play | 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55

max time kernel
1096s
max time network
1202s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07/02/2023, 04:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PLAY.mal_.exe
Size 178KB
Sample230207-e28dlshd37
SHA256 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55
MD5 223eff1610b432a1f1aa06c60bd7b9a6
SHA1 14177730443c65aefeeda3162b324fdedf9cf9e0
SHA512 cf8b097e4d8dae444c4759a6588bcc5769694d34675f17fed5ee6d0b7aa52ed44263b0cc73f4ff422182a01ad8d69b18a71110c4fc4e9dd2233e9cfe833cbd36
SSDEEP 3072:Yrl2uRkddO+iR7OZOQ+dzeIP9mwUGU3l2bxW1/9JnOC/fhKJ2hXh3lmG:22uyqOh2g8U12K9dtEWx17
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

play ransomware spyware stealer

Malware Config

Signatures

PLAY Ransomware, PlayCrypt
Ransomware family first seen in mid 2022.
ransomware play

Modifies extensions of user files 15 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

description	ioc	Process
File opened for modification	C:\Users\Admin\Pictures\RenameHide.png.PLAY	PLAY.mal_.exe
File renamed	C:\Users\Admin\Pictures\UnregisterSend.raw => C:\Users\Admin\Pictures\UnregisterSend.raw.PLAY	PLAY.mal_.exe
File opened for modification	C:\Users\Admin\Pictures\BackupWait.tiff.PLAY	PLAY.mal_.exe
File opened for modification	C:\Users\Admin\Pictures\ClosePop.tif.PLAY	PLAY.mal_.exe
File opened for modification	C:\Users\Admin\Pictures\CompleteMount.tif.PLAY	PLAY.mal_.exe
File opened for modification	C:\Users\Admin\Pictures\InvokeSync.raw.PLAY	PLAY.mal_.exe
File renamed	C:\Users\Admin\Pictures\ClosePop.tif => C:\Users\Admin\Pictures\ClosePop.tif.PLAY	PLAY.mal_.exe
File renamed	C:\Users\Admin\Pictures\CompleteMount.tif => C:\Users\Admin\Pictures\CompleteMount.tif.PLAY	PLAY.mal_.exe
File renamed	C:\Users\Admin\Pictures\RenameHide.png => C:\Users\Admin\Pictures\RenameHide.png.PLAY	PLAY.mal_.exe
File opened for modification	C:\Users\Admin\Pictures\DismountAssert.raw.PLAY	PLAY.mal_.exe
File opened for modification	C:\Users\Admin\Pictures\UnregisterSend.raw.PLAY	PLAY.mal_.exe
File renamed	C:\Users\Admin\Pictures\InvokeSync.raw => C:\Users\Admin\Pictures\InvokeSync.raw.PLAY	PLAY.mal_.exe
File opened for modification	C:\Users\Admin\Pictures\BackupWait.tiff	PLAY.mal_.exe
File renamed	C:\Users\Admin\Pictures\BackupWait.tiff => C:\Users\Admin\Pictures\BackupWait.tiff.PLAY	PLAY.mal_.exe
File renamed	C:\Users\Admin\Pictures\DismountAssert.raw => C:\Users\Admin\Pictures\DismountAssert.raw.PLAY	PLAY.mal_.exe

Executes dropped EXE 1 IoCs

pid	Process
41208	ChromeRecovery.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Drops desktop.ini file(s) 39 IoCs

