec382e557f5a9b9d683b
SHA512 93bc7215febfc9232a85e7110f85777f00b2e4e1395b4b18a6644967d35e0328dac7ad2793adbb62ad818aaa7a7f4029c8db972dcc8c0d35cc63e387cc6dc811
SSDEEP 96:JC4PhFRKC4PP5FC4PI7ZWdCwmmgchC4PkvnFikvZQC4PG8iC4Pg18:M81/8P+8aZWdCwh08Y18GW8f
TLSH
T1FA32F00277F61E05F2F38D72EAB237514F7AF8138A1C990E618183095D71A245EA9F7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1c4d73b3-5e08-40d7-8d11-f30a6f256621.tmp

Path C:\Users\Admin\AppData\Roaming\lupa\1c4d73b3-5e08-40d7-8d11-f30a6f256621.tmp
Size 86B
SHA256 8029940de92ae596278912bbbd6387d65f4e849d3c136287a1233f525d189c67
MD5 d11dedf80b85d8d9be3fec6bb292f64b
SHA1 aab8783454819cd66ddf7871e887abdba138aef3
SHA512 6b7ec1ca5189124e0d136f561ca7f12a4653633e2d9452d290e658dfe545acf6600cc9496794757a43f95c91705e9549ef681d4cc9e035738b03a18bdc2e25f0
TLSH
T113A0124350152476150F2A2400474E5618E801301D1BF945C1E035A1756685C084700E
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\lupa\Cache\Cache_Data\data_0
Size 44KB
SHA256 45c8132435265a2198ead4f33ab152a9c9cee8fea02258385754c124faa834fb
MD5 7a32f34f2002069c3e58ac4a295d9ec0
SHA1 8d1823748b591b61f1d35da03719b29816617009
SHA512 9e737f725e6e98c6451d746727cee744bd01eaa75863391774ad7c730d757eaf29b91ec852081493e7fc1dac574fba40bc3cab57213cf27d337d0beff1047759
SSDEEP 12:daXCZpQNKvUZd0XAll5+71kBggPFE5ncihyxk2j+ScH6Fg42f9:daSZpZWdj5I1CsciAHjNca+bV
TLSH
T1E213843E6AD06E2ECBC4633D881B23B133B49E03C4195613C433F8F9AA18302192E320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\lupa\Cache\Cache_Data\data_1
Size 264KB
SHA256 84f1896a2d3ed10682200c256243196c73df9257a7a7fdeaa8937198de58225e
MD5 8c392c43aafd545490ac285166f4a311
SHA1 ffa38ae0811b0425b3040b0bcd7051df6e6bee69
SHA512 f66d3ea881e9b91bac2ca4f730a066108386513808a1a6246f57e83f9233d839e4b336b09c4ce7bdfcfde264887f3e81bc3e7dca2acd8f1e33f7140833eed50f
SSDEEP 48:Z71tuQEoplRoPa11iDMnLjWbalDVDlQ+l2mlk/xOBw2nTlBOWDn5n:94y1AQnkik8Bw2nKWDn5n
TLSH
T1434484EF670484A8DF0481329B1FE45CFE79245F5AB4C390943BFC7B9C361A26257149
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\lupa\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 b84d4821f734aa118e5f55056b0dadf3ef0cb8bdc05dcdf84c0b662bfe0a925e
MD5 918357331f5532288baf2cd9dadc37f1
SHA1 c9f70edd1ab7d43c32e861c4706ca49b397a56ae
SHA512 ad22c42d24283b5a856452af445edce70832d9ac9cfb66c7a0f811f1e054dd1145680cfce5419ced6bf6ac41eb23eefd4bd1f3b8ed71969440a88e330c8b8544
SSDEEP 768:F7Wg7W17Wn7We7WG7Ws7WV7W67W67Ww7W:Figi1inieiGisiVi6i6iwi
TLSH
T1DC25D7C61F58A9C2DBD3ED31FDC6D42A6CB840469AE3A0136553CABB50C27C21F9691F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000005

Path C:\Users\Admin\AppData\Roaming\lupa\Cache\Cache_Data\f_000005
Size 69KB
SHA256 9cabcad7ba86d8b3fefcf5f051db607b461d842136e1904362dd9856b627004f
MD5 0681a6397af66a0f3c141f07718c7441
SHA1 447acc6deaace0cc1a6b2cfb9f8788941d9a5803
SHA512 02d4256d415c23646e2039f3e5e97e9c7fc72a996bb6eb96416b0848516a2dd33b08b558b90b141c61ba3164c3b494d77808f317994e84ec1cad41f4d8d9192d
SSDEEP 1536:HwGAo9UrI1KUx9sIwXJAxhT7djb2olpRs/OKxGYoqNGksFp53C1:HTorJs9DzxJ7djZlpRs/O6xo7tj5y
TLSH
T15463022909DD0FACD614CFB9ACD6ECA691712832A0065318CFD9D3A1DA7FA4C0D718BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000e

Path C:\Users\Admin\AppData\Roaming\lupa\Cache\Cache_Data\f_00000e
Size 97KB
SHA256 c79b316fb253aa7d4e76bab5cfa28a85d0c82dbbf96ff3b8a9a10c7a7f3a1b41
MD5 d5f2a194385f5625c786a7c3b9874e9a
SHA1 1803842ae1db89365a50cdecfb40b9364a2698d1
SHA512 4d8bd75252755af81343344f7ac1c7e3bcd24891158600d1262860a14720e75bae3b6d43bb201da39e2c1f7e478e48e308ef91efa1fbf6a87529147f39e4cab6
SSDEEP 3072:CYhWunZz1lsYuH8siZSk36daWgZolM3I+wXm8eDZ73:lIelsYuH8XZSk3U1RM4+wY3
TLSH
T119A312C3158AAE37361AFF760AC8F876C400D39772B545CCB71264F04CE2669EB09A78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000011

