Analysis
- user interaction
yes - max time kernel
900s - max time network
901s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
05/10/2026, 15:02
General
- Target winrar-x64-723tr.exe
- Size 3.7MB
- Sample261005-sefxqsys6m
- SHA256 cffdebf3b84cc6d24452d2d40055dbff5f6588dddcec46aaefe8fd6aa44d0744
Score
10/10
Malware Config
Extracted
Family
-
darkcomet
Botnet
-
Guest16
C2
-
pastelqq.duckdns.org:1604
Mutex
-
DC_MUTEX-0TSYMN9
Attributes
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
DqNeYtB3JaM3
-
install
true
-
offline_keylogger
true
-
persistence
false
-
reg_key
MicroUpdate
rc4.plain
Signatures
- Family: Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
- Looks for VMWare Tools registry key 2 TTPs 1 IoCs
- VMProtect packed file 1 IoCs
Detects executables packed with VMProtect commercial packer.
- Writes a Windows system DLL name to a user directory 2 TTPs 4 IoCs
A module named after a system DLL outside System32 can be loaded instead of the real one by a program searching that directory.
- Adds Run key to start application 2 TTPs 1 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 64 IoCs
- Executes dropped EXE 18 IoCs
- Loads dropped DLL 23 IoCs
- Modifies system executable filetype association 2 TTPs 8 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks processor information in registry 2 TTPs 26 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 11 IoCs
- Modifies registry class 64 IoCs
- Modifies registry key 1 TTPs 5 IoCs
- Opens file in notepad (likely ransom note) 3 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious behavior: GetForegroundWindowSpam 5 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 56 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 48 IoCs
- Suspicious use of SetWindowsHookEx 5 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\winrar-x64-723tr.exe"C:\Users\Admin\AppData\Local\Temp\winrar-x64-723tr.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\WinRAR\uninstall.exe"C:\Program Files\WinRAR\uninstall.exe" /setup2⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff9f741c728,0x7ff9f741c734,0x7ff9f741c7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1656,i,7085269040185992133,10815517588531341006,524288 --field-trial-handle=2104,i,2460051778847056613,6086794055076208039,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2236 /prefetch:32⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1772,i,1393190705151986451,16631202797156543618,262144 --field-trial-handle=2104,i,2460051778847056613,6086794055076208039,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2100 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2468,i,17172723433677703719,4512606830505807392,524288 --field-trial-handle=2104,i,2460051778847056613,6086794055076208039,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2624 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3288,i,10223634528840909955,10594105516643262635,2097152 --field-trial-handle=2104,i,2460051778847056613,6086794055076208039,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3292 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3300,i,9503180024076834624,4137274180643423504,2097152 --field-trial-handle=2104,i,2460051778847056613,6086794055076208039,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3340 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4508,i,8397882427854191830,3966929176191709658,2097152 --field-trial-handle=2104,i,2460051778847056613,6086794055076208039,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4540 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4768,i,7585224037325722060,16191989327258494795,2097152 --field-trial-handle=2104,i,2460051778847056613,6086794055076208039,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4812 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5536,i,13730734390766085545,15506597996388548894,524288 --field-trial-handle=2104,i,2460051778847056613,6086794055076208039,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5556 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5388,i,5638163089091065290,3863167056484799241,2097152 --field-trial-handle=2104,i,2460051778847056613,6086794055076208039,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5924 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3408,i,4211717756259050797,17828067901225260453,2097152 --field-trial-handle=2104,i,2460051778847056613,6086794055076208039,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3404 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5876,i,4773848249122627709,8431598929257918370,2097152 --field-trial-handle=2104,i,2460051778847056613,6086794055076208039,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5556 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=240,i,7577726238085798121,10957553085333191741,2097152 --field-trial-handle=2104,i,2460051778847056613,6086794055076208039,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3996 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5816,i,13497705415336880397,7235846099865028482,524288 --field-trial-handle=2104,i,2460051778847056613,6086794055076208039,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4492 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5788,i,9810501312207646155,6367153372742510066,524288 --field-trial-handle=2104,i,2460051778847056613,6086794055076208039,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3280 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4800,i,8483012205565869215,5458665182169238094,524288 --field-trial-handle=2104,i,2460051778847056613,6086794055076208039,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6016 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4556,i,10303697729982339409,9421998181902132614,524288 --field-trial-handle=2104,i,2460051778847056613,6086794055076208039,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5996 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=3976,i,12159728743390535860,12612178080897172113,524288 --field-trial-handle=2104,i,2460051778847056613,6086794055076208039,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4492 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=4620,i,11699276649672520559,8966454146738669658,2097152 --field-trial-handle=2104,i,2460051778847056613,6086794055076208039,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4512 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=3260,i,6847880240259314452,8417985575083544292,2097152 --field-trial-handle=2104,i,2460051778847056613,6086794055076208039,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3468 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6408,i,9788770433692433326,1568787995523586114,2097152 --field-trial-handle=2104,i,2460051778847056613,6086794055076208039,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6364 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=3456,i,18009377478013383550,16904887699581692410,2097152 --field-trial-handle=2104,i,2460051778847056613,6086794055076208039,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6388 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=5568,i,6390554937859943395,497857173649253313,2097152 --field-trial-handle=2104,i,2460051778847056613,6086794055076208039,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=240 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=1288,i,6295454582294250286,1398193060989767601,2097152 --field-trial-handle=2104,i,2460051778847056613,6086794055076208039,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6348 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=6532,i,2140757169575756226,13666040518125568171,2097152 --field-trial-handle=2104,i,2460051778847056613,6086794055076208039,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6484 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=6504,i,8141404370950940788,1291850583982596389,2097152 --field-trial-handle=2104,i,2460051778847056613,6086794055076208039,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6352 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=6132,i,13428889183676750926,12794194786016489576,2097152 --field-trial-handle=2104,i,2460051778847056613,6086794055076208039,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6464 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=3384,i,18070394947287847366,13701777777735699508,2097152 --field-trial-handle=2104,i,2460051778847056613,6086794055076208039,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6252 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=6820,i,5621384626774555263,16040754764318306587,2097152 --field-trial-handle=2104,i,2460051778847056613,6086794055076208039,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6708 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=6352,i,14084178147391588704,1171184415902792979,2097152 --field-trial-handle=2104,i,2460051778847056613,6086794055076208039,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6948 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=5568,i,269239966243152880,13010211311805673494,2097152 --field-trial-handle=2104,i,2460051778847056613,6086794055076208039,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3456 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5800,i,4010971389906032762,14166620676991502787,262144 --field-trial-handle=2104,i,2460051778847056613,6086794055076208039,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6844 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --metrics-shmem-handle=6872,i,10527157784158728243,949155118895890098,2097152 --field-trial-handle=2104,i,2460051778847056613,6086794055076208039,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1348 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --metrics-shmem-handle=7028,i,7245852378231881126,1944304316691184582,2097152 --field-trial-handle=2104,i,2460051778847056613,6086794055076208039,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7116 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --metrics-shmem-handle=6468,i,3912593000092358626,8525863997519960571,2097152 --field-trial-handle=2104,i,2460051778847056613,6086794055076208039,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6244 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=6168,i,12037277832901957876,5759678287736790667,524288 --field-trial-handle=2104,i,2460051778847056613,6086794055076208039,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7020 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --metrics-shmem-handle=4664,i,6783512630575548346,3419107592219403731,2097152 --field-trial-handle=2104,i,2460051778847056613,6086794055076208039,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6768 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --metrics-shmem-handle=3260,i,12981748732390862387,5239895967447934230,2097152 --field-trial-handle=2104,i,2460051778847056613,6086794055076208039,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6084 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --metrics-shmem-handle=6672,i,7595672642483055790,9563616641396289121,2097152 --field-trial-handle=2104,i,2460051778847056613,6086794055076208039,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5564 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=7664,i,8421977879635753581,6257416932949002616,524288 --field-trial-handle=2104,i,2460051778847056613,6086794055076208039,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3532 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --metrics-shmem-handle=1588,i,3571289437211338785,9745018336182980504,2097152 --field-trial-handle=2104,i,2460051778847056613,6086794055076208039,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7136 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --metrics-shmem-handle=6452,i,5796549087582903461,17948542419858035620,2097152 --field-trial-handle=2104,i,2460051778847056613,6086794055076208039,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6560 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --metrics-shmem-handle=6772,i,12143345142027444975,9993205213431282909,2097152 --field-trial-handle=2104,i,2460051778847056613,6086794055076208039,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6348 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --metrics-shmem-handle=7580,i,12514441572584370482,6193739617925779170,2097152 --field-trial-handle=2104,i,2460051778847056613,6086794055076208039,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6276 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --metrics-shmem-handle=7608,i,15802667240466981737,7001058942565033196,2097152 --field-trial-handle=2104,i,2460051778847056613,6086794055076208039,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7668 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --metrics-shmem-handle=7484,i,15170131584823857813,17893509670261309728,2097152 --field-trial-handle=2104,i,2460051778847056613,6086794055076208039,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7548 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=7668,i,14164006961680152014,18423478032131125734,524288 --field-trial-handle=2104,i,2460051778847056613,6086794055076208039,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=8100 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=8104,i,14055673490238766106,10860977478479833779,524288 --field-trial-handle=2104,i,2460051778847056613,6086794055076208039,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6956 /prefetch:82⤵
