644d07bfb71d1051f12a18f5cc7285ac12e493d7bb58fccc6c9767831da0bcd2

Analysis

user interaction
yes
max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/05/2026, 10:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
forza-painter-fh6-v1.5.4.exe
Size 25.0MB
Sample260523-mfcc2saw7x
SHA256 644d07bfb71d1051f12a18f5cc7285ac12e493d7bb58fccc6c9767831da0bcd2
MD5 c3361f8162805f11c5be3fe1888cc8ad
SHA1 19aab2b23d1346100cc47a84c949fde9c84343f6
SHA512 eb6266b26a2f5d3daa79bcc460cba59ed7b0dbdd5d4ddc13e847469bf36126a5a2e71361762e499c772032549e03ed159072814fc63775f01ff38e3cfff2c3d7
SSDEEP 786432:JljSYGC2W85cxjDWcmLQfCH9qJbVZQDMw8:LjStWVVULuCH9MQF
TLSH
T1454733547B880CD8F8BEE53CD1A09A0787A9B15117FA859726F4E9830DB32D4FE31726
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 24 IoCs

pid	Process
1748	forza-painter-fh6-v1.5.4.exe
1748	forza-painter-fh6-v1.5.4.exe
1748	forza-painter-fh6-v1.5.4.exe
1748	forza-painter-fh6-v1.5.4.exe
1748	forza-painter-fh6-v1.5.4.exe
1748	forza-painter-fh6-v1.5.4.exe
1748	forza-painter-fh6-v1.5.4.exe
1748	forza-painter-fh6-v1.5.4.exe
1748	forza-painter-fh6-v1.5.4.exe
1748	forza-painter-fh6-v1.5.4.exe
1748	forza-painter-fh6-v1.5.4.exe
1748	forza-painter-fh6-v1.5.4.exe
1748	forza-painter-fh6-v1.5.4.exe
1748	forza-painter-fh6-v1.5.4.exe
1748	forza-painter-fh6-v1.5.4.exe
1748	forza-painter-fh6-v1.5.4.exe
1748	forza-painter-fh6-v1.5.4.exe
1748	forza-painter-fh6-v1.5.4.exe
1748	forza-painter-fh6-v1.5.4.exe
1748	forza-painter-fh6-v1.5.4.exe
1748	forza-painter-fh6-v1.5.4.exe
1748	forza-painter-fh6-v1.5.4.exe
1748	forza-painter-fh6-v1.5.4.exe
1748	forza-painter-fh6-v1.5.4.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
6	raw.githubusercontent.com
8	raw.githubusercontent.com
9	raw.githubusercontent.com

Drops file in System32 directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jtx	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSStmp.log	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00001.jrs	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00002.jrs	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.jfm	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jcp	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.log	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat	svchost.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
7760	chrome.exe
1552	chrome.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134240054914630466"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Version = "1"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e8005398e082303024b98265d99428e115f0000	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Downloads"	forza-painter-fh6-v1.5.4.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	forza-painter-fh6-v1.5.4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Downloads"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	forza-painter-fh6-v1.5.4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616193"	forza-painter-fh6-v1.5.4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	forza-painter-fh6-v1.5.4.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	forza-painter-fh6-v1.5.4.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	forza-painter-fh6-v1.5.4.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	forza-painter-fh6-v1.5.4.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	forza-painter-fh6-v1.5.4.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	forza-painter-fh6-v1.5.4.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Downloads"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	forza-painter-fh6-v1.5.4.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	forza-painter-fh6-v1.5.4.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	mspaint.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	forza-painter-fh6-v1.5.4.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff	forza-painter-fh6-v1.5.4.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0000000001000000ffffffff	forza-painter-fh6-v1.5.4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	forza-painter-fh6-v1.5.4.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1748	forza-painter-fh6-v1.5.4.exe
1748	forza-painter-fh6-v1.5.4.exe
2832	chrome.exe
2832	chrome.exe
7048	mspaint.exe
7048	mspaint.exe
7148	chrome.exe
7148	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
5084	chrome.exe
1748	forza-painter-fh6-v1.5.4.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 64 IoCs