Path C:\Users\Admin\AppData\Roaming\lupa\Cache\Cache_Data\f_000011
Size 33KB
SHA256 e6bd10f3ec9eddfdfd20e8b965c7d5bb9216ff900cef36510cd2aef9b3d8f770
MD5 e78fa06e11d07d412da872c02a7b1ae1
SHA1 bf77648860afd731ef344d0c9bdf9a8cb5d9b822
SHA512 7e2a22602dab7acec5f3616a65d8136e8fb891f08af5f2ca1579635c05ce667792acccda66d53c670567e66132a9d8f2b8d480e79db5ca6878f7acacc29263b1
SSDEEP 768:E1eL8cEa137T2Al7/OVU0j3GMULQlIULwWYASa0mVGu95s6:jAS1/bOVj3SLQlXhtXt9b
TLSH
T11BF2F10F5E9458E0D03624B090C2EDAB03BD66DAEA674F21891DCCAAE934CC9DF53D31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00001c

Path C:\Users\Admin\AppData\Roaming\lupa\Cache\Cache_Data\f_00001c
Size 172KB
SHA256 b236b5cf3fdbb63d6bb60fd6b008d030293ff0b6c506d59dac08bc856e724e1f
MD5 31082ee9c2527356336e46923ddd47e8
SHA1 3bcbf6faf5f9a07d6c08c2f64cffc5e189841fb4
SHA512 e73918fab93a6f386fe9f0723e3bc36184feda462fafc85aa96e3317cffd58f18d34ffd1e444f66c32434e40a803dabe528d1837888a9e90cb99e48aa287ec3b
SSDEEP 3072:PBepVV7+zausYuHUAblRwH8R9B+seqmBRcHhnLTAZWs/VRyMaqscsjgKsd9zY44w:PBgP7AHsYuHUA7A8RnhgRsnfU1RyO8cl
TLSH
T12D0412628B0D2E6F366C3E34328DBA320623A03B2E571AE96635D195C071BF4AD35D17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00001f

Path C:\Users\Admin\AppData\Roaming\lupa\Cache\Cache_Data\f_00001f
Size 229KB
SHA256 727390ef222bff62b9c993cd264111d632281efbfdc0389bfb2832839ffa3e3c
MD5 5c9a5f9159488842d29d9cdb6bc5c0f6
SHA1 c5f6fe7aa05dfa7c57a11fb25f689299a22e2348
SHA512 d7c1be0cd3e91b9db69a6dc2845a4acab3133ae699a52a45a8eb74978beb6a303bc047f3f76535ef5c8d693a69ebf8288a128de60e84f2b40c9732763233a748
SSDEEP 6144:IwQdmZYlr3469vPh2/TX4AGWEE2iZD2N2iDHi3UjnQmF9WSp:IwOm+l84h8TodEbZD2N/DHBnLf
TLSH
T17034130E3E32DA25458D653D64BE132EA17375111AE727B9EC4801BDE82C9A20F59FCF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000027

Path C:\Users\Admin\AppData\Roaming\lupa\Cache\Cache_Data\f_000027
Size 259KB
SHA256 be9463119c10e26a909f0d6e6cda49eab57f58e9d09982a5fd8c445025506a76
MD5 faa3b4e0d0920be394f0011f7048d631
SHA1 f6c7522c96f6fcaf4027cb671027398deb721dd8
SHA512 c94cf538a66617e6d53fbfa693ce757ef06b0e5314f243a6a9595d8fe1c0bfe0b33c96e6a7fdd1e548c71a6ad4d1ba3f6371653852096278777cce09e8b08fd7
SSDEEP 6144:XTN97xWdKZ+17PcecJE18msZZAbGaOTR1LHxI5fb+J0JZJqHwF:XTNAtiHHVoOV1i5T+JyqQF
TLSH
T1704412254CB0DE087DEB757A980B4F2B91BFDA025588637BDA9A0B5D4920F1C7638B31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000032

