Analysis
- user interaction
yes - max time kernel
2700s - max time network
2695s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
22/10/2026, 22:07
General
- Target http://ftp.unshacklegroove.in.net
- Sample261022-11tpqabf64
Score
8/10
Malware Config
Signatures
- Downloads MZ/PE file 1 IoCs
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 13 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Probable phishing domain 1 TTPs 1 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 1 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies data under HKEY_USERS 5 IoCs
- Modifies registry class 64 IoCs
- Modifies system certificate store 2 TTPs 5 IoCs
- Opens file in notepad (likely ransom note) 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: LoadsDriver 2 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 37 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 58 IoCs
- Suspicious use of SetWindowsHookEx 52 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://ftp.unshacklegroove.in.net1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffad96ec728,0x7ffad96ec734,0x7ffad96ec7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1680,i,4881120359921228981,14946527877978791119,262144 --field-trial-handle=1932,i,9925450582609133492,13825856462732976531,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1928 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1488,i,9556462126764552989,18013424623656682733,524288 --field-trial-handle=1932,i,9925450582609133492,13825856462732976531,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2272 /prefetch:32⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2372,i,13124566416891287962,15777490685371600645,524288 --field-trial-handle=1932,i,9925450582609133492,13825856462732976531,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2544 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3124,i,3981395381058664082,15701037927652736171,2097152 --field-trial-handle=1932,i,9925450582609133492,13825856462732976531,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3144 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3148,i,229501143398385152,13641796843380535650,2097152 --field-trial-handle=1932,i,9925450582609133492,13825856462732976531,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3256 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4524,i,9961995248756822688,5891417169449246625,2097152 --field-trial-handle=1932,i,9925450582609133492,13825856462732976531,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4536 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5152,i,15229587076670676807,8943775876469738479,524288 --field-trial-handle=1932,i,9925450582609133492,13825856462732976531,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5160 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3268,i,13837763415030096499,3158349080543732813,524288 --field-trial-handle=1932,i,9925450582609133492,13825856462732976531,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3292 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5184,i,10387154485299127487,16929961354174965157,524288 --field-trial-handle=1932,i,9925450582609133492,13825856462732976531,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5152 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5160,i,10870387905401124785,7836903760300470972,524288 --field-trial-handle=1932,i,9925450582609133492,13825856462732976531,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5164 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5156,i,8025630992691642684,131015286228360866,524288 --field-trial-handle=1932,i,9925450582609133492,13825856462732976531,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5452 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5596,i,9098622388182551898,11188829517173805965,524288 --field-trial-handle=1932,i,9925450582609133492,13825856462732976531,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=728 /prefetch:82⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=728,i,15735148635421760355,16130702206459513957,524288 --field-trial-handle=1932,i,9925450582609133492,13825856462732976531,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1088 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5368,i,5532173732339277695,11596961499304278924,262144 --field-trial-handle=1932,i,9925450582609133492,13825856462732976531,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5152 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5236,i,11804569334953596071,8506436336982931956,524288 --field-trial-handle=1932,i,9925450582609133492,13825856462732976531,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1088 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5956,i,3580939212056777471,17451270476570851541,2097152 --field-trial-handle=1932,i,9925450582609133492,13825856462732976531,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3092 