pid	Process
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1748	forza-painter-fh6-v1.5.4.exe
Token: SeShutdownPrivilege	2832	chrome.exe
Token: SeCreatePagefilePrivilege	2832	chrome.exe
Token: SeShutdownPrivilege	2832	chrome.exe
Token: SeCreatePagefilePrivilege	2832	chrome.exe
Token: SeShutdownPrivilege	2832	chrome.exe
Token: SeCreatePagefilePrivilege	2832	chrome.exe
Token: SeShutdownPrivilege	2832	chrome.exe
Token: SeCreatePagefilePrivilege	2832	chrome.exe
Token: SeShutdownPrivilege	2832	chrome.exe
Token: SeCreatePagefilePrivilege	2832	chrome.exe
Token: SeShutdownPrivilege	2832	chrome.exe
Token: SeCreatePagefilePrivilege	2832	chrome.exe
Token: SeShutdownPrivilege	2832	chrome.exe
Token: SeCreatePagefilePrivilege	2832	chrome.exe
Token: SeShutdownPrivilege	2832	chrome.exe
Token: SeCreatePagefilePrivilege	2832	chrome.exe
Token: SeShutdownPrivilege	2832	chrome.exe
Token: SeCreatePagefilePrivilege	2832	chrome.exe
Token: SeShutdownPrivilege	2832	chrome.exe
Token: SeCreatePagefilePrivilege	2832	chrome.exe
Token: SeShutdownPrivilege	2832	chrome.exe
Token: SeCreatePagefilePrivilege	2832	chrome.exe
Token: SeShutdownPrivilege	2832	chrome.exe
Token: SeCreatePagefilePrivilege	2832	chrome.exe
Token: SeShutdownPrivilege	2832	chrome.exe
Token: SeCreatePagefilePrivilege	2832	chrome.exe
Token: SeShutdownPrivilege	2832	chrome.exe
Token: SeCreatePagefilePrivilege	2832	chrome.exe
Token: SeShutdownPrivilege	2832	chrome.exe
Token: SeCreatePagefilePrivilege	2832	chrome.exe
Token: SeShutdownPrivilege	2832	chrome.exe
Token: SeCreatePagefilePrivilege	2832	chrome.exe
Token: SeShutdownPrivilege	2832	chrome.exe
Token: SeCreatePagefilePrivilege	2832	chrome.exe
Token: SeShutdownPrivilege	2832	chrome.exe
Token: SeCreatePagefilePrivilege	2832	chrome.exe
Token: SeShutdownPrivilege	2832	chrome.exe
Token: SeCreatePagefilePrivilege	2832	chrome.exe
Token: SeShutdownPrivilege	2832	chrome.exe
Token: SeCreatePagefilePrivilege	2832	chrome.exe
Token: SeShutdownPrivilege	2832	chrome.exe
Token: SeCreatePagefilePrivilege	2832	chrome.exe
Token: SeShutdownPrivilege	2832	chrome.exe
Token: SeCreatePagefilePrivilege	2832	chrome.exe
Token: SeShutdownPrivilege	2832	chrome.exe
Token: SeCreatePagefilePrivilege	2832	chrome.exe
Token: SeShutdownPrivilege	2832	chrome.exe
Token: SeCreatePagefilePrivilege	2832	chrome.exe
Token: SeShutdownPrivilege	2832	chrome.exe
Token: SeCreatePagefilePrivilege	2832	chrome.exe
Token: SeShutdownPrivilege	2832	chrome.exe
Token: SeCreatePagefilePrivilege	2832	chrome.exe
Token: SeShutdownPrivilege	2832	chrome.exe
Token: SeCreatePagefilePrivilege	2832	chrome.exe
Token: SeShutdownPrivilege	2832	chrome.exe
Token: SeCreatePagefilePrivilege	2832	chrome.exe
Token: SeShutdownPrivilege	2832	chrome.exe
Token: SeCreatePagefilePrivilege	2832	chrome.exe
Token: SeShutdownPrivilege	2832	chrome.exe
Token: SeCreatePagefilePrivilege	2832	chrome.exe
Token: SeShutdownPrivilege	2832	chrome.exe
Token: SeCreatePagefilePrivilege	2832	chrome.exe
Token: SeShutdownPrivilege	2832	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1748	forza-painter-fh6-v1.5.4.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
7148	chrome.exe
7148	chrome.exe
7148	chrome.exe
7148	chrome.exe
7148	chrome.exe
7148	chrome.exe
7148	chrome.exe
7148	chrome.exe
7148	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
7148	chrome.exe
7148	chrome.exe
7148	chrome.exe
7148	chrome.exe
7148	chrome.exe
7148	chrome.exe
7148	chrome.exe
7148	chrome.exe
7148	chrome.exe
7148	chrome.exe
7148	chrome.exe
7148	chrome.exe
7148	chrome.exe
7148	chrome.exe
7148	chrome.exe
7148	chrome.exe
7148	chrome.exe
7148	chrome.exe
7148	chrome.exe
7148	chrome.exe
7148	chrome.exe
7148	chrome.exe
7148	chrome.exe
7148	chrome.exe
7148	chrome.exe
7148	chrome.exe
7148	chrome.exe
7148	chrome.exe
7148	chrome.exe
7148	chrome.exe
7148	chrome.exe
7148	chrome.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
5084	chrome.exe
7164	chrome.exe
7596	chrome.exe
1748	forza-painter-fh6-v1.5.4.exe
7048	mspaint.exe
4344	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3612 wrote to memory of 1748	3612	forza-painter-fh6-v1.5.4.exe	88
PID 2832 wrote to memory of 1884	2832	chrome.exe	102
PID 2832 wrote to memory of 4660	2832	chrome.exe	103
PID 2832 wrote to memory of 1552	2832	chrome.exe	104
PID 2832 wrote to memory of 4660	2832	chrome.exe	103
PID 2832 wrote to memory of 1200	2832	chrome.exe	105
PID 2832 wrote to memory of 1200	2832	chrome.exe	105
PID 2832 wrote to memory of 3404	2832	chrome.exe	107
PID 2832 wrote to memory of 3404	2832	chrome.exe	107
PID 2832 wrote to memory of 4564	2832	chrome.exe	108
PID 2832 wrote to memory of 4564	2832	chrome.exe	108
PID 2832 wrote to memory of 3044	2832	chrome.exe	109
PID 2832 wrote to memory of 3044	2832	chrome.exe	109
PID 2832 wrote to memory of 2680	2832	chrome.exe	110
PID 2832 wrote to memory of 2680	2832	chrome.exe	110
PID 2832 wrote to memory of 4264	2832	chrome.exe	114
PID 2832 wrote to memory of 4196	2832	chrome.exe	116
PID 2832 wrote to memory of 4196	2832	chrome.exe	116
PID 2832 wrote to memory of 2952	2832	chrome.exe	117
PID 2832 wrote to memory of 2952	2832	chrome.exe	117
PID 2832 wrote to memory of 2700	2832	chrome.exe	119
PID 2832 wrote to memory of 2700	2832	chrome.exe	119
PID 2832 wrote to memory of 5084	2832	chrome.exe	121
PID 2832 wrote to memory of 5156	2832	chrome.exe	122
PID 2832 wrote to memory of 5156	2832	chrome.exe	122
PID 2832 wrote to memory of 5332	2832	chrome.exe	123
PID 2832 wrote to memory of 5332	2832	chrome.exe	123
PID 2832 wrote to memory of 5392	2832	chrome.exe	124
PID 2832 wrote to memory of 5392	2832	chrome.exe	124
PID 2832 wrote to memory of 5404	2832	chrome.exe	125
PID 2832 wrote to memory of 5404	2832	chrome.exe	125
PID 2832 wrote to memory of 5468	2832	chrome.exe	126
PID 2832 wrote to memory of 5468	2832	chrome.exe	126
PID 2832 wrote to memory of 5476	2832	chrome.exe	127
PID 2832 wrote to memory of 5476	2832	chrome.exe	127
PID 2832 wrote to memory of 5484	2832	chrome.exe	128
PID 2832 wrote to memory of 5484	2832	chrome.exe	128
PID 2832 wrote to memory of 5492	2832	chrome.exe	129
PID 2832 wrote to memory of 5492	2832	chrome.exe	129
PID 2832 wrote to memory of 5500	2832	chrome.exe	130
PID 2832 wrote to memory of 5500	2832	chrome.exe	130
PID 2832 wrote to memory of 5508	2832	chrome.exe	131
PID 2832 wrote to memory of 5508	2832	chrome.exe	131
PID 2832 wrote to memory of 5516	2832	chrome.exe	132
PID 2832 wrote to memory of 5516	2832	chrome.exe	132
PID 2832 wrote to memory of 5524	2832	chrome.exe	133
PID 2832 wrote to memory of 5524	2832	chrome.exe	133
PID 2832 wrote to memory of 5532	2832	chrome.exe	134
PID 2832 wrote to memory of 5532	2832	chrome.exe	134
PID 2832 wrote to memory of 5540	2832	chrome.exe	135
PID 2832 wrote to memory of 5540	2832	chrome.exe	135
PID 2832 wrote to memory of 5548	2832	chrome.exe	136
PID 2832 wrote to memory of 5548	2832	chrome.exe	136
PID 2832 wrote to memory of 5556	2832	chrome.exe	137
PID 2832 wrote to memory of 5556	2832	chrome.exe	137
PID 2832 wrote to memory of 5564	2832	chrome.exe	138
PID 2832 wrote to memory of 5564	2832	chrome.exe	138
PID 2832 wrote to memory of 5572	2832	chrome.exe	139
PID 2832 wrote to memory of 5572	2832	chrome.exe	139
PID 2832 wrote to memory of 6056	2832	chrome.exe	140
PID 2832 wrote to memory of 6056	2832	chrome.exe	140
PID 2832 wrote to memory of 6068	2832	chrome.exe	141
PID 2832 wrote to memory of 6068	2832	chrome.exe	141
PID 2832 wrote to memory of 6076	2832	chrome.exe	142

C:\Users\Admin\AppData\Local\Temp\forza-painter-fh6-v1.5.4.exe
"C:\Users\Admin\AppData\Local\Temp\forza-painter-fh6-v1.5.4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3612
- C:\Users\Admin\AppData\Local\Temp\forza-painter-fh6-v1.5.4.exe
  "C:\Users\Admin\AppData\Local\Temp\forza-painter-fh6-v1.5.4.exe"
  2⤵
  - Loads dropped DLL
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:1748

