redline | hxxps://google[.]com

max time kernel
1409s
max time network
1414s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04/12/2022, 12:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://google.com

Score

10^/10

redline milliondollarsssssssss infostealer

Malware Config

Extracted

Family

redline

Botnet

MILLIONDOLLARSSSSSSSSS

195.201.122.190:45976

Attributes

auth_value
971e3b56584ce491575444038fafa07c

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral1/memory/3996-178-0x0000000000970000-0x0000000000998000-memory.dmp	family_redline
behavioral1/memory/3336-188-0x0000000000C30000-0x0000000000C58000-memory.dmp	family_redline

Executes dropped EXE 2 IoCs

pid	Process
1500	Sеtup.exe
4356	Sеtup.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1500 set thread context of 3996	1500	Sеtup.exe	185
PID 4356 set thread context of 3336	4356	Sеtup.exe	188

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4684	1368	WerFault.exe	92

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2295526160-1155304984-640977766-1000\{0075A0AF-937A-4E50-A352-A043A0AFBB95}	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5104	chrome.exe
5104	chrome.exe
916	chrome.exe
916	chrome.exe
4900	chrome.exe
4900	chrome.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
4860	taskmgr.exe
1888	7zG.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 25 IoCs

pid	Process
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
3944	chrome.exe
3944	chrome.exe
3944	chrome.exe
3944	chrome.exe
3944	chrome.exe
3944	chrome.exe
3944	chrome.exe
3944	chrome.exe
3944	chrome.exe
3944	chrome.exe
3944	chrome.exe
3944	chrome.exe
3944	chrome.exe
3944	chrome.exe
3944	chrome.exe
3944	chrome.exe
3944	chrome.exe
3944	chrome.exe
3944	chrome.exe
3944	chrome.exe
3944	chrome.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeDebugPrivilege	4860	taskmgr.exe
Token: SeSystemProfilePrivilege	4860	taskmgr.exe
Token: SeCreateGlobalPrivilege	4860	taskmgr.exe
Token: 33	4036	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4036	AUDIODG.EXE
Token: SeRestorePrivilege	2744	7zG.exe
Token: 35	2744	7zG.exe
Token: SeSecurityPrivilege	2744	7zG.exe
Token: SeSecurityPrivilege	2744	7zG.exe
Token: SeRestorePrivilege	1888	7zG.exe
Token: 35	1888	7zG.exe
Token: SeSecurityPrivilege	1888	7zG.exe
Token: SeSecurityPrivilege	1888	7zG.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3944	chrome.exe
3944	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 916 wrote to memory of 2124	916	chrome.exe	79
PID 916 wrote to memory of 2124	916	chrome.exe	79
PID 916 wrote to memory of 1092	916	chrome.exe	82
PID 916 wrote to memory of 1092	916	chrome.exe	82
PID 916 wrote to memory of 1092	916	chrome.exe	82
PID 916 wrote to memory of 1092	916	chrome.exe	82
PID 916 wrote to memory of 1092	916	chrome.exe	82
PID 916 wrote to memory of 1092	916	chrome.exe	82
PID 916 wrote to memory of 1092	916	chrome.exe	82
PID 916 wrote to memory of 1092	916	chrome.exe	82
PID 916 wrote to memory of 1092	916	chrome.exe	82
PID 916 wrote to memory of 1092	916	chrome.exe	82
PID 916 wrote to memory of 1092	916	chrome.exe	82
PID 916 wrote to memory of 1092	916	chrome.exe	82
PID 916 wrote to memory of 1092	916	chrome.exe	82
PID 916 wrote to memory of 1092	916	chrome.exe	82
PID 916 wrote to memory of 1092	916	chrome.exe	82
PID 916 wrote to memory of 1092	916	chrome.exe	82
PID 916 wrote to memory of 1092	916	chrome.exe	82
PID 916 wrote to memory of 1092	916	chrome.exe	82
PID 916 wrote to memory of 1092	916	chrome.exe	82
PID 916 wrote to memory of 1092	916	chrome.exe	82
PID 916 wrote to memory of 1092	916	chrome.exe	82
PID 916 wrote to memory of 1092	916	chrome.exe	82
PID 916 wrote to memory of 1092	916	chrome.exe	82
PID 916 wrote to memory of 1092	916	chrome.exe	82
PID 916 wrote to memory of 1092	916	chrome.exe	82
PID 916 wrote to memory of 1092	916	chrome.exe	82
PID 916 wrote to memory of 1092	916	chrome.exe	82
PID 916 wrote to memory of 1092	916	chrome.exe	82
PID 916 wrote to memory of 1092	916	chrome.exe	82
PID 916 wrote to memory of 1092	916	chrome.exe	82
PID 916 wrote to memory of 1092	916	chrome.exe	82
PID 916 wrote to memory of 1092	916	chrome.exe	82
PID 916 wrote to memory of 1092	916	chrome.exe	82
PID 916 wrote to memory of 1092	916	chrome.exe	82
PID 916 wrote to memory of 1092	916	chrome.exe	82
PID 916 wrote to memory of 1092	916	chrome.exe	82
PID 916 wrote to memory of 1092	916	chrome.exe	82
PID 916 wrote to memory of 1092	916	chrome.exe	82
PID 916 wrote to memory of 1092	916	chrome.exe	82
PID 916 wrote to memory of 1092	916	chrome.exe	82
PID 916 wrote to memory of 5104	916	chrome.exe	83
PID 916 wrote to memory of 5104	916	chrome.exe	83
PID 916 wrote to memory of 3616	916	chrome.exe	84
PID 916 wrote to memory of 3616	916	chrome.exe	84
PID 916 wrote to memory of 3616	916	chrome.exe	84
PID 916 wrote to memory of 3616	916	chrome.exe	84
PID 916 wrote to memory of 3616	916	chrome.exe	84
PID 916 wrote to memory of 3616	916	chrome.exe	84
PID 916 wrote to memory of 3616	916	chrome.exe	84
PID 916 wrote to memory of 3616	916	chrome.exe	84
PID 916 wrote to memory of 3616	916	chrome.exe	84
PID 916 wrote to memory of 3616	916	chrome.exe	84
PID 916 wrote to memory of 3616	916	chrome.exe	84
PID 916 wrote to memory of 3616	916	chrome.exe	84
PID 916 wrote to memory of 3616	916	chrome.exe	84
PID 916 wrote to memory of 3616	916	chrome.exe	84
PID 916 wrote to memory of 3616	916	chrome.exe	84
PID 916 wrote to memory of 3616	916	chrome.exe	84
PID 916 wrote to memory of 3616	916	chrome.exe	84
PID 916 wrote to memory of 3616	916	chrome.exe	84
PID 916 wrote to memory of 3616	916	chrome.exe	84
PID 916 wrote to memory of 3616	916	chrome.exe	84