Path C:\Users\Admin\AppData\Roaming\lupa\Cache\Cache_Data\f_000032
Size 259KB
SHA256 24b1645f36aa8f03e3dc2a8fcdd7fcebb488894bc1671f45c3308419c25681a2
MD5 78c2785908473cfdbad09de250847470
SHA1 486b433c98105d163123c021f8869286ead2cd87
SHA512 b0cc5e4c1592a8c2028e0ff45c98dd07b22fb40be7bfbc39386a33cb339a5f86b5c4a5021996443800d7c38f17f95e6710af888dcb83cec47880cc4ee06cd641
SSDEEP 6144:QGPBACnmeY0jhTQDFWgrGqlg+OlEnw8CjfhVzjTU9d3d/YKA3bdVoJu:QGPBAhe992FRtg+qYw8CHrUn3dQKGzoc
TLSH
T1EF4412D447FBAE433C903A57548F0672BE76E50B0A5F14AA4C90617E8944FB22638F9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\lupa\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\lupa\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\lupa\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\lupa\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\lupa\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\lupa\Network\Network Persistent State
Size 1KB
SHA256 57832d515460af073b797cd555463df721f9915a8b7d3155fcfbc2f7122e0182
MD5 3435becb7893d41f88269a86545235aa
SHA1 970e29cb8a1c9e5c1b56f0dcf80c7cbc89b5ea0b
SHA512 647edba19446bef74b1dc18941e4e8aa75fa8ba01410c0271dca600a56e161017a02a8dab7b719f63d587b0bb102a2576c95a5e18bba6e5a1381fab69d38283c
TLSH
T1BC11CEDAC3E849BE4652A3F11F21B923C5BE092D42287C068CD8EFCE93F1076431164E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\lupa\Network\Network Persistent State
Size 1KB
SHA256 1ff9e9b8b62eefad1812c893891a8b1414b9f2a98e489cb97a56dc38d2f762e5
MD5 ef8ccc35640b50183127de676c44b0cb
SHA1 802e9eb0b8dffbd714ad1f0f38da3245ed75e98a
SHA512 68059bcc2e958807199bef24a341d4e51853772fbfe777cc7afff357320ea394f732e2091212ffe4c9eb3af1a973a22d8efc030142e3211010b6688db75f5219
TLSH
T14221BED6C7D8497E855293F16F217933C5BE092C02287C0288E9EF9EA7F1476431164E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\lupa\Network\Network Persistent State
Size 1KB
SHA256 382a0e3e55b4285cfc929aedd2bd774e16cde8e77a06d798db2d1f6702d3d8fa
MD5 9af7da4a00c37c82ef288602ff4e937b
SHA1 987fcfb7125730fc558fd35d5e22a9f6fc80ac57
SHA512 2c8897fc3cd62d615e9a99356cc165d5e654d52186d8aa10b1e9b424dfc6363d9c2dd96a53ac4bf32dcd6fa424d23e2600e474be85fe6324ad8b9f9588e217a7
TLSH
T180119ED6C3D8497E465693F16F25B933C5FE092D02687C0288D8EF8E93F1476525164E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\lupa\Network\Network Persistent State
Size 1KB
SHA256 fcdf127dd20b7f87bcf58c3d8312f3862a84e48194f128c4f044039bb17a1075
MD5 471d07f654880894c76127a3520ea7d1
SHA1 27f4a49c00affa05bff37d2731c5e1a23beeedc0
SHA512 b98185b657584bed4a08471d3c77e520c60135fd449d3ba031185251195843e69395c89b4e0a669471ac9dfe3676586aefdeabd36d3885519e3f80f6568a4dbd
TLSH
T19421CED6C3D849BD4A4252F11F617923C5BD092C42687C0688E9EF8EA3F14B1431154E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\lupa\Network\Network Persistent State
Size 1KB
SHA256 035da32376d076045625bc3fa4e1eaf6a11d9289d946ee784b1723fd343a566a
MD5 d65f59b8f913c275238a261b6f5bfb8f
SHA1 4a1ebc1253ceefbffcabb44b14a60a03021e6050
SHA512 53dd7078d6fe4c9126e1a2acc5a0561bb2dab52a87c2fa9d811046ce67831cbe6a26956e179b7aceeab4c10653ae4ba5810a9572b00a8034a390b8fb182e1015
TLSH
T10921BED6C3D8497E865293F12F21B927C5BE092C43287C068CE8EF8E93F1476531164E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\lupa\Network\Network Persistent State
Size 1KB
SHA256 3a3a2676e591247fd831aa787eb17b5390d35c2456f1051fb3c96ff5347f56d9
MD5 46b39bdd1635510cd9fc5c2491892fea
SHA1 faa21215d00944485b3175647541360ad809bd9b
SHA512 867948c9cf8e6f95c0d0f27f77949c945b46c62e64325c672715372e2018c81ef002a60a858ebbedeb40b129841137a9aaf8b0cd22894ab3d023cc3ca9fcb0b8
TLSH
T12621CED6C3D849BD4A4252F11F613923C5BD092C42687C0688E9EF8EA3F14B1431154E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\lupa\Network\Network Persistent State
Size 1KB
SHA256 ce3acf020bfd649692afd5a352578daa0c273e1bbb944f390512365ed371e487
MD5 e82b82a6287f220b31d19faa71164aac
SHA1 40f32f203502433ce3e60b0010a8144998b64f76
SHA512 5684ba5cb0c643e50b8eb875ec1525ef8e2a52c85d990de8ffc863e2b2a070d2d811a0080df4eb4cdac9589d4c1f7a12f08599794e6b6658004ab4b952391667
TLSH
T18821DDD7C3D84ABE8552A7F12F217923C5BE092C42287C0288D9EF9EA3F1476535164E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\lupa\Network\Network Persistent State
Size 1KB
SHA256 c6a1efe85259d80925cf1b222ca40d1a8cd83804410cd9b1e9bcc78ad1f10699
MD5 bb14754fabef348ba91bd74d7d305f2e
SHA1 6b8fbf82e4f31d450c8444edba7c678d5092b690
SHA512 2f536ac89d2f9fd76aa09f4b7592fa1acb3d0f697c75da683c5386458f24a3a016877f507df11c2dcf5e276bc9a22e9f1365b66e7f6173cb4e2196bab643a1ef
TLSH
T1A321BED6C3D84A7E865293F12F21B933C5BE092C42287C0688E9EF8E93F1476571164E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\lupa\Network\Network Persistent State
Size 1KB
SHA256 ad9e2650ca41c1a3fee3182e6194d3d4f2373d6668a02318d1bf4ea989d8ac20
MD5 e5a9a50d4820637247a6a40cd5b09dce
SHA1 714f5781b001c48df95bc192a22d92e784bacc67
SHA512 d492b65f1a438c448d57acd12462ea22623a223f79178370e98d11488f8c2f8bedc657a405ba89f0f12f7cb3ba5e3a6dad1756be75fe9dba5b7d52f8b174d0db
TLSH
T176218BD6C3D84ABE865666F15F317923C5BE092D82243C0A88E9EFCEA3F14B5435154E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\lupa\Network\Network Persistent State
Size 1KB
SHA256 4a614266aa177ba39d83e27fab4840fd59f8f3020be35b513c151e9c8503fa50
MD5 9e43d0a9966b60b34982697760018392
SHA1 8f089d66689bce0bbc711833afad05c53b7e6c79
SHA512 01c6e114c07a88cf2b019a7bdbf3f3d04655d468b2842f91b10f10bcd705d773a8cb5479f19bd8d62bb8cfe58bce12836ef14e3849a95e00bd07890748350e9b
TLSH
T1C821BED6C3D8497E865293F12F21B923C5BE092C43287C068CE8EF8E93F1476531164E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\lupa\Network\Network Persistent State
Size 1KB
SHA256 863f8877067b90b6be79eb899358decb07253ed95663b7df71ed6e53e2a2ddac
MD5 cb89d33733a618b5e3f8e4c66cdbd4c2
SHA1 1f5e886fa8f82892b32bd7b7a26caae36bb44d5f
SHA512 e9542bee5d300d9eb9b474feea2debcc67b91e3f01f9c9a9cb8279d5b20f46c072fec8c4e8e05230a30f622c57bc8f0fdee66b7db310f0e2cfd0beb30a1946d6
TLSH
T1E221BED6C3D84A7E865293F12F217933C5BE092C42287C0688E9EF8E93F1476531164E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\lupa\Network\Network Persistent State
Size 1KB
SHA256 6a5bb22f6e55041939185cb7c867158ab404c2af4caed9294d592565545d6c14
MD5 a8e5d34e41f0e441f512b37af6ae94b4
SHA1 dfad6193b93c60cfe679aecc65f07bb56bb918bb
SHA512 52833c8a1ca878ed4ab4843c0c17fbebdd4d0091f8d2b5049ebb667730582b65a5cf4f2e474a41a30de45296ff3e30ae5ca9ffa42f62d3ba004e464ddc336231
TLSH
T1DB21BED6C7D8497E855293F16F21B923C5BE092C02287C0288E9EF9EA7F1476471164E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\lupa\Network\Network Persistent State
Size 1KB
SHA256 9c18dd90ba488970e7e47ec6e8d42a841091812f795b7dfa4b47610cdfce2db7
MD5 a1c6a98d810cf5822165ec8b02d46b58
SHA1 ce4e7ab9b5efc8ac17263eae3268e52206413806
SHA512 62a3c6e2f13c7e4d118d13f890ddb88af190c41eeb23559cefa03574935ff8857f2528e669718913b255ade81b0d90b3f545f0a89c4a3c5af7d15572f347a8b2
TLSH
T1CF21DDD7C3D84ABE8552A7F12F21B923C5BE092C42287C0288D9EF9EA3F1476535164E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5e9fd8.TMP

