Analysis
- user interaction
yes - max time kernel
201s - max time network
208s - platform
windows11-21h2_x64 - resource
win11-20260911-en - resource tags
- submitted
24/10/2026, 23:37
General
- Target Nighty_logger.exe
- Size 99.1MB
- Sample261024-3l56basx5p
- SHA256 55e023fe8a8e1855bc34064d5fe4d7f727ba8d83f7242a4787383f4cd09748f9
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 64 IoCs
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Network Share Discovery 1 TTPs
Attempt to gather information on host network.
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 1 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 6 IoCs
- Gathers network information 2 TTPs 3 IoCs
Uses commandline utility to view network configuration.
- Modifies registry class 64 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious behavior: GetForegroundWindowSpam 2 IoCs
- Suspicious behavior: LoadsDriver 2 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 38 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 36 IoCs
- Suspicious use of SendNotifyMessage 18 IoCs
- Suspicious use of SetWindowsHookEx 19 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Nighty_logger.exe"C:\Users\Admin\AppData\Local\Temp\Nighty_logger.exe"1⤵
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Nighty_logger.exe"C:\Users\Admin\AppData\Local\Temp\Nighty_logger.exe"2⤵
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Nighty_logger.exe --webview-exe-version=2.6.1 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tmpwq7k5ph3\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --allow-file-access-from-files --disable-features=ElasticOverscroll --mojo-named-platform-channel-pipe=4716.5416.159165133445753085053⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\tmpwq7k5ph3\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\tmpwq7k5ph3\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x160,0x164,0x168,0x13c,0x84,0x7ffad93bb078,0x7ffad93bb084,0x7ffad93bb0904⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tmpwq7k5ph3\EBWebView" --webview-exe-name=Nighty_logger.exe --webview-exe-version=2.6.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1684,i,8197628285201717809,15234394817034312109,262144 --disable-features=ElasticOverscroll --variations-seed-version --mojo-platform-channel-handle=1680 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tmpwq7k5ph3\EBWebView" --webview-exe-name=Nighty_logger.exe --webview-exe-version=2.6.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=1992,i,8197628285201717809,15234394817034312109,262144 --disable-features=ElasticOverscroll --variations-seed-version --mojo-platform-channel-handle=2004 /prefetch:114⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tmpwq7k5ph3\EBWebView" --webview-exe-name=Nighty_logger.exe --webview-exe-version=2.6.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=1688,i,8197628285201717809,15234394817034312109,262144 --disable-features=ElasticOverscroll --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tmpwq7k5ph3\EBWebView" --webview-exe-name=Nighty_logger.exe --webview-exe-version=2.6.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --disable-databases --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3564,i,8197628285201717809,15234394817034312109,262144 --disable-features=ElasticOverscroll --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:14⤵
-
-
-
C:\Windows\system32\ipconfig.exeC:\Windows\system32\ipconfig /all3⤵
- Gathers network information
-
-
C:\Windows\SYSTEM32\ipconfig.exeipconfig /all3⤵
- Gathers network information
-
-
\??\c:\windows\system32\ipconfig.exec:\windows\system32\ipconfig /all3⤵
- Gathers network information
