Analysis
- user interaction
yes - max time kernel
898s - max time network
888s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
13/11/2026, 15:39
General
- Target ссылка.txt
- Size 65B
- Sample261113-s31xtads2x
- SHA256 446490cbc1d802f26e17741b2d8938666e28b58643387a9c4b2b02433e11b693
Score
8/10
Malware Config
Signatures
- Downloads MZ/PE file 1 IoCs
- Drops file in Drivers directory 1 IoCs
- Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 64 IoCs
- Loads dropped DLL 64 IoCs
- Unexpected DNS network traffic destination 40 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Adds Run key to start application 2 TTPs 2 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory 64 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 21 IoCs
- Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 21 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 12 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
- Checks SCSI registry key(s) 3 TTPs 63 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies data under HKEY_USERS 64 IoCs
- Modifies registry class 64 IoCs
- Modifies system certificate store 2 TTPs 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 52 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 57 IoCs
- Suspicious use of SendNotifyMessage 40 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\NOTEPAD.EXEC:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\ссылка.txt1⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffc5877c728,0x7ffc5877c734,0x7ffc5877c7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1616,i,2561477675085963493,2461416629166737530,524288 --field-trial-handle=2064,i,12243773202349324811,7774625142252999913,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2164 /prefetch:32⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1704,i,130714989094722956,10601356461740676702,262144 --field-trial-handle=2064,i,12243773202349324811,7774625142252999913,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2060 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2460,i,1194790723477163700,612640652617517338,524288 --field-trial-handle=2064,i,12243773202349324811,7774625142252999913,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2312 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3260,i,3908390441293700009,2844437346180855328,2097152 --field-trial-handle=2064,i,12243773202349324811,7774625142252999913,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3268 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3296,i,17116316715417683810,1904943484982966602,2097152 --field-trial-handle=2064,i,12243773202349324811,7774625142252999913,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3332 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4444,i,6425971101680605436,4178813697019536228,2097152 --field-trial-handle=2064,i,12243773202349324811,7774625142252999913,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4556 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5348,i,5749331430103534437,1916005319787984195,524288 --field-trial-handle=2064,i,12243773202349324811,7774625142252999913,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5356 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5604,i,3083202513933576249,7042707791278809002,2097152 --field-trial-handle=2064,i,12243773202349324811,7774625142252999913,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5624 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5348,i,14692991982594499628,4713240456075801435,2097152 --field-trial-handle=2064,i,12243773202349324811,7774625142252999913,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5432 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3388,i,10356570642283132038,17073433013633574650,2097152 --field-trial-handle=2064,i,12243773202349324811,7774625142252999913,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6000 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5692,i,9488817140196726380,14988347212612719634,2097152 --field-trial-handle=2064,i,12243773202349324811,7774625142252999913,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5700 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5812,i,15267930000134526463,3794269175342408487,2097152 --field-trial-handle=2064,i,12243773202349324811,7774625142252999913,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5616 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=3536,i,8428265557490403548,10679262806938701565,2097152 --field-trial-handle=2064,i,12243773202349324811,7774625142252999913,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6124 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6168,i,7630098658183135593,11693131412080860584,2097152 --field-trial-handle=2064,i,12243773202349324811,7774625142252999913,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3396 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6420,i,12051126184288724082,8554406308449968350,2097152 --field-trial-handle=2064,i,12243773202349324811,7774625142252999913,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6448 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6560,i,6815399135333857809,15903835443742780134,2097152 --field-trial-handle=2064,i,12243773202349324811,7774625142252999913,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6372 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6720,i,6850293229799817255,1022065783098948862,2097152 --field-trial-handle=2064,i,12243773202349324811,7774625142252999913,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6764 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5712,i,9750584876223090711,4948439897335844865,2097152 --field-trial-handle=2064,i,12243773202349324811,7774625142252999913,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3460 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6864,i,1501434254806664731,15879287261331509238,2097152 --field-trial-handle=2064,i,12243773202349324811,7774625142252999913,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5692 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=7012,i,13475709571321458465,11807124830333609018,2097152 --field-trial-handle=2064,i,12243773202349324811,7774625142252999913,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7004 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=7176,i,1117588310155649053,157068833191136002,2097152 --field-trial-handle=2064,i,12243773202349324811,7774625142252999913,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7160 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=7356,i,472814973637852442,1188402797013730062,2097152 --field-trial-handle=2064,i,12243773202349324811,7774625142252999913,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7352 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=7528,i,2017514481914714768,13206566339737441393,2097152 --field-trial-handle=2064,i,12243773202349324811,7774625142252999913,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7532 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=7640,i,1947124987899121285,8377873077268643017,2097152 --field-trial-handle=2064,i,12243773202349324811,7774625142252999913,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7656 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=7820,i,12148875699044681460,2715695736344168607,2097152 --field-trial-handle=2064,i,12243773202349324811,7774625142252999913,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7824 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=7356,i,9665376166106790768,2046835285596885679,2097152 --field-trial-handle=2064,i,12243773202349324811,7774625142252999913,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7464 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=7848,i,8096741146792337019,16979514718839711885,2097152 --field-trial-handle=2064,i,12243773202349324811,7774625142252999913,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7208 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=8212,i,6597953372174891548,12065441696122827834,2097152 --field-trial-handle=2064,i,12243773202349324811,7774625142252999913,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=8268 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=8396,i,5353872218108855942,2224591974828264986,2097152 --field-trial-handle=2064,i,12243773202349324811,7774625142252999913,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=8392 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=8548,i,1168854339490113972,738853052574327003,2097152 --field-trial-handle=2064,i,12243773202349324811,7774625142252999913,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=8504 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=8668,i,14796593431133233360,4980275811971040063,2097152 --field-trial-handle=2064,i,12243773202349324811,7774625142252999913,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=8656 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=8816,i,16893921586169157458,8440412267811124207,2097152 --field-trial-handle=2064,i,12243773202349324811,7774625142252999913,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=8852 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --metrics-shmem-handle=7200,i,4152353655814633884,14431856978656181192,2097152 --field-trial-handle=2064,i,12243773202349324811,7774625142252999913,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7840 