Path C:\Users\Admin\AppData\Roaming\lupa\Network\Network Persistent State~RFe5e9fd8.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Roaming\lupa\Network\TransportSecurity
Size 523B
SHA256 30cfc09592c7fa4cee53464e2a79bf296066c750675747bcee9483b8e38b0b81
MD5 89b39801b43e1d1b58d5e73aea1c0c4b
SHA1 389db7d233ad43014678ee1cbf86803a7346862e
SHA512 7d2351ceadae28baef0b8b4e3784eff6c388a5782a26443b53c16bebbcd192a8c54489a749f27b4d68007c759365224ac7ebc735a8bdacf5adef2f094f1fd8a3
TLSH
T10DF059A3957EF02710783FBB0D843C226F36B97051529CECDA92937C60455F75716822
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Roaming\lupa\Network\TransportSecurity
Size 523B
SHA256 f62ff4b66ef54a7dac2b09608902b33d09da48dfa03831d470142b16a286b0de
MD5 581aa86fb532c69af92a59bf08bdaa27
SHA1 b867e41000dfcba7ceda82ab98ba6b29d1cda3fc
SHA512 8b7df913b2c9fa7b3b77f12824203365a623d0b529bfd7a7473bb7dd27a63ef05e1d5b54725838e208b45a0377d5b78da485aa445f2e386b01aeec5e8ac46063
TLSH
T1C7F059B294BEF0A710792EB71D847C222F36B57040559CE8C992827C60455F75B12836
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Roaming\lupa\Network\TransportSecurity
Size 523B
SHA256 c918a71691c83033b1050a75ef5358c47b9d88cf878329f465a2f69a4548eddd
MD5 c3707f48ece34bd86f1dd43f096aa496
SHA1 f6f0800be422d3701cd515371e0e5b1d3d608464
SHA512 0521cfdbd61933f0742221c9645a728bb952bc5f0c1b65b8ff80dacb1824c130ed4b502e0d7198835a61a5d2005932901c0d743a2b61ff62bdca2047e3708008
TLSH
T10AF059B681BAF02710BC3EB70D847C262F7BB670119198F8C642827C60405F75703C66
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Roaming\lupa\Network\TransportSecurity
Size 523B
SHA256 8f4f8ef725e1048a50dd65f6db5726ddf6575339eea6046af959dab0e269bdf5
MD5 bd00bf476f4b5558338865e0ad6980e8
SHA1 774625a48912d05878e90d25bc7be8f95951f171
SHA512 d596fc7851c8287c035fe82aa4a186a5a6bf87203992a0b11fc1da8408052d3844bee52b113e72d266f4a42517595dba1099f996a83f8ac3fac5bcef665c320d
TLSH
T1DAF059B680BAF02710BD7EBA0D883C262F3AB57011919CE8D642837C60404F78713C62
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Roaming\lupa\Network\TransportSecurity
Size 523B
SHA256 4bd73ed8dce22766024e293795bfb94dd707a1f2438681bdf5f2b8d03954b926
MD5 d49ce531a86d489c89a811a4b2a0568c
SHA1 ab2a0fdd694df979f0e38bae6a2caa5c31f14c78
SHA512 7e3deca3d06fe397d9e265d338ad0c3f4fa2e67613bb4eaf2f7484c70c3dcb55bcb06284dfa152c8981d72c343dde648a5e929b5b4918d75ce5e082d72c9cf44
TLSH
T18DF059F690BEF46710792EBA1C847C32AF37B5344191D8F8D652827E60405FB4616826
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Roaming\lupa\Network\TransportSecurity
Size 523B
SHA256 17b01bafeebe200bec654ba3690243066fb96ec9c159778683b2189c8e17dcff
MD5 f8d052b8fa84244dd450ecfd41596400
SHA1 014622ef59969182244b91c7b28640c40991db79
SHA512 437b1bbb9eee593e07d0d84509fdd4849e3364b72d3cbdcd3719d920c0972cb7f879e7a6b23c6d9bfa8431c6be7702ed51ec261c278cfd5bd2fbeb35093ee19f
TLSH
T153F059F6807EF47710B92EBB1D843C22AF37F274019198F4D646427D60405FB4702822
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Roaming\lupa\Network\TransportSecurity
Size 523B
SHA256 515233a05a1b0c57dfd18333faca2d99af27b02f653552554d93b0bb0ee68c2c
MD5 8bece72faa45a49b2d12789c2beb94b0
SHA1 0ca11bf147a6ede18e59b53f1f8278dbab81928c
SHA512 409e63428868b19c7e55bba7172d704bcca84330f09c96153c3574cc133691a46e6bbc54ac28d6591ea2cc101cecfff8e2b1536c8eacde9a707bb5f0949fdfd3
TLSH
T11BF059A698BEF02B10782EBB0D843C266F36B57061529CE8C992863C60946F75B13867
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Roaming\lupa\Network\TransportSecurity
Size 523B
SHA256 7e7fb27af0361319f30cc67c3f5dc94009bc2b695ea1a726ccea7b0c6f4b2075
MD5 f00517a80eb348bcb80f2076ba7e24b1
SHA1 11403980463c8464be560e3b3b2970412ada6fee
SHA512 5bde9dd7105fd93d87d5a1b66dcd2f86f718341754415e16e1cda3cfaed6b19a8c1cefac1557d07659cd32643004727eefe9c5f71d9743e993561a9ac230efab
TLSH
T14FF059A690BEF02710BD7EBA0D843C262F3BB57010A198E8C642827C70404F75713CA3
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Roaming\lupa\Network\TransportSecurity
Size 523B
SHA256 a97056678670da2ac89ff3f27f794d99cd2750509c55f03b0fdbebc0567bc821
MD5 b968104f3663ba2cecb1d65f5d5b94b7
SHA1 19a7f09a13fc2414cf9201c5fabe132edffe5927
SHA512 ca6208c6b171fa0af5840a487cd51b22a3098fb2f2f317d25fdbbdc7bf2e6fd35eaadc7758f0dda02933c7b6b0ded622b7eca7c0c8411b299bf4d93cd32a9ef5
TLSH
T100F059A7907FE03B117C7EB60DC47CA66F3AB5354055A8E8CA96427E70408F74B13836
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Roaming\lupa\Network\TransportSecurity
Size 523B
SHA256 4d424cc4dfa822197945fb8195ebebbdd493b84093c3b64a9f7cb088b8de91c7
MD5 4cb5d311d74938e62583ff9ef2776b84
SHA1 e6c6bc1b15df15f6247d906928b60f45fe2df522
SHA512 8bedd149cd89ab4500e4c81fa78a243330015e15e3f77c5f7f9875515e907dfa59d5e720da2031e673a94bb68b3c8e8404bbbb579d5aceb711aca63777696002
TLSH
T196F059A284FEE02710B82EB70D947C223F36B57041919CE8CDD2867C60445FB5712876
