The link to sysinternals.com in the timeline is missing the s linking to parking domain and possiblity hosting malicious stuff.