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffb6210c728,0x7ffb6210c734,0x7ffb6210c740
  2⤵
  PID:1884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1696,i,1884651577200157956,10392062170106785121,262144 --field-trial-handle=2000,i,9114931649154259720,17886147703232480419,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1992 /prefetch:2
  2⤵
  PID:4660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1616,i,12650496068329928933,14800599302706618767,524288 --field-trial-handle=2000,i,9114931649154259720,17886147703232480419,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2012 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2436,i,11747596449245197751,14291239435107201416,524288 --field-trial-handle=2000,i,9114931649154259720,17886147703232480419,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2608 /prefetch:8
  2⤵
  PID:1200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3268,i,12822205959944261430,10551791502789212895,2097152 --field-trial-handle=2000,i,9114931649154259720,17886147703232480419,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:3404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3316,i,6455155391279631528,15691112403029672306,2097152 --field-trial-handle=2000,i,9114931649154259720,17886147703232480419,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:4564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4496,i,18010865995241849650,10205458855130649509,2097152 --field-trial-handle=2000,i,9114931649154259720,17886147703232480419,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4508 /prefetch:2
  2⤵
  PID:3044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4744,i,6754661224815296759,7865010854582031832,2097152 --field-trial-handle=2000,i,9114931649154259720,17886147703232480419,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4624 /prefetch:1
  2⤵
  PID:2680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5528,i,7750272005335267939,315505275132146724,524288 --field-trial-handle=2000,i,9114931649154259720,17886147703232480419,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5536 /prefetch:8
  2⤵
  PID:4264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5728,i,5277076491110160474,7902885361910252449,2097152 --field-trial-handle=2000,i,9114931649154259720,17886147703232480419,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5584 /prefetch:1
  2⤵
  PID:4196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3376,i,9460176024924259241,11224196807749843840,2097152 --field-trial-handle=2000,i,9114931649154259720,17886147703232480419,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:2952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=4748,i,4633247145755015385,8206202618209209461,2097152 --field-trial-handle=2000,i,9114931649154259720,17886147703232480419,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:2700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6060,i,5855658422422264589,411230480739876835,524288 --field-trial-handle=2000,i,9114931649154259720,17886147703232480419,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6020 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:5084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6000,i,2614492341212830311,9503089424710794381,2097152 --field-trial-handle=2000,i,9114931649154259720,17886147703232480419,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6116 /prefetch:1
  2⤵
  PID:5156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5992,i,1067154295713233554,4384562831781100506,2097152 --field-trial-handle=2000,i,9114931649154259720,17886147703232480419,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6140 /prefetch:1
  2⤵
  PID:5332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6280,i,11570741258719859982,14693967142450563842,2097152 --field-trial-handle=2000,i,9114931649154259720,17886147703232480419,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6300 /prefetch:1
  2⤵
  PID:5392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6464,i,1586101115576717060,2873903956918440057,2097152 --field-trial-handle=2000,i,9114931649154259720,17886147703232480419,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6444 /prefetch:1
  2⤵
  PID:5404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6496,i,5933886684346041525,9285935177048028049,2097152 --field-trial-handle=2000,i,9114931649154259720,17886147703232480419,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6644 /prefetch:1
  2⤵
  PID:5468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6760,i,18254283846549875711,8996072683841685475,2097152 --field-trial-handle=2000,i,9114931649154259720,17886147703232480419,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6768 /prefetch:1
  2⤵
  PID:5476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6904,i,2385237831558917237,16855735876027452834,2097152 --field-trial-handle=2000,i,9114931649154259720,17886147703232480419,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6912 /prefetch:1
  2⤵
  PID:5484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6940,i,13313262004922187605,8065084633933062626,2097152 --field-trial-handle=2000,i,9114931649154259720,17886147703232480419,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7072 /prefetch:1
  2⤵
  PID:5492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=7204,i,16705974124281799890,10782678692984570448,2097152 --field-trial-handle=2000,i,9114931649154259720,17886147703232480419,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7208 /prefetch:1
  2⤵
  PID:5500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=7352,i,5208831152657416596,6622078452051256806,2097152 --field-trial-handle=2000,i,9114931649154259720,17886147703232480419,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7356 /prefetch:1
  2⤵
  PID:5508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=7500,i,3976810235042365889,4808250620889922046,2097152 --field-trial-handle=2000,i,9114931649154259720,17886147703232480419,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7516 /prefetch:1
  2⤵
  PID:5516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=7648,i,15731182824902395499,8928607390456789557,2097152 --field-trial-handle=2000,i,9114931649154259720,17886147703232480419,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7656 /prefetch:1
  2⤵
  PID:5524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=7796,i,5961462930884550439,1216259487051964387,2097152 --field-trial-handle=2000,i,9114931649154259720,17886147703232480419,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7812 /prefetch:1
  2⤵
  PID:5532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=7948,i,13821279724785798685,13919489774607159233,2097152 --field-trial-handle=2000,i,9114931649154259720,17886147703232480419,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7956 /prefetch:1
  2⤵
  PID:5540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=8100,i,4166044660346396556,3136818027501782930,2097152 --field-trial-handle=2000,i,9114931649154259720,17886147703232480419,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8104 /prefetch:1
  2⤵
  PID:5548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=8252,i,1362925341394306288,17951913340012282939,2097152 --field-trial-handle=2000,i,9114931649154259720,17886147703232480419,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8128 /prefetch:1
  2⤵
  PID:5556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=8392,i,12390525247533542533,6449004690329403361,2097152 --field-trial-handle=2000,i,9114931649154259720,17886147703232480419,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8404 /prefetch:1
  2⤵
  PID:5564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=8552,i,16623311797529428486,2332005136526004672,2097152 --field-trial-handle=2000,i,9114931649154259720,17886147703232480419,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8432 /prefetch:1
  2⤵
  PID:5572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=8732,i,4316069954797784403,8770672166787743728,2097152 --field-trial-handle=2000,i,9114931649154259720,17886147703232480419,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8700 /prefetch:1
  2⤵
  PID:6056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=8872,i,16333568159736860499,733123501342832201,2097152 --field-trial-handle=2000,i,9114931649154259720,17886147703232480419,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8752 /prefetch:1
  2⤵
  PID:6068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --metrics-shmem-handle=9028,i,10154576326477567102,3779380217110368712,2097152 --field-trial-handle=2000,i,9114931649154259720,17886147703232480419,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=9032 /prefetch:1
  2⤵
  PID:6076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --metrics-shmem-handle=9180,i,8345188066592583740,3526742369483855959,2097152 --field-trial-handle=2000,i,9114931649154259720,17886147703232480419,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=9184 /prefetch:1
  2⤵
  PID:6084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --metrics-shmem-handle=8084,i,4398098230870313144,7722777495670643481,2097152 --field-trial-handle=2000,i,9114931649154259720,17886147703232480419,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8676 /prefetch:1
  2⤵
  PID:2264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --metrics-shmem-handle=9504,i,11797355986334223389,15224083511643691915,2097152 --field-trial-handle=2000,i,9114931649154259720,17886147703232480419,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=9520 /prefetch:1
  2⤵
  PID:408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --metrics-shmem-handle=9776,i,4495160648220291184,12506832223651761508,2097152 --field-trial-handle=2000,i,9114931649154259720,17886147703232480419,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=9748 /prefetch:1
  2⤵
  PID:6256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --metrics-shmem-handle=9876,i,236984073532001713,15771204825271651304,2097152 --field-trial-handle=2000,i,9114931649154259720,17886147703232480419,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=9872 /prefetch:1
  2⤵
  PID:6264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --metrics-shmem-handle=10052,i,5337488516735467861,5519192644334557606,2097152 --field-trial-handle=2000,i,9114931649154259720,17886147703232480419,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=10064 /prefetch:1
  2⤵
  PID:6368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --metrics-shmem-handle=10164,i,2177359158087902691,11789674321883584671,2097152 --field-trial-handle=2000,i,9114931649154259720,17886147703232480419,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=10008 /prefetch:1
  2⤵
  PID:6428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --metrics-shmem-handle=10304,i,14954361040343785364,7484904286680672474,2097152 --field-trial-handle=2000,i,9114931649154259720,17886147703232480419,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=10316 /prefetch:1
  2⤵
  PID:6440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --metrics-shmem-handle=10500,i,14834001788411500608,9441894006951314332,2097152 --field-trial-handle=2000,i,9114931649154259720,17886147703232480419,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=10488 /prefetch:1
  2⤵
  PID:6576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --metrics-shmem-handle=10304,i,14249312118408869086,16834490116207093604,2097152 --field-trial-handle=2000,i,9114931649154259720,17886147703232480419,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=10296 /prefetch:1
  2⤵
  PID:6696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --metrics-shmem-handle=9876,i,16032893118113651960,9882700069035217398,2097152 --field-trial-handle=2000,i,9114931649154259720,17886147703232480419,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=9884 /prefetch:1
  2⤵
  PID:6824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --metrics-shmem-handle=10904,i,6945250474104342598,17517318301701114598,2097152 --field-trial-handle=2000,i,9114931649154259720,17886147703232480419,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=10908 /prefetch:1
  2⤵
  PID:6832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --metrics-shmem-handle=11048,i,10217347115606107610,6986879252943407944,2097152 --field-trial-handle=2000,i,9114931649154259720,17886147703232480419,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=10924 /prefetch:1