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Roaming\lupa\Network\TransportSecurity
Size 523B
SHA256 c7b7d0f75f3c34f7a9e24ce9230510c7941a9fe2ce84e40f38e95efb59576e9b
MD5 c0f851f8abefbe5a59294771a37db633
SHA1 24f8d4fc5d19ed940935d6af2cb2b3b00b71bb93
SHA512 79e172244331950e8dd9fc7fbbc3c3291383f391c212f4882db5210da80ac2a7f0dbdce3fa018c120655f4c32d468c2fea6f2eb9ec78c3281dafc0e3b3e6bbd6
TLSH
T122F059A6C0BAF06710BC7EBA0D843C272F3AB570009198E8C65682BC60444F74717C62
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Roaming\lupa\Network\TransportSecurity
Size 523B
SHA256 49c4005399ad9e76fe57d2d4849d99a3a1c3eae9ebe28a78c55ee49b813e9c9a
MD5 87c3f63f463f957e21a5050d001f9f50
SHA1 0bfaf906283bb3cf21e559491b4ca4db7a5b66fc
SHA512 a753587cf205bd225d631aaa4aa232ea8bdc5985e9d84a224432364d783db25c35c6c38c5387df7b77590ab8f2f0ce6c622a2f33bd01bec47a82a78bc3f17491
TLSH
T182F059A2947EF06710792FBB0D843C366F36B57051529CE9C996C33C60445FB5B12822
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Roaming\lupa\Network\TransportSecurity
Size 523B
SHA256 0171a9999421f1166f07994d51e2aaa70636b0d118f65558320745416cf75c3a
MD5 0c6793074bb13998bd328b7677d9242b
SHA1 8e572981d32faa804771290199cb3373700dfce5
SHA512 48199b70d18a490879d45741c52df98cc85f199fdd8adcd54aee1d874213ab18c4657480fa205c145c09b9574b3ba04e0b2618fde9bebf03cb98b9b064fb637d
TLSH
T1F9F059A294BEE067107C3FB70D887C226F76B97040929CECC992863C60455F75716836
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Roaming\lupa\Network\TransportSecurity
Size 523B
SHA256 9873ea8868548390803e608b16974e2dd8394ac5eb13e82488d37ead748bb215
MD5 090fc89f43a4017a4eabc14938192f82
SHA1 e98b8536d6f5130f5d0e1bec39d8365c43dc6f19
SHA512 beee7bfcd3c68d479ef5853d4223265aa32aeb462bdd783bbf233516394d27938291be7c29830295452fda74036e529ced08d80e0a630182017d2efc45daf049
TLSH
T13AF024E280BAF47710AC2EBA0D843C266F7AF670109198F8C64282BC61405F74717866
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Roaming\lupa\Network\TransportSecurity
Size 523B
SHA256 63ebf3c7963b688874bf8c71892dd1fd4ec2d08e0f32652f3beb21c8077ff400
MD5 8c4f516fb409de9232e3d00a15b14151
SHA1 6afdb03d098fc272557a7a004046438b616c2264
SHA512 a67c8cff6054e3640c29f1fe09fae085d0132908aa431a6fbae2812496c0a11bc1af6083d831dd3526e4c21b03778694a3bca2324d8ea274ca476f77ce290aad
TLSH
T12FF024E294BAE02750782EBB0D843D222F36B97040629CE9CE92827C6045AF75B12832
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Roaming\lupa\Network\TransportSecurity
Size 523B
SHA256 db07978122380a8bc5822586304e65c985d88a647110322a85bbdfa9223fb449
MD5 9721e205535420922fc8c414ce93b009
SHA1 c1b8df012e6735ce3592f4f450122989e72c4ffd
SHA512 69323ae18677b325dcff77fdf80181169e35e5fc593932f70018c3538776671f065df5476575f82ae3773fd3785a98eeca161107069fb8ffe468ae5cc211aca6
TLSH
T14BF059E641BEF02710782EBB0C847C222F36F5714150DCE4C657423C60818F74B13866
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Roaming\lupa\Network\TransportSecurity
Size 523B
SHA256 6572d3df63622a73bb174843b82fc69256f5bb9b35083360b97cdb58b9fcdc5a
MD5 989f3e49cb20faa63a2624eb19bff745
SHA1 88a7d483daab95d9b0a7482eec8fc017acfebafe
SHA512 70dfc32003347152f0775d58dab0c79025ceed80d5f8819689497864a25317b3adb339c459f6578e99e029a5f91126be6ec527203e6780456853d6d25f85c3b5
TLSH
T12DF059E290BFF02B10787EB60CC47D226F36B97140909CE4CBC282BD60489F74A13826
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Roaming\lupa\Network\TransportSecurity
Size 523B
SHA256 e59210f27bb3a0b2ccb22c7268b9cf1d64e7cf5974147eb344cb7d37abee0875
MD5 1fd5d86cfebf084dcc792b5df663eaea
SHA1 c80650ca19f46c561e4cba9d82a62076c1c68fd1
SHA512 15e9584b246499f5713ec860cb04784262ec154438f9f551c7a9260b7a350451b6b798a3bfa098e39b819ef95f61d4e3a1f8c6012b5a322f49d9c7aa13f951cf
TLSH
T1BAF059E2907FF02B10787EB60CC4BD226F36B97141909CE4CBC242FD60489F75A27866
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Roaming\lupa\Network\TransportSecurity
Size 523B
SHA256 fa75dd10db3238edba02d29138be028e4116ca1e5a614ea49ffe866d1046e5d6
MD5 341415cdedd35b97f80b9c15348c0aca
SHA1 c281faa3ab8531bb1d09dc7c22750f86fd2e3b1c
SHA512 e4960a9b586f7062c593babb832b210e4f28978cb63ff4f433d13436b8ea293cb4c109a6ca2d5ac493ae2a5c466f8250a786fa931b3e0ef1ce732b247455c266
TLSH
T139F059E3407EF067107C2EB70C847C226F36B571409298F8C542823DB0404F75B23C62
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Roaming\lupa\Network\TransportSecurity
Size 523B
SHA256 e5e4f06be45399e94080c3e38dd54141fb0440791dadfe8a642a7a758095aae6
MD5 68590feb73baf37231a4e69961559a37
SHA1 7fb0826b342b2a4ab75f07ea9044be7e9acc4edc
SHA512 34daba15bdf98cba79c26a80d3cdefa3aa49fbeffc5b40dc1657233b2075392025f454c91b8960d31d9bbcc6a34eb5bbb2508a9270f36ac9afc21c5804f200d8
TLSH
T191F059E2A07FF06710787EBA2C887D327F36B535025098E8DA8242BD60489F75A03866
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe5f968c.TMP