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6064,i,16049618746423576775,7784630243748527325,2097152 --field-trial-handle=1932,i,9925450582609133492,13825856462732976531,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6068 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5964,i,3661936619903582904,18272778308844550444,2097152 --field-trial-handle=1932,i,9925450582609133492,13825856462732976531,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6168 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6156,i,9450143896185668379,9034891113606547054,2097152 --field-trial-handle=1932,i,9925450582609133492,13825856462732976531,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6368 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=3316,i,14723691994462433041,12377710558201551473,2097152 --field-trial-handle=1932,i,9925450582609133492,13825856462732976531,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3124 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5608,i,2203190712825055935,16543263181091332445,2097152 --field-trial-handle=1932,i,9925450582609133492,13825856462732976531,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4516 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=5584,i,2543863263375670427,4066659824907852083,2097152 --field-trial-handle=1932,i,9925450582609133492,13825856462732976531,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5972 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=4536,i,7776148067938976335,9333970276816182438,2097152 --field-trial-handle=1932,i,9925450582609133492,13825856462732976531,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6016 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6636,i,8947314780286302306,6427240760242210397,2097152 --field-trial-handle=1932,i,9925450582609133492,13825856462732976531,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1512 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=3148,i,8462814481397372446,1388499205441623835,2097152 --field-trial-handle=1932,i,9925450582609133492,13825856462732976531,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6736 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=6912,i,2282133389237658715,18123389666229767431,2097152 --field-trial-handle=1932,i,9925450582609133492,13825856462732976531,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6916 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=7248,i,10770722273053222921,5994741933594732627,2097152 --field-trial-handle=1932,i,9925450582609133492,13825856462732976531,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7344 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=6856,i,16072985920219138075,10758781020701456291,2097152 --field-trial-handle=1932,i,9925450582609133492,13825856462732976531,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7132 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=3936,i,17448729588315676126,3264617485514479771,2097152 --field-trial-handle=1932,i,9925450582609133492,13825856462732976531,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6552 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=7256,i,6946549166906314972,14297793099856324731,524288 --field-trial-handle=1932,i,9925450582609133492,13825856462732976531,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7208 /prefetch:82⤵
-
-
C:\Users\Admin\Downloads\npp.8.9.8.1.Installer.x64.exe"C:\Users\Admin\Downloads\npp.8.9.8.1.Installer.x64.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe" "C:\Program Files\Notepad++\notepad++.exe"3⤵
-
-
C:\Program Files\Notepad++\notepad++.exe"C:\Program Files\Notepad++\notepad++.exe" "C:\Program Files\Notepad++\change.log"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=4520,i,15477538480641072887,8394911133878412649,2097152 --field-trial-handle=1932,i,9925450582609133492,13825856462732976531,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6048 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=7072,i,380149791196761813,17470116767411149634,2097152 --field-trial-handle=1932,i,9925450582609133492,13825856462732976531,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7084 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --metrics-shmem-handle=6580,i,18047211353505904049,10600049858146861796,2097152 --field-trial-handle=1932,i,9925450582609133492,13825856462732976531,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6700 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --metrics-shmem-handle=6644,i,7951071916318285605,17279654052136990008,2097152 --field-trial-handle=1932,i,9925450582609133492,13825856462732976531,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6600 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --metrics-shmem-handle=6912,i,6620157682004652820,18378005446779269626,2097152 --field-trial-handle=1932,i,9925450582609133492,13825856462732976531,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1180 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --metrics-shmem-handle=7180,i,11314005920424673491,6032062045387679362,2097152 --field-trial-handle=1932,i,9925450582609133492,13825856462732976531,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7096 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --metrics-shmem-handle=7236,i,14488178873442711472,18028015792709736908,2097152 --field-trial-handle=1932,i,9925450582609133492,13825856462732976531,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4560 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --metrics-shmem-handle=7348,i,13786560495522729091,16896772069750135637,2097152 --field-trial-handle=1932,i,9925450582609133492,13825856462732976531,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7048 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=7076,i,10871616241370859325,6501126522615225921,524288 --field-trial-handle=1932,i,9925450582609133492,13825856462732976531,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1500 /prefetch:82⤵
- Modifies registry class
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=7232,i,7890445422193662343,12083124953506403756,524288 --field-trial-handle=1932,i,9925450582609133492,13825856462732976531,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5588 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --metrics-shmem-handle=7124,i,2071240280174956263,6215621230114324520,2097152 --field-trial-handle=1932,i,9925450582609133492,13825856462732976531,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6540 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --metrics-shmem-handle=7816,i,1592613119250647730,7324717675978421056,2097152 --field-trial-handle=1932,i,9925450582609133492,13825856462732976531,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7812 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --metrics-shmem-handle=7904,i,1166159803741255695,104691159957075112,2097152 --field-trial-handle=1932,i,9925450582609133492,13825856462732976531,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7896 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --metrics-shmem-handle=8060,i,10165171402434361766,1383883922356598923,2097152 --field-trial-handle=1932,i,9925450582609133492,13825856462732976531,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=8040 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --metrics-shmem-handle=7116,i,1055479942366064919,141335829133130441,2097152 --field-trial-handle=1932,i,9925450582609133492,13825856462732976531,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7628 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --metrics-shmem-handle=7432,i,13657121471904054567,10236148353248844582,2097152 --field-trial-handle=1932,i,9925450582609133492,13825856462732976531,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7768 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --metrics-shmem-handle=8036,i,16851254638161488397,13624455718505016978,2097152 --field-trial-handle=1932,i,9925450582609133492,13825856462732976531,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7876 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --metrics-shmem-handle=3104,i,2943637247532467267,9818489914142018189,2097152 --field-trial-handle=1932,i,9925450582609133492,13825856462732976531,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=8120 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --metrics-shmem-handle=8332,i,17870778973556559134,9088575252486859726,2097152 --field-trial-handle=1932,i,9925450582609133492,13825856462732976531,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7780 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --metrics-shmem-handle=7424,i,10928124160513628388,15428048377854113120,2097152 --field-trial-handle=1932,i,9925450582609133492,13825856462732976531,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7016 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --metrics-shmem-handle=6896,i,13614728021457827374,4536849820492348200,2097152 --field-trial-handle=1932,i,9925450582609133492,13825856462732976531,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=8412 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=8584,i,3854228748677306716,15759857021457285033,524288 --field-trial-handle=1932,i,9925450582609133492,13825856462732976531,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7160 /prefetch:82⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --metrics-shmem-handle=6748,i,12825568324934701032,7002497269409419235,2097152 --field-trial-handle=1932,i,9925450582609133492,13825856462732976531,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=8592 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\python314._pth2⤵
- Opens file in notepad (likely ransom note)