  2⤵
  PID:6840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --metrics-shmem-handle=11052,i,11478858936673264967,4320909918394086596,2097152 --field-trial-handle=2000,i,9114931649154259720,17886147703232480419,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=11196 /prefetch:1
  2⤵
  PID:6848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --metrics-shmem-handle=11344,i,6730564388543965984,2058131194228159993,2097152 --field-trial-handle=2000,i,9114931649154259720,17886147703232480419,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=11340 /prefetch:1
  2⤵
  PID:6856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --metrics-shmem-handle=11472,i,10460868202122899094,8207621940803853074,2097152 --field-trial-handle=2000,i,9114931649154259720,17886147703232480419,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=11464 /prefetch:1
  2⤵
  PID:6868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --metrics-shmem-handle=11628,i,6019972639954687973,15375111379286153141,2097152 --field-trial-handle=2000,i,9114931649154259720,17886147703232480419,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=11632 /prefetch:1
  2⤵
  PID:6876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=11812,i,12871526430015044601,15624731939766414796,524288 --field-trial-handle=2000,i,9114931649154259720,17886147703232480419,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=11492 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:7164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --metrics-shmem-handle=11904,i,7374471433571897972,15503513823496067798,2097152 --field-trial-handle=2000,i,9114931649154259720,17886147703232480419,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=12124 /prefetch:1
  2⤵
  PID:6800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --metrics-shmem-handle=12264,i,16013959049702232287,841515294375331244,2097152 --field-trial-handle=2000,i,9114931649154259720,17886147703232480419,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=12272 /prefetch:1
  2⤵
  PID:6668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --metrics-shmem-handle=10736,i,9500169065241417207,13316231178913440140,2097152 --field-trial-handle=2000,i,9114931649154259720,17886147703232480419,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=11036 /prefetch:1
  2⤵
  PID:6692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --metrics-shmem-handle=11176,i,10019422370369959779,7785126286493405157,2097152 --field-trial-handle=2000,i,9114931649154259720,17886147703232480419,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=11980 /prefetch:1
  2⤵
  PID:7192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --metrics-shmem-handle=11972,i,18040535390218934644,11190410037413319256,2097152 --field-trial-handle=2000,i,9114931649154259720,17886147703232480419,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=12304 /prefetch:1
  2⤵
  PID:7200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --metrics-shmem-handle=12500,i,14049250954690891788,3245947922403393248,2097152 --field-trial-handle=2000,i,9114931649154259720,17886147703232480419,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=12520 /prefetch:1
  2⤵
  PID:7296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --metrics-shmem-handle=12636,i,5086340017602572271,17457230760347400572,2097152 --field-trial-handle=2000,i,9114931649154259720,17886147703232480419,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=12644 /prefetch:1
  2⤵
  PID:7304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --metrics-shmem-handle=12788,i,14020380880386456025,15122137545953140177,2097152 --field-trial-handle=2000,i,9114931649154259720,17886147703232480419,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=12112 /prefetch:1
  2⤵
  PID:7652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --metrics-shmem-handle=12452,i,17326376768969246207,4378960976190310014,2097152 --field-trial-handle=2000,i,9114931649154259720,17886147703232480419,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=11972 /prefetch:1
  2⤵
  PID:7660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --metrics-shmem-handle=12808,i,5270529192238497843,11858203757769378950,2097152 --field-trial-handle=2000,i,9114931649154259720,17886147703232480419,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=11376 /prefetch:1
  2⤵
  PID:7668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --metrics-shmem-handle=12828,i,6013653932233965702,12571000172924058179,2097152 --field-trial-handle=2000,i,9114931649154259720,17886147703232480419,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=11428 /prefetch:1
  2⤵
  PID:7676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --metrics-shmem-handle=11880,i,6981635890279243759,2247095304895542870,2097152 --field-trial-handle=2000,i,9114931649154259720,17886147703232480419,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=12264 /prefetch:1
  2⤵
  PID:7684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --metrics-shmem-handle=12824,i,6010264048904833623,12212466234235002760,2097152 --field-trial-handle=2000,i,9114931649154259720,17886147703232480419,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=11044 /prefetch:1
  2⤵
  PID:7692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=12872,i,16747679086251794442,14729096664889724052,524288 --field-trial-handle=2000,i,9114931649154259720,17886147703232480419,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=11104 /prefetch:8
  2⤵
  PID:7700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=12876,i,17397007435694268114,2549871925830115962,524288 --field-trial-handle=2000,i,9114931649154259720,17886147703232480419,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=12144 /prefetch:8
  2⤵
  PID:7708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=12880,i,7829778042985749762,2894388640864404849,524288 --field-trial-handle=2000,i,9114931649154259720,17886147703232480419,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=11112 /prefetch:8
  2⤵
  PID:7716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --metrics-shmem-handle=12044,i,15519644438118113075,8656969322690558418,2097152 --field-trial-handle=2000,i,9114931649154259720,17886147703232480419,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=12848 /prefetch:1
  2⤵
  PID:7724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --metrics-shmem-handle=12896,i,12516047580693863393,2277600408811068997,2097152 --field-trial-handle=2000,i,9114931649154259720,17886147703232480419,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=11816 /prefetch:1
  2⤵
  PID:7732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --metrics-shmem-handle=12956,i,6782940555801039163,11920055432660864485,2097152 --field-trial-handle=2000,i,9114931649154259720,17886147703232480419,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=12636 /prefetch:1
  2⤵
  PID:7740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --metrics-shmem-handle=12928,i,18046651409289462191,13331960601058303435,2097152 --field-trial-handle=2000,i,9114931649154259720,17886147703232480419,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=12164 /prefetch:1
  2⤵
  PID:7748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --metrics-shmem-handle=13008,i,6555303279572307141,9367623489797477487,2097152 --field-trial-handle=2000,i,9114931649154259720,17886147703232480419,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=11436 /prefetch:1
  2⤵
  PID:7756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --metrics-shmem-handle=12908,i,16072068677640568815,16276035013495919034,2097152 --field-trial-handle=2000,i,9114931649154259720,17886147703232480419,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=11876 /prefetch:1
  2⤵
  PID:7764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --metrics-shmem-handle=12888,i,17532811863093645565,7824427164790728575,2097152 --field-trial-handle=2000,i,9114931649154259720,17886147703232480419,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=12192 /prefetch:1
  2⤵
  PID:7772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --metrics-shmem-handle=12932,i,11203030773432732021,6605495581080478199,2097152 --field-trial-handle=2000,i,9114931649154259720,17886147703232480419,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=12184 /prefetch:1
  2⤵
  PID:7780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --metrics-shmem-handle=13076,i,8263328454551654286,3946172780395941985,2097152 --field-trial-handle=2000,i,9114931649154259720,17886147703232480419,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=9924 /prefetch:1
  2⤵
  PID:7796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --metrics-shmem-handle=13064,i,6956237815456011886,2136907442770778529,2097152 --field-trial-handle=2000,i,9114931649154259720,17886147703232480419,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=9964 /prefetch:1
  2⤵
  PID:7804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --metrics-shmem-handle=13036,i,3959089938487905221,11320323125512755062,2097152 --field-trial-handle=2000,i,9114931649154259720,17886147703232480419,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=10652 /prefetch:1
  2⤵
  PID:7788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --metrics-shmem-handle=13164,i,4133878603176531534,4680730190097055848,2097152 --field-trial-handle=2000,i,9114931649154259720,17886147703232480419,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=9612 /prefetch:1
  2⤵
  PID:7812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=85 --metrics-shmem-handle=13200,i,12104425657941465392,3735098748097868778,2097152 --field-trial-handle=2000,i,9114931649154259720,17886147703232480419,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=9580 /prefetch:1
  2⤵
  PID:7820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --metrics-shmem-handle=13136,i,6753753652569597759,12662520559325950758,2097152 --field-trial-handle=2000,i,9114931649154259720,17886147703232480419,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=9532 /prefetch:1
  2⤵
  PID:7828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=84 --metrics-shmem-handle=13176,i,10667089628558350378,7162908437569494331,2097152 --field-trial-handle=2000,i,9114931649154259720,17886147703232480419,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=9592 /prefetch:1
  2⤵
  PID:7836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --metrics-shmem-handle=13104,i,5222415471160480571,14200296562717161929,2097152 --field-trial-handle=2000,i,9114931649154259720,17886147703232480419,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=9912 /prefetch:1
  2⤵
  PID:7844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --metrics-shmem-handle=13116,i,1210766137532480227,17954262325742027333,2097152 --field-trial-handle=2000,i,9114931649154259720,17886147703232480419,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=9932 /prefetch:1
  2⤵
  PID:7852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=86 --metrics-shmem-handle=11000,i,16003329459250430185,15163458908657288798,2097152 --field-trial-handle=2000,i,9114931649154259720,17886147703232480419,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7684 /prefetch:1
  2⤵
  PID:7292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=87 --metrics-shmem-handle=10956,i,16007301994518080144,16980119071943953055,2097152 --field-trial-handle=2000,i,9114931649154259720,17886147703232480419,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=11952 /prefetch:1
  2⤵
  PID:7196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=88 --metrics-shmem-handle=8660,i,16789073373017527281,844258057367874969,2097152 --field-trial-handle=2000,i,9114931649154259720,17886147703232480419,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=13176 /prefetch:1
  2⤵
  PID:3384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=11092,i,17351988924535876811,10699228429043849352,524288 --field-trial-handle=2000,i,9114931649154259720,17886147703232480419,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=12632 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:7596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=12632,i,5989396271031052531,13968538005070051173,524288 --field-trial-handle=2000,i,9114931649154259720,17886147703232480419,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8640 /prefetch:8
  2⤵
  PID:6624