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --metrics-shmem-handle=7936,i,5070615350975844667,1491420379850221007,2097152 --field-trial-handle=2064,i,12243773202349324811,7774625142252999913,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7892 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --metrics-shmem-handle=8884,i,9641403837277887597,12789032985212652010,2097152 --field-trial-handle=2064,i,12243773202349324811,7774625142252999913,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=8856 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --metrics-shmem-handle=7496,i,12825042632409750461,16412516464307532146,2097152 --field-trial-handle=2064,i,12243773202349324811,7774625142252999913,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6552 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=5820,i,8790271690423928577,7630269295420441567,524288 --field-trial-handle=2064,i,12243773202349324811,7774625142252999913,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7152 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6348,i,16808313125211972786,10690566777645655640,524288 --field-trial-handle=2064,i,12243773202349324811,7774625142252999913,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6612 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --metrics-shmem-handle=7868,i,18170437292197533934,265385552018304263,2097152 --field-trial-handle=2064,i,12243773202349324811,7774625142252999913,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=8872 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=10072,i,9760656104484848513,18256796110777298626,524288 --field-trial-handle=2064,i,12243773202349324811,7774625142252999913,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=10092 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=10076,i,18155238374340372604,7150862412404233808,524288 --field-trial-handle=2064,i,12243773202349324811,7774625142252999913,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=9996 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=10068,i,1908391508460424426,3067422064779377224,524288 --field-trial-handle=2064,i,12243773202349324811,7774625142252999913,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=10108 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=9556,i,15019419294762460234,6801443405955797957,524288 --field-trial-handle=2064,i,12243773202349324811,7774625142252999913,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=9612 /prefetch:82⤵
-
-
C:\Users\Admin\Downloads\setup-Happ.x64.exe"C:\Users\Admin\Downloads\setup-Happ.x64.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\is-82CQLC5ZNX.tmp\setup-Happ.x64.tmp"C:\Users\Admin\AppData\Local\Temp\is-82CQLC5ZNX.tmp\setup-Happ.x64.tmp" /SL5="$902DA,124834237,893440,C:\Users\Admin\Downloads\setup-Happ.x64.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Temp\is-SMXU27EILT.tmp\vcredist2022_x64.exe"C:\Users\Admin\AppData\Local\Temp\is-SMXU27EILT.tmp\vcredist2022_x64.exe" /passive /norestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\Temp\{8C81B82D-7B8F-4DDF-AEAB-C516E660270E}\.cr\vcredist2022_x64.exe"C:\Windows\Temp\{8C81B82D-7B8F-4DDF-AEAB-C516E660270E}\.cr\vcredist2022_x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-SMXU27EILT.tmp\vcredist2022_x64.exe" -burn.filehandle.attached=716 -burn.filehandle.self=720 /passive /norestart5⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
-
C:\Windows\Temp\{A8BD9F62-6FA6-42C6-BDDE-AC80D146AD25}\.be\VC_redist.x64.exe"C:\Windows\Temp\{A8BD9F62-6FA6-42C6-BDDE-AC80D146AD25}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{C1C67187-ACB5-46A0-9DA8-3A84E325EE61} {432705B4-78B2-492E-9BC8-0976B5DDEA7C} 42926⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={d8bbe9f9-7c5b-42c6-b715-9ee898a2e515} -burn.filehandle.self=1100 -burn.embedded BurnPipe.{121596FE-44F1-4EF9-BEA4-9CF8AD6E88EA} {B42CC92E-4860-49C1-AF96-01728B1ED650} 48007⤵
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=544 -burn.filehandle.self=564 -uninstall -quiet -burn.related.upgrade -burn.ancestors={d8bbe9f9-7c5b-42c6-b715-9ee898a2e515} -burn.filehandle.self=1100 -burn.embedded BurnPipe.{121596FE-44F1-4EF9-BEA4-9CF8AD6E88EA} {B42CC92E-4860-49C1-AF96-01728B1ED650} 48008⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{3DE56166-6560-49B1-96DF-AEFAC8528CE1} {B9905E19-7A4A-41BB-A223-63BDC0B71ACF} 70689⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
-
-
-
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "Happ Proxy Autostart" /F4⤵
-
-
C:\Program Files\FlyFrogLLC\Happ\happd.exe"C:\Program Files\FlyFrogLLC\Happ\happd.exe" --register4⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Windows\system32\sc.exe"sc.exe" start HappService4⤵
- Launches sc.exe