description	ioc	Process
File opened for modification	C:\Users\Public\Pictures\Sample Pictures\desktop.ini	PLAY.mal_.exe
File opened for modification	C:\Program Files\Microsoft Games\FreeCell\desktop.ini	PLAY.mal_.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	PLAY.mal_.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	PLAY.mal_.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	PLAY.mal_.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	PLAY.mal_.exe
File opened for modification	C:\Users\Public\Music\Sample Music\desktop.ini	PLAY.mal_.exe
File opened for modification	C:\Users\Public\Recorded TV\desktop.ini	PLAY.mal_.exe
File opened for modification	C:\Users\Public\Videos\Sample Videos\desktop.ini	PLAY.mal_.exe
File opened for modification	C:\Program Files\Microsoft Games\Chess\desktop.ini	PLAY.mal_.exe
File opened for modification	C:\Program Files\Microsoft Games\Mahjong\desktop.ini	PLAY.mal_.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	PLAY.mal_.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	PLAY.mal_.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	PLAY.mal_.exe
File opened for modification	C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini	PLAY.mal_.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	PLAY.mal_.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	PLAY.mal_.exe
File opened for modification	C:\Users\Public\desktop.ini	PLAY.mal_.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	PLAY.mal_.exe
File opened for modification	C:\Program Files\desktop.ini	PLAY.mal_.exe
File opened for modification	C:\Program Files\Microsoft Games\Purble Place\desktop.ini	PLAY.mal_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini	PLAY.mal_.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	PLAY.mal_.exe
File opened for modification	C:\Users\Admin\Favorites\Links for United States\desktop.ini	PLAY.mal_.exe
File opened for modification	C:\Program Files\Microsoft Games\Solitaire\desktop.ini	PLAY.mal_.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	PLAY.mal_.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	PLAY.mal_.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini	PLAY.mal_.exe
File opened for modification	C:\Program Files\Microsoft Games\Hearts\desktop.ini	PLAY.mal_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI	PLAY.mal_.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	PLAY.mal_.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	PLAY.mal_.exe
File opened for modification	C:\$Recycle.Bin\S-1-5-21-2292972927-2705560509-2768824231-1000\desktop.ini	PLAY.mal_.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	PLAY.mal_.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	PLAY.mal_.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	PLAY.mal_.exe
File opened for modification	C:\Program Files (x86)\desktop.ini	PLAY.mal_.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	PLAY.mal_.exe
File opened for modification	C:\Users\Public\Recorded TV\Sample Media\desktop.ini	PLAY.mal_.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	PLAY.mal_.exe
File opened (read-only)	\??\E:	PLAY.mal_.exe
File opened (read-only)	\??\H:	PLAY.mal_.exe
File opened (read-only)	\??\M:	PLAY.mal_.exe
File opened (read-only)	\??\N:	PLAY.mal_.exe
File opened (read-only)	\??\U:	PLAY.mal_.exe
File opened (read-only)	\??\X:	PLAY.mal_.exe
File opened (read-only)	\??\G:	PLAY.mal_.exe
File opened (read-only)	\??\K:	PLAY.mal_.exe
File opened (read-only)	\??\L:	PLAY.mal_.exe
File opened (read-only)	\??\Q:	PLAY.mal_.exe
File opened (read-only)	\??\T:	PLAY.mal_.exe
File opened (read-only)	\??\Z:	PLAY.mal_.exe
File opened (read-only)	\??\F:	PLAY.mal_.exe
File opened (read-only)	\??\I:	PLAY.mal_.exe
File opened (read-only)	\??\J:	PLAY.mal_.exe
File opened (read-only)	\??\O:	PLAY.mal_.exe
File opened (read-only)	\??\R:	PLAY.mal_.exe
File opened (read-only)	\??\V:	PLAY.mal_.exe
File opened (read-only)	\??\A:	PLAY.mal_.exe
File opened (read-only)	\??\P:	PLAY.mal_.exe
File opened (read-only)	\??\S:	PLAY.mal_.exe
File opened (read-only)	\??\W:	PLAY.mal_.exe
File opened (read-only)	\??\Y:	PLAY.mal_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\index.gif.PLAY	PLAY.mal_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\AIR98.POC.PLAY	PLAY.mal_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH01875_.WMF	PLAY.mal_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH00636_.WMF	PLAY.mal_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Yekaterinburg.PLAY	PLAY.mal_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-search_ja.jar	PLAY.mal_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-tools.jar.PLAY	PLAY.mal_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\DESIGNER.ONE.PLAY	PLAY.mal_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jetty.security_8.1.14.v20131031.jar.PLAY	PLAY.mal_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_MoveDrop32x32.gif	PLAY.mal_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00163_.GIF	PLAY.mal_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Lime\TAB_ON.GIF	PLAY.mal_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\jfluid-server.jar.PLAY	PLAY.mal_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\SETUP.XML.PLAY	PLAY.mal_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\PROOF\MSWDS_FR.LEX.PLAY	PLAY.mal_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\ViewHeaderPreview.jpg.PLAY	PLAY.mal_.exe
File opened for modification	C:\Program Files\DVD Maker\de-DE\DVDMaker.exe.mui	PLAY.mal_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\BG_ADOBE.GIF.PLAY	PLAY.mal_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105520.WMF	PLAY.mal_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382958.JPG.PLAY	PLAY.mal_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099204.WMF	PLAY.mal_.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Pacific\Chatham	PLAY.mal_.exe
File opened for modification	C:\Program Files\Windows Journal\ja-JP\jnwdui.dll.mui	PLAY.mal_.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\en-US\ImagingDevices.exe.mui	PLAY.mal_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\diner_dot.png	PLAY.mal_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\WINWORD.DEV_COL.HXC.PLAY	PLAY.mal_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\ONMAIN.DLL.PLAY	PLAY.mal_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\launcher.win32.win32.x86_64.properties	PLAY.mal_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\css\picturePuzzle.css	PLAY.mal_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\toc.gif.PLAY	PLAY.mal_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-host.xml.PLAY	PLAY.mal_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\MSO0127.ACL	PLAY.mal_.exe