Path C:\Users\Admin\AppData\Roaming\lupa\Network\TransportSecurity~RFe5f968c.TMP
Size 523B
SHA256 468bda14fc14f817b4fd6415dc3999a48161bfe038e8a3b22ee2975a1dc867fe
MD5 44d8a7709f108622d52294290b03c3be
SHA1 f9a54ac5c30eb2c3ccb6d2b27f0752ff2e9824d0
SHA512 55f2d18b0961a239481c4c754fd26ef04efbd9bd35a916bed70f604cec93c91e3c64867234a99651286aaeea900f6aee81ba3653f193fb84f5dd1dbb1b263d63
TLSH
T159F059F680BEE46710BA3EBE1C843C36AF37B5348490D8F4C646823D60405FB4603826
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\lupa\Preferences
Size 1KB
SHA256 ffceb983a45fdcc283ebfe39f0ec2cd062116d1efbb6c4768ffd72b6db631702
MD5 b4c4d03d97eda17f1fe124622a0c206d
SHA1 c9bc4853f02aa83384bac4954cb7b6703e68be50
SHA512 6e2ec4c0085a4d9e736da282dab54081feae6269d966ba2368830572a354a5c014239f0f2ffb0f581ec42b7045f38d988af087d2ba294d21ec19adbf81b6170d
TLSH
T1E7316B1E501CEAB4D152A27E47B85FB322CF0CEB1B4559388A8F601D80B5C3C7793813
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\lupa\Preferences
Size 1KB
SHA256 b566b9c0ff3a8d140a9105b4b7342ec9fc84a7fbbd7b5f79989c79a939ffdf10
MD5 7e2c7bed4fd8ab44d12b27e03dc4840b
SHA1 11ff358339677c8b5413394e4975b31cc55991e6
SHA512 224775131305a5495251c4f1bbc8f57c9d3313edc4918a100bf7d07bcfa7b1516bcb1668c89f572d02832d3223bb1e56ca3536e286ec3c72c2aa60d34f8eb67b
TLSH
T1B711B41E502DE6B5C153A6BE43BD9F7311CB0DEB1B19A9248A9FA01DC0B583C7B52823
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\lupa\Preferences
Size 1KB
SHA256 5f562a40baf60074142b060dad00775b987283d5ed13469eb569e05aa149859e
MD5 fe43df1ae1ad213a9532c9b25333dc55
SHA1 a178f0fde134380ac1789904f1078209cbf80c9c
SHA512 5f9c4b9265a51f7d15fdce71651f80bf7f899652ab7324596086f9e61689cda525359d49fcbedc1f5609bee5f8802ac5e6b2aca83d24e76afbfb10b2a734ae0e
TLSH
T135316B1E501DEAB4D152A27E47B85FB312CF0CEB1B4559388A8F601D80B5C7C7793813
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\lupa\Preferences
Size 1KB
SHA256 a4f6cdbe7050dc9818b0aa5479b385332721a5960b0ee647f99d6208904921c0
MD5 d8f1d997c50c29ba86534f3f63862666
SHA1 8cf042d14b51f80b54cebadee3be711a8edfcb58
SHA512 9612e55f4680ef21b43fad55b6c58fada70bd72e5cb6d3f7826159190ebe9f770de55894096f98f956b41bb1acd3d2b1eafcfd157f11ed78db42ad0a6cbbc4b5
TLSH
T1D431591E501CEAB4D152A2BE47B85E7312CF0CEB1B4559288A8FA01D80B5C3C7793813
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\lupa\Preferences
Size 1KB
SHA256 355d6081cab903ee82c136b9d6035db5da426d4a1da1534e69771f9e0e8cab07
MD5 aaf2233c3504efbda9bc0536968f22a0
SHA1 57deb32a8986ae5f160fe7276b8b82e70baa916f
SHA512 f6046f4c13ea80a22a6225fc10586a175d6f3ba3282079296fe6df3d965a5c954d9c5b329254a7e63f636c44658260b71574b4406fcc71a5be76a9bb2aff33b3
TLSH
T13F316B1E501DEAB4D152A27E47B85FB312CF0CEB1B4559388A8F601D80B5C7C7753813
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\lupa\Preferences
Size 1KB
SHA256 59adaca5a788edf55a64b5bf54b9f2c6e64a835bd41aa72c539591fe01375f75
MD5 7d70a8f0d1c6fed3a218bb4f24536763
SHA1 12d2f62056cd2942298aa3830dfd8c5079c3f4c9
SHA512 5c6bf36beef872f17a0bddb8e1d8d4cb55ec29590ccb37e010077ce5ee10805b18c73641e02f209406b77c392524d70d58314e5e69697c74c94ecc0f55d9fc50
TLSH
T1E531591E501CEAB4D156A27E47B85FB316CF0DEB1B4559288A8F601D80B5C3C7793813
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\lupa\Preferences
Size 1KB
SHA256 70315d4334add2cd08acc8574d4ec57d4ff32cfba9fd65832f17f04561faeb9b
MD5 02368e9a21aabfeca2a008e687fa09b3
SHA1 80e3866642ddef63f1915e0b66140e409f26af77
SHA512 c4b1e592d2f4368b78b3108fb0bfd2c1cd51e0ce16e37526966de51f84fe946a6b4a1b9b40c9b24e5721297e21b4a2e4ab8500bf7119374aab89acbf3e3478b4
TLSH
T11A31591E501CEAB4D152A27E47B85E7312CF0CEB1B4559388A8FA01D80B5C3C7753813
MD5 SHA1 SHA512 TLSH