-
-
C:\Program Files\FlyFrogLLC\Happ\Happ.exe"C:\Program Files\FlyFrogLLC\Happ\Happ.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Unexpected DNS network traffic destination
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\FlyFrogLLC\Happ\core\xray.exe"C:\Program Files\FlyFrogLLC\Happ\core\xray.exe" --version5⤵
- Executes dropped EXE
-
-
C:\Program Files\FlyFrogLLC\Happ\tun\sing-box.exe"C:\Program Files\FlyFrogLLC\Happ\tun\sing-box.exe" version5⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\FlyFrogLLC\Happ\tun2\tun2proxy-bin.exe"C:\Program Files\FlyFrogLLC\Happ\tun2\tun2proxy-bin.exe" --version5⤵
- Executes dropped EXE
-
-
C:\Program Files\FlyFrogLLC\Happ\core\xray.exe"C:\Program Files\FlyFrogLLC\Happ\core\xray.exe" --version5⤵
- Executes dropped EXE
-
-
C:\Program Files\FlyFrogLLC\Happ\core\xray.exe"C:\Program Files\FlyFrogLLC\Happ\core\xray.exe" -test5⤵
- Executes dropped EXE
-
-
C:\Program Files\FlyFrogLLC\Happ\core\xray.exe"C:\Program Files\FlyFrogLLC\Happ\core\xray.exe" --version5⤵
- Executes dropped EXE
-
-
C:\Program Files\FlyFrogLLC\Happ\core\xray.exe"C:\Program Files\FlyFrogLLC\Happ\core\xray.exe" --version5⤵
- Executes dropped EXE
-
-
C:\Program Files\FlyFrogLLC\Happ\core\xray.exe"C:\Program Files\FlyFrogLLC\Happ\core\xray.exe" -test5⤵
- Executes dropped EXE
-
-
C:\Program Files\FlyFrogLLC\Happ\core\xray.exe"C:\Program Files\FlyFrogLLC\Happ\core\xray.exe"5⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
-
-
C:\Program Files\FlyFrogLLC\Happ\core\xray.exe"C:\Program Files\FlyFrogLLC\Happ\core\xray.exe" --version5⤵
- Executes dropped EXE
-
-
C:\Program Files\FlyFrogLLC\Happ\core\xray.exe"C:\Program Files\FlyFrogLLC\Happ\core\xray.exe" --version5⤵
- Executes dropped EXE
-
-
C:\Program Files\FlyFrogLLC\Happ\core\xray.exe"C:\Program Files\FlyFrogLLC\Happ\core\xray.exe" -test5⤵
- Executes dropped EXE
-
-
C:\Program Files\FlyFrogLLC\Happ\core\xray.exe"C:\Program Files\FlyFrogLLC\Happ\core\xray.exe"5⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
-
-
C:\Program Files\FlyFrogLLC\Happ\core\xray.exe"C:\Program Files\FlyFrogLLC\Happ\core\xray.exe" --version5⤵
- Executes dropped EXE
-
-
C:\Program Files\FlyFrogLLC\Happ\core\xray.exe"C:\Program Files\FlyFrogLLC\Happ\core\xray.exe" --version5⤵
- Executes dropped EXE
-
-
C:\Program Files\FlyFrogLLC\Happ\core\xray.exe"C:\Program Files\FlyFrogLLC\Happ\core\xray.exe" -test5⤵
- Executes dropped EXE
-
-
C:\Program Files\FlyFrogLLC\Happ\core\xray.exe"C:\Program Files\FlyFrogLLC\Happ\core\xray.exe"5⤵
- Executes dropped EXE
-
-
C:\Program Files\FlyFrogLLC\Happ\core\xray.exe"C:\Program Files\FlyFrogLLC\Happ\core\xray.exe" --version5⤵
- Executes dropped EXE
-
-
C:\Program Files\FlyFrogLLC\Happ\core\xray.exe"C:\Program Files\FlyFrogLLC\Happ\core\xray.exe" --version5⤵
- Executes dropped EXE
-
-
C:\Program Files\FlyFrogLLC\Happ\core\xray.exe"C:\Program Files\FlyFrogLLC\Happ\core\xray.exe" -test5⤵
- Executes dropped EXE
-
-
C:\Program Files\FlyFrogLLC\Happ\core\xray.exe"C:\Program Files\FlyFrogLLC\Happ\core\xray.exe"5⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
-
-
C:\Program Files\FlyFrogLLC\Happ\core\xray.exe"C:\Program Files\FlyFrogLLC\Happ\core\xray.exe" --version5⤵
- Executes dropped EXE
-
-
C:\Program Files\FlyFrogLLC\Happ\core\xray.exe"C:\Program Files\FlyFrogLLC\Happ\core\xray.exe" --version5⤵
- Executes dropped EXE
-
-
C:\Program Files\FlyFrogLLC\Happ\core\xray.exe"C:\Program Files\FlyFrogLLC\Happ\core\xray.exe" -test5⤵
- Executes dropped EXE
-
-
C:\Program Files\FlyFrogLLC\Happ\core\xray.exe"C:\Program Files\FlyFrogLLC\Happ\core\xray.exe"5⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
-
-
C:\Program Files\FlyFrogLLC\Happ\core\xray.exe"C:\Program Files\FlyFrogLLC\Happ\core\xray.exe" --version5⤵
- Executes dropped EXE
-
-
C:\Program Files\FlyFrogLLC\Happ\core\xray.exe"C:\Program Files\FlyFrogLLC\Happ\core\xray.exe" --version5⤵
- Executes dropped EXE
-
-
C:\Program Files\FlyFrogLLC\Happ\core\xray.exe"C:\Program Files\FlyFrogLLC\Happ\core\xray.exe" -test5⤵
- Executes dropped EXE
-
-
C:\Program Files\FlyFrogLLC\Happ\core\xray.exe"C:\Program Files\FlyFrogLLC\Happ\core\xray.exe"5⤵
- Executes dropped EXE
-
-
C:\Program Files\FlyFrogLLC\Happ\core\xray.exe"C:\Program Files\FlyFrogLLC\Happ\core\xray.exe" --version5⤵
- Executes dropped EXE
-
-
C:\Program Files\FlyFrogLLC\Happ\core\xray.exe"C:\Program Files\FlyFrogLLC\Happ\core\xray.exe" --version5⤵
- Executes dropped EXE
-
-
C:\Program Files\FlyFrogLLC\Happ\core\xray.exe"C:\Program Files\FlyFrogLLC\Happ\core\xray.exe" -test5⤵
- Executes dropped EXE
-
-
C:\Program Files\FlyFrogLLC\Happ\core\xray.exe"C:\Program Files\FlyFrogLLC\Happ\core\xray.exe"5⤵
- Executes dropped EXE