-
-
C:\Program Files\WinRAR\WinRAR.exe"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\Admin\Downloads\MHDDoS-2.4.6.zip"2⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --metrics-shmem-handle=5576,i,5437519376219039032,17084422263411321927,2097152 --field-trial-handle=2104,i,2460051778847056613,6086794055076208039,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6344 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --metrics-shmem-handle=7784,i,10368220879737456299,13644392924152340028,2097152 --field-trial-handle=2104,i,2460051778847056613,6086794055076208039,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7976 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --metrics-shmem-handle=3500,i,7626778918399684723,188025883913973366,2097152 --field-trial-handle=2104,i,2460051778847056613,6086794055076208039,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7792 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --metrics-shmem-handle=7532,i,12983575496239462256,14495042216709895092,2097152 --field-trial-handle=2104,i,2460051778847056613,6086794055076208039,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7500 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --metrics-shmem-handle=7840,i,3504893944625080935,9972704874463681996,2097152 --field-trial-handle=2104,i,2460051778847056613,6086794055076208039,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7048 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --metrics-shmem-handle=7512,i,295293735762339754,3081986424384020439,2097152 --field-trial-handle=2104,i,2460051778847056613,6086794055076208039,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=8048 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --metrics-shmem-handle=7968,i,16628519491751449315,12773202443442327047,2097152 --field-trial-handle=2104,i,2460051778847056613,6086794055076208039,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7608 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --metrics-shmem-handle=6540,i,3419709311318720091,7538213851978257497,2097152 --field-trial-handle=2104,i,2460051778847056613,6086794055076208039,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=8180 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --metrics-shmem-handle=8272,i,17937642556269782322,12980736395643268686,2097152 --field-trial-handle=2104,i,2460051778847056613,6086794055076208039,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=8336 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --metrics-shmem-handle=8428,i,12837800349549107103,10355631003017350361,2097152 --field-trial-handle=2104,i,2460051778847056613,6086794055076208039,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=8452 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --metrics-shmem-handle=8652,i,15420668035002241709,2024493133743617153,2097152 --field-trial-handle=2104,i,2460051778847056613,6086794055076208039,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=8668 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --metrics-shmem-handle=7860,i,18090634231516116881,11939655309382916277,2097152 --field-trial-handle=2104,i,2460051778847056613,6086794055076208039,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7616 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --metrics-shmem-handle=8184,i,4900054806182896598,10318189313560261474,2097152 --field-trial-handle=2104,i,2460051778847056613,6086794055076208039,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=8256 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --metrics-shmem-handle=8804,i,17815704817186368952,3560050607960625297,2097152 --field-trial-handle=2104,i,2460051778847056613,6086794055076208039,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=8764 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --metrics-shmem-handle=8160,i,13039090564298249518,5613310239455648994,2097152 --field-trial-handle=2104,i,2460051778847056613,6086794055076208039,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6960 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --metrics-shmem-handle=8248,i,11493476439049672378,15902197196867656,2097152 --field-trial-handle=2104,i,2460051778847056613,6086794055076208039,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7608 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --metrics-shmem-handle=8612,i,7530040172014369322,3552005147356419760,2097152 --field-trial-handle=2104,i,2460051778847056613,6086794055076208039,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=8476 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=9260,i,11555585951192340775,211338815798781075,524288 --field-trial-handle=2104,i,2460051778847056613,6086794055076208039,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=9244 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --metrics-shmem-handle=8136,i,15130758180433666898,16317231527738089048,2097152 --field-trial-handle=2104,i,2460051778847056613,6086794055076208039,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3312 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --metrics-shmem-handle=9220,i,9768484239453784050,14144224550619276156,2097152 --field-trial-handle=2104,i,2460051778847056613,6086794055076208039,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=9224 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --metrics-shmem-handle=8640,i,4569228077144713147,3264911149731241587,2097152 --field-trial-handle=2104,i,2460051778847056613,6086794055076208039,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=8824 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --metrics-shmem-handle=4764,i,1362354776234422763,8748658690085955195,2097152 --field-trial-handle=2104,i,2460051778847056613,6086794055076208039,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=9248 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --metrics-shmem-handle=7180,i,3469343858356055986,8343703308153107231,2097152 --field-trial-handle=2104,i,2460051778847056613,6086794055076208039,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3404 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=9052,i,10752104871625873385,9627502137812184234,524288 --field-trial-handle=2104,i,2460051778847056613,6086794055076208039,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=8248 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=9088,i,12123393650887532977,9946699655319024262,524288 --field-trial-handle=2104,i,2460051778847056613,6086794055076208039,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=9384 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --metrics-shmem-handle=7664,i,17298061370985816389,17853955137061613706,2097152 --field-trial-handle=2104,i,2460051778847056613,6086794055076208039,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=868 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files\WinRAR\WinRAR.exe"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\Admin\Downloads\Git_Project.zip"1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Temp\Rar$EXa3620.2766.rartemp\Git_Project\Latest_Build.exe"C:\Users\Admin\AppData\Local\Temp\Rar$EXa3620.2766.rartemp\Git_Project\Latest_Build.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\3JxJnCX3Am2JWpTCBjYw4ffLGjO\Pv1znnyyrm.exeC:\Users\Admin\AppData\Local\Temp\3JxJnCX3Am2JWpTCBjYw4ffLGjO\Pv1znnyyrm.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
-
C:\Users\Admin\AppData\Local\Temp\3JxJnCX3Am2JWpTCBjYw4ffLGjO\Pv1znnyyrm.exe"C:\Users\Admin\AppData\Local\Temp\3JxJnCX3Am2JWpTCBjYw4ffLGjO\Pv1znnyyrm.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\livg7px51lxk" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1708 --field-trial-handle=1696,i,16023951230067037501,521342634912296595,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:24⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe query HKLM\SYSTEM\CurrentControlSet\Control\ProductOptions /v ProductType4⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe query "HKLM\SOFTWARE\Microsoft\Virtual Machine\Guest\Parameters"4⤵
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe query "HKLM\SOFTWARE\VMware, Inc.\VMware Tools"4⤵
- Looks for VMWare Tools registry key
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe query HKLM\HARDWARE\DESCRIPTION\System\BIOS /v SystemManufacturer4⤵
- Enumerates system info in registry
- Modifies registry key
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe query HKLM\HARDWARE\DESCRIPTION\System\BIOS /v SystemProductName4⤵
- Enumerates system info in registry
- Modifies registry key