Submit Download

f11d6318-1570-4ee3-aece-83a758288438.tmp

Path C:\Users\Admin\Downloads\f11d6318-1570-4ee3-aece-83a758288438.tmp
Size 42KB
SHA256 2c47029f84fbac25274e7b66dc61c748203a8775a083f306b40bc169252985ed
MD5 83b44162f0a16846c1348491d11e8114
SHA1 ffade61003aa329e6d9a6672bca0eaca4235f1e9
SHA512 cd4821e8676a99aff6a2d2be2406d3342b44867e0aac88d4e538ba691adb0f278731bcf1b45b11920e6f3758e5ab1c6a513f167757dbb2b9c1596b4c8fa73ebb
SSDEEP 768:/l1rqDJtSG+fCXn+zYkKlguyrVe2Rp4HRHxFdOUXD5Wb3AFL9+KGmZifp:X+FtSVfCXn+zYBgugp4HRRFUUT5WzCZi
TLSH
T10013027A3EF80C63A50016619559B7B11A61EFCF3502556B2E2120E6A7F35F2CF03ED5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

semver

Path C:\Users\Admin\Downloads\lupa\lupa\node_modules\app-builder-lib\node_modules\.bin\semver
Size 389B
SHA256 77ef070b2790156c37dd77efd5d0cf54fbff85d9c1adabc890948192cd2b2639
MD5 1bfba09d643e7607fc6f1c37b8f45603
SHA1 0c7b860a46de97e04c3f7e1cb8595b61c231c918
SHA512 687719bf3bef716393bb43cd00e49f239535438bff63f6367558c9cab276162ddce9750d8b66f9e4c624329bbf443adde2c31775e200ccdf19dd66c33d21eec5
TLSH
T162E0927164A55F7B940D42B89D455C58425E034378083F55F90C3B475B6131DB1E773D
MD5 SHA1 SHA512 TLSH

Submit Download

semver.cmd

Path C:\Users\Admin\Downloads\lupa\lupa\node_modules\app-builder-lib\node_modules\.bin\semver.cmd
Size 325B
SHA256 3fa2710c6522669c2253edbd465ccf4c58d0d29e0eff3337d7900cd4e5cec7ac
MD5 eba7c469176dbc3fad15e2ae0f8c802e
SHA1 0417b2e953dde16603704c8e3b70874b75124e1b
SHA512 0585b704dfe82546f7916f3da25e8bd50ed576a081bbe2548f423095fc795eea5a8098d2e337bbe9f72bef44969ae24eb6af15b4a89e97d8b6a38335f94861ea
TLSH
T17FE07D76F100704A723B9F729447264237F6B74984470176B87805FB6B413865FCF8AD
MD5 SHA1 SHA512 TLSH

Submit Download

semver.ps1

Path C:\Users\Admin\Downloads\lupa\lupa\node_modules\app-builder-lib\node_modules\.bin\semver.ps1
Size 805B
SHA256 1e1355d1aaf2a75275f9d884dbcd2f1c713d4ada1782fe8370bc21db6aedbc31
MD5 f9e4a5cd62ddedd074d4ce1eccd0a51a
SHA1 0fc9a592457db4cfce5c3e08db0d299624b5c9bf
SHA512 f56df783b74ca20894e268fb6b0d8493d9077c5d1ce0a3ceec3f7f059399b0dabb31fef6e1d6bb723ee6266cacdd393d15ee80b1882b40badccfb3e475b6b9a4
TLSH
T1AB01DB2479B43EAFD24A9A9773A91E01634D876B2C4C2F25D40C3F83466172C63E7675
MD5 SHA1 SHA512 TLSH

Submit Download

node-v24.20.0-x64.msi

Path C:\Users\Admin\Downloads\node-v24.20.0-x64.msi
Size 31.6MB
SHA256 28b69132c35ccc033bf8f2a67cd10c9d75ef5822593363309da448f2afff2d8a
MD5 0d20c4ad397dd7f872418a3c1ca6a935
SHA1 b6b68cde1c07fe31de2c118ef3f889561665e24a
SHA512 fd90c7b168580aebda77f14cf325f7656bb5452d88219565fb3bfee91f755b71c006eb5bfe1da620bcb70edd29516d630194e889eebeac4f3ef3e3d669d9e73a
SSDEEP 786432:XlvliM8Ar02IDvcr3/1Yy0gtLB7TVWX2z:Vv4LAQvk3/JPtDsK
TLSH
T1D0773337F6E2093BD4EA4231D1A38741AB35BD64371046DA56B4A05CFE732F06AFAB05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI1970.tmp