-
-
C:\Program Files\FlyFrogLLC\Happ\core\xray.exe"C:\Program Files\FlyFrogLLC\Happ\core\xray.exe" --version5⤵
- Executes dropped EXE
-
-
C:\Program Files\FlyFrogLLC\Happ\core\xray.exe"C:\Program Files\FlyFrogLLC\Happ\core\xray.exe" --version5⤵
- Executes dropped EXE
-
-
C:\Program Files\FlyFrogLLC\Happ\core\xray.exe"C:\Program Files\FlyFrogLLC\Happ\core\xray.exe" -test5⤵
- Executes dropped EXE
-
-
C:\Program Files\FlyFrogLLC\Happ\core\xray.exe"C:\Program Files\FlyFrogLLC\Happ\core\xray.exe"5⤵
- Executes dropped EXE
-
-
C:\Program Files\FlyFrogLLC\Happ\core\xray.exe"C:\Program Files\FlyFrogLLC\Happ\core\xray.exe" --version5⤵
- Executes dropped EXE
-
-
C:\Program Files\FlyFrogLLC\Happ\core\xray.exe"C:\Program Files\FlyFrogLLC\Happ\core\xray.exe" --version5⤵
- Executes dropped EXE
-
-
C:\Program Files\FlyFrogLLC\Happ\core\xray.exe"C:\Program Files\FlyFrogLLC\Happ\core\xray.exe" -test5⤵
- Executes dropped EXE
-
-
C:\Program Files\FlyFrogLLC\Happ\core\xray.exe"C:\Program Files\FlyFrogLLC\Happ\core\xray.exe"5⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
-
-
C:\Program Files\FlyFrogLLC\Happ\core\xray.exe"C:\Program Files\FlyFrogLLC\Happ\core\xray.exe" --version5⤵
- Executes dropped EXE
-
-
C:\Program Files\FlyFrogLLC\Happ\core\xray.exe"C:\Program Files\FlyFrogLLC\Happ\core\xray.exe" --version5⤵
- Executes dropped EXE
-
-
C:\Program Files\FlyFrogLLC\Happ\core\xray.exe"C:\Program Files\FlyFrogLLC\Happ\core\xray.exe" -test5⤵
- Executes dropped EXE
-
-
C:\Program Files\FlyFrogLLC\Happ\core\xray.exe"C:\Program Files\FlyFrogLLC\Happ\core\xray.exe"5⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
-
-
C:\Program Files\FlyFrogLLC\Happ\core\xray.exe"C:\Program Files\FlyFrogLLC\Happ\core\xray.exe" --version5⤵
- Executes dropped EXE
-
-
C:\Program Files\FlyFrogLLC\Happ\core\xray.exe"C:\Program Files\FlyFrogLLC\Happ\core\xray.exe" --version5⤵
- Executes dropped EXE
-
-
C:\Program Files\FlyFrogLLC\Happ\core\xray.exe"C:\Program Files\FlyFrogLLC\Happ\core\xray.exe" -test5⤵
- Executes dropped EXE
-
-
C:\Program Files\FlyFrogLLC\Happ\core\xray.exe"C:\Program Files\FlyFrogLLC\Happ\core\xray.exe"5⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
-
-
C:\Program Files\FlyFrogLLC\Happ\core\xray.exe"C:\Program Files\FlyFrogLLC\Happ\core\xray.exe" --version5⤵
- Executes dropped EXE
-
-
C:\Program Files\FlyFrogLLC\Happ\core\xray.exe"C:\Program Files\FlyFrogLLC\Happ\core\xray.exe" --version5⤵
- Executes dropped EXE
-
-
C:\Program Files\FlyFrogLLC\Happ\core\xray.exe"C:\Program Files\FlyFrogLLC\Happ\core\xray.exe" -test5⤵
-
-
C:\Program Files\FlyFrogLLC\Happ\core\xray.exe"C:\Program Files\FlyFrogLLC\Happ\core\xray.exe"5⤵
-
-
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --metrics-shmem-handle=9928,i,12130314141225769753,193667736097339043,2097152 --field-trial-handle=2064,i,12243773202349324811,7774625142252999913,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=9244 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --metrics-shmem-handle=6404,i,8404323141226584259,591614457527347420,2097152 --field-trial-handle=2064,i,12243773202349324811,7774625142252999913,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6320 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --metrics-shmem-handle=6256,i,9314414688775389632,14164118616201910032,2097152 --field-trial-handle=2064,i,12243773202349324811,7774625142252999913,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6280 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --metrics-shmem-handle=8768,i,14124967904260073809,5292556194452496818,2097152 --field-trial-handle=2064,i,12243773202349324811,7774625142252999913,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=8720 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --metrics-shmem-handle=8264,i,5752589449756505137,12365295472064557139,2097152 --field-trial-handle=2064,i,12243773202349324811,7774625142252999913,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=8324 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --metrics-shmem-handle=8164,i,18177203229995699729,14378972011165443234,2097152 --field-trial-handle=2064,i,12243773202349324811,7774625142252999913,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=8140 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --metrics-shmem-handle=8584,i,3317844443647120496,9521247464248093310,2097152 --field-trial-handle=2064,i,12243773202349324811,7774625142252999913,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7856 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --metrics-shmem-handle=8036,i,7154403505392977402,5588628598389131178,2097152 --field-trial-handle=2064,i,12243773202349324811,7774625142252999913,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7988 