File opened for modification	C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME-JAVAFX.txt	PLAY.mal_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02435_.WMF	PLAY.mal_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\19.png	PLAY.mal_.exe
File opened for modification	C:\Program Files\7-Zip\Lang\th.txt.PLAY	PLAY.mal_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Indianapolis.PLAY	PLAY.mal_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOICONS.EXE.PLAY	PLAY.mal_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-nodes.xml	PLAY.mal_.exe
File opened for modification	C:\Program Files (x86)\Common Files\System\msadc\ja-JP\msadcor.dll.mui	PLAY.mal_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGCINFO.XML	PLAY.mal_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0387895.JPG.PLAY	PLAY.mal_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\EXCEL.DEV.HXS.PLAY	PLAY.mal_.exe
File opened for modification	C:\Program Files\Java\jre7\lib\cmm\sRGB.pf	PLAY.mal_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PROOF\MSHY7EN.DLL	PLAY.mal_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.sdk.nl_zh_4.4.0.v20140623020002.jar.PLAY	PLAY.mal_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\MSPUB.HXS.PLAY	PLAY.mal_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Country.gif.PLAY	PLAY.mal_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Newsprint.xml	PLAY.mal_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_default_win7.css	PLAY.mal_.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Mexico_City	PLAY.mal_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02810J.JPG	PLAY.mal_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_222222_256x240.png.PLAY	PLAY.mal_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0304933.WMF.PLAY	PLAY.mal_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14756_.GIF.PLAY	PLAY.mal_.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationLeft_ButtonGraphic.png	PLAY.mal_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\POSTCD98.POC.PLAY	PLAY.mal_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0186002.WMF.PLAY	PLAY.mal_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Nome.PLAY	PLAY.mal_.exe
File opened for modification	C:\Program Files\Microsoft Games\Purble Place\fr-FR\PurblePlace.exe.mui.PLAY	PLAY.mal_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\bg_OliveGreen.gif.PLAY	PLAY.mal_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Windhoek	PLAY.mal_.exe
File opened for modification	C:\Program Files\Windows Media Player\ja-JP\wmlaunch.exe.mui	PLAY.mal_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ESEN\MSB1ESEN.ITS	PLAY.mal_.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
2204	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
73624	chrome.exe
73624	chrome.exe
73624	chrome.exe
73624	chrome.exe
73624	chrome.exe
50316	chrome.exe
50316	chrome.exe
50316	chrome.exe
50316	chrome.exe
50316	chrome.exe
73444	chrome.exe
73444	chrome.exe
73444	chrome.exe
73444	chrome.exe
73444	chrome.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	71764	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	71764	AUDIODG.EXE
Token: 33	71764	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	71764	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1968 wrote to memory of 1732	1968	chrome.exe	29
PID 1968 wrote to memory of 1732	1968	chrome.exe	29
PID 1968 wrote to memory of 1732	1968	chrome.exe	29
PID 1968 wrote to memory of 2148	1968	chrome.exe	30
PID 1968 wrote to memory of 2148	1968	chrome.exe	30
PID 1968 wrote to memory of 2148	1968	chrome.exe	30
PID 1968 wrote to memory of 2148	1968	chrome.exe	30
PID 1968 wrote to memory of 2148	1968	chrome.exe	30
PID 1968 wrote to memory of 2148	1968	chrome.exe	30
PID 1968 wrote to memory of 2148	1968	chrome.exe	30
PID 1968 wrote to memory of 2148	1968	chrome.exe	30
PID 1968 wrote to memory of 2148	1968	chrome.exe	30
PID 1968 wrote to memory of 2148	1968	chrome.exe	30
PID 1968 wrote to memory of 2148	1968	chrome.exe	30
PID 1968 wrote to memory of 2148	1968	chrome.exe	30
PID 1968 wrote to memory of 2148	1968	chrome.exe	30
PID 1968 wrote to memory of 2148	1968	chrome.exe	30
PID 1968 wrote to memory of 2148	1968	chrome.exe	30
PID 1968 wrote to memory of 2148	1968	chrome.exe	30
PID 1968 wrote to memory of 2148	1968	chrome.exe	30
PID 1968 wrote to memory of 2148	1968	chrome.exe	30
PID 1968 wrote to memory of 2148	1968	chrome.exe	30
PID 1968 wrote to memory of 2148	1968	chrome.exe	30
PID 1968 wrote to memory of 2148	1968	chrome.exe	30
PID 1968 wrote to memory of 2148	1968	chrome.exe	30
PID 1968 wrote to memory of 2148	1968	chrome.exe	30
PID 1968 wrote to memory of 2148	1968	chrome.exe	30
PID 1968 wrote to memory of 2148	1968	chrome.exe	30
PID 1968 wrote to memory of 2148	1968	chrome.exe	30
PID 1968 wrote to memory of 2148	1968	chrome.exe	30
PID 1968 wrote to memory of 2148	1968	chrome.exe	30
PID 1968 wrote to memory of 2148	1968	chrome.exe	30
PID 1968 wrote to memory of 2148	1968	chrome.exe	30
PID 1968 wrote to memory of 2148	1968	chrome.exe	30
PID 1968 wrote to memory of 2148	1968	chrome.exe	30
PID 1968 wrote to memory of 2148	1968	chrome.exe	30
PID 1968 wrote to memory of 2148	1968	chrome.exe	30
PID 1968 wrote to memory of 2148	1968	chrome.exe	30
PID 1968 wrote to memory of 2148	1968	chrome.exe	30
PID 1968 wrote to memory of 2148	1968	chrome.exe	30
PID 1968 wrote to memory of 2148	1968	chrome.exe	30
PID 1968 wrote to memory of 2148	1968	chrome.exe	30
PID 1968 wrote to memory of 2148	1968	chrome.exe	30
PID 1968 wrote to memory of 2148	1968	chrome.exe	30
PID 1968 wrote to memory of 2204	1968	chrome.exe	31
PID 1968 wrote to memory of 2204	1968	chrome.exe	31
PID 1968 wrote to memory of 2204	1968	chrome.exe	31
PID 1968 wrote to memory of 2452	1968	chrome.exe	32
PID 1968 wrote to memory of 2452	1968	chrome.exe	32
PID 1968 wrote to memory of 2452	1968	chrome.exe	32
PID 1968 wrote to memory of 2452	1968	chrome.exe	32
PID 1968 wrote to memory of 2452	1968	chrome.exe	32
PID 1968 wrote to memory of 2452	1968	chrome.exe	32
PID 1968 wrote to memory of 2452	1968	chrome.exe	32
PID 1968 wrote to memory of 2452	1968	chrome.exe	32
PID 1968 wrote to memory of 2452	1968	chrome.exe	32
PID 1968 wrote to memory of 2452	1968	chrome.exe	32
PID 1968 wrote to memory of 2452	1968	chrome.exe	32
PID 1968 wrote to memory of 2452	1968	chrome.exe	32
PID 1968 wrote to memory of 2452	1968	chrome.exe	32
PID 1968 wrote to memory of 2452	1968	chrome.exe	32
PID 1968 wrote to memory of 2452	1968	chrome.exe	32
PID 1968 wrote to memory of 2452	1968	chrome.exe	32
PID 1968 wrote to memory of 2452	1968	chrome.exe	32