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe query HKLM\HARDWARE\DESCRIPTION\System\BIOS /v BIOSVendor4⤵
- Enumerates system info in registry
- Modifies registry key
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe query HKLM\HARDWARE\DESCRIPTION\System\BIOS /v SystemVersion4⤵
- Enumerates system info in registry
- Modifies registry key
-
-
-
-
C:\Program Files\WinRAR\WinRAR.exe"C:\Program Files\WinRAR\WinRAR.exe" x -iext -ver -imon1 -- "C:\Users\Admin\Downloads\Git_Project.zip" C:\Users\Admin\Downloads\1⤵
- Executes dropped EXE
-
C:\Users\Admin\Downloads\Git_Project\Latest_Build.exe"C:\Users\Admin\Downloads\Git_Project\Latest_Build.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\3JxJnCX3Am2JWpTCBjYw4ffLGjO\Pv1znnyyrm.exeC:\Users\Admin\AppData\Local\Temp\3JxJnCX3Am2JWpTCBjYw4ffLGjO\Pv1znnyyrm.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
-
C:\Users\Admin\AppData\Local\Temp\3JxJnCX3Am2JWpTCBjYw4ffLGjO\Pv1znnyyrm.exe"C:\Users\Admin\AppData\Local\Temp\3JxJnCX3Am2JWpTCBjYw4ffLGjO\Pv1znnyyrm.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\livg7px51lxk" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1688 --field-trial-handle=1660,i,2281911146402244600,6861183376941409638,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:23⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Git_Project\Readme.txt1⤵
- Opens file in notepad (likely ransom note)
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Git_Project\FAQ.txt1⤵
- Opens file in notepad (likely ransom note)
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Git_Project\Readme.txt1⤵
- Opens file in notepad (likely ransom note)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\MHDDoS-2.4.6\install.bat" "1⤵
- Executes a command shell one-liner
-
C:\Windows\system32\where.exewhere python2⤵
-
-
C:\Program Files\WinRAR\WinRAR.exe"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\Admin\Downloads\CRAFTRİSE HİLE.zip"1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\hile\beni oku.txt1⤵
-
C:\Program Files\WinRAR\WinRAR.exe"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\Admin\Downloads\Roblox ucma hilesi(Roblox fly hack).rar"1⤵
- Writes a Windows system DLL name to a user directory
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Program Files\WinRAR\WinRAR.exe"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\Admin\Downloads\Craftrise Sonoyuncu Hile Noise+.rar"1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Users\Admin\Desktop\Noise Xray_\Extreme Injector v3.exe"C:\Users\Admin\Desktop\Noise Xray_\Extreme Injector v3.exe"1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
-
C:\Users\Admin\Desktop\Noise Xray_\Noise+.exe"C:\Users\Admin\Desktop\Noise Xray_\Noise+.exe"1⤵
- Adds Run key to start application
- Checks computer location settings
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exeC:\Users\Admin\Documents\MSDCSC\msdcsc.exe1⤵
- Suspicious use of SetThreadContext
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\Desktop\Noise Xray_\Noise+.exe"C:\Users\Admin\Desktop\Noise Xray_\Noise+.exe"1⤵
- Suspicious use of SetThreadContext
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Event Triggered Execution
2Change Default File Association
1Component Object Model Hijacking
1Hijack Execution Flow
1DLL Search Order Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Event Triggered Execution
2Change Default File Association
1Component Object Model Hijacking
1Hijack Execution Flow
1DLL Search Order Hijacking
1Defense Evasion
Hijack Execution Flow
1DLL Search Order Hijacking
1Masquerading
1Match Legitimate Name or Location
1Modify Registry
4Virtualization/Sandbox Evasion
1Replay Monitor
Loading Replay Monitor...
Downloads
Rar.txt
Uninstall.exe
WhatsNew.txt
WinRAR.chm
WinRAR.exe
rarext.dll
uninstall.lng
winrar.lng
078e1a8b-def2-430d-88d6-8a68ddae2947.tmp
0930ec8a-0597-4c92-b8eb-27f37412997b.tmp
0ad57784-4155-4f4c-8110-175547eef632.tmp
0e9eeedd-6f51-475a-9f10-1485423cbb7b.tmp
10ba999a-894d-40d0-a074-59ba7511435d.tmp
182767b8-7e02-4a03-be91-e87d1d4d5d6b.tmp
1d3c01c3-cce6-467a-bd40-dcf42b7ff3b8.tmp
308e5ac5-1e6d-47c9-89a0-dc31e3555daf.tmp
364250f2-d590-439d-8326-422c6d431dee.tmp
3eac7d95-bb46-4dfb-a0c3-4983f7e055c5.tmp
449b3963-794d-4576-8605-aaafba6f2bc5.tmp
4682e5cd-3b6b-4c70-b5ca-510420e298b9.tmp
5baa9408-3369-409c-ba09-2b27f9f8db14.tmp
5cd8921b-9694-427a-ae2a-45ec4cca1aa4.tmp