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" https://google.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa7b684f50,0x7ffa7b684f60,0x7ffa7b684f70
  2⤵
  PID:2124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1636,15508881777026208858,4312251505964847757,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1700 /prefetch:2
  2⤵
  PID:1092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1636,15508881777026208858,4312251505964847757,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2016 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1636,15508881777026208858,4312251505964847757,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2304 /prefetch:8
  2⤵
  PID:3616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,15508881777026208858,4312251505964847757,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3024 /prefetch:1
  2⤵
  PID:364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,15508881777026208858,4312251505964847757,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3044 /prefetch:1
  2⤵
  PID:1356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,15508881777026208858,4312251505964847757,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4352 /prefetch:8
  2⤵
  PID:1436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1636,15508881777026208858,4312251505964847757,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4944 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1636,15508881777026208858,4312251505964847757,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5020 /prefetch:8
  2⤵
  PID:4632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,15508881777026208858,4312251505964847757,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5136 /prefetch:1
  2⤵
  PID:3812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,15508881777026208858,4312251505964847757,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4640 /prefetch:1
  2⤵
  PID:4744

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1252

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 460 -p 1368 -ip 1368
1⤵
PID:4396

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1368 -s 1152
1⤵
- Program crash
PID:4684

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4860

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of SetWindowsHookEx
PID:3944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffa7b684f50,0x7ffa7b684f60,0x7ffa7b684f70
  2⤵
  PID:3520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1644,14438618975794918178,15263191923307524898,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1796 /prefetch:8
  2⤵
  PID:4808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1644,14438618975794918178,15263191923307524898,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1656 /prefetch:2
  2⤵
  PID:3692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1644,14438618975794918178,15263191923307524898,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2844 /prefetch:1
  2⤵
  PID:4288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1644,14438618975794918178,15263191923307524898,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2836 /prefetch:1
  2⤵
  PID:4716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1644,14438618975794918178,15263191923307524898,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2260 /prefetch:8
  2⤵
  PID:712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1644,14438618975794918178,15263191923307524898,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3932 /prefetch:1
  2⤵
  PID:4224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1644,14438618975794918178,15263191923307524898,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4516 /prefetch:8
  2⤵
  PID:2268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1644,14438618975794918178,15263191923307524898,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4660 /prefetch:8
  2⤵
  PID:2660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1644,14438618975794918178,15263191923307524898,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4652 /prefetch:8
  2⤵
  PID:736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1644,14438618975794918178,15263191923307524898,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4560 /prefetch:8
  2⤵
  PID:540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1644,14438618975794918178,15263191923307524898,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5076 /prefetch:8
  2⤵
  PID:548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1644,14438618975794918178,15263191923307524898,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5332 /prefetch:8
  2⤵
  PID:1472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1644,14438618975794918178,15263191923307524898,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5228 /prefetch:8
  2⤵
  PID:2308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1644,14438618975794918178,15263191923307524898,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5212 /prefetch:8
  2⤵
  PID:4300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1644,14438618975794918178,15263191923307524898,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5264 /prefetch:8
  2⤵
  PID:380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1644,14438618975794918178,15263191923307524898,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:1
  2⤵
  PID:1104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1644,14438618975794918178,15263191923307524898,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5784 /prefetch:8
  2⤵
  PID:1540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1644,14438618975794918178,15263191923307524898,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5828 /prefetch:1
  2⤵
  PID:4532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1644,14438618975794918178,15263191923307524898,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1540 /prefetch:8
  2⤵
  PID:4080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1644,14438618975794918178,15263191923307524898,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1540 /prefetch:1
  2⤵
  PID:3100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1644,14438618975794918178,15263191923307524898,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:1
  2⤵
  PID:4456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1644,14438618975794918178,15263191923307524898,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1608 /prefetch:1
  2⤵