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2132

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4420

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:7500

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Downloads\bocchi-hero-1672352739701.jpg" /ForceBootstrapPaint3D
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:7048

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s DsSvc
1⤵
- Drops file in System32 directory
PID:2172

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4344

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:7148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffb6210c728,0x7ffb6210c734,0x7ffb6210c740
  2⤵
  PID:7144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1740,i,12032415752120325326,3715614858390856867,262144 --field-trial-handle=1936,i,10272347805674196623,575155255119921945,262144 --variations-seed-version=20260522-170104.411000-production --mojo-platform-channel-handle=1932 /prefetch:2
  2⤵
  PID:4972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2224,i,2840249149992680408,1713325716061711009,524288 --field-trial-handle=1936,i,10272347805674196623,575155255119921945,262144 --variations-seed-version=20260522-170104.411000-production --mojo-platform-channel-handle=2228 /prefetch:3
  2⤵
  - System Time Discovery
  PID:7760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2344,i,3424323068695973550,9297363822325416238,524288 --field-trial-handle=1936,i,10272347805674196623,575155255119921945,262144 --variations-seed-version=20260522-170104.411000-production --mojo-platform-channel-handle=2536 /prefetch:8
  2⤵
  PID:7680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3268,i,10991873537215850709,11691898201101486205,2097152 --field-trial-handle=1936,i,10272347805674196623,575155255119921945,262144 --variations-seed-version=20260522-170104.411000-production --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:5024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3252,i,14886378012840862277,18338328607219629780,2097152 --field-trial-handle=1936,i,10272347805674196623,575155255119921945,262144 --variations-seed-version=20260522-170104.411000-production --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:7804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4548,i,7674846595346540417,15653173691802847114,2097152 --field-trial-handle=1936,i,10272347805674196623,575155255119921945,262144 --variations-seed-version=20260522-170104.411000-production --mojo-platform-channel-handle=4568 /prefetch:1
  2⤵
  PID:6212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5312,i,427413815861166508,11605282023210811754,524288 --field-trial-handle=1936,i,10272347805674196623,575155255119921945,262144 --variations-seed-version=20260522-170104.411000-production --mojo-platform-channel-handle=5332 /prefetch:8
  2⤵
  PID:7172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5636,i,9376791620580529992,10524747898825721283,2097152 --field-trial-handle=1936,i,10272347805674196623,575155255119921945,262144 --variations-seed-version=20260522-170104.411000-production --mojo-platform-channel-handle=5648 /prefetch:1
  2⤵
  PID:688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3384,i,3189470839188910890,15044034659722805722,524288 --field-trial-handle=1936,i,10272347805674196623,575155255119921945,262144 --variations-seed-version=20260522-170104.411000-production --mojo-platform-channel-handle=3348 /prefetch:8
  2⤵
  PID:3904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3396,i,4255268258792923719,13723626566375231799,524288 --field-trial-handle=1936,i,10272347805674196623,575155255119921945,262144 --variations-seed-version=20260522-170104.411000-production --mojo-platform-channel-handle=3372 /prefetch:8
  2⤵
  PID:8076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3408,i,14894828084706077919,17990819588245806191,524288 --field-trial-handle=1936,i,10272347805674196623,575155255119921945,262144 --variations-seed-version=20260522-170104.411000-production --mojo-platform-channel-handle=5716 /prefetch:8
  2⤵
  PID:6128

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:7844

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 f46e987b393cd6609db2cfb81579623e6c1ff06cd5d0bb36f4f71348130de12b
MD5 37aee978b623a4a7825596a618a1dfde
SHA1 d7fcbead61319a98385cd4a3418cdc496d781a38
SHA512 b612325b6d6695670405a660640e2eb9f75d9065559194886b0ca8b67700037a92093fff9fe8eae3977455db1ae834eaff016ea1090be69bb683328dd3352109
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 8f6804b270646793eb038ebea191f076ab2dc24f21e6b1c650dcb3d5c43a23d1
MD5 0c7bfd74970e3c6aada727b8034958a2
SHA1 b50a9ceeab8a50301164a99e1e4f14c6443e1443
SHA512 43cc9b38638280bc61080b5e20ddb29ffff1c96cb21785117cc2c03fee76f34de8ffa20b7361142c7b09ca635b26a7318fd8f5dca3b0628dfc2f50d9c9d9e82b
TLSH
T1BAF028B6C821EC3719FD4B1974650B8BEB51135B2B81595F3A3D930D8FB0A3B4586C2C
MD5 SHA1 SHA512 TLSH

Submit Download

f_00004d

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00004d
Size 52KB
SHA256 58ed81ac02c4f46ad9faf3f6bfff1fa97c98889caa8cd33aeb6c302b3ec3ebf9
MD5 f7bf9c6f341affbe6371d2d1aef49bed
SHA1 0edd76dd788da9e4123245727d13267164bb35ac
SHA512 9b78c7f3b7527d3815fa989faf5021e4d582f2c078d12aca08fb18f9c6c61c35a4c90ebc572c3bd52e9f79e5b7d3914240bbfdc9e02527e6ffe1c4bbf067ef59
SSDEEP 1536:s/qSWlBz/nDSkg6SIBdKPLX3lC/G0htEMp+v5fj:syS+VnDSBu2PTlC/G0h5Sx
TLSH
T10B3302DB20DFED39F36E154A9BC50FDD6C861368E0E9888861F78744768846F5848B72
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000054

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000054
Size 73KB
SHA256 fb69de564c55a631541f30a26e52223a2b422597eefa5a9e4edf9bceb8231067
MD5 8822fe579701e42c5e040b1744724840
SHA1 0c416166b448914abe086a784c24a83078a1b499
SHA512 016813d4e5539b4e3d6cb4ec59c91afe114a9e530115727c49a21f98b9624bae968083443a1c554716fd6a19da056d9c1d57206484c1f8db58e28ecea3804927
SSDEEP 1536:yfMXjpph2FzFBd9el1ehoPgjakxvP8Cmm4gTkQ7yo3DR24fxvyyEX2v9iFJ:+MXjpphqzF7ElfgBvPlmKTNyoPfxvykc
TLSH
T10C73025D799F1FDB1D648642F0ECB084892E687229317AB8D5C89000BF3F625EB1F579
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00005f

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00005f
Size 158KB
SHA256 60072b4eb6fc5f1f1214a34fcd55b3cbd1d05eddf778f85611f9b352c4c6452d
MD5 83266658f29f5cb762001d5d9f6985a7
SHA1 9ff52157193e1e798944e6a3172d938183f5e550
SHA512 60b2a8749bb597b71c6cb7113c4ea6c430ab90c6f6a5f78a36ab5fbd2676fbc173ade236be939e862569c786fbdc8e0aa984f1ae4263e91de2ba681cc8ce5d66
SSDEEP 3072:pqj6fcYjfI87fn/NWUEu+Y4rwgnWSPrrGh9SC2VRvkQdv45cf+Fg:pTvjg87fnVTEu+W3rSC2VRpBf+y
TLSH
T196F3232CABB1EF2298ADD32D789EF491C870553AC097303BB84FDF8575154348A7684E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000075