C:\Users\Admin\AppData\Local\Temp\PLAY.mal_.exe
"C:\Users\Admin\AppData\Local\Temp\PLAY.mal_.exe"
1⤵
- Modifies extensions of user files
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
PID:2036

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6954f50,0x7fef6954f60,0x7fef6954f70
  2⤵
  PID:1732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1008,8203653087216508035,15846593419631602062,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1092 /prefetch:2
  2⤵
  PID:2148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1008,8203653087216508035,15846593419631602062,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1384 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1008,8203653087216508035,15846593419631602062,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1704 /prefetch:8
  2⤵
  PID:2452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1008,8203653087216508035,15846593419631602062,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2024 /prefetch:1
  2⤵
  PID:2688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1008,8203653087216508035,15846593419631602062,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2128 /prefetch:1
  2⤵
  PID:2704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1008,8203653087216508035,15846593419631602062,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2732 /prefetch:8
  2⤵
  PID:3936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1008,8203653087216508035,15846593419631602062,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=3268 /prefetch:2
  2⤵
  PID:9584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1008,8203653087216508035,15846593419631602062,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:10112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1008,8203653087216508035,15846593419631602062,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3520 /prefetch:8
  2⤵
  PID:10912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1008,8203653087216508035,15846593419631602062,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3716 /prefetch:8
  2⤵
  PID:11008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1008,8203653087216508035,15846593419631602062,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3848 /prefetch:8
  2⤵
  PID:13932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1008,8203653087216508035,15846593419631602062,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3856 /prefetch:8
  2⤵
  PID:13924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1008,8203653087216508035,15846593419631602062,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3892 /prefetch:8
  2⤵
  PID:13948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1008,8203653087216508035,15846593419631602062,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3896 /prefetch:8
  2⤵
  PID:13940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1008,8203653087216508035,15846593419631602062,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3980 /prefetch:8
  2⤵
  PID:13956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1008,8203653087216508035,15846593419631602062,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3988 /prefetch:8
  2⤵
  PID:13964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1008,8203653087216508035,15846593419631602062,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3872 /prefetch:8
  2⤵
  PID:13828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1008,8203653087216508035,15846593419631602062,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4168 /prefetch:1
  2⤵
  PID:15332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1008,8203653087216508035,15846593419631602062,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1724 /prefetch:1
  2⤵
  PID:32236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1008,8203653087216508035,15846593419631602062,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:34508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1008,8203653087216508035,15846593419631602062,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1232 /prefetch:1
  2⤵
  PID:34500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1008,8203653087216508035,15846593419631602062,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=772 /prefetch:8
  2⤵
  PID:44196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1008,8203653087216508035,15846593419631602062,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4584 /prefetch:1
  2⤵
  PID:46320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1008,8203653087216508035,15846593419631602062,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4580 /prefetch:1
  2⤵
  PID:45984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1008,8203653087216508035,15846593419631602062,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4752 /prefetch:1
  2⤵
  PID:46004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1008,8203653087216508035,15846593419631602062,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4988 /prefetch:1
  2⤵
  PID:46524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1008,8203653087216508035,15846593419631602062,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:1
  2⤵
  PID:48052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1008,8203653087216508035,15846593419631602062,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5324 /prefetch:1
  2⤵
  PID:48044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1008,8203653087216508035,15846593419631602062,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:1
  2⤵
  PID:48028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1008,8203653087216508035,15846593419631602062,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:1
  2⤵
  PID:48020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1008,8203653087216508035,15846593419631602062,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5752 /prefetch:1
  2⤵
  PID:54736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1008,8203653087216508035,15846593419631602062,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6172 /prefetch:1
  2⤵
  PID:58028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1008,8203653087216508035,15846593419631602062,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6164 /prefetch:1
  2⤵
  PID:58020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1008,8203653087216508035,15846593419631602062,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6136 /prefetch:1
  2⤵
  PID:58012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1008,8203653087216508035,15846593419631602062,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6092 /prefetch:1
  2⤵
  PID:58000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1008,8203653087216508035,15846593419631602062,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6644 /prefetch:1
  2⤵
  PID:59184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1008,8203653087216508035,15846593419631602062,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6652 /prefetch:1
  2⤵
  PID:59192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1008,8203653087216508035,15846593419631602062,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6664 /prefetch:1
  2⤵
  PID:59216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1008,8203653087216508035,15846593419631602062,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6676 /prefetch:1
  2⤵
  PID:59228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1008,8203653087216508035,15846593419631602062,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6684 /prefetch:1
  2⤵
  PID:59240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1008,8203653087216508035,15846593419631602062,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6940 /prefetch:1
  2⤵
  PID:59248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1008,8203653087216508035,15846593419631602062,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6948 /prefetch:1
  2⤵
  PID:59260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1008,8203653087216508035,15846593419631602062,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6184 /prefetch:1
  2⤵
  PID:59304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1008,8203653087216508035,15846593419631602062,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6732 /prefetch:1
  2⤵
  PID:59316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1008,8203653087216508035,15846593419631602062,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6084 /prefetch:1
  2⤵
  PID:59336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1008,8203653087216508035,15846593419631602062,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6744 /prefetch:1
  2⤵
  PID:59344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1008,8203653087216508035,15846593419631602062,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6956 /prefetch:1
  2⤵
  PID:59352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1008,8203653087216508035,15846593419631602062,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6964 /prefetch:1
  2⤵
  PID:59536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1008,8203653087216508035,15846593419631602062,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6972 /prefetch:1
  2⤵
  PID:59620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1008,8203653087216508035,15846593419631602062,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6980 /prefetch:1
  2⤵
  PID:60412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1008,8203653087216508035,15846593419631602062,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6988 /prefetch:1
  2⤵
  PID:60976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1008,8203653087216508035,15846593419631602062,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6996 /prefetch:1
  2⤵
  PID:61592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1008,8203653087216508035,15846593419631602062,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7004 /prefetch:1
  2⤵
  PID:61900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1008,8203653087216508035,15846593419631602062,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7012 /prefetch:1
  2⤵
  PID:61908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1008,8203653087216508035,15846593419631602062,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7020 /prefetch:1
  2⤵
  PID:61932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1008,8203653087216508035,15846593419631602062,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7028 /prefetch:1
  2⤵
  PID:61956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1008,8203653087216508035,15846593419631602062,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=58 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7036 /prefetch:1
  2⤵
  PID:62060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1008,8203653087216508035,15846593419631602062,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=59 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7044 /prefetch:1
  2⤵
  PID:62844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1008,8203653087216508035,15846593419631602062,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=60 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7312 /prefetch:1
  2⤵
  PID:62852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1008,8203653087216508035,15846593419631602062,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=61 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10408 /prefetch:1
  2⤵
  PID:62868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1008,8203653087216508035,15846593419631602062,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=62 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10416 /prefetch:1
  2⤵
  PID:63144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1008,8203653087216508035,15846593419631602062,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=63 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8936 /prefetch:1
  2⤵
  PID:63184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1008,8203653087216508035,15846593419631602062,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=64 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6196 /prefetch:1
  2⤵
  PID:63248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1008,8203653087216508035,15846593419631602062,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=65 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:1
  2⤵
  PID:66976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1008,8203653087216508035,15846593419631602062,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=66 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8328 /prefetch:1
  2⤵
  PID:67036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1008,8203653087216508035,15846593419631602062,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=67 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7340 /prefetch:1
  2⤵
  PID:67044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1008,8203653087216508035,15846593419631602062,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=68 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7324 /prefetch:1
  2⤵
  PID:67056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1008,8203653087216508035,15846593419631602062,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=69 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9656 /prefetch:1
  2⤵
  PID:67064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1008,8203653087216508035,15846593419631602062,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=70 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11532 /prefetch:1
  2⤵
  PID:71184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1008,8203653087216508035,15846593419631602062,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=71 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=14436 /prefetch:1
  2⤵
  PID:2292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1008,8203653087216508035,15846593419631602062,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=14608 /prefetch:8
  2⤵
  PID:71712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1008,8203653087216508035,15846593419631602062,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=73 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=14612 /prefetch:1
  2⤵
  PID:72708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1008,8203653087216508035,15846593419631602062,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=74 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=14788 /prefetch:1
  2⤵
  PID:73628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1008,8203653087216508035,15846593419631602062,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=75 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=14840 /prefetch:1
  2⤵
  PID:73664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1008,8203653087216508035,15846593419631602062,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=76 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2100 /prefetch:1
  2⤵
  PID:156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1008,8203653087216508035,15846593419631602062,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=77 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=15116 /prefetch:1
  2⤵
  PID:72960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1008,8203653087216508035,15846593419631602062,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=78 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=14620 /prefetch:1
  2⤵
  PID:61972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1008,8203653087216508035,15846593419631602062,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=79 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=14764 /prefetch:1
  2⤵
  PID:2076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1008,8203653087216508035,15846593419631602062,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=80 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8540 /prefetch:1
  2⤵
  PID:59180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1008,8203653087216508035,15846593419631602062,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4604 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:73624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1008,8203653087216508035,15846593419631602062,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4604 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:50316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1008,8203653087216508035,15846593419631602062,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=83 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=14892 /prefetch:1
  2⤵
  PID:73596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1008,8203653087216508035,15846593419631602062,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2444 /prefetch:8
  2⤵
  PID:73156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1008,8203653087216508035,15846593419631602062,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=15448 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:73444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1008,8203653087216508035,15846593419631602062,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=86 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=14896 /prefetch:1
  2⤵
  PID:71360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1008,8203653087216508035,15846593419631602062,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=87 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8140 /prefetch:1
  2⤵
  PID:73252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1008,8203653087216508035,15846593419631602062,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=88 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4732 /prefetch:1
  2⤵
  PID:70088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1008,8203653087216508035,15846593419631602062,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=89 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=14808 /prefetch:1
  2⤵
  PID:70060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1008,8203653087216508035,15846593419631602062,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=90 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=14760 /prefetch:1
  2⤵
  PID:71040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1008,8203653087216508035,15846593419631602062,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=14856 /prefetch:8
  2⤵
  PID:73640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1008,8203653087216508035,15846593419631602062,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=15396 /prefetch:8
  2⤵
  PID:72972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1008,8203653087216508035,15846593419631602062,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=93 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4604 /prefetch:1
  2⤵
  PID:71272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1008,8203653087216508035,15846593419631602062,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=94 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4756 /prefetch:1
  2⤵
  PID:71048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1008,8203653087216508035,15846593419631602062,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=14816 /prefetch:8
  2⤵
  PID:6984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1008,8203653087216508035,15846593419631602062,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=96 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2120 /prefetch:1
  2⤵
  PID:71800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1008,8203653087216508035,15846593419631602062,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=97 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2124 /prefetch:1
  2⤵
  PID:73672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1008,8203653087216508035,15846593419631602062,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=14804 /prefetch:8
  2⤵
  PID:1580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1008,8203653087216508035,15846593419631602062,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2660 /prefetch:8
  2⤵
  PID:70932