  PID:1100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1644,14438618975794918178,15263191923307524898,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4952 /prefetch:8
  2⤵
  PID:2280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1644,14438618975794918178,15263191923307524898,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5492 /prefetch:8
  2⤵
  PID:3984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1644,14438618975794918178,15263191923307524898,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2684 /prefetch:8
  2⤵
  PID:3792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1644,14438618975794918178,15263191923307524898,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:1
  2⤵
  PID:396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1644,14438618975794918178,15263191923307524898,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=6028 /prefetch:8
  2⤵
  - Modifies registry class
  PID:2308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1644,14438618975794918178,15263191923307524898,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5996 /prefetch:8
  2⤵
  PID:1436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1644,14438618975794918178,15263191923307524898,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4060 /prefetch:2
  2⤵
  PID:4464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1644,14438618975794918178,15263191923307524898,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6048 /prefetch:8
  2⤵
  PID:4640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1644,14438618975794918178,15263191923307524898,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4724 /prefetch:1
  2⤵
  PID:2120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1644,14438618975794918178,15263191923307524898,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5816 /prefetch:1
  2⤵
  PID:912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1644,14438618975794918178,15263191923307524898,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5996 /prefetch:8
  2⤵
  PID:3276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1644,14438618975794918178,15263191923307524898,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
  2⤵
  PID:3172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1644,14438618975794918178,15263191923307524898,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5720 /prefetch:8
  2⤵
  PID:2040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1644,14438618975794918178,15263191923307524898,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3176 /prefetch:8
  2⤵
  PID:700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1644,14438618975794918178,15263191923307524898,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4724 /prefetch:1
  2⤵
  PID:2276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1644,14438618975794918178,15263191923307524898,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6196 /prefetch:1
  2⤵
  PID:2308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1644,14438618975794918178,15263191923307524898,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6288 /prefetch:8
  2⤵
  PID:460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1644,14438618975794918178,15263191923307524898,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6044 /prefetch:8
  2⤵
  PID:1120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1644,14438618975794918178,15263191923307524898,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6300 /prefetch:8
  2⤵
  PID:2620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1644,14438618975794918178,15263191923307524898,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2864 /prefetch:8
  2⤵
  PID:4508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1644,14438618975794918178,15263191923307524898,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5752 /prefetch:1
  2⤵
  PID:1920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1644,14438618975794918178,15263191923307524898,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6128 /prefetch:1
  2⤵
  PID:4752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1644,14438618975794918178,15263191923307524898,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6308 /prefetch:1
  2⤵
  PID:2480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1644,14438618975794918178,15263191923307524898,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6012 /prefetch:8
  2⤵
  PID:2900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1644,14438618975794918178,15263191923307524898,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6656 /prefetch:8
  2⤵
  PID:3156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1644,14438618975794918178,15263191923307524898,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:5004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1644,14438618975794918178,15263191923307524898,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5424 /prefetch:8
  2⤵
  PID:4084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1644,14438618975794918178,15263191923307524898,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6740 /prefetch:8
  2⤵
  PID:3172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1644,14438618975794918178,15263191923307524898,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1524 /prefetch:1
  2⤵
  PID:4072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1644,14438618975794918178,15263191923307524898,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:5032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1644,14438618975794918178,15263191923307524898,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3068 /prefetch:8
  2⤵
  PID:644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1644,14438618975794918178,15263191923307524898,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3764 /prefetch:1
  2⤵
  PID:3172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1644,14438618975794918178,15263191923307524898,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6732 /prefetch:8
  2⤵
  PID:880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1644,14438618975794918178,15263191923307524898,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5528 /prefetch:8
  2⤵
  PID:4532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1644,14438618975794918178,15263191923307524898,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1556 /prefetch:8
  2⤵
  PID:5076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1644,14438618975794918178,15263191923307524898,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6624 /prefetch:8
  2⤵
  PID:3892