-
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\python314\" -spe -an -ai#7zMap3368:82:7zEvent305911⤵
- Suspicious use of FindShellTrayWindow
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\python314\itq2⤵
-
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\python314\python3.dll2⤵
- Opens file in notepad (likely ransom note)
-
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\installation_status.json2⤵
- Opens file in notepad (likely ransom note)
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Notepad++\notepad++.exe"C:\Program Files\Notepad++\notepad++.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Modifies system certificate store
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Enterprise v16
Defense Evasion
Modify Registry
1Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
change.log
langs.model.xml
notepad++.exe
nppPluginList.dll
NppConverter.dll
NppExport.dll
mimeTools.dll
stylers.model.xml
gup.exe
02e3291b-6084-4011-acd3-3924ac5329ef.tmp
1a668353-b531-4a09-8a78-3fcc15e2c630.tmp
344ee1f7-3e72-4b37-b49a-0439d70f25c6.tmp
3ed9cc81-0988-4845-b42f-3b8f630fb467.tmp
56d1917d-6b7d-4f5f-a19f-7f2ddb9f84d9.tmp
5d01677e-f806-4238-a03f-c2c23005dd7f.tmp
81ae5db6-20cd-4896-aab3-f381aaee2185.tmp
8da79711-b4ce-4ec9-880d-1b92d7b6129e.tmp
0b568697-5a4d-4516-af34-207b5d8055ca.tmp
1027aa38-1583-477b-bf18-8e51c0d32e40.tmp
1151949a-1321-4f42-916b-a47d23be3e46.tmp
122f89c3-08e2-4a2c-8839-e18f39042ab7.tmp
12f798ba-9604-474f-a653-7f562b0ed324.tmp
167571d3-eefb-4d31-9a48-1708ed048f5d.tmp
3feaf869-626c-48a2-953a-85e4594894aa.tmp
565fa6df-2491-4c22-b90a-9572fd34aa72.tmp
6e9748dc-75f2-451f-831d-acc6794e710f.tmp
76a8bffd-69bf-40f0-a82a-ab1eb777abbf.tmp
773ec071-a3d2-40b5-9df4-f3ef11a3e48f.tmp
78f76536-320e-4ed6-ac52-4f6f4511c568.tmp
7c2ffdc9-3b47-4528-a331-e4162ef2213d.tmp
7cfd4bb7-e1be-401c-9a41-e07ccc6f58ab.tmp
85b6ace9-4523-47a3-97ee-5426da441670.tmp
8fab74be-726e-4ccf-ad0a-f11d6f16c1bb.tmp
90a7610f-cc0c-4d62-bea4-a6ffc149ccf6.tmp
9412dedb-89ff-464a-899e-67b0aadab639.tmp
97efbf30-7ae0-4248-9992-9cc04c31e25c.tmp
98a330ce-93b1-482c-8298-3ceecb894c51.tmp
9c135e95-9b76-4f2f-ae7e-c27716d7858d.tmp
9fa412dc-10db-4d2b-89ba-0cd6810de497.tmp
f_000005
f_000007
f_00000e
f_00001b
f_000029
f_000036
f_00003b
f_00003d
f_000041
f_000047
f_00004d
f_000051
f_000052
f_000053
f_000054
f_000056
f_000057
f_000058
f_00005b
f_00005c
f_00007c
f_000084
f_000085
f_000086
f_000088
f_00008b
f_00008d
f_00008e
f_00008f
f_000092
f_00009c
f_0000a2
f_0000a3
f_0000a4
f_0000a5
f_0000a6
f_0000a7
f_0000b6
f_0000ce
f_0000d2
f_0000d7
f_0000d8
35d5aa88fbbf209a_0
52a0a35565bf6e3c_0
7be9fbeccee59ce3_0
a9434184311fb003_0
temp-index
temp-index
temp-index
temp-index
temp-index
temp-index
temp-index
temp-index
the-real-index
the-real-index
the-real-index
the-real-index
temp-index
temp-index
LOG.old
MANIFEST-000001
CURRENT
05270c88-eb30-4d6c-b56d-0b079a8e4e10.tmp
17bec79f-a9a4-4f60-ac6b-3ddf17db9829.tmp
17f50107-dffb-41b9-8a50-caf3bb839e5b.tmp
18a19217-7032-491a-a43a-cf35cd1b17b0.tmp
40868b3a-759b-4c2a-b5fe-e0e74d290327.tmp
55bfaa73-1f3e-49e0-930d-bc727d7926ec.tmp
5a606317-0d37-4bfe-911e-3db0b4c1ed46.tmp
6e5e6aaf-846d-4ec0-b06f-1122b59e3fae.tmp
733f5618-196d-4afa-af57-f9a4595b3192.tmp
749732c6-9802-44a2-a1e2-485f20946610.tmp
c5a78508-aa09-4d34-b6a7-d1f9eb75f952.tmp
dca4ce3a-3511-4918-9b4f-d89468b8a4da.tmp
f27fe5f5-b66f-444c-90cb-1772dc7eb196.tmp
fc4b7216-3069-4684-96a9-468f13d406a2.tmp
fd05f611-9b24-4f27-8005-666b0c88af05.tmp
54e8f94e86f3d04e_0
temp-index
temp-index
temp-index
index.txt
index.txt.tmp
a479a632-a29f-4d08-b4f3-7884a91cec22.tmp
bd5fa2ed-f047-4ae2-9b16-f029ab2bc42b.tmp
c6a35cf6-aace-46ca-bf4e-4634b2082309.tmp
c9646984-1473-44fa-9055-177f2be9e7c5.tmp
ca1dda7f-c0fb-44ab-a660-5f4227a5352f.tmp
cecb2593-ef53-450b-86be-2d71c8738bc6.tmp
d0f27d41-3146-491b-9647-ebf392a92990.tmp
d7d6551e-c511-49d4-b08e-6f70aa2c5d41.tmp
debd982e-93c8-48a3-9cd3-280f3314f24d.tmp
e2bb7b4c-acff-4f07-937d-5e0ffb8d8da3.tmp
e4d2f381-668b-41c9-9049-ad5c09190870.tmp
f2476ded-51fe-42bc-ac78-4dbe6f55721e.tmp
fad1714b-007f-4347-8c25-9fc07cda2984.tmp
fbf53a50-2058-409e-b7bd-83304f83c5d0.tmp
a18d229c-4bcd-4ba6-915c-c7ec48555d00.tmp
a1d390df-2969-4690-a556-44c3b83c6609.tmp
InstallOptions.dll
LangDLL.dll
System.dll
UserInfo.dll
ioSpecial.ini
ioSpecial.ini
ioSpecial.ini
modern-wizard.bmp
english.xml
nsDialogs.dll
default.dic
1FEOGIA53M7P3ANNZECO.temp
5d696d521de238c3.customDestinations-ms
DGH93M8S6ISJNO684UYW.temp
installation_status.json@2026-10-22_231530
installation_status.json@2026-10-22_231530
installation_status.json@2026-10-22_231530
contextMenu.xml
langs.xml
converter.ini
shortcuts.xml
stylers.xml
markdown._preinstalled.udl.xml
markdown._preinstalled_DM.udl.xml
542e36ed-80c5-4556-a811-a7c1b0900017.tmp
88ded7fa-9966-4ada-9b84-53fe087ad067.tmp
npp.8.9.8.1.Installer.x64.exe
python314._pth.crdownload
itq
python3.dll