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaf285c728,0x7ffaf285c734,0x7ffaf285c7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1476,i,14893601286878271527,3854562894332570885,524288 --field-trial-handle=2080,i,810128790391788832,8806756739653254264,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2108 /prefetch:112⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1600,i,444572363743801373,4526549685272804467,262144 --field-trial-handle=2080,i,810128790391788832,8806756739653254264,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2076 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2384,i,14850406819345758053,10838545644384385677,524288 --field-trial-handle=2080,i,810128790391788832,8806756739653254264,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2400 /prefetch:132⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3260,i,3856213085131235689,10268840750782777047,2097152 --field-trial-handle=2080,i,810128790391788832,8806756739653254264,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3264 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3288,i,15292720494647382505,16894891095656539315,2097152 --field-trial-handle=2080,i,810128790391788832,8806756739653254264,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3312 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4292,i,4578575706807038114,10804532693940427769,2097152 --field-trial-handle=2080,i,810128790391788832,8806756739653254264,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4312 /prefetch:92⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4628,i,15814275708655750596,10555499661236784871,2097152 --field-trial-handle=2080,i,810128790391788832,8806756739653254264,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4768 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5548,i,5194640738818863279,7433335122989879690,524288 --field-trial-handle=2080,i,810128790391788832,8806756739653254264,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5552 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5568,i,4759578363037829678,718982797797473877,2097152 --field-trial-handle=2080,i,810128790391788832,8806756739653254264,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5580 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=6024,i,33678400683712021,2531831926870254028,2097152 --field-trial-handle=2080,i,810128790391788832,8806756739653254264,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6048 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5888,i,11961394581914830081,3799126452454154933,2097152 --field-trial-handle=2080,i,810128790391788832,8806756739653254264,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5956 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=4632,i,4628009614232627066,11207457579568237908,2097152 --field-trial-handle=2080,i,810128790391788832,8806756739653254264,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5564 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=3424,i,12894825786924436491,2790978948646744757,2097152 --field-trial-handle=2080,i,810128790391788832,8806756739653254264,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3388 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5576,i,9821309294040659116,10144267641465636041,2097152 --field-trial-handle=2080,i,810128790391788832,8806756739653254264,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5572 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=3356,i,613138566786420763,12497849807269929832,2097152 --field-trial-handle=2080,i,810128790391788832,8806756739653254264,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3524 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4852,i,2221212097084071185,10223903158057104706,524288 --field-trial-handle=2080,i,810128790391788832,8806756739653254264,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4928 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4828,i,11336343928905065609,2707604247468644576,524288 --field-trial-handle=2080,i,810128790391788832,8806756739653254264,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4856 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4668,i,11502159845325350940,4214398031213999675,524288 --field-trial-handle=2080,i,810128790391788832,8806756739653254264,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4860 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=5844,i,12710124248232302693,9754176621787105108,2097152 --field-trial-handle=2080,i,810128790391788832,8806756739653254264,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5552 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=4408,i,6466164673098257708,2997608282687481804,2097152 --field-trial-handle=2080,i,810128790391788832,8806756739653254264,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4412 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=4836,i,5906425826683516600,10656635635764434133,2097152 --field-trial-handle=2080,i,810128790391788832,8806756739653254264,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6188 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6224,i,17671552274011263125,17382983128317179608,524288 --field-trial-handle=2080,i,810128790391788832,8806756739653254264,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6236 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=6216,i,17377011512051802351,17385030269345712262,524288 --field-trial-handle=2080,i,810128790391788832,8806756739653254264,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3432 /prefetch:122⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=6340,i,5066447778861918549,12177785732732238091,2097152 --field-trial-handle=2080,i,810128790391788832,8806756739653254264,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6360 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=6548,i,8087293091497148056,13903110894017806218,2097152 --field-trial-handle=2080,i,810128790391788832,8806756739653254264,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6620 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6492,i,8345316743165834390,16829997174539973690,524288 --field-trial-handle=2080,i,810128790391788832,8806756739653254264,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6344 /prefetch:142⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6332,i,2759278495998621413,17739894247622837211,524288 --field-trial-handle=2080,i,810128790391788832,8806756739653254264,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6348 /prefetch:142⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=6356,i,18363490196828817538,10671488937051654920,2097152 --field-trial-handle=2080,i,810128790391788832,8806756739653254264,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6364 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=6644,i,3972482843246465974,3803643827935285401,2097152 --field-trial-handle=2080,i,810128790391788832,8806756739653254264,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6756 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=7032,i,7895848408082598075,11796879296035877254,2097152 --field-trial-handle=2080,i,810128790391788832,8806756739653254264,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6988 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=7088,i,131628999680052122,18312336819081473970,2097152 --field-trial-handle=2080,i,810128790391788832,8806756739653254264,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7112 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --metrics-shmem-handle=6460,i,2766096014030302159,13923431979239433534,2097152 --field-trial-handle=2080,i,810128790391788832,8806756739653254264,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6776 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --metrics-shmem-handle=7092,i,11174722819203229307,2463883228861867893,2097152 --field-trial-handle=2080,i,810128790391788832,8806756739653254264,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6848 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --metrics-shmem-handle=7248,i,16187725006751904809,13834143867165710802,2097152 --field-trial-handle=2080,i,810128790391788832,8806756739653254264,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7256 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --metrics-shmem-handle=6456,i,14020356934631057648,2486916558065696007,2097152 --field-trial-handle=2080,i,810128790391788832,8806756739653254264,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7164 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --metrics-shmem-handle=7012,i,7774528519749739349,8692172083188066566,2097152 --field-trial-handle=2080,i,810128790391788832,8806756739653254264,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6956 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --metrics-shmem-handle=7324,i,12879801927825932552,16045598363790169352,2097152 --field-trial-handle=2080,i,810128790391788832,8806756739653254264,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7260 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --metrics-shmem-handle=6500,i,13687848622191699183,10846186326832034708,2097152 --field-trial-handle=2080,i,810128790391788832,8806756739653254264,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7436 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --metrics-shmem-handle=6864,i,3003679522989692435,10890746202572221117,2097152 --field-trial-handle=2080,i,810128790391788832,8806756739653254264,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7580 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --metrics-shmem-handle=7704,i,15154322502444102038,15868378738643512061,2097152 --field-trial-handle=2080,i,810128790391788832,8806756739653254264,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7712 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --metrics-shmem-handle=7760,i,10016676574412332723,3250010964564629630,2097152 --field-trial-handle=2080,i,810128790391788832,8806756739653254264,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7844 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --metrics-shmem-handle=8028,i,3969145839596658428,17383318780908165945,2097152 --field-trial-handle=2080,i,810128790391788832,8806756739653254264,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7980 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --metrics-shmem-handle=7696,i,6799573318437170671,8684315451627962470,2097152 --field-trial-handle=2080,i,810128790391788832,8806756739653254264,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6464 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --metrics-shmem-handle=7676,i,8108882275300303811,15689764007040831884,2097152 --field-trial-handle=2080,i,810128790391788832,8806756739653254264,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7652 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --metrics-shmem-handle=7672,i,7610613474179142825,1886250338915351975,2097152 --field-trial-handle=2080,i,810128790391788832,8806756739653254264,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7344 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --metrics-shmem-handle=7152,i,6853126348230025009,2798462064731953106,2097152 --field-trial-handle=2080,i,810128790391788832,8806756739653254264,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6852 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --metrics-shmem-handle=6420,i,15066900434125978977,8836445220919666612,2097152 --field-trial-handle=2080,i,810128790391788832,8806756739653254264,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7648 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --metrics-shmem-handle=7432,i,3040935963264834104,2063629414889109887,2097152 --field-trial-handle=2080,i,810128790391788832,8806756739653254264,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7004 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=7680,i,1961662591645487243,14372673350041145755,262144 --field-trial-handle=2080,i,810128790391788832,8806756739653254264,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=8396 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
24b4f950-5cfc-45b9-a19b-7a912c192125.tmp
760433f4-75a9-40f2-a81c-6a9651bb031c.tmp
9af873c7-0354-4758-b522-adcdaf700b1d.tmp
20ab9dab-50c8-4cde-a7d8-d5247f82be4c.tmp
366fbd64-5779-46ec-a710-0222c9c2545d.tmp
49d22c1f-ac20-4fb8-b78d-b05e1bed82c5.tmp
54d41eea-f973-4d2e-b87b-b06f8604ba23.tmp
643f0fdb-6344-4e74-8b41-900ab557ffc5.tmp
6a131ce9-94d6-431e-a0de-c5411a943936.tmp
6ef8ee24-cd72-4028-a677-9b2040a3eed1.tmp
8e9a7167-0019-40d4-85d2-48d365b4bbd9.tmp
f_000005
f_00000a
f_00000d
f_00000e
f_00000f
f_000010
f_000011
f_000012
f_000013
f_000014
f_000015
f_000016
f_000017
f_000019