639b84c0-8a5f-4da1-bade-226a800ff76f.tmp
6a15a931-649c-40ec-931b-a200e5cf4564.tmp
7220d984-959f-4e0d-9c70-4683129252b0.tmp
7ad2b95b-4c35-4aa6-a9a4-32288e742bf2.tmp
8b2ad55a-fa64-42fc-a3ea-a57d73d0c11e.tmp
00f250b1-f75a-4347-bb56-01467500213a.tmp
03206620-9748-4fee-963b-d2cc50722310.tmp
0d118441-0421-4acb-9411-0a431cb6f59a.tmp
3b11daab-72b3-4cbb-9878-a34184523d78.tmp
4ac73697-7bd2-4712-ad85-ff2ad4bc528d.tmp
55bab0e2-c314-4c8e-9801-2792a3a579ca.tmp
61b45953-0b27-4e84-a6b7-69a48e408f63.tmp
78f049bb-3385-4575-b17b-81d63e115422.tmp
7af282bf-5fb3-4003-be62-88ab6fdaa6cf.tmp
8296d397-aba0-4767-b809-342cac15f087.tmp
852516d0-c039-47ca-85c7-6a1b7754f38b.tmp
8cfe3b57-8d46-43b5-9794-4e4d6589dae5.tmp
9c84e090-38bc-4528-aec6-2705858ceedc.tmp
f_000005
f_000008
f_000009
f_00000b
f_00000d
f_00000e
f_00000f
f_000010
f_00001a
f_00001d
f_00001e
f_000021
f_000027
f_00002b
f_000031
f_00003a
f_00003f
f_00004a
f_00004b
f_00004f
f_000051
f_000052
f_000053
f_000054
f_000055
f_000056
f_000057
f_000058
f_000059
f_00005a
f_00005b
f_00005c
f_000060
f_000061
f_000068
f_000069
f_00006a
f_00006b
f_00006c
f_00006e
f_00006f
f_000070
f_000071
f_000072
f_000073
f_000074
f_000075
f_000076
f_000077
f_000078
f_000079
f_00007c
f_000083
f_000084
f_000085
f_000086
f_000088
f_000089
f_00008a
f_00008b
f_00008c
f_00008d
f_00008e
f_00008f
f_00009d
f_00009f
f_0000a4
f_0000a6
f_0000c8
f_0000c9
f_0000e9
f_0000ea
f_0000ef
f_0000f0
f_0000f1
f_0000f2
f_0000f3
f_0000f4
f_0000f5
f_0000f6
f_0000f7
037c17119ef4054b_0
059766dff628a7b0_0
071c1128df643428_0
07e32941025fbe31_0
07fd7a4e5fe8b258_0
0c28710a6005afb7_0
0e33be5fe5fc86e5_0
0fc2d39ffdc7cf5e_0
10221ac6047b687d_0
10f9ba851ee49823_0
1131937bc84b5c8c_0
13be21801cd98220_0
1660b7f4adc7746c_0
16efeb492bada89a_0
1891a22b028d3b24_0
19f0c5de1d49ad39_0
1a23a9ae1a37f1cc_0
1b14e6ed84c97f39_0
21e9848c42b1a0b1_0
2260e661a3e499c0_0
234c1e8c5294adf4_0
2437b34e6751e701_0
25112257ddee7994_0
261c3bdcf02fcbbe_0
26322e1070a84fb7_0
28986b5f3bd2b7e3_0
29d8d585c4d4d001_0
2b46b08bd29748bb_0
2b84796f392fac23_0
2c191ba2dc0b84e0_0
2dc002a86566e286_0
2fbceb2e3561e815_0
30cd99727d3e6494_0
31c0bf2bafb37c39_0
32a71c5ac326dc87_0
3327917a3ac40547_0
33ed520404acc1d9_0
3736cb07a7865690_0
38b27e9ba60a057b_0
39524ad684b24b6c_0
3c8ecf16eb575c26_0
3cf627ba18e5418b_0
3e018cba23288215_0
3eb012db40534c81_0
410481a976add328_0
417ce13111469d84_0
43d3e0f3ef8fc664_0
4515fef1a7cdd625_0
495e3fed2a95de43_0
49ab9f89bd7bcc8d_0
4aed36ccc49c93ef_0
4e5c704ddc834ed7_0
4f09c6f162f63467_0
4f9ffee09dcccfcb_0
4fd018567c990084_0
50090186eafad737_0
504d1c624fcb17ba_0
51696a24e9cc02e0_0
522236da1d81fd02_0
564d5afa3a7fe4ef_0
57ad007a1bd06bb8_0
58af71d8e34a0785_0
5cf2225ddc381424_0
5d98941f69c0013d_0
5db74a53052c9561_0
612a407446c0f49f_0
613f4e72673dd0aa_0
636fe9c2f6308331_0
6a2571a30fa5eb4e_0
6b0efc62c5899215_0
6b77ea783677a22d_0
6becfc22058f2eaa_0
6cfbdf47b5435b91_0
6f432719b5a38ade_0
6fd38eb63a44e0a7_0
74343a6ff253190c_0
75454905ca99e2b1_0
75d9c70d3af57254_0
76a38f5172d8f38c_0
78472403e5ab7a20_0
799e5901ac9ed935_0
7b21d0fc9c08a49a_0
801a54c53ecce322_0
80b12b37dd5a7de2_0
81f3e430b4cb72df_0
8621f4eb1702117b_0
868d063309e36c61_0
885b2931071e9b59_0
89a6ebd98e80525e_0
8b0d13b2ac049591_0
8b21c709746699b8_0
8baff564a24ef342_0
8bc442f443c655e1_0
8c68fe6d39a07b97_0
8cec7a35252332b6_0
8eb156ced8d56155_0
8fbbc3c26513735e_0
8fbc349ddebbdf93_0
8fbc349ddebbdf93_0
90ba3b09560a6650_0
910329ea4cd323f1_0
9125a5d51fce8f84_0
919697d20758112f_0
91d0b0f87984824f_0
965c85ac0f1da3c5_0
974b736a16eef29b_0
98fb17b4034f8f18_0
991469bcb2c589c8_0
99abc3b5f2b3c47b_0
9b451ed1de36d188_0
9d80173b0d285fe8_0
9d96f7167c657da3_0
9fb64e1ece7e4d9e_0
a127643f0bf87515_0
a8b5d7ee64e7a486_0
ac45e1e3dc096bb0_0
ac520fc1b41fa9f2_0
ad3ab59e4d10361c_0
b0d757a1859e172b_0
b19bc4bb27559333_0
b2070ace45ec677f_0
b39bbf123f8f5d83_0
b3b24b1486a7f60f_0
b40bcbdea947aaa2_0
b4591da7acc1908d_0
b4af6f0ecae28d75_0
bc9c45bc22d3904b_0
bc9c45bc22d3904b_0
bd47e87aeb29692b_0
bda34ea700b97dfb_0
bdb627a446030d0e_0
bfd1d1b1ace38ce4_0
c11888e251d5c048_0
c32b21e404a7969e_0
c38dbcf0dc77caad_0
c698db1ea942fc28_0
c83af370fddff215_0
cdd013d65d7049e1_0
cde9b301ce78e510_0
ce1147abb441059c_0
ce236d0d35eeb380_0
d31a495bf10ee28c_0
d6f51a44a600e81c_0
d835bfa854316497_0
d864c5af2c762595_0
d92bce620bf74a24_0
dbc35f1673cf94b5_0
de4b07ee565592f9_0
de50d7ee9598fe98_0
df16d1b0c2e468fb_0
e5f1bf7fe54dcd33_0
e9e7951d5d327737_0
ed36edb2fd4a14e1_0
ef67c3460e01db93_0
efa9dc4b434229af_0