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000075
Size 24KB
SHA256 12e551f0b1aec3ecb9eaded684a1f81de00925820363c6ad2cb943b9661b99d9
MD5 84645b6733e631540334b4a8efdc1e32
SHA1 cee1f19593d248e7f743a65a8731e0cffcba072e
SHA512 bee08bf3649b27deb85d44f9d45581a22daf2e90503c1638665b87aa87d91499f47cf44b7c839176640a5f3b0f57a60fe9a89afeb512f8f3ee7a5524e804aaf4
SSDEEP 384:kCR+ayo/7URsizvc0ncXudfnrFalhVccll1RHM7kphxyH3EOxQklKcprZtU6:kCR+ay6oLRnlnr1cl7+CzG3EalKcpNG6
TLSH
T126B2D0C040C05FDDED72F80492CC8AC9866EB7D47E6472D49692C9355BAE903482BF7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 7481133cc95408c8dcf076ebb9fedfb3b4e2c115a0ca562c50d630128c1c4ded
MD5 8c906daaba706eb812192d6a2cefd700
SHA1 6218c8337769064add27cf5d61bcce4f0d8cf8d4
SHA512 c442f438fc8f2d9ab90c129ddd5c16e84d59690d1f6a8650c9602f7509154a5b5900ac5bf77e9bb4993e4af06a3d048575fb61c69a36120c8b9c0fc04b8ae38f
TLSH
T18081726352D5FDEACB2A457169E80FE670752499DE271F2FB3100DB420A3F9B8606C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 47KB
SHA256 911e2c326abbfb6aede0c730de27a756f2443a790a397af2223fd575a52df826
MD5 cdc86e094a6e3899d3385be9d6984b50
SHA1 43c4c79189547cd47548413a2d2b3335aec0b7ea
SHA512 c317899388344c999a36f4662e920c407e95ce71ac88d66c902e52a107d2314ad535ccb82d318b86df249c69d1ffb69a66a84268ccb3e3e7b230b42fd110b537
SSDEEP 384:Dwhm+55cqt9ywED1eYbYy4IyBe/CmVHBe8HeKPFASDYe6q1/UJqb4JK9qTrFWPan:Ae0z7ccVkrUbjYAhpSaTbnyjJ9k
TLSH
T12D23EDF3C3F5463D9D1165F06A146F1FCE28049603AC3D4A8DE4AE8A93F1D72E252A5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 7KB
SHA256 3bb73827e2f0c99684a61003322f69dbebcf0d4c2bc78bece4a546ff7e43a4fc
MD5 edaa87c1043ab5b484266dc68f5049a5
SHA1 d32fe9c69739452e3253bb72e7bcaaf452b59a76
SHA512 c98e98282856b75ce484cfb0870d2437a15d22c2834f5f24e75114f6e61a2717a824b5f05b83efa3c26f5e77444db55af87a114a03556bf76e3433825be81c28
SSDEEP 192:tyUIUWeUGUgU3UlUeUWUIsUXUHnUfUjUCUPUnUPUWRUjUKUOU2UmU9UEIUpUGUpy:cXRebBgi/PRsmmo+7YAeJR+JjTr+/IcF
TLSH
T112F15BA3D77FF85B102DC97B1D14B80A29BAB4361192A4F5DF67817DB0C88F72B16026
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 ce203bae8718362ec15c6b8770256cfb9366b333003801b88368ab7e3c29b2dc
MD5 b48ec20602986212f70dc358aa6e4467
SHA1 077bce34e579e88a6efd53e6131ca48ec8beb690
SHA512 cd6c15a05fe9889439896b57cc5e36e700518a5e48af71c0d3b8e65472066a4738a0bccc3e6936974415bad63a31857e3a19acc02516b177e5eedf1fb78ce3e7
SSDEEP 192:pRecBzvGp/ARK2v7spAPRp22m+Z9wHsb+WNn814T2126k2CUkwQtVyIsnAUgtaJ:pRemzvkKKCYUX/7KwMF2T2nm8
TLSH
T1E842E62EBD18293B5DDAC21AF9227B97D7F5002126842E94E6FCCA1C14DB9CC332741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 fd2979d6caa870cb88c7fa1ed43b57e55ce18bdb975fb5d829b38261b1b75fea
MD5 3f33a32ab92512372727a02b65967691
SHA1 5d783663b03e8f4b348df1926845d5d0254e966f
SHA512 ea47be8f32ef2dd5d375fc9b552ef1c5035059b46c94869d75fc1b662b57263e31b2ca879b4ef7b8aa0ab9083e8967c784c830722c0699a981224fe3ffeeed40
SSDEEP 192:JRecBh/Gp/ATtv7spAPRp22m4XXp89wHsb+WNYuT7ZOrBDcjG/2N6cp2CUkwQYQM:JRemh/koNYUX/WKws2Y2p2nhUe
TLSH
T1EB62D72FA964297B5DD6D22AF921BB97D7F9102226C01E94EAFC8F1C04DB6CC3217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 58884c5bffaf171138db329aa1393ab709f01bcc9674fa71b7d6533c7b7aad2c
MD5 42f63278ac9f45c7f43b61876fca7944
SHA1 afd31ac1d6d19da9395c279928242e292e1e7026
SHA512 e0241bb0b27ad9afdf9d93e669b6924a1658e6966a89f358a6c004adda6ea722fb9b1026e578ad50b32569c3ce3887eccad2a59dad4543f4cac8874e77f46390
SSDEEP 192:JRecBz/Gp/ATtv7spAPRp22m+0p89wHsb+WNYuT7ZOrBT21DG/2N6Bp2CUkwQYQM:JRemz/koNYUX/3Kws+42c2nhUe
TLSH
T17362C62FA864297B5DD6D22AF921BB97D7F9102226C01E94AAFC8F1C14DB6CC3217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 da881867ace15bd0a843d2ad5154f2f103695f49140a615710ae980373a8fd32
MD5 c0e67083340a75d9e9e4177f1111b4f4
SHA1 5edb37630905bc432bf5b6ed4e47399f45bb3fe0
SHA512 c5fa46b21c47891918498307ee92b09b4da2f404e2375a964e14e7af60d2b7e8b6962ab8fcf7b532560db4010ac5da66e57e3485c5be7bd8ae059a66f267fc4a
SSDEEP 192:pRecBz/Gp/ARK2v7spAPRp22m+0p89wHsb+WNYuT7Z814T21DG/2N6+p2CUkwQYf:pRemz/kKKCYUX/3KwoF42x2nh6e
TLSH
T19662C62FA864293B5DDAD22AF9217B97D7F5102226D01E90EAFCCB1C14DBACC3217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 379d96542283773f422c052abe7293924621df1604b63c9a59676e1514d2db6c
MD5 d066f854d368cbebca026e5da297c2c3
SHA1 4f2f84d54b0a8dfd273bbdb70bcde51ad5e2f12f
SHA512 613285c6b38983d33fb336394c5eff7edb692f60dfa433defdbf45524dd1c84cadfc8cba744a39b1c75482b318f7db6eaaae9842cfa8649a9ad00cece8442e41
SSDEEP 384:gCjUH7KxkXqKf/pUZNCgVLH2HfgslsZ7pLuLcSjCDXODUr+ErU3/NHGcmyqOqjmo:gCUH7KxkXqKf/pUZNCgVLH2Hfgs+Z7pF
TLSH
T15A7209676C4C9E370F94C6CCD8267F4F9DB5024B65E9886483FA9C2903D5ACB114A2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 d94dbd3cf5090c9ef0c0a2143eff09153531e6792b59f791608db73ea4c3e293
MD5 638a142f8aca732c1edb931f6a764261
SHA1 9d00c1baf23069a6dd91606cf3f754cb11845db9
SHA512 8f537073647c476a4e34a1bff627932ead1a4f74d16dfeae04b31ffdd1a8ea5dcfb48b6f83f2673579eb2918c1e60a00dcbd40d7c1afa08f2f0ad6b3064da447
TLSH
T183B012508001D711C00302F4114214887114EF21E70A1B0143E07922882555085560B0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58c772.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58c772.TMP
Size 96B
SHA256 b4b2cd63b28ce0ba6dd267706a3370fd397dcfc1c1730311d9ccd789a66470a1
MD5 8c625f98451aef43751750dc1dcb3dcb
SHA1 3515b5041702f683808a05b0e5074ed8befd6fbd
SHA512 2575f012346362a28ff4ff5556ac29be123dc113452a84c4ec1d6e8014d2897b17de2f508e275fca6c3fd45e18a327c8f79a810262fb783a0455ff95e938a9c3
TLSH
T1CFB0029DC116B223C05703B02996F5E87360DF37EB131376A3E12B6BDC256A0856557A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 e487c453d483a70496529dda483ada6d4dae25a9ebe5b41def83dfd69dcd9e38