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2f0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:71764

C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe"
1⤵
PID:72884
- C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir72884_2059554983\ChromeRecovery.exe
  "C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir72884_2059554983\ChromeRecovery.exe" --appguid={8A69D345-D564-463c-AFF1-A69D9E530F96} --browser-version=89.0.4389.114 --sessionid={b1e002bf-27c0-46f9-ae6c-fcd3a56e2e7e} --system
  2⤵
  - Executes dropped EXE
  PID:41208

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

desktop.ini

Path C:\$Recycle.Bin\S-1-5-21-2292972927-2705560509-2768824231-1000\desktop.ini
Size 1KB
SHA256 d177bf4ad9756215f160b45e0d400024dde54548693a2a54b42212e96fcc2422
MD5 e66c6ed457f3b2164ca6a75ccd4a1ca3
SHA1 7876a34708b6ef1c0dd405dde126f9409a6f5a37
SHA512 fd722b7df18207bff0e050fb4c62f95afd4361e4497e05fc789d45e5ae7343a3e3229ef32f2582ce0885893ae1601cceb1f95674be343d0d3db9982441048bc9
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 1KB
SHA256 42c5cfd495848ee9a7c6077a71d9e627f9ae0d5da474ae9c2cae2f70c6d11e47
MD5 21d883a146a6a56dc6e3725538f4ae56
SHA1 0d07948c7540073e6114773bb5d61a59a5ec9d83
SHA512 0e628463a298efb655f398f79e1d72b8d27cb940391bdb322b5f660bd945657ca866ff53fa717f190ff4b1898f805272ba521db8b47a5a1081ffdffdba8f547b
MD5 SHA1 SHA512

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\f_000002
Size 37KB
SHA256 2008fadcd23ff33a8e899bcd2f67980e69ac296623f523d5ac8699f935e6f238
MD5 5fc37ab0623ebdea03014ca6ae9617d2
SHA1 b7248d1fae604f9bb753467cedf72e4f89a5ef18
SHA512 bed2a413e6732bee1186463d02e95285ed8fd27ece144ea0cd454e40615c96b1ef38fa1d9929e7543a53bafcb2552c08d271be0cf025892133bd9a67c2959e1e
SSDEEP 768:4y/i52WcGT6SF3FaLVJl2O79H+C9xkDtzoR3rjTPlt2/D:4eiLcc3FoVJn9H1z8gHjlt2r
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000003

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\f_000003
Size 81KB
SHA256 9750613b439918427f4dbe8769bfaa1bde5d0043ddb6b6ce3e2a27f171ba5e17
MD5 856e0191d03121df99cb397ba0650882
SHA1 f6667be295d6c100315697e47c9079794e6ef074
SHA512 faab089dacc24d250992f806fd83ffc1df7a639e4ca226a91434fe3857f414943082e3d30954b2627e0191c2fc1722429e980357638b8c738fb7bf960e9c2912
SSDEEP 1536:4bJ+zozm4LKPTrkHlkz9h/QJllSqQASKSAO5ZMF16TldwLdl:4d+zozm2YvkFk5h/CrSelSPM7AyLr
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000004

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\f_000004
Size 46KB
SHA256 7854c52285d2340c6d039e135d6e39c296171625ea9bb6549b195f951d21cab9
MD5 106d272e4ffa1320d0715d39af9453bd
SHA1 f3049db9fad87bf06431097dd2ec9f674d78c622
SHA512 ed3b63c15ef4748001ae746cd2d2a345154b6d8a63841aca7de1f7008c43686e4d1b2c4acc9b92ada9dc4e7be8b5879c141542ee380c6c55739af8879059b44a
SSDEEP 768:2LZka7Yn7CX0S5JX0biIOZP+xPUW+kTYk8Rg/8dpAvlr7UsVO93OgIs/llSBOBBf:UZuG0SLX3Ch+jk8UkANr7UsglOgD/aBW
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000005

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\f_000005
Size 38KB
SHA256 6129ca58ddef2fab491d991591ecee8ee11254d6eb2a5b91ed91932ed5ffb189
MD5 92fd6ef91e4db7374e7dd3b96ff62d51
SHA1 3af175325f04e5711642b156b397acf3f28f6270
SHA512 d5ec2d194a6a0f038c74ad7ff2848d2e2f210e93a4518f74c2067f033799eca64cdf45dce0f2f65e13ee84eada6180d1987711bd90f1feb6fd66ed3332ca9526
SSDEEP 768:K/a2SCjLLA8+cYM3rdWraN/FLMosIVZAvXrih0kkvvo2ekbbdK57:K/a2dij8IraN/Fw6DAv7o0voubdKN
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000006

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\f_000006
Size 160KB
SHA256 1fd703cb16e3f6f3f7192109d19c69d6e5ac1cfa0feb5b105a86564b7970d28a
MD5 fe98364486b3206867b17008f995646f
SHA1 35a5e9aa210970f7abd718d99e629c6982a3cc02
SHA512 4342fafba1ce77925177b9dc766b592363405f83809c3b2bcbdbd72725523dd1c722224f1030a01f2ac0d29cae8b22451020801fc6b6d5be99b8fdc8c72fb305
SSDEEP 3072:VFoh4+08cuYfj7+jD4opSGAaVdPGA0uXhr2T8zz1Jei91RZPS:VFo+Bu0qjVHNnh0uXhr2Gze4nPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000007