f_00001a
f_00001c
f_00001e
f_00002d
f_000031
c1d675da7f35b766_0
e980c6bcd5d294e7_0
temp-index
temp-index
2ab7071f-df19-4342-8451-d659bf095adc.tmp
temp-index
the-real-index
047c02539476ddcc_0
temp-index
bf49d0fa-9d3c-47a5-a065-9e01b056e77b.tmp
d9657ede-9ffc-4ad7-b342-518344ca3757.tmp
e9291a0f-31cb-4494-8f42-d3325e42c2a4.tmp
a09f7c0f-50cd-42f1-ab2d-d6e133cc4722.tmp
c1d42d3f-b47e-4fcf-b384-d79f1a5762cb.tmp
cc7aeca5-bae0-4302-99b7-8440cf04e2c5.tmp
dde4e0ad-c563-47da-80f2-859fabec6ee1.tmp
iconcache_idx.db
81d243bd2c585b0f4821__mypyc.cp38-win_amd64.pyd
qtconnectivity_en.qm
__init__.py
VCRUNTIME140.dll
_bz2.pyd
_ctypes.pyd
_lzma.pyd
init.tcl
text.tcl
tk.tcl
cursors.tcl
fonts.tcl
ttk.tcl
utils.tcl
api-ms-win-core-console-l1-1-0.dll
api-ms-win-core-datetime-l1-1-0.dll
api-ms-win-core-debug-l1-1-0.dll
api-ms-win-core-errorhandling-l1-1-0.dll
api-ms-win-core-file-l1-1-0.dll
api-ms-win-core-file-l1-2-0.dll
api-ms-win-core-file-l2-1-0.dll
api-ms-win-core-handle-l1-1-0.dll
api-ms-win-core-heap-l1-1-0.dll
api-ms-win-core-interlocked-l1-1-0.dll
api-ms-win-core-libraryloader-l1-1-0.dll
api-ms-win-core-localization-l1-2-0.dll
api-ms-win-core-memory-l1-1-0.dll
api-ms-win-core-namedpipe-l1-1-0.dll
api-ms-win-core-processenvironment-l1-1-0.dll
api-ms-win-core-processthreads-l1-1-0.dll
api-ms-win-core-processthreads-l1-1-1.dll
api-ms-win-core-profile-l1-1-0.dll
api-ms-win-core-rtlsupport-l1-1-0.dll
api-ms-win-core-string-l1-1-0.dll
api-ms-win-core-synch-l1-1-0.dll
api-ms-win-core-synch-l1-2-0.dll
api-ms-win-core-sysinfo-l1-1-0.dll
api-ms-win-core-timezone-l1-1-0.dll
api-ms-win-core-util-l1-1-0.dll
api-ms-win-crt-conio-l1-1-0.dll
api-ms-win-crt-convert-l1-1-0.dll
api-ms-win-crt-environment-l1-1-0.dll
api-ms-win-crt-filesystem-l1-1-0.dll
api-ms-win-crt-heap-l1-1-0.dll
api-ms-win-crt-locale-l1-1-0.dll
api-ms-win-crt-math-l1-1-0.dll
api-ms-win-crt-multibyte-l1-1-0.dll
api-ms-win-crt-process-l1-1-0.dll
api-ms-win-crt-runtime-l1-1-0.dll
api-ms-win-crt-stdio-l1-1-0.dll
api-ms-win-crt-string-l1-1-0.dll
api-ms-win-crt-time-l1-1-0.dll
api-ms-win-crt-utility-l1-1-0.dll
INSTALLER
base_library.zip
libcrypto-1_1.dll
libffi-7.dll
libssl-1_1.dll
pyexpat.pyd
python3.DLL
python38.dll
pytransform.pyd
select.pyd
tcl86t.dll
tk86t.dll
ucrtbase.dll
WHEEL
nighty_gate.log
nighty_gate.log
nighty_gate.log
nighty_gate.log
0f478e19-51ec-4559-a9ad-83878d6d4c35.tmp
414aae7e-f562-4bc2-b4ce-c0063b5dfd70.tmp
settings.dat
settings.dat
145c4578-6e5c-4ab9-8dc0-c7b679f63e77.tmp
data_0
data_1
data_2
data_3
temp-index
Network Persistent State
b66b07a4-73c6-4511-8a52-eb5f2f0c7283.tmp
MANIFEST-000001
CURRENT
index
Local State
c6e1d43a-d539-4100-a813-730edbb7730f.tmp
c6eecef5-db20-4e60-ac17-152daa40a3e8.tmp
db1bc624-0233-4f42-a86a-f4357082a94a.tmp
default.dic
custom_features.json
user_history.json
notifications.json
nighty.config
nighty_gate.log
nighty_gate.log
nighty_gate.log
nighty_gate.log
memory/4716-52617-0x0000025D006E0000-0x0000025D00C86000-memory.dmp
memory/4716-3963-0x0000025CFCE80000-0x0000025CFCE81000-memory.dmp
memory/4716-52614-0x0000025CFFFF0000-0x0000025CFFFF8000-memory.dmp
memory/4716-52615-0x0000025D00020000-0x0000025D00028000-memory.dmp
memory/4716-52616-0x0000025D00100000-0x0000025D00122000-memory.dmp
memory/4716-3927-0x0000025CFCE80000-0x0000025CFCE81000-memory.dmp
memory/4716-52618-0x0000025D00030000-0x0000025D00038000-memory.dmp
memory/4716-52619-0x0000025D00040000-0x0000025D00048000-memory.dmp
memory/4716-52620-0x0000025D00040000-0x0000025D00048000-memory.dmp
memory/4716-52621-0x0000025D00040000-0x0000025D00048000-memory.dmp
memory/4716-52622-0x0000025D001D0000-0x0000025D00268000-memory.dmp
memory/4716-52623-0x0000025D00040000-0x0000025D0004E000-memory.dmp
memory/4716-52697-0x0000025D00130000-0x0000025D00138000-memory.dmp
memory/4716-50296-0x0000025D00080000-0x0000025D000F4000-memory.dmp
memory/4716-50271-0x00007FFAE2760000-0x00007FFAE276A000-memory.dmp
memory/4716-50270-0x0000025C837E0000-0x0000025C837EA000-memory.dmp
memory/4716-34020-0x0000025CFD0F0000-0x0000025CFD1A4000-memory.dmp
memory/4716-3931-0x0000025CFCE80000-0x0000025CFCE81000-memory.dmp