MD5 94ac1ff3ea65c5dcf09ecdf10adeac0f
SHA1 b43a01de2556214ecc0eac65b856d34d0a723ec1
SHA512 04dfc25545534c7ac0b85b8940223bb7057d2785d197a5fb75fdc12cb9cccf5e6c1aa5028f3f04d3f99a23e9959b83933fd5a3ba9d32d428cef51df4f9504c54
TLSH
T1B1B022C22382A082C30233B002C0228033308C3283020283F0B888EECCB030FCA00320
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 120KB
SHA256 5f9f2d0cb4e631ec89fd931020f708f2ec73b3998bf6fe19dda3dff37e401810
MD5 538fb3321bb792ef7d17a86cbc08c175
SHA1 748e184572c2fdcc36892c9ac4ea921a75d86376
SHA512 4377c6aba92c40b3fe19cf7578ce8d86124297d1b6a9e75e610cb346a6971fd4071bdd1a25407136ba45af2ccdae80ae33016aabc9aeecea85661363a8a500b2
SSDEEP 3072:r1ObAWSl6tgbE3ct2qFW4XRqcKyZP2+OWVEkDZ2IZ8lFU:rLWhtQp2WBhKyZPhp32IZ8lFU
TLSH
T1CFC31290CC303E59F912F61ABA15A91B9F151F662E90FEB5668CE70335C98AF4317E30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 f54f2bada05d49dc88c1cb3f45601edbae99cfb243f187912ef06a247806ff92
MD5 ea2e4fc0aa6168967c02cf33946cdda8
SHA1 25496167fb952a672f1e45e6d917459ca9885674
SHA512 56912d0284635cd38f241aadd9bedf08cec29ac5514153b457c6d2918e6cd46142b908dd7cbebd17e9c9e1fa902b40c7204641a85b8a29de8a634afa36d123ce
SSDEEP 3072:lGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMK:sm7Rkm1tYpBeh2BAoK
TLSH
T1EDC3123B5D65E9779979A70EB08E0B1F1EF149A2C920DE92C8D85B0437E97C90A04D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 231KB
SHA256 0b56ce9a2870a47bb4967968e592b6020fd81593aa98b15a2bcd7bb72a4f0e10
MD5 fed6dc9e630dc7c8e9ece3ea2836b289
SHA1 baf900598b1eaec17b0fa2c6c681dbe2bba83afd
SHA512 94a4b97a4d8e9902f7b65f67629a3770e596b7d9d964298f80ccb8bcd9eb2ca030804f2f1b6cff684720b14a6267acff2bd43359b92551d18f6794c8f132958c
SSDEEP 6144:mLWhtQp2WBhKyZPhp32IZ8Rm7Rkm1tYpBeh2BAo5U:Lh0BHPhRlZ79oBGcAoy
TLSH
T18E3412228D303979FD25F71EB54D5E2F1EB10F665D20EEA295C8EB0136D9A9E0706E30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 231KB
SHA256 2517517cb359b1bf2e86c6b51cc7e6f2ebe97336f16e2bda4a9af24799b67e21
MD5 49e16f9b7d79d73c188b01a44920ecf4
SHA1 6624b5b28ad1ab4101e14cf5014bf271894a400b
SHA512 d4229bfe9e412354e1ef5d836820ae5109c27f9511dabe65c2ec14026144cc5b352eec6a71ae57e250f51cbf399a09626b6818768130855784f28a2ff88c12eb
SSDEEP 6144:vLWhtQp2WBhKyZPhp32IZ8Rm7Rkm1tYpBeh2BAo5U:Sh0BHPhRlZ79oBGcAoy
TLSH
T1D83412228D303979FD25F71EA54D5E1F1EB10F665D20EEA295C8EB0136D9A9E0706E30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 231KB
SHA256 71a2e2abcecf740ba06740e389be64ac168253398d40c3d3cea2ad32387a51c4
MD5 8a842b69141521ba50072d674a28ac8f
SHA1 fdb67ef65b7f7b7328f2a271b8c88d4562140f78
SHA512 471f6ba2ba208758d1343e734f04aea50d1c8cd201468d2563215f16754598288e2f195f74847973d5b040337ca315ec97ebd849a1941fd4e69936487ede9c0a
SSDEEP 6144:ELWhtQp2WBhKyZPhp32IZ8Rm7Rkm1tYpBeh2BAo5U:ph0BHPhRlZ79oBGcAoy
TLSH
T18C3412228D303979FD25F71EB54D5E2F1EB10F665D20EEA295C8EB0136D9A9E0706E30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 231KB
SHA256 17664cfe3eabab9345b256e02b026e90969134c511e729fc54b5e6eca6217be0
MD5 6ffb8b8b6be9816674c831490ff4ec88
SHA1 02cad32d18a7958719193dd28f9006fc663aea6b
SHA512 9bb120215bfe4fb611d7c4ee9ecd148e12dd1fe5cdd631d6cd3153d34c38876882153df8148f9b6bdc4599b65fd0b1ca10dadbb75db0d1073b86c57f46e1f5d5
SSDEEP 6144:xLWhtQp2WBhKyZPhp32IZ8Rm7Rkm1tYpBeh2BAo5U:8h0BHPhRlZ79oBGcAoy
TLSH
T1C43412228D303979FD25F71EB54D5E2F1EB10F665D20EEA295C8EB0136D9A9E0706E30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Size 264KB
SHA256 35c6c114ac7910cac766948b8fc79ef79f04f8f6b27b35aa042745f1d4933dc8
MD5 4eed98ca3c71d77f678aa7e9f828eae0
SHA1 49d115f9d2f29a2ab130b64b5e12c27f3764a850
SHA512 1379420123409a8697cdeb19317ca473e00692d2d0cecfe1a71f7dc0ffb3729142eb1ccb871d5f298a2e06f96bf38f403983a8cf6cd1f3599a9b178ffee69db3
SSDEEP 3:MsEllllkEthXllkl2zEklE:/M/xT02znE
TLSH
T1414404047FC0C405D50014304111D7500370D410C71157C3755D04D35DF7D410D41101
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI36122\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI36122\_bz2.pyd
Size 84KB
SHA256 b3dd7cea6d03342252834cebcc814af37d850b86d0627fa22b7f6990882f2f8b
MD5 77294e590d14a22d98862c141e7ea4ae
SHA1 88a64817b0699025fcb1dda533355a0b30bd92bf
SHA512 3dac79115a510fd09d384829ff1b45864c2bd20db34459c5ac84ccb65f2befe5d59e13cc232fa23c77232421886a8eefa8d6b5986199e32d2953fee92dad0abd
SSDEEP 1536:HdsvXm8z7+Cnqncm4WlTtdKSzBdIM8vOBs8iMdIsLVuyEJ7Q9bfIgHX:9svXm8zaYqRptX7IvvOC8hdIsLVyY
TLSH
T1B6837D86F36542B6F99BD1F886800793FB30BB950750A3AFF148C2992F13B916E5C219
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI36122\_ctypes.pyd
Size 130KB
SHA256 dfa65498c77e71f038883337d2b5ffd92508489e79e6ee5e96ddec4ecf2a7fa1
MD5 0ac143334e94105facaddc5fb20fc691
SHA1 28cf13be0a0eb84f48c919e68f78852aa4856853
SHA512 00b1a76760b33f054a785be9e4818879121cf5cb60b716d19f2c22c8c58075eea32e626a0962385b18babfaf5d5e33244c09c2e481f99a93577cfeb1647a22e7
SSDEEP 3072:au1mymWLaxMd/w1KVMSf/Fa4IP0JrsFXI/1cswRIsyPyW4IiFx:ac4WLEMWmRf/FaFP2rsFy0zx
TLSH
T161D37D0B775800AAEAA79178C173AF47EBB1B453171187CF02A4C69A2F637D25E3E315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI36122\_lzma.pyd
Size 155KB
SHA256 f20be6a9fee8fb5d53170c4bc24a39b48d3c0ccbe8e2000e60ff7d65b77c6ea1
MD5 a0e27c2f376dc80dfc3f884963a0f416
SHA1 f2738a7e6dc65cd9b915a33af354d2f04b768712
SHA512 6e0c50e52e48b29098fa3b7614f190ecc84ab12ed3b376e7e7148f84eceb3101b9ea6972f100b5478059f62d90aded0dff8522440728d0c0904d8c70457f734e
SSDEEP 3072:xqZ/boPLmhrKifqGDRJUs0znfB9mNoTvm28fgS+dIs01xMW4Iiy:xeTgLhyvUsq5YOTCfd+E9
TLSH