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\f_000007
Size 25KB
SHA256 59e4baa64ae08a9643d845d2d621bb1c6e99e8896cd830b649ea0d350f13d70d
MD5 8429dbbf2249095ca9ac9d32528d285c
SHA1 887121194108119ac62e892a6442bc73257f0922
SHA512 daa7a35e5f1c23ffece6455b3e6264f40e4f527c7d2da65c8dc7d9374700b5eedf1ed8f8c652a2a5cebf6e364400e2a87695caa4df4cba6d7cf2a232a8cf5cb9
SSDEEP 768:n9HR1oXV2WGC9isL0gsexlQuLjg/gVNeIgxn:nNfoIOjsexlQYgg8xn
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000008

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\f_000008
Size 23KB
SHA256 f59ad61ea08c91ffde5033bbb6bd3e290362080d104f4cf1ca469d2f9f99acd1
MD5 1dd02c38d64e9e7a6283ae60d8ae285b
SHA1 897f0a4a610f21ed511dc26aa373e3a940ebe1c8
SHA512 918868b785046618822112b49743e983c77d5f631efda9562b2a452a21d1e02250f4853b90645f5a6531f59ef0665573ac18855147f030ed5dd8be7d8e794f56
SSDEEP 384:aXVlB33535ZaQLcmIVbIz3//6WVgeqXeieSAJO8QLQ3EZLW+3UStX+vO3aSKmDmA:azB535ZndxC/Xe7JB3EZLW+hX+W3RKmt
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000009

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\f_000009
Size 22KB
SHA256 0c25b3a16149b0afba4d08c28d0926ccfb8e6cb520c91d3c3b0da9f421bc3215
MD5 a07e0e6da6579b9011bbd696321c3ebc
SHA1 baac76b26f93dbb59f40b734d9fb400ff5aa0053
SHA512 39be14039de0c45c70d52880183d3469dacef6561ada1d327f892bc025ef3daad74b2e9bab8463d7d1eb1cd3d3c8cbd4774178b6d7ef84bb99a8e556cfa3c402
SSDEEP 384:YPbaOSgLwJ21IdBamPELJ4jJJNhbfVqD5jw1ZYNRBkf2p92EuBH4bH:YOOSgLwLBamPEejJJrbti6iNRBkf2PwS
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000a

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\f_00000a
Size 81KB
SHA256 7e27c4d2d1846cb91206e45df9ebf96b1e164dfade8dc9d4793b301e0a5b0f00
MD5 13d15dfdf015356769177cc368648ab2
SHA1 60e72b4844cd4d4ec0101723a62bbea3f3b15d54
SHA512 fe9d0635e5efe93e968e201ad5707bcfabca9170e04a5456b9350efd06e20af12e2d7784389764771a310afdac190331a17c3f7877deb810083d6863e1854bbc
SSDEEP 1536:7al0oYrIajnQIfta0LOB0OGqyajbm7N5zDyTG5gFTxN:Gl0jVjdtFOB01qyajbmpQTLF1N
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000b

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\f_00000b
Size 287KB
SHA256 75f8a2f2447861e91ac9b03a771e80c2be0cd874dc3960c06df069d53a804835
MD5 882d75272540d1eb2e64522547205c56
SHA1 71e08ad5ad1ed1f84c477b63ec18f47eac72c0cb
SHA512 3496e2642418ca6e3a5ac148c74e332b22bc7f94d8b5d8b114811c19c1db0dc678fd7856fd2f7b9db860e8b76a9ae26a9d5dbdb70567d4038c5954228717c78e
SSDEEP 6144:U0m3PPhho6ZbAsaveYEaMcVMruCc4igeGHJ3P9AFV/2XkoEIzLE2pUMS6Z:UPPhh9ZbAsQecRUuHXQPCH2oIzLHR
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000c

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\f_00000c
Size 63KB
SHA256 26bac545a278251071f921dfc4b5a4eecc9da70930479bd2e3ae8fa33b8edc22
MD5 631a18b43e8a2085bc2793d6297eb931
SHA1 a48d4eb3f337de6a46189b4314e006390be03247
SHA512 93635b47da701066da29a9b5ed983505d7696cc7ac2fdb629afe06e4981ef97e2051aeff64ae5244ded54df3856ee5313afaa6cdb946e89f042bf96cbdaf5798
SSDEEP 1536:h8zjjffHzLEIPhsJQPrBmZfMevm4q6LO//V5Ff8Ec1ANS29Y7PC:hGjjfLLECTYY4qpXV5F2AvCC
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000d

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\f_00000d
Size 173KB
SHA256 b020038f902cf398772a0158da5443ee7a143aa140377e536a9c13f6954ff61c
MD5 223a108b07c1af060a89fea848f8e489
SHA1 75b69cf547306afffbec0ae0912491d392a2fd5c
SHA512 a71faf0d33a984c9d02d4b96b84ade2a147fcef8081a40a63d13afaa57c17f977ee2ae2cc577beada47cf517c2e4d587a2f32a8ab3e821158a813d4c79ec2ad4
SSDEEP 3072:epvzrdztMp5gquII3ayJqTciz1a0TiD1qv8tHA9lVHJTzv0DklfHf7VU+OiMytwW:yzrdztM7wayD2a0TiD1+8tHchaDkhHf9
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000e

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\f_00000e
Size 38KB
SHA256 fa8793ff0960fcf40b9814b99fe16f4f0e354582564bc903b7219f6f0657e145
MD5 996d8258bd0b15b8eb31b9202fd7d635
SHA1 9be5a7f458aac790901e4425e049a4917f9ed241
SHA512 62ed7b46531095bc9a7bd31efc828e7f1d378deb1791b54d675edb18f78c1bde95a2f11b01bae657dc9d933f1c106f66f90d4f0cdb0a590932d05fb99263587a
SSDEEP 768:3Z3PsVIJQ55XNuqf/ASRnJbH3q+sDhRc3+39MktsBp6o9Wil6jnJB6Dl:5P1JQ5Ow/AqF6pD3cu39MV6oIiY6l
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000f

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\f_00000f
Size 66KB
SHA256 b09de2f6f58d69729f546cabaf19abcb1bb6d0f9f339f365bb2c72dd8e290791
MD5 8af9d7bff23041196f2059dbb1a449ee
SHA1 b92bbcce6204a49471e75c92cc03adaea1bbe0e9
SHA512 dc65a6c74e4cdcd8dc0a2de5ca30cbe6c26a76338f8568ec1983b7385049aae5a9c48e5b6973f89d3d0ebd6d9053eab774410a9d79a5b83d1665779e137ebd18
SSDEEP 1536:cYt5Tgf6ugj4eGj2cw0rhOcMvUWvpe7ARGpJGeYbbDVN1TrBrnyZb1BMwC4:cYTsdg0eQXkpcv/GeYbb9NGl1ywC4
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000010