memory/4716-3929-0x0000025CFCE80000-0x0000025CFCE81000-memory.dmp
memory/4716-3933-0x0000025CFCE80000-0x0000025CFCE81000-memory.dmp
memory/4716-3935-0x0000025CFCE80000-0x0000025CFCE81000-memory.dmp
memory/4716-3909-0x0000025CFCE80000-0x0000025CFCE81000-memory.dmp
memory/4716-3937-0x0000025CFCE80000-0x0000025CFCE81000-memory.dmp
memory/4716-3939-0x0000025CFCE80000-0x0000025CFCE81000-memory.dmp
memory/4716-3941-0x0000025CFCE80000-0x0000025CFCE81000-memory.dmp
memory/4716-3943-0x0000025CFCE80000-0x0000025CFCE81000-memory.dmp
memory/4716-3945-0x0000025CFCE80000-0x0000025CFCE81000-memory.dmp
memory/4716-3913-0x0000025CFCE80000-0x0000025CFCE81000-memory.dmp
memory/4716-3947-0x0000025CFCE80000-0x0000025CFCE81000-memory.dmp
memory/4716-3915-0x0000025CFCE80000-0x0000025CFCE81000-memory.dmp
memory/4716-3917-0x0000025CFCE80000-0x0000025CFCE81000-memory.dmp
memory/4716-3919-0x0000025CFCE80000-0x0000025CFCE81000-memory.dmp
memory/4716-3949-0x0000025CFCE80000-0x0000025CFCE81000-memory.dmp
memory/4716-3951-0x0000025CFCE80000-0x0000025CFCE81000-memory.dmp
memory/4716-3953-0x0000025CFCE80000-0x0000025CFCE81000-memory.dmp
memory/4716-3955-0x0000025CFCE80000-0x0000025CFCE81000-memory.dmp
memory/4716-3957-0x0000025CFCE80000-0x0000025CFCE81000-memory.dmp
memory/4716-3959-0x0000025CFCE80000-0x0000025CFCE81000-memory.dmp
memory/4716-3961-0x0000025CFCE80000-0x0000025CFCE81000-memory.dmp
memory/4716-50297-0x0000025D00000000-0x0000025D0001A000-memory.dmp
memory/4716-3965-0x0000025CFCE80000-0x0000025CFCE81000-memory.dmp
memory/4716-3967-0x0000025CFCE80000-0x0000025CFCE81000-memory.dmp
memory/4716-3969-0x0000025CFCE80000-0x0000025CFCE81000-memory.dmp
memory/4716-3971-0x0000025CFCE80000-0x0000025CFCE81000-memory.dmp
memory/4716-3973-0x0000025CFCE80000-0x0000025CFCE81000-memory.dmp
memory/4716-3975-0x0000025CFCE80000-0x0000025CFCE81000-memory.dmp
memory/4716-3977-0x0000025CFCE80000-0x0000025CFCE81000-memory.dmp
memory/4716-3979-0x0000025CFCE80000-0x0000025CFCE81000-memory.dmp
memory/4716-3981-0x0000025CFCE80000-0x0000025CFCE81000-memory.dmp
memory/4716-3983-0x0000025CFCE80000-0x0000025CFCE81000-memory.dmp
memory/4716-3985-0x0000025CFCE80000-0x0000025CFCE81000-memory.dmp
memory/4716-3987-0x0000025CFCE80000-0x0000025CFCE81000-memory.dmp
memory/4716-3989-0x0000025CFCE80000-0x0000025CFCE81000-memory.dmp
memory/4716-3991-0x0000025CFCE80000-0x0000025CFCE81000-memory.dmp
memory/4716-3993-0x0000025CFCE80000-0x0000025CFCE81000-memory.dmp
memory/4716-3995-0x0000025CFCE80000-0x0000025CFCE81000-memory.dmp
memory/4716-3997-0x0000025CFCE80000-0x0000025CFCE81000-memory.dmp
memory/4716-3999-0x0000025CFCE80000-0x0000025CFCE81000-memory.dmp
memory/4716-4001-0x0000025CFCE80000-0x0000025CFCE81000-memory.dmp
memory/4716-4003-0x0000025CFCE80000-0x0000025CFCE81000-memory.dmp
memory/4716-4005-0x0000025CFCE80000-0x0000025CFCE81000-memory.dmp
memory/4716-4007-0x0000025CFCE80000-0x0000025CFCE81000-memory.dmp
memory/4716-4009-0x0000025CFCE80000-0x0000025CFCE81000-memory.dmp
memory/4716-4011-0x0000025CFCE80000-0x0000025CFCE81000-memory.dmp
memory/4716-4013-0x0000025CFCE80000-0x0000025CFCE81000-memory.dmp
memory/4716-4015-0x0000025CFCE80000-0x0000025CFCE81000-memory.dmp
memory/4716-4017-0x0000025CFCE80000-0x0000025CFCE81000-memory.dmp
memory/4716-4019-0x0000025CFCE80000-0x0000025CFCE81000-memory.dmp
memory/4716-4021-0x0000025CFCE80000-0x0000025CFCE81000-memory.dmp
memory/4716-3921-0x0000025CFCE80000-0x0000025CFCE81000-memory.dmp
memory/4716-4023-0x0000025CFCE80000-0x0000025CFCE81000-memory.dmp
memory/4716-4025-0x0000025CFCE80000-0x0000025CFCE81000-memory.dmp
memory/4716-4027-0x0000025CFCE80000-0x0000025CFCE81000-memory.dmp
memory/4716-4029-0x0000025CFCE80000-0x0000025CFCE81000-memory.dmp
memory/4716-3911-0x0000025CFCE80000-0x0000025CFCE81000-memory.dmp
memory/4716-3923-0x0000025CFCE80000-0x0000025CFCE81000-memory.dmp
memory/4716-3906-0x0000025CFCE70000-0x0000025CFCE71000-memory.dmp
memory/4716-3907-0x0000025CFCE80000-0x0000025CFCE81000-memory.dmp
memory/4716-3881-0x00007FFAE0240000-0x00007FFAE04A3000-memory.dmp
memory/4716-3925-0x0000025CFCE80000-0x0000025CFCE81000-memory.dmp