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --metrics-shmem-handle=8808,i,5122015209220959495,13592680501713504415,2097152 --field-trial-handle=2064,i,12243773202349324811,7774625142252999913,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3404 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --metrics-shmem-handle=7720,i,13983863571747446472,13425758257918287184,2097152 --field-trial-handle=2064,i,12243773202349324811,7774625142252999913,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7652 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --metrics-shmem-handle=8268,i,10500186529490439892,15768609704527436170,2097152 --field-trial-handle=2064,i,12243773202349324811,7774625142252999913,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=8116 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --metrics-shmem-handle=7028,i,15169771396194851324,3387140918713415277,2097152 --field-trial-handle=2064,i,12243773202349324811,7774625142252999913,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7032 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --metrics-shmem-handle=5868,i,8199555209016895025,18292967715302986223,2097152 --field-trial-handle=2064,i,12243773202349324811,7774625142252999913,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6896 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --metrics-shmem-handle=7524,i,3476133241387845588,304524053587463065,2097152 --field-trial-handle=2064,i,12243773202349324811,7774625142252999913,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7520 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --metrics-shmem-handle=8080,i,9423281957344727050,6752306301900966266,2097152 --field-trial-handle=2064,i,12243773202349324811,7774625142252999913,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=9752 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --metrics-shmem-handle=8348,i,4580825655463577868,9918364223838577876,2097152 --field-trial-handle=2064,i,12243773202349324811,7774625142252999913,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=8264 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --metrics-shmem-handle=9200,i,167859556545086644,8867068327661852621,2097152 --field-trial-handle=2064,i,12243773202349324811,7774625142252999913,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7084 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=8752,i,2026713513337528497,16751676632858887564,262144 --field-trial-handle=2064,i,12243773202349324811,7774625142252999913,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=8736 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --metrics-shmem-handle=4012,i,4526539112705331916,16151122933399568364,2097152 --field-trial-handle=2064,i,12243773202349324811,7774625142252999913,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=8992 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --metrics-shmem-handle=8260,i,2440236601291267666,2623346571116583883,2097152 --field-trial-handle=2064,i,12243773202349324811,7774625142252999913,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6060 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=6292,i,10915885629865675647,2699640165116445816,524288 --field-trial-handle=2064,i,12243773202349324811,7774625142252999913,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=9196 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:21⤵
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" /burn.runonce1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" /passive /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20261113154151.log"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" -burn.filehandle.attached=520 -burn.filehandle.self=540 /passive /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20261113154151.log"3⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
-
C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{CA4FA706-13BB-4D72-B5A3-9C9AE663E873} {D07351B3-E839-4661-9A05-EE5025263E8B} 38724⤵
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
-
-
C:\Program Files\FlyFrogLLC\Happ\happd.exe"C:\Program Files\FlyFrogLLC\Happ\happd.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\FlyFrogLLC\Happ\core\xray.exe"C:\Program Files\FlyFrogLLC\Happ\core\xray.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
- Modifies system certificate store
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "9" "C:\Windows\Temp\1635bd48be17022017333e3bd668d315e33fed5b257a0835152a6b6090490daf\wintun.inf" "9" "467f98b3f" "0000000000000138" "Service-0x0-3e7$\Default" "0000000000000150" "208" "C:\Windows\Temp\1635bd48be17022017333e3bd668d315e33fed5b257a0835152a6b6090490daf"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "0" "SWD\Wintun\{96393862-E9FD-E153-2267-F16A3E0139B8}" "" "" "4c1a99207" "0000000000000000"2⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