T178F35C86B794F0D5F7728C38D6628F57E7F5781A0320929A01CC936D2B1FB659A2E313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-console-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI36122\api-ms-win-core-console-l1-1-0.dll
Size 19KB
SHA256 0052515763a1a31d2527a2eb2523fb7b88d8e55c4e4da5ef352b565476bf21e0
MD5 7699c096202da0db6b07fafc914d60ed
SHA1 6e952be34b9457b0cc3e4aa372d941030407a0fc
SHA512 ae93507cae8d2096c688850d369f8ef282699770b1e27621ed8ebeede1bb285a290f1e2e06a6e9287a05c243b907371977501f1aa4181810913763e0d5bcc2c0
SSDEEP 384:vWEhWQy36q0GftpBjqVsVERHRN75UVplCADZgJq:/0kisKEBq8ADZg4
TLSH
T1899229D2CEBC8443EC939C7017A8D9877D3CEBC71910661515AAF6E918C33D1EB14A2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-datetime-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI36122\api-ms-win-core-datetime-l1-1-0.dll
Size 18KB
SHA256 cc6c2fdf1c34fa82036165b111f91220bcf7e43aab79dfb284f982f0590bebb1
MD5 928be2a3fc2e88bda5ca0808324e97c4
SHA1 b1e1bf73c5dfa99ad69bdc83ec6b6f65cef1c3e2
SHA512 fc83a74dbd60ada174798d7f40d839f30ef4a288805121ea8d303e39c5fc81188f9ee86131c3df3e2b37edfcca2bfeb3f69aa14e93a0d5d87a6255c6e87c73a7
SSDEEP 384:4WEhWRMoq0GftpBjCtOSbERHRN7qlZwHcC:ufaiEbEBGwB
TLSH
T1F9923BD5CABC8083ED935C7063A8DE837D3CABD71D10951615AAF5E82CC33D5AB2492C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-debug-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI36122\api-ms-win-core-debug-l1-1-0.dll
Size 18KB
SHA256 f9aaaabf78feb39a1d8e971f5ce047d1c4a896a80409b800f1f7112cdce420ed
MD5 4cb14835b061f42179d5251e744fd667
SHA1 4a1b0b32963a20c479927e4e008bfa9b4168f226
SHA512 20c11b2dcf8a928d04cfe6a0130716cc474d48c996025950214d6f9e97bf26b0ec6e2a68f954b0875fc05ca49811bc6e943f91b592fecd14cc8fddd3201841e9
SSDEEP 384:EWEhWbC2Jq0GftpBjDNACiERHRN7lVTdlrltm:SoLifNiEBDl
TLSH
T158923AD6CA7C9443FDA35C7063A8D9877D3CE7C72D204656059AF5E928833D2EB2492C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-errorhandling-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI36122\api-ms-win-core-errorhandling-l1-1-0.dll
Size 18KB
SHA256 a0aa340274d4bb46b6d9547d647ab7dc16c229577bbab836e6a4f3307f310332
MD5 6177998c2ce574a177e524746b77efe7
SHA1 21f262c4826e6edd8534a9196afdfae9ac0e3d51
SHA512 af8d6bbacd38b23f48f27bb472beb81ee4ee6200ae54317d282ada104252777b57b056fd5de5ff0463ede1be8b734a8741d80c65a70b37910c13f04d85005117
SSDEEP 384:QvfC5WEhWHy36q0GftpBjTIPaHHCERHRN7sylTIw3R/E/M9:Qi5FkifCEBjR/mC
TLSH
T14F9218D5CEBC8583EC975C7022A8ED477D3CA7C719209A1605A9F5E92CC33D1EB24A2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-fibers-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI36122\api-ms-win-core-fibers-l1-1-0.dll
Size 11KB
SHA256 4fc85a8c0702cc1735168c19df4576df9781422788870f60a35bc92ab435b9ad
MD5 82c2924e57eb2ce06436bad4c52d2259
SHA1 4875c1ba30398fb006f3469ca44304df58068f8d
SHA512 203b00a3cdff9cfd8faf872aa12715047b32e82e7a67bd92ed7c1e6af0fcec62bc27fd98b19c7f4cec274354c8a0280af8e6b10aaa72e2ae5c10deea8163a5c4
SSDEEP 192:F9RfWphWA3D1S8f4DBQABJJ7FDpc9blDJ5iqnajVss1xb1:1WphWqD1IDBRJJ77c95DKlxT1xb
TLSH
T145322BC18BB84443FAAA7E7003A9E9577D3D77C72C20416A059AF2AE1C833C5DB0476E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-fibers-l1-1-1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI36122\api-ms-win-core-fibers-l1-1-1.dll
Size 10KB
SHA256 3a7a0e70e2bfb555cb093e1584cad4610d559db25d60c2982fa01958e565f514
MD5 88eb90167f6ab6b608191faed33917a4
SHA1 5579be793c82998d1d93c6a23db53d647633e845
SHA512 32c14f9e30fc0acf7be34dec837e2057a380c0056d544ba7b0dd7533e1f62dd07c4bc2af4554391ce42b52d4a9626da209a5a1acfb56f903b1dfac1559acaebf
SSDEEP 192:aWphWlFD1S8f4DBQABJtX7u5uE7MqnajcaZ:aWphWnD1IDBRJtX+uOMlAy
TLSH
T1AC3219C18B784503F6A77E7012A9D9973D3E77CB1820829E4585F2D92C877C5EF00A6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI36122\api-ms-win-core-file-l1-1-0.dll
Size 22KB
SHA256 05b478718540a6f410a3ad859f7d5e56c223d6786eacc7e9bc80264f587fd0c7
MD5 33636552339a4a04d75b7c32dbec59d9
SHA1 6457c3941d57bebbc3a737c84377d102b6ece18f
SHA512 b0f9ffed8b8861c9599e5cf0fbc5374e7cd8d170a360a3dfeb37d381dabef941875eaf325666978071d25aa8f49d729684d8be71d12c1b5a8928a7c00156ed03
SSDEEP 384:SBPvVX7WEhWqC2Jq0GftpBjQXERHRN7qulfgOBU/Xwm:yPvVXD3LiaXEBuW2X5
TLSH
T125A21997C9B8E247FD8B9D3122A5D9437C3893C30820559617DAE7AD3CD33C6E7A8918
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l1-2-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI36122\api-ms-win-core-file-l1-2-0.dll
Size 18KB
SHA256 6878d8168d5cc159efe58f14e5ba10310d99b53ab8495521e54c966994dac50b
MD5 9d8413744097196f92327f632a85acee
SHA1 dfc07f5e5a0634dd1f15fdc9ff9731748fbff919
SHA512 a8f6e9ee1c5d65f68b8b20d406d3e666c186e15cb3b92575257b5637fe7dd5ac7d75e9ad51c839ba4490512f68f6b48822fc9edd316dd7625d3627d3b975fb2a
SSDEEP 384:8ZWEhW4Moq0GftpBjbFZERHRN7rklkETkA:8ZGaiDZEBLETf
TLSH
T10B924AD18ABC8483ED935D7063E8DD477D3DA7C61E20951905AAF1E82CC33D1EB2492D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l2-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI36122\api-ms-win-core-file-l2-1-0.dll
Size 18KB
SHA256 b74aefd6fa638be3f415165c8109121a2093597421101abc312ee7ffa1130278
MD5 361c6bcfcea263749419b0fbed7a0ce8
SHA1 03db13108ce9d5fc01cecf3199619ffbccbd855a
SHA512 aa8b585000cc65f9841b938e4523d91d8f6db650e0b4bb11efd740c27309bf81cdb77f05d0beda2489bf26f4fbc6d02c93ce3b64946502e2c044eea89696cc76
SSDEEP 384:oVxWEhWWy36q0GftpBjHAdsERHRN7wUlZwHcv:oVhukiqdsEBwUww
TLSH
T12E9229D5CABC9483ED939C3063E8D9877D3CA7C31910951615AAF5E92CC33D4EB2892C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-handle-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI36122\api-ms-win-core-handle-l1-1-0.dll
Size 18KB
SHA256 550b4f5ba95108b01a24f05496576a4e73642334a10dde61b09846e0efb9f260
MD5 c2cd29370b21c0361d7