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\f_000010
Size 255KB
SHA256 f252a64d26e170a9c3151f82b46d25cfe67799801df78edfaf7c861c21191a78
MD5 43dadbc63154445f30ad7ae6c36c2fb3
SHA1 7a32c03ffdda6203f0906dfda578ce955abdf3d0
SHA512 8d8e3d082b5668ee0de2b13477693b3471b5b28ef9bfa9603ba44667433a89be84524c01c528001fa66ba590ffa82a417f38d1d18536e8019f0ff7a401d7d6cf
SSDEEP 6144:pZvyLNUPCu9YVMdiwsoyDAiNKmGIZpYhKHPesRr:faZUPC+YV0nyEiNKmdZpUKHPesRr
MD5 SHA1 SHA512 SSDEEP

Submit Download

081c677120b54c30_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\081c677120b54c30_0
Size 3KB
SHA256 090ccf2acd25de7bbd8d42edcba7d8b66bed18151f01ce722a17af6b26720f3a
MD5 c12b70b54a533d20bb651b21bce40d17
SHA1 3e4b43e5af3b15a92109dfe0688303af37e6c0e4
SHA512 d5f914eec8568932e5a1e5aa106b14c31dcb53a28f1752a324585bf317aa388b8205e515916165bfea89b144c93ea283737d2b6eaf3b23342ac1387882f9432d
MD5 SHA1 SHA512

Submit Download

13c95eefd92223f2_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\13c95eefd92223f2_0
Size 1KB
SHA256 fe8cd4cd42edc5cd8527e8e1fd84a98d6901a93fc69dc1ec5ba3286e2576e010
MD5 65840b2fab332f016fcf3e2078e59aa8
SHA1 f6879a892698d1dec07ec7d111bb0bbc14b80e1c
SHA512 de71c8b4cc883ad05f196acf591313e0981fb7d1c65c2c1c1c53e5c1478820b274dd300213b5599e553237fb7a50af1743416a9e83ee92b60f8effb1132b9245
MD5 SHA1 SHA512

Submit Download

1ecb9364aa1f39bc_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\1ecb9364aa1f39bc_0
Size 268KB
SHA256 547fd450444690a30eda9a40506e986076281f6a54e39a6ac524e683b89f73f5
MD5 0cacda87d6b5c7c2b867d0989a55b101
SHA1 732dbd6c0940dc0040dbc7ca9d8f838aeb386c50
SHA512 596f9f0d02129e1e315e2116a4b231be1602361388c9631f42445300456365d8c30e9ae4a0ac72b6e5d1d5a61065315a578f56c4466887297f7d0bbda9f9c5b5
SSDEEP 6144:7kdo6anOtXH33MRdcl5AwZDRheoNKo8CZ6eFeLNVJkyeXa:7kIOtXXcMl5AEDRE4K7eFqJGXa
MD5 SHA1 SHA512 SSDEEP

Submit Download

305f690bb57d960c_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\305f690bb57d960c_0
Size 1KB
SHA256 5f250ac1e6ad203bed8743bc7d5c829945a466a96d948382d7d5200f8abebe35
MD5 8aa8a152e438ac46a45507a11ed0b52d
SHA1 ac2f47c6df681227a1e620e730959d3bb7375c54
SHA512 93c343779c7cce6afb3f66b9ae266712c39f4497cc77fa2d9a4880cd403f0d65a990ffa9e1bdb5430b8cb68645ba16d391967a8e25fe2df2d1dfc5b7ef87a5f1
MD5 SHA1 SHA512

Submit Download

3c75ac29a9adc9ad_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\3c75ac29a9adc9ad_0
Size 3KB
SHA256 47a8a329ebf866bf6e565b34d66151a628a00d5c694ae36fe41c3e4e288d9bfd
MD5 13638e3a186a49b427d6059fa5135a53
SHA1 e2e5ff2d42b816dfa35fd345caa0762ffb5c94f1
SHA512 3e45b1c67d8cc159813f1ada28911bc663067eb3cee26bc0f904c662b27ab0484edeb9a6ed016398fcff6c4d76c91a47c7cd73c7f972c8034f26aaa05c528a90
MD5 SHA1 SHA512

Submit Download

44db5bba70176817_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\44db5bba70176817_0
Size 1KB
SHA256 ef5612c31a7bfbcebc39ba52e7c3a9b2c0ade031dd436f511402ca3de3e3c9fe
MD5 e489ef880d8ac97ae3f0c37ca562da6a
SHA1 b56cafe226823a8637df507ddb32aadf8004cf9a
SHA512 895b7a73c7ece7fa4bdf9b6f1694380ef6ea332705489ae033862ed8844922ea306cb7bfc746ef3cea62acc0f7b988872756f228e4803acf778af3b75a38d482
MD5 SHA1 SHA512

Submit Download

57a09f813fa7cfc6_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\57a09f813fa7cfc6_0
Size 1KB
SHA256 df88ac93c7080913ff208993171eb31837062ddd6d947e0ab72aaeff76f0cd99
MD5 f0636cf0a7b6a9580ef42b9f8b747ee6
SHA1 ed984d15a20fce9d6e2a24c5fd33afb7f56cfec1
SHA512 08d21661b290fe652c2d2c1f3ba8557675a3b6fa1bf76f81b29b4d6350b421c7a63ee91fd38742f51e22b1031dc704df7ba0b2befd3f44dbc501903a38d4ae11
MD5 SHA1 SHA512

Submit Download

9190a6c229034acc_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\9190a6c229034acc_0
Size 1KB
SHA256 05ff49306b0631368cfaafea299568094c7a32ae59f1a4e5983cffecc539af86
MD5 74fc6dfd9f80d8fd1330231e6078c64d
SHA1 d4c540c9ccecebdb661a7f101354be18caf28394
SHA512 f54abb9fde0297fcf775222ebee86f1d0527dd64035ada6a14cc9975042bb32ea3bc4efbeee7065fa3c233355f34ad7ef35e2abad3f05e1c7851d76fe4675704
MD5 SHA1 SHA512

Submit Download

a13ee82497df0259_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\a13ee82497df0259_0
Size 2KB
SHA256 3758946a5c57d4a10816fc43632925341e979200e5afba1867ec157f246ebafd
MD5 0a75620e27de58747c563d2fc5ceb91a
SHA1 bbd60b436e4d39cadb2706dea69eb81dc34b8857
SHA512 5d67d5e2e1556a7435664df3b08f8bf773c17c31cf124357321bf5f42ee552c441a0eb7e47678bc1b761e0f26631541b8f692bcb64087593ba2bbd7746068ce2
MD5 SHA1 SHA512