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:640

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x414 0x4a0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4036

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1044

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\" -an -ai#7zMap26320:86:7zEvent1813
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2744

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\" -an -ai#7zMap4279:80:7zEvent10561
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1888

C:\Users\Admin\Desktop\Sеtup.exe
"C:\Users\Admin\Desktop\Sеtup.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1500
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  PID:3996

C:\Users\Admin\Desktop\Sеtup.exe
"C:\Users\Admin\Desktop\Sеtup.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4356
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  PID:3336

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

T1064

Web Service

T1102

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Filesize
40B

MD5
a3a937930c5b01ecd542f094135aa0a4

SHA1
79234b7656f2a562129f98b27bc0762dc867d7fa

SHA256
985145fe40ae859f59ca7f31f100fe1a194f21810f50f5fd26c4c73c25b03ff9

SHA512
7fa94881f580973ffe4c6b67b811d47e7c104681b1fb8b36c6754ca0d29e731e89c252a9ea62e1888edf2eb3ffc8aa9f6462ed78f61c9683ddbe0d3f50f7ca41

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\data_0

Filesize
44KB

MD5
c08d957c27ff5955d03d3e9c409f6eb3

SHA1
adaa416ed21ec35f594968a7a16d49c5e3029760

SHA256
6d6afa25e9a50d03df06e6fdcb68b1f02bca8d5986222540b1edf73b929477db

SHA512
85d8eba053b3fd1c0488f90dcd9b2a7aeb4bae1e7b97cabed2524d48e9a51dfc84a50a18462be89e605bdc0d0f70ae9f7c8c01497ef6fc1c334d352aa24c311b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\data_1

Filesize
264KB

MD5
9c7a1edab792f19256be659eb64eda93

SHA1
b2dfb5662eb21e31f5f1a5e9435b632c2f0af75f

SHA256
8de1c806b74f238425b3849e904fe505b8370bc1255f1faafbe552c7d79fdcc7

SHA512
b8dc23c9532c93c81ed1a8135e3e5ffb42daf67f3f9c044bd0a883b15db5f5793de6e050a9d0ca3f90af8e393cc7fb324e41cf0de98dd7bbd9cea5fe2152e4e5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\data_2

Filesize
1.0MB

MD5
1bc11654d0c04f5b7d78f8a8abdebdfa

SHA1
95ef1c69c7b197f4cf9150afaa0cd21e8df4697a

SHA256
9961df1d95f3365ff952d700d3c4f7765c8754c68d8f94bccdfdc8bbe86699b0

SHA512
dc7d14aef57550155c374c1bf30ffbd4636c39acd9a80001021922445dbbb70fdd2bd64f199fcc40e2a3e99d49c50525432b697069b2ea28770a45672641acf0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\data_3

Filesize
4.0MB

MD5
aaff0ab6d8e273c0c9311c84b6e4b834

SHA1
4e0b02a773fb08dd302b37e491e5ef8e565997a4

SHA256
1dbda7c59f0c1825a7f912952797c6cfd10f01315dedc4c83921d6e200c38d4e

SHA512
5620d8f4d71c915770ad75050d56e657bcf576475871594c926e3d28c8fe8b5e5595681a0211df794ad3efcedf0e538b8aca420c73c04112f61d4ccfc137082c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
a97d97b72ec4000615038cb1518c88e6

SHA1
6516892f8b338a2fbbb108cc134705244371210d

SHA256
aacecf7f7cb4e21fb65bb2acbd4127624402b82209c9803c35c97476a9ce03b0

SHA512
0c06c635fe056d8edc2acc9f83cf7c9f1a5f9d5f02cd10e923ba5a0b669d67ed0a1f19f4ed47d13986b7e7e1be409fc257b135ba391fb429852e04aa7622adc1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cookies