-
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
e5a8b00.rbs
e5a8b0c.rbs
e5a8b13.rbs
e5a8b22.rbs
Happ.exe
concrt140.dll
happd.exe
msvcp140.dll
msvcp140_1.dll
msvcp140_2.dll
msvcp140_atomic_wait.dll
msvcp140_codecvt_ids.dll
is-7HGGUMHO7R.tmp
is-0GXSRJ5SOC.tmp
is-13M989T2PV.tmp
is-1CTCKY6OVC.tmp
is-1SORLGNRBP.tmp
is-24Z9XYYJQN.tmp
is-2LWXOTGOIV.tmp
is-3C2WYYNJF2.tmp
is-475ZBMSM0N.tmp
is-4796E9Q6BU.tmp
is-56I2NPEQC7.tmp
is-58F94AZ99E.tmp
is-5IPNE3Q6Q8.tmp
is-5QQUHCIZB2.tmp
is-607CTNY6SS.tmp
is-6OHIHXWCE7.tmp
is-6WFU32NLVH.tmp
is-70J1LNK2QI.tmp
is-75VFV5BI91.tmp
is-787HK3ZOAA.tmp
is-7HHPDDHDRX.tmp
is-7NMWPK7ELE.tmp
is-7NW9MEH2D6.tmp
is-91D5L40I50.tmp
is-AT52UPYTIV.tmp
is-B8CZA1QJ3C.tmp
is-BCUZBRWQK4.tmp
is-CB5ASR596O.tmp
is-DBHOHVWJLP.tmp
is-EQTJMAYWCS.tmp
is-FJS4233CY5.tmp
is-FRHBQ96WPZ.tmp
is-FX35ZQKJNP.tmp
is-FXU30GQPY6.tmp
is-GJH3B9TF0N.tmp
is-GN4ZQVDMWL.tmp
is-GYCLQ690O2.tmp
is-IARBMLMK8G.tmp
is-IBKWP2OUBJ.tmp
is-J0SHMS40E4.tmp
is-J96MW0N01X.tmp
is-JB2S0FT7XO.tmp
is-JBTEY9HWP0.tmp
is-JO74JPKN2Y.tmp
is-JQT282ANQQ.tmp
is-JWBBOEZT16.tmp
is-JXZG1517ZD.tmp
is-K797IYKEZE.tmp
is-L0139DVINZ.tmp
is-LPQ8OPH0RJ.tmp
is-LQAD8YBDB4.tmp
is-LZSN48T7G6.tmp
is-MIKKQMZ9O9.tmp
is-MX19DD3TH4.tmp
is-N0Q805K9R8.tmp
is-N1N7B7O783.tmp
is-NAUIZ5N76X.tmp
is-NLFVGBAPGL.tmp
is-PL67X8HHDO.tmp
is-PLPRXR328B.tmp
is-PT5H55W1NU.tmp
is-R4JJOGGFIR.tmp
is-S3QJQVUPE2.tmp
is-SK8OHA1ULJ.tmp
is-ST0DG77T24.tmp
is-SZYJEBIQ6N.tmp
is-T6W2MCZTCO.tmp
is-T7B42XRFZZ.tmp
is-TQ41T23AIJ.tmp
is-TZSOWRDDSW.tmp
is-UQLXURG6JZ.tmp
is-VYQXGMDUEB.tmp
is-WHMX4KA3PY.tmp
is-WOP85X1A34.tmp
is-X0ZDNMYJ2Q.tmp
is-XDBAGSJG33.tmp
is-XPTP9TNV16.tmp
is-Y7YBXLHQLW.tmp
is-YJLT3P7MPU.tmp
is-Z2R6XWCEZR.tmp
is-ZAV1A8UV0T.tmp
is-ZWOHDQJYP8.tmp
is-0DOY918V7I.tmp
is-0N3MG3QKQ7.tmp
is-0R5O0WG9JO.tmp
is-0UAY5DV6EN.tmp
is-0ZLXZAGL69.tmp
is-107H5LK17S.tmp
is-22HDFAO73U.tmp
is-24JB95S5UT.tmp
is-2KJW8T8Z46.tmp
is-2QHV7J5X0T.tmp
is-3IE4OBOBNN.tmp
is-3UNOYBAT24.tmp
is-4K4QGG2AG7.tmp
is-51037EDA6U.tmp
is-53AYVJSUS1.tmp
is-6FKG5BH92C.tmp
is-6Q83P06RPP.tmp
is-7BMLF8CPJO.tmp
is-7VJQNBQ25P.tmp
is-7XYK7FZB8H.tmp
is-8BGTOE5RU3.tmp
is-AGZ2O69MBZ.tmp
is-AJCTL48DOS.tmp
is-B0CF2EXXD9.tmp
is-B5RGOHWGYT.tmp
is-B61NRLHH1P.tmp
is-BLGTY54WAD.tmp
is-CG7H30BS6L.tmp
is-CKUMTVWN7E.tmp
is-CXZB8CI86V.tmp
is-E0XJPMZVW7.tmp
is-ESNZ4K4AVW.tmp
is-EYWP90HOP7.tmp
is-F98QPOU5P3.tmp
is-FDII7CNEBH.tmp
is-FP53EIG2RF.tmp
is-FRMWT1JAZQ.tmp
is-GH03DF7HJV.tmp
is-GQ64SQMWOF.tmp
is-H1AI7DD84M.tmp
is-HB54Q94T1I.tmp
is-I216KCS0YH.tmp
is-IFO5CWSH0E.tmp
is-IHB4BSHSXD.tmp
is-IL46ZU9DAU.tmp
is-JF3F0741CI.tmp
is-K9GLLT295N.tmp
is-KF42W7HRQS.tmp
is-LB6T01IMFH.tmp
is-MM4UPD4E8T.tmp
is-MW2JYCP0DB.tmp
is-NWOR5RI39H.tmp
is-O8E7A6YJ24.tmp
is-OA9IU52NTP.tmp
is-OC4PNLC2O9.tmp
is-OQS7NS0WKZ.tmp
is-PF9MT1MWVY.tmp
is-PIEX31V8D6.tmp
is-QATO9B8UNM.tmp
is-R1XRQZZZ2O.tmp
is-SE7PWMT9LK.tmp
is-SSX1AW2GMU.tmp
is-ST7W346TIB.tmp
is-TQ1O7CUTXM.tmp
is-U8NKD0AG45.tmp
is-UPJL85E0JL.tmp
is-UWAJMQM384.tmp
is-WI5ZNY7H07.tmp
is-XPO00VN982.tmp
is-XRMIRBV6ZC.tmp
is-YACEIN1DBU.tmp
is-Z6KWWW2EIA.tmp
is-CQ1H3TWBFD.tmp
is-EL6M85JNVQ.tmp
is-EMO88215V2.tmp
is-IUS9PVIZCL.tmp
is-KM433TYPV3.tmp
is-OBXQ2G08JK.tmp
is-SHCPNN163U.tmp
is-MO3ZTR9PSV.tmp
is-OONPTPMDAS.tmp
is-PMHHTJFTH5.tmp
is-P4UYVM0TJW.tmp
is-UHY87IAA7W.tmp
is-XC9KQREWBY.tmp
is-0FEUBYNJHI.tmp
is-7VRU3UZYM7.tmp
is-9K3HCAEUPU.tmp
is-E5MUM3KZGK.tmp
is-LQ1Q4L0S7L.tmp
is-QE0D5S7W8A.tmp
is-FXV2DE9E4I.tmp
is-FEQT61CWZ1.tmp
vccorlib140.dll
vcruntime140.dll
vcruntime140_1.dll
vcruntime140_threads.dll
happd.log
vc_runtimeMinimum_x64.msi
0ae8dccc-aa6b-4b7c-95ca-b6001d8c57a2.tmp
19eeba42-4a63-46a9-bba2-79ffb7573b60.tmp
1b091f8e-a5b6-41fd-bd01-13ba9ba58338.tmp
23f3a9c2-28ac-44bf-9f54-ad9db998c880.tmp
252f6f0a-b4da-4fe0-8ddb-58071adbf1e3.tmp
settings.dat
074b82a5-78bb-42ba-a8d5-44071cb7976e.tmp
3e959236-9ee2-4940-b0f1-f4b29090368f.tmp
466b4dc7-d472-4f9f-8683-cbbc08609c61.tmp
6816a6b1-e6fb-43c3-bd86-11b3456a3073.tmp
77e7c659-ad17-47b2-8f56-916717debdd9.tmp
f_000005
f_000011
f_000013
f_000015
f_000016
f_00001e
f_000035
f_00003c
f_000049
f_00006e
temp-index
temp-index
temp-index
MANIFEST-000001
CURRENT
1a14d044-43d5-4eb0-a8a0-98377a4755f6.tmp
3e59ed6d-76f1-4ebc-b98a-77a500b1bef1.tmp
58e48a45-88ef-469d-9826-2520b0a62c79.tmp
temp-index
the-real-index
a913ba5c-b72f-47e2-9076-1913aedde039.tmp
b2d32a8d-87bd-4109-9e1f-3b9a7b6f2442.tmp
c5410c58-d98d-4385-be07-93742cbdea76.tmp
d1cb0267-4802-4d94-a7c9-942eef7b9f00.tmp
d32d6275-69ad-4bcf-b6cf-05f71aa6dbc7.tmp
data_1
c345bd7f-3901-496d-b068-189b665c53d7.tmp