Path C:\Windows\Installer\MSI1970.tmp
Size 342KB
SHA256 69cdc445cd2b1ade4074853f11c8a229c7501e176b5b113b47ac18c5564148b6
MD5 8795eed320191d21091350b952553175
SHA1 fdb195742e9066789e46424499f9984e5d27ca4e
SHA512 33785b2bd3514476d5bbe55df699c0724426dc2db54dd668d9e6b2c5e142e489c76e6d9faf40fe9de2437672bdf00292c694c4e444f99ac5789c636531bc72b8
SSDEEP 6144:yJ7qjBiG9tQFTT4U/zwWr3FvdBlGJWrmUgMzyFGfORG:yJ7ogGYFTG81vdBPmUgM0mOw
TLSH
T1E2745B366456303BE6F90D32F528CB706D3DB61827D8959E83E0984E38245E36BF375A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 4724825a28b450d264464c470b994646d084836c123210a1c6c19e3d1a17291e
MD5 d3698cf3340cceacf66ea53a2fa0af50
SHA1 d391270c3da885ce5aa0504ad62271a84b3b5670
SHA512 d80c79da0cea794d060c48d1566f011c595f505f9f7f29c4526f20562d7028034e9041d2b4823e5f5505e0790969f95defa16e24708adf4a1c4c44f71d3c66bb
SSDEEP 24576:sFo3DMPbdoO/vvTL/SAiCiVQ/LeIpbFREf0AdfMqUXsa5lzScYRWSrYj2+o:GHk
TLSH
T10F57E32432F92100E7B79E3CACF46A634D397D5BAC19DE8D45411B4E0822F71E972F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{6b351619-2503-4a95-95cc-ee576be1724b}_OnDiskSnapshotProp

Path \??\Volume{cb1876cb-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{6b351619-2503-4a95-95cc-ee576be1724b}_OnDiskSnapshotProp
Size 6KB
SHA256 05ae21d1e249532436b8140d0a3e4cdc376b2c60c84696f5e0cd6ca2e6c56f25
MD5 9675b996ceecbae21b787db816fcdfca
SHA1 be23ef96a9474212f9a8150ec66759eeeb1ac402
SHA512 c862bb43c7c313a8245034dd1665d52cdb28496335f1ae3d424a94333a05432985009404edefc1437b32dd87cfa14dd5bcf81ec0ddd6e3d52335cd836c092e52
SSDEEP 96:FNqQPOvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:H6b++uVm
TLSH
T16ED187081AF54311E2B3AB3128F18557A877B811EF33CB8E0298238E6631910F975F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/804-5181-0x000001AA71270000-0x000001AA71271000-memory.dmp

Download

memory/804-5187-0x000001AA71270000-0x000001AA71271000-memory.dmp

Download

memory/804-5186-0x000001AA71270000-0x000001AA71271000-memory.dmp

Download

memory/804-5179-0x000001AA71270000-0x000001AA71271000-memory.dmp

Download

memory/804-5190-0x000001AA71270000-0x000001AA71271000-memory.dmp

Download

memory/804-5189-0x000001AA71270000-0x000001AA71271000-memory.dmp

Download

memory/804-5188-0x000001AA71270000-0x000001AA71271000-memory.dmp

Download

memory/804-5185-0x000001AA71270000-0x000001AA71271000-memory.dmp

Download

memory/1084-7772-0x00000277FF9B0000-0x00000277FF9B1000-memory.dmp

Download

memory/1084-7767-0x00000277FF9B0000-0x00000277FF9B1000-memory.dmp

Download

memory/1084-7771-0x00000277FF9B0000-0x00000277FF9B1000-memory.dmp

Download

memory/1084-7775-0x00000277FF9B0000-0x00000277FF9B1000-memory.dmp

Download

memory/1084-7774-0x00000277FF9B0000-0x00000277FF9B1000-memory.dmp

Download

memory/1084-7773-0x00000277FF9B0000-0x00000277FF9B1000-memory.dmp

Download

memory/1084-7769-0x00000277FF9B0000-0x00000277FF9B1000-memory.dmp

Download

memory/1884-9925-0x00000207BC980000-0x00000207BC981000-memory.dmp

Download

memory/1884-9927-0x00000207BC980000-0x00000207BC981000-memory.dmp

Download

memory/1884-9929-0x00000207BC980000-0x00000207BC981000-memory.dmp

Download

memory/1884-9930-0x00000207BC980000-0x00000207BC981000-memory.dmp

Download

memory/1884-9931-0x00000207BC980000-0x00000207BC981000-memory.dmp

Download

memory/1884-9923-0x00000207BC980000-0x00000207BC981000-memory.dmp

Download

memory/1884-9928-0x00000207BC980000-0x00000207BC981000-memory.dmp

Download

memory/2116-7730-0x00007FFEB84D0000-0x00007FFEB84D1000-memory.dmp

Download

memory/2116-7729-0x00007FFEB9AF0000-0x00007FFEB9AF1000-memory.dmp

Download

memory/3452-9898-0x000001FCC6E00000-0x000001FCC72B8000-memory.dmp

Download

memory/3452-9864-0x000001FCC6E00000-0x000001FCC72B8000-memory.dmp

Download

memory/4164-7666-0x000001B4D0030000-0x000001B4D0031000-memory.dmp

Download

memory/4164-7667-0x000001B4D0030000-0x000001B4D0031000-memory.dmp

Download

memory/4164-7659-0x000001B4D0030000-0x000001B4D0031000-memory.dmp

Download

memory/4164-7661-0x000001B4D0030000-0x000001B4D0031000-memory.dmp

Download

memory/4164-7663-0x000001B4D0030000-0x000001B4D0031000-memory.dmp

Download

memory/4164-7664-0x000001B4D0030000-0x000001B4D0031000-memory.dmp

Download

memory/4164-7665-0x000001B4D0030000-0x000001B4D0031000-memory.dmp

Download

memory/6528-6492-0x000001C09A3C0000-0x000001C09A4C0000-memory.dmp

Download

memory/6528-7067-0x000001C09B690000-0x000001C09B790000-memory.dmp

Download

memory/6528-7066-0x000001C09BF00000-0x000001C09C000000-memory.dmp

Download

memory/6528-6907-0x000001C09BF00000-0x000001C09C000000-memory.dmp

Download

memory/6528-5224-0x000001C0801F0000-0x000001C0802F0000-memory.dmp

Download

memory/6528-5235-0x000001C084230000-0x000001C084250000-memory.dmp

Download

memory/6528-5532-0x000001C09B1C0000-0x000001C09B2C0000-memory.dmp

Download

memory/6528-5245-0x000001C084340000-0x000001C084360000-memory.dmp

Download

memory/6528-5222-0x000001C0801F0000-0x000001C0802F0000-memory.dmp

Download

memory/6528-5236-0x000001C094460000-0x000001C094560000-memory.dmp

Download

memory/6528-5268-0x000001C094C50000-0x000001C094C70000-memory.dmp

Download