Filesize
20KB

MD5
055c8c5c47424f3c2e7a6fc2ee904032

SHA1
5952781d22cff35d94861fac25d89a39af6d0a87

SHA256
531b3121bd59938df4933972344d936a67e75d8b1741807a8a51c898d185dd2a

SHA512
c2772893695f49cb185add62c35284779b20d45adc01184f1912613fa8b2d70c8e785f0d7cfa3bfaf1d2d58e7cdc74f4304fd973a956601927719d6d370dd57a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cookies-journal

Filesize
12KB

MD5
49a34673cd3e836366ffabfca97ae150

SHA1
823dc7583f129c4e5186efd1c70e1ffcae502d53

SHA256
64631568dd9d09a37b428ee3851f1f34568ee6c8542ff12924d85cffed039d34

SHA512
96850f419f05e941b9920fd33685712fb3e4ee02880f3bc1687fd89d48c2babe81a47bf15b58586d0398c3949d666d9dc596a3e7172c4aa24be241b04f8222a9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOG

Filesize
317B

MD5
e39fd06e5db481d8797c9f083974cd9c

SHA1
088d08ef7ed146a0d3e4f6852d962c86d7f9103e

SHA256
237eaec96e7769ed25389a448cc1d324b650daefe55aa7053ea51077f8067c15

SHA512
bb47da8fff8502ead8750e1d15b537e15154c39d5d39683113534ffdf1d957c952110c0f998d6ffddc31a87c88594b3d7151325fbf13594ef65e96b36d916c2d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Favicons

Filesize
20KB

MD5
40c053cfbe253998aae4bb2cc5e2a6b9

SHA1
2f1e80023bddfec951c13fa9a6e43b0b26d81941

SHA256
c398417c5191645be9a35e98f0245b0f3c1f6fcc2e003b3bae3dd7653edfcee2

SHA512
4522f5fc6dca32e1c6087a8a426ac875c20039e719fa90f2fcf2e3bcf171a4755f1a3cebcd7214ba41ef1e37b4bf304daebbbdea940d159165007f206b52f2ae

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
699d8752ec250828719cca6ca1205e7a

SHA1
a1d6f35631dbc2f70e0980820b773f00ada306fd

SHA256
164381ab8f485376c516a418005dee5362c20a1e4e59878276b86da4a86ecd07

SHA512
33e68a427dfd88fe0ddc8d306885fc2d707c57fe7258ceb098c7c9bfe1bf5e4c94ba584db0a859008af5fa915e68eef9b519fa8140599ebd7bdc6f80d27d704b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\History

Filesize
116KB

MD5
3316d595e58df5c2a7ba134475c3d6d7

SHA1
7245341b0d85be1142e172ddfef1e6bbbcf68e13

SHA256
d7d19bf466a28c68178bb03fb78b641cd1a812c41c71dcfa98fb8ef1604b7d0e

SHA512
b1d3f37959cc75902e365dfdaa6b085769b29c74944a02e3776122b35396ff888b0df18f676da43a78245156adda6353c5117203f0eb9008a90b05c60481582f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\History Provider Cache

Filesize
403B

MD5
556bd55e6b266fa8192c9a46340a0526

SHA1
e83c5d506726573ad54c2b7577ff633e85347531

SHA256
a76a0c1c92f881abe33876ecf65bb44c532452f85c2f6aeef2de92e851e3b036

SHA512
95de3fe730e469cf804405a0a8278caa6907298f1ccc16f691611ab8b8450cbd669b161203955e95748e61c17b1786923a7685c142d36b9772612737f13040d8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG

Filesize
329B

MD5
94a67b48d955c30cbfb3fdf67170926c

SHA1
54695750cce89e408cd8e6a21e883fe56752d788

SHA256
a4b04a5240f13dff2342578d5e542759ae97995a73ac49180ef18817f0aa86de

SHA512
9c60bf3f40bf71baa1fc1428d7674bc66370b244d1851029dace8c6d0bbe4dc16ac3644bdf6684fb9fb61c9cb48e4f5458b3bc140957382399a5ae6101ad4c37

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Platform Notifications\LOG

Filesize
331B

MD5
75dd844117e4e25b8a8b95590b820560

SHA1
c287e9e3c5959620dabbc970019169c508d53006

SHA256
4933c8c1b178ca42339e179ff39f538796c999262e6a0c0c7786b5510a48cb5e

SHA512
19b04138ad4a8c60776fab7acb2a7c40d1617bdabff4227990829b9da75c0de78e0a423ec5adfd1c9e9e361fd97a6d76a7319be9b70b6fd5fc052f841564652e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
86322537612ada9f24a544270eb99387