ffa02807-9d17-4293-a3ec-926ec8d454ad.tmp
subscription_log.txt
Setup Log 2026-11-13 #001.txt
setup-Happ.x64.tmp
vcredist2022_x64.exe
default.dic
c6efab4e-153c-4c39-83f1-d45121ea5d51.tmp
wintun.cat
wintun.sys
wintun.inf
BootstrapperApplicationData.xml
license.rtf
thm.wxl
thm.xml
vcredist2022_x64.exe
wixstdba.dll
logo.png
wixstdba.dll
memory/2148-1253-0x0000000000020000-0x0000000000097000-memory.dmp
memory/2260-867-0x0000000000740000-0x0000000000829000-memory.dmp
memory/2260-843-0x0000000000740000-0x0000000000829000-memory.dmp
memory/2260-842-0x00000000007FF000-0x0000000000800000-memory.dmp
memory/2260-6457-0x0000000000740000-0x0000000000829000-memory.dmp
memory/2744-1292-0x0000000000720000-0x0000000000B6B000-memory.dmp
memory/2744-6289-0x0000000000720000-0x0000000000B6B000-memory.dmp
memory/2744-1426-0x0000000000720000-0x0000000000B6B000-memory.dmp
memory/2744-919-0x0000000000720000-0x0000000000B6B000-memory.dmp
memory/2744-1521-0x0000000000720000-0x0000000000B6B000-memory.dmp
memory/2744-6213-0x0000000000720000-0x0000000000B6B000-memory.dmp
memory/2744-4392-0x0000000000720000-0x0000000000B6B000-memory.dmp
memory/2744-1269-0x0000000000720000-0x0000000000B6B000-memory.dmp
memory/2744-6261-0x0000000000720000-0x0000000000B6B000-memory.dmp
memory/2744-868-0x0000000000720000-0x0000000000B6B000-memory.dmp
memory/2744-6456-0x0000000000720000-0x0000000000B6B000-memory.dmp
memory/7044-1256-0x0000000000020000-0x0000000000097000-memory.dmp
memory/7068-1255-0x0000000000020000-0x0000000000097000-memory.dmp
memory/11008-6472-0x00000275AC1F0000-0x00000275AC1F1000-memory.dmp
memory/11008-6505-0x00000275AC230000-0x00000275AC231000-memory.dmp
memory/11008-6458-0x00000275922D0000-0x0000027592712000-memory.dmp
memory/11008-6466-0x00000275AC1E0000-0x00000275AC1E1000-memory.dmp
memory/11008-6465-0x00000275AC1E0000-0x00000275AC1E1000-memory.dmp
memory/11008-6464-0x00000275AC1E0000-0x00000275AC1E1000-memory.dmp
memory/11008-6468-0x00000275AC1E0000-0x00000275AC1E1000-memory.dmp
memory/11008-6467-0x00000275AC1E0000-0x00000275AC1E1000-memory.dmp
memory/11008-6469-0x00000275AC1E0000-0x00000275AC1E1000-memory.dmp
memory/11008-6471-0x00000275AC1F0000-0x00000275AC1F1000-memory.dmp
memory/11008-6473-0x00000275AC1F0000-0x00000275AC1F1000-memory.dmp
memory/11008-6455-0x00007FF7BC260000-0x00007FF7BD6D2000-memory.dmp
memory/11008-6475-0x00000275AC1F0000-0x00000275AC1F1000-memory.dmp
memory/11008-6476-0x00000275AC1F0000-0x00000275AC1F1000-memory.dmp
memory/11008-6474-0x00000275AC1F0000-0x00000275AC1F1000-memory.dmp
memory/11008-6478-0x00000275AC1F0000-0x00000275AC1F1000-memory.dmp
memory/11008-6477-0x00000275AC1F0000-0x00000275AC1F1000-memory.dmp
memory/11008-6479-0x00000275AC1F0000-0x00000275AC1F1000-memory.dmp
memory/11008-6481-0x00000275AC210000-0x00000275AC211000-memory.dmp
memory/11008-6483-0x00000275AC210000-0x00000275AC211000-memory.dmp
memory/11008-6496-0x00000275AC220000-0x00000275AC221000-memory.dmp
memory/11008-6507-0x00000275AC230000-0x00000275AC231000-memory.dmp
memory/11008-6506-0x00000275AC230000-0x00000275AC231000-memory.dmp
memory/11008-6460-0x0000027592720000-0x0000027592922000-memory.dmp
memory/11008-6503-0x00000275AC220000-0x00000275AC221000-memory.dmp
memory/11008-6502-0x00000275AC220000-0x00000275AC221000-memory.dmp
memory/11008-6501-0x00000275AC220000-0x00000275AC221000-memory.dmp
memory/11008-6500-0x00000275AC220000-0x00000275AC221000-memory.dmp
memory/11008-6499-0x00000275AC220000-0x00000275AC221000-memory.dmp
memory/11008-6498-0x00000275AC220000-0x00000275AC221000-memory.dmp
memory/11008-6497-0x00000275AC220000-0x00000275AC221000-memory.dmp
memory/11008-6495-0x00000275AC220000-0x00000275AC221000-memory.dmp
memory/11008-6494-0x00000275AC220000-0x00000275AC221000-memory.dmp
memory/11008-6493-0x00000275AC220000-0x00000275AC221000-memory.dmp
memory/11008-6492-0x00000275AC220000-0x00000275AC221000-memory.dmp
memory/11008-6491-0x00000275AC220000-0x00000275AC221000-memory.dmp
memory/11008-6490-0x00000275AC220000-0x00000275AC221000-memory.dmp
memory/11008-6488-0x00000275AC210000-0x00000275AC211000-memory.dmp
memory/11008-6487-0x00000275AC210000-0x00000275AC211000-memory.dmp
memory/11008-6486-0x00000275AC210000-0x00000275AC211000-memory.dmp
memory/11008-6485-0x00000275AC210000-0x00000275AC211000-memory.dmp
memory/11008-6484-0x00000275AC210000-0x00000275AC211000-memory.dmp
memory/11008-6482-0x00000275AC210000-0x00000275AC211000-memory.dmp
memory/11008-6453-0x00007FF7BC260000-0x00007FF7BD6D2000-memory.dmp
memory/11008-6454-0x00007FFC57F90000-0x00007FFC585D8000-memory.dmp
memory/11008-6452-0x00007FFC57430000-0x00007FFC57A64000-memory.dmp
memory/11008-6450-0x00007FFC57F90000-0x00007FFC585D8000-memory.dmp