f16151be81df5d79_0
f265ee6f1fe3570a_0
f2f6a0b5cefe0b96_0
f418d3750c61de23_0
f8372281845c99da_0
f95409d152568ff9_0
fcdcccf49d04dc77_0
fd1573f47485e56b_0
temp-index
temp-index
temp-index
temp-index
temp-index
temp-index
the-real-index
000003.log
LOG
LOG
6f1b5da5-900b-4272-b456-68deecba302c.tmp
0d2b1c4f-7379-4720-a239-5b1c9b44e345.tmp
150826d9-e04b-4312-9b4a-5cbef47a15bc.tmp
23279983-78f3-4070-a9a4-5c86ef61bc8a.tmp
58cf54df-91fd-4b9a-84e4-e5a86623dc3c.tmp
906c51fa-8a6a-41c5-bb3b-089db6e68cc0.tmp
e916bfa8-e08b-4038-9a85-9bda86fd01c8.tmp
temp-index
the-real-index
Session_13435686832901872
6aad5c6cfa604508_0
d0ade8407f7ca002_0
temp-index
index
index.txt
index.txt.tmp
index.txt.tmp
index.txt.tmp
000003.log
CURRENT
LOG
index.txt
index.txt.tmp
MANIFEST-000001
b0181a47-d9f4-4d8d-b9d4-24da52cced34.tmp
b735ed54-9f0e-4f74-a3ce-a8f867824d91.tmp
b8b95d00-8b3e-4edb-be4b-a45e4bf9453c.tmp
b9f457f2-1ef8-4f24-afd3-1307a184d116.tmp
c2116221-3b3e-4af5-9a81-a427dbdc1094.tmp
c58aa49c-9685-4611-b79b-04567e7452cf.tmp
d0d7c6cd-9fdf-41dc-97b3-0156f6f6acea.tmp
dcaede38-973d-4974-89a5-71c2dd3efd6a.tmp
de88637f-803f-448c-b93b-2227d57fc88e.tmp
e14ea1f7-879d-4385-bb75-bcf156f44535.tmp
e2289b3c-5a43-4258-a06c-1f0d8ce9d4a6.tmp
e70a2714-620c-489c-a911-0dcfffe52100.tmp
e76b29a3-322a-4898-841e-d638d373121c.tmp
ec4dc16c-682e-4b21-8c80-39375d5cd882.tmp
f44071d4-9f9e-4f9d-91b6-f0700e258214.tmp
b8c98306-b0cb-4b5f-a686-c8033dc04140.tmp
c136b8f2-67f3-4572-be71-67d613d416da.tmp
c5f757f5-966c-4eb1-8b5c-bb9bef5c4e5e.tmp
c6e8961e-75dc-45f5-9d85-1f251f48e743.tmp
c8ceef6f-00bc-4241-aabb-d2d10bce6fb6.tmp
c91cd0e9-6a35-4dc4-ac07-e48b943c6298.tmp
cb4a2453-6370-44b0-9ba8-5fd2a37dadff.tmp
cbd3cf6e-f0f6-4200-8d23-98ce2c50f619.tmp
ce4c851d-81b6-422c-9790-2366eb7055f9.tmp
d52130fa-dd30-405c-9112-fc5dc867fa19.tmp
f71fae26-3dac-4a19-829e-471cd32bfc45.tmp
LICENSE.electron.txt
LICENSES.chromium.html
d3dcompiler_47.dll
ffmpeg.dll
icudtl.dat
libEGL.dll
libGLESv2.dll
af.pak
am.pak
ar.pak
bg.pak
bn.pak
ca.pak
cs.pak
da.pak
de.pak
el.pak
en-GB.pak
en-US.pak
es-419.pak
es.pak
et.pak
fa.pak
fi.pak
fil.pak
fr.pak
gu.pak
he.pak
hi.pak
hr.pak
hu.pak
id.pak
it.pak
ja.pak
kn.pak
ko.pak
lt.pak
lv.pak
ml.pak
mr.pak
ms.pak
nb.pak
nl.pak
pl.pak
pt-BR.pak
pt-PT.pak
ro.pak
ru.pak
sk.pak
sl.pak
sr.pak
sv.pak
sw.pak
ta.pak
te.pak
th.pak
tr.pak
uk.pak
ur.pak
vi.pak
zh-TW.pak
resources.pak
app.asar
elevate.exe
snapshot_blob.bin
v8_context_snapshot.bin
vk_swiftshader.dll
vk_swiftshader_icd.json
vulkan-1.dll
S303H4X.CETRAINER
32bb.bak
64bb.bak
CCv3 - 32bit.exe
CCv3 - 64bit.exe
CED3D10Hook.dll
CED3D10Hook64.dll
CED3D11Hook.dll
CED3D11Hook64.dll
DotNetDataCollector32.exe
DotNetDataCollector64.exe
allochook-i386.dll
allochook-x86_64.dll
CEJVMTI.dll
CEJVMTI.dll
MonoDataCollector.dll
MonoDataCollector.frm
java.lua
javaClassEditor.lua
javaclass.lua
monoscript.lua
savesession.lua
ced3d9hook.dll
ced3d9hook64.dll
class.lua
classwrapper.lua
lfs.dll
lfs.dll
commonmodulelist.txt
d3dhook.dll
d3dhook64.dll
dbk32.sys
dbk64.sys
defines.lua
donottrace.txt
lua5.1-32.dll
lua5.1-64.dll
main.lua
overlay.fx
speedhack-i386.dll
speedhack-x86_64.dll
standalonephase1.dat
standalonephase2.dat
tiny.dat
tutorial-i386.exe
tutorial-x86_64.exe
dbghelp.dll
dbghelp.dll
verbhaxx.dll
tenacitybold.ttf
classic_theme.cfg
._Config
._.DS_Store
chrome_100_percent.pak
chrome_200_percent.pak
zh-CN.pak
StdUtils.dll
System.dll
nsis7z.dll
default.dic
1SLLUEEOSPKYCGP4MC49.temp
25E4B9A0XISUY5R6GOQV.temp
5d696d521de238c3.customDestinations-ms
7WCYVY40XOVFQGMGD1U7.temp
8VSFIVAZCZNFGLVZAYWW.temp
BRQUMP7LNKWV82A3MKBG.temp
DFECV0AR0E9IBFQCWKSU.temp
FMQ2SIB4N47U0AEGAIQL.temp
GHDUNFPKZG4LIX7SZJ9V.temp
GSZTKCEZHS0XO3YVJSKL.temp
NZF1Y8BT3MOV06757C62.temp
RZW6YW0GGNOR71R9SBS3.temp
WMQ869AFYUSPSB1IY4DT.temp
XOWR1V8IKQ8UHH2PUFMD.temp
XV8G1L8XY1KSY3YWZ98W.temp
ZM73J7IPJCEDSX5SALZ0.temp
msdcsc.exe
.DS_Store
bebfd43f-36c1-452e-a5bd-45df4a7d506c.tmp
memory/1548-8091-0x0000000000290000-0x0000000000476000-memory.dmp
memory/1548-8092-0x000000001B460000-0x000000001B472000-memory.dmp
memory/1548-8093-0x000000001DD40000-0x000000001DD7C000-memory.dmp
memory/2408-8149-0x0000000000400000-0x00000000004CA000-memory.dmp
memory/3140-8153-0x0000000000400000-0x00000000004CA000-memory.dmp
memory/3500-8151-0x0000000000400000-0x00000000004CA000-memory.dmp
memory/4508-8150-0x0000000000400000-0x00000000004CA000-memory.dmp
memory/4868-8148-0x0000000000400000-0x00000000004CA000-memory.dmp