SHA1
e3137a6e44ecef46bd15681fd23c8713e3e5a67f

SHA256
54975fb87f7f131524c371cd9f83c301d447b7483a3a1a741f4fa6ffbc54fddb

SHA512
0e1336cb1459b222d927d5e4e4b05a7f97f3989048e0e86afb73f612d1e72d27bc2f2390269a1ece7e39499c3a52a6262077cd672fb6baeac9a517e57da934cd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferredApps

Filesize
33B

MD5
2b432fef211c69c745aca86de4f8e4ab

SHA1
4b92da8d4c0188cf2409500adcd2200444a82fcc

SHA256
42b55d126d1e640b1ed7a6bdcb9a46c81df461fa7e131f4f8c7108c2c61c14de

SHA512
948502de4dc89a7e9d2e1660451fcd0f44fd3816072924a44f145d821d0363233cc92a377dba3a0a9f849e3c17b1893070025c369c8120083a622d025fe1eacf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Reporting and NEL

Filesize
36KB

MD5
4e36423b6bab134a52a28ee876185787

SHA1
1ac4f03f0742cbe5d57d78f69ed193967a64e23f

SHA256
0d5b354244126447c6a86fa87ee0f32f8bb6b2660d69a452c1f3598dd769f76a

SHA512
f7a50af712597fc924b8442a587bcd2bebc4705c8a538b1c3db8f4a749ef10dc6c2b5cb5c69a4c64fb54bdf0743f4cfa6d913fb1e1963c9adf76f7f6813c0523

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Reporting and NEL-journal

Filesize
20KB

MD5
2f750ca9ce34d8cda340f4ae5a3eae17

SHA1
8a48aece09b300eae54557eef42e2c0e29a5d085

SHA256
fbc270f2a8650a9373f50fad0eda838f666c8bee90c06f86c1a3aeb59c5a4007

SHA512
e45f3e1acd6e7fdb5fd51b202cddc5884aa6f9148a14d5fe5a5628d25ad14a5f46aff61c6197f984d7e1c8cd50ce26ec053e4625561e95bee3dbad5dbd9b244b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
914370a703d7204f3fcd91736bd92299

SHA1
bcfffbb17470c24b187421e4ef1943f1b6b5ba5f

SHA256
326cceab330ed823b58ed593022272b0ff4cb05aa886f4352260bc60bcdd00a8

SHA512
85c07d60d7d45f117ddffb0d300cf5d55c423f11770e7e5cb7523ad09c8bb56a4a6dbd9f7d035366f18401f64af204ffe20f22f94434531a54d3058301c0cc6a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\000003.log

Filesize
232B

MD5
8a30a1fdd0459d9ea8b1e78a8e636856

SHA1
9d7225e97f9cfcfb225cfbfd0b0bba21d4efdd20

SHA256
88fe1d31608930f2738d102d45c75dc77acdf01a1b69bfb7e7c0281575b75e33

SHA512
b529bce870cd8165bf82f3ebf94f07552467bd0993b9d35145182e54e26fb2ae8e7bb167d88267b632757e2146f27dfddf8867db0c66e5dcc306db12ec6b7bef

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\LOG

Filesize
317B

MD5
7601e06223686b3f95c683ae01a5be48

SHA1
4ed3666bbe5efc1b24ead62ad0e41307f4f6a90a

SHA256
fc3df9cb56cfcfa8014e12e2a0e7196ec3854569d10e801de55e257594ea348c

SHA512
737eeb02252abf7da431ebc7c83c4dd669171bf4e05d7d6df6f40842d944b609faa9d18c2e51e006761eb69eeb736b75b0ccea9e3d0e250c34694469d8f35788

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sessions\Tabs_13314635356793392

Filesize
2KB

MD5
b0dbe0ee1c84fcb5c50b9276bbe2cdf1

SHA1
6c269349dec26ce43ad9fe25ce3e77467c2e73c2

SHA256
0e21761684c85c4bb33bdd85248b766158e8c3c90d77e08a50ea16382254d1da

SHA512
fd441eab94176f19fa00ded93f4215e5750cc7d3f238a7c8f0f333f0c699714d07dfb4f4b76074764281114a5d74004a378b7e48d5cb5d8c234ea36ef6b189a7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shortcuts

Filesize
20KB

MD5
8be985ece811ba0a3f10087f5f4e6fd4

SHA1
c87c84d4fe182ffb8362f3cabd33349af94e9b55

SHA256
da78d36c765d3248b1a72ead5f83b7a58cba7d361f17a6831332ee994cee939a

SHA512
901932baea8712e89188cfce00a6b2388ba38697bcbfeebcf8b83b88b0cb26c7323b098ba6983c312ded1041f6e297412010113a32e99a9350aa4492ca40efa9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000003.log

Filesize
112B

MD5
3846f52cc105775c1d0d5dcd94de6440

SHA1
cb2ca93f6fa2cf0a6c808a827617714908b6e520

SHA256
e45fdbcf8164325850a3a8133cb359de0082596800153740615a145e23e8358a

SHA512
a8f9d3f989a84b3e2b4ccd5282095f57a4c354f1461c9f778bee13dfb72f479cd54089ee575410e21bdf2bd8dd818a4f631f4522b11dc0faa5e413b38d014fec

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG

Filesize
345B

MD5
9360ea059b8607b97e0a4d9328bf9d8c

SHA1
4156a429b705f76b5505d9f92c0549cfcc7aea3a

SHA256
6f47cd12c7ef68697e31452bbbe292376bd667bb2d8be21530a1f4817e97dcf0

SHA512
67ab2e660cde7c5beb6c6c28498d4495a7f443de02c3ae413e416796f41a1d150e5b4de2d394b74b825a691d339d148c64dd152fc058d3786b9b206ecc2603c9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000003.log

Filesize
160B

MD5
de92ad90be6d3364745b2f73f4c3cf73

SHA1
9158681463bd30e5af4dda4baac81f93cedbda77

SHA256
0025a3e0d3b834401b3b5f820e1991ef7e810d9a4b8b6b579e6301c94e7031a0

SHA512
9e81cefc195439439f4b23ee7696309d7bc3c08e5b444d2abde26d2f12b2d3bcfd124fb9a2d40c6389e9f787741676fad366a2e9982674e7b931028c014d8a79

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG

Filesize
321B

MD5
3d68a15e47eac8ef0c888aee6089b5b1

SHA1
b430d7ad23f53538092fc157e3692ba811fc6e4e

SHA256
64b9d861bb1b9b67f4a7583419d4beb6d44654325d45e2a43fcbb4739c0f87e2

SHA512
a7e1adb4f8b07496300a049d4553c5c3e67a268b992fb47c98146e4f89e06124778a5f95b900f887ae2d3b0f2dd159ee84ce621ff929d6b10c1cdf556ec324c6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\TransportSecurity

Filesize
538B

MD5
f522eb065fbbd495c32c501510f8b7b4

SHA1
eb78eae6384c1b9ba0816c06b938ac51a1cdf763

SHA256
f07cb8785b0bbcf4ab096fb0cf1689ff8674e2943153a0e3fff76c53193874f4

SHA512
dc0170f6e2c2bcea1dc32491aa4d0317976d37f478b9bc9234f247533b107d52a955c463aaac753e6a441cda0afe3e0f27871a7c8ce987fa869405fa902b007f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Visited Links

Filesize
128KB

MD5
1db36fcb70f82c8722a767517d6991fd

SHA1
1041710d3e49cc588fb2bd0b9697dc4734d0237a

SHA256
a7a31427f6dc8e7d97a411a413274780722854545d92d8bdb1834c4b8cf36836

SHA512
cbe3ddc0ed71dda7091d8e7522cefa7e99cb919d4d83874851d86870e5c7bb64a3103a718ae087055f0327e9fcca11a29a0d087e8fb6b317c38cacb8ff47e429

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\LOG

Filesize
44B

MD5
34fbdd0678091c0135827a7fd628f977

SHA1
29c80739197cc3d251324e817e59d6f244482ad8

SHA256
34f548a89cbf2bb34594da6aea57bc4e4638f6fb722db23d766fdc16e49d78c5

SHA512
90cfca633b2eae970d1553648829a39890d6db21a69d2602ec4a46a97e24c328b3439456f9b098d7ccaf32576712ead03310d5d9b114c42c88ee122e1ec9a84a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\MANIFEST-000002

Filesize
50B

MD5
22bf0e81636b1b45051b138f48b3d148

SHA1
56755d203579ab356e5620ce7e85519ad69d614a

SHA256
e292f241daafc3df90f3e2d339c61c6e2787a0d0739aac764e1ea9bb8544ee97

SHA512
a4cf1f5c74e0df85dda8750be9070e24e19b8be15c6f22f0c234ef8423ef9ca3db22ba9ef777d64c33e8fd49fada6fcca26c1a14ba18e8472370533a1c65d8d0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\heavy_ad_intervention_opt_out.db

Filesize
16KB

MD5
9a8e0fb6cf4941534771c38bb54a76be

SHA1
92d45ac2cc921f6733e68b454dc171426ec43c1c

SHA256
9ee9211a57c3f6fa211fe0323fa8cd521e7cbffcd8ff0896645a45795dc472be

SHA512
12ed22537dcc79d53f6c7d39e92a38f8fea076d793198928f5b7a5dd1234d50a3c0b4815632f3fadf8bc4ef0499773d22bd83f961d2d0ffd8afacf471bd3a5ae

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\previews_opt_out.db

Filesize
16KB

MD5
d926f072b41774f50da6b28384e0fed1

SHA1
237dfa5fa72af61f8c38a1e46618a4de59bd6f10

SHA256
4f7b0e525d4bfc53d5df49589e25a0bccf2fcf6a1a0ca3f94d3285bb9cf0a249

SHA512
a140df6ec0d3099ef374e8f3ece09bf91bc896ac4a1d251799a521543fe9bdea796ba09fa47932bd54fa939118495078f9258557b32c31d3d4011b0666a4723f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\GPUCache\data_1

Filesize
264KB

MD5
bf7f341ff815bc6b3451a3197184ef33

SHA1
592c457d5604bf1e2d2b64e50e516d7bc9b0865f

SHA256
4db1a6f80ce71e657f1ad2c00d62771b7481bf60a803091d87d7cf588fddaac5

SHA512
fac68c65079ae51a460333400280ed9fd96aa423c5bb48c9e4c21874df05d7ac443def15002f08076b7c70345c534282c35fd1479699ad7c800aaef9fc98e957

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version

Filesize
13B

MD5
b63048c4e7e52c52053d25da30d9c5ab

SHA1
679a44d402f5ec24605719e06459f5a707989187

SHA256
389caa40ea458e84bc624a9af1e0dec60fa652b2db2b81c09b1dfe22822cc3d1

SHA512
e86c58c5a25e24f21ad79ed526a90c120a09c115f4820663bd2ebbc59e7bb1c4c418267eb77645522aa20b2c1b53fba8e31690db7bae9b21e4eff3db06316359

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
106KB

MD5
895a592f5b039107df573e0b2b478066

SHA1
ca309d6076be34cb207098ef20567effc9678c90

SHA256
3e186a86068eb9d1d23ac8989263fdc42fc55043020631b595d10aa64635bf6c

SHA512
3e708d14647a3b35e732ca2bf562e4c28db01b48502ccc61178d30e18b7c5c0d4a231d736d298de11c958b3f33435ff3247c169c038eae51a8a55460c14d7bb5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
53a11cfef82fd57e01f287e2358f060e

SHA1
fd034cfe62f70bca6574a119ed5d2d060ea80bf9

SHA256
73d1de4dcd8bc7fa2321e363a155f78c90c37d4fc05baa7360397cac5e93e6b8

SHA512
be422b8b84930c398364dc81a80f8834cd4ff0fb261f3cb5d539eb23d66a34736aa54521ae0b58634e7e40804aaff69a6970decc0a5888f2c8deb06d5608e968

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\chrome_shutdown_ms.txt

Filesize
6B

MD5
c48489b973eccb217f9072e4d881e638

SHA1
b4bed6e27b53d613b5aeabf3e77d3f944c307365

SHA256
c4a97b26b0e5ea4686d3fdd37be2141010aba5aa8ba6a0d083a810b06566078c

SHA512
5b5a0c05ce041239e4ec1f33b5b23478f572e1a0fe62062ab15ce24167a0b8ed34f7748302278ca42bc9dc5b906f01913821187b4a8f2fc22ab1246650521bab

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.acl

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
memory/3336-188-0x0000000000C30000-0x0000000000C58000-memory.dmp

Filesize
160KB

Download
memory/3996-178-0x0000000000970000-0x0000000000998000-memory.dmp

Filesize
160KB

Download
memory/3996-184-0x0000000005330000-0x000000000543A000-memory.dmp

Filesize
1.0MB

Download
memory/3996-185-0x0000000005260000-0x0000000005272000-memory.dmp

Filesize
72KB

Download
memory/3996-186-0x00000000052C0000-0x00000000052FC000-memory.dmp

Filesize
240KB

Download
memory/3996-183-0x00000000057E0000-0x0000000005DF8000-memory.dmp

Filesize
6.1MB

Download