Submit Download

b682b8a2c553d9d0_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\b682b8a2c553d9d0_0
Size 479B
SHA256 a68fc38a22389fb02dfb2eff090bf591747a085c12c071d2c543d8cf8a5c6069
MD5 cee2d75afb044ed2527dcf773231dd7f
SHA1 0db82bf9daf38c6f38212a88baabc88d2d74d08e
SHA512 7279baddd301543a4e7eadea70d286a3d7149d5672d198f71bbc2452430231d6f81fd969a49eda570f7b64d381a65fc038b1166f8461be84b751e2c92943ecae
MD5 SHA1 SHA512

Submit Download

e87383a9590b6e7b_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\e87383a9590b6e7b_0
Size 3KB
SHA256 2a811984e43a7d952791fe3a084db52fbf9e1d22153fd10944dd9137988b6304
MD5 05cd3d350bcf503c4e4f68360ca29859
SHA1 5689e42bd3fcc2ccd01be57c80789d478b7269af
SHA512 78ab2683d04c5c61200cec9d681e28aea29308a1b6291dd9d21a4d38c3e365b7d726ea6cb1967b13f4c9aff3b1f112945d1614d96855e211d3babfd2be2a1c75
MD5 SHA1 SHA512

Submit Download

f6adf42611789759_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\f6adf42611789759_0
Size 256B
SHA256 9c57c25007bedd3a77a5e4a0b9a0136cd3fdad80ad3aae62d3ed5e86947271ea
MD5 0a191169525af340bf50bc76f1b8a1da
SHA1 6dc3d9547ca8ca3fc144b958d57f0a7a8972690d
SHA512 8dbafd42db6a6b1c973bc3f2599996071a2b837e69b2bfdea2f802da440e8d0c9a00939c482f92f14eb970ce6fc4cef0cff5c0a664d9ad5cc2d266a034c8e1b5
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 ccf99f92dcf6e7dfd8b278dd58c3fa9e368b75beaa8af87f30c1c21cd5ef3b26
MD5 3ceeecf25efbd91b44951ffd6ded0519
SHA1 26d10ae387edb3feb29d99feaf93567b66ba2db0
SHA512 b2c63b9f46a7b23217942f62cdf0030629d93e0607565b227c631173a562a6964d3dcbb7b0b43e614a1cc334685d6054c86c7f1b0e380933ce133013ffca5a65
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 6KB
SHA256 9e763ea4db5b7fbaa6c8dd234f3377c5e587481d8033cc888eb77de900b2cbe1
MD5 c86c13b688b5651533c2b683afe72c2b
SHA1 131845f7da0cae990151204263474fff3b914293
SHA512 f86674aab5febf2d71ab8714edcaf75d7e77235a5e3e8d310dce6064d5722f72ba12a0271a8298bf991c8a4b308edb5161b514053d4888a4889364b24c58acab
SSDEEP 192:8jKKz/h/LT8u2cCoEggqnPSSzJHoYKY+wn:8uKFf52foLPTqYB+2
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 15KB
SHA256 f9afe10f46d1a05c7ca9fcd57d6c35041c32dd881053c8a2af10582608e0d582
MD5 cf0b0ca9aa6310bac64795fe47929ad6
SHA1 9169fc91f80d5a8c5964fee88f2b079d4b44403d
SHA512 38805c6c8925a78ee83b78f9830f8bea37e47ea4d949317dfcd3db26676cd020a3e6a9064b0ed9482c05d1ec095535b896ebe320dfce105abd411d969e17a4c9
SSDEEP 384:STtqLlNXp1kXqKf/pUZNCgVLH2HfnjrUf6R7ggqGz:jLlpp1kXqKf/pUZNCgVLH2HfjrUyR3z
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\TransportSecurity
Size 526B
SHA256 d5c0f0097757020464dc18f785deb13433123ccc06fb05ee00e4e3c5271cf497
MD5 b45a8c06bca4bb3e971c9acda0ee2e5e
SHA1 bcca2a5237f7b14c5c47234aca547f2041548c3b
SHA512 53e8345d3a01f2df014fa5fea1980872db1e60b1c78d4762155f50f83c380c1fef0ae1f0d4222cb4cce923c1701849950021cb5bf58170396cdb8e3b0765a60f
MD5 SHA1 SHA512

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version
Size 13B
SHA256 389caa40ea458e84bc624a9af1e0dec60fa652b2db2b81c09b1dfe22822cc3d1
MD5 b63048c4e7e52c52053d25da30d9c5ab
SHA1 679a44d402f5ec24605719e06459f5a707989187
SHA512 e86c58c5a25e24f21ad79ed526a90c120a09c115f4820663bd2ebbc59e7bb1c4c418267eb77645522aa20b2c1b53fba8e31690db7bae9b21e4eff3db06316359
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 110KB
SHA256 dc780ff7354afab2d8a016e050f317b0c85adc1db539b67706a04fccd36f0378
MD5 60381f9a9f2f75f984429b7c7519bfed
SHA1 1a0e098361361544bf4a7cfbd6df6c1a50e7c532
SHA512 6f06629c26496c76e74baef18e35a57d5abdae358c27e04bc893336ff45707539c8435190438e995ee5f4401887d7fa8cdc222fc6c014b89b058731b96013597
SSDEEP 1536:rt2r9t5j2ty8ItbYJtWjmK9elgxMO1WZ+7V/g3mgwohONpDfgFNKP9NrQ3Zsi4pg:I9t5Z8IyJzKKOgZPgogTiMFUZAHQw2
MD5 SHA1 SHA512 SSDEEP

Submit Download

3b4080af-e3b5-4610-85e1-ea878d32a94f.tmp

Path C:\Users\Admin\AppData\Local\Temp\3b4080af-e3b5-4610-85e1-ea878d32a94f.tmp
Size 243KB
SHA256 e730967773ada5f11057eb40c9a4b332aa2680cf715b98a5120f60e88b8bc359
MD5 8fc952b414aee9b3e49c2d6088e07d73
SHA1 6b5ae844296fbbd716c4c7489bd5af0cb1f8632a
SHA512 a62e6668b35ba9ed3407ef2abd372263a1db239f702e4ac78986e60b0320a6cb8c5dfec9aea06b8efff3ca1e76c55cfe2712c2e70549b8ed2ccab9c8767d41b2
SSDEEP 6144:k3oF4Z4h45P99Fld9RBQYBVcPYEuQPlbi:ko4Z4h45bQEVlEu
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2036-54-0x0000000075521000-0x0000000075523000-memory.dmp

Download

memory/2036-55-0x0000000000170000-0x000000000019C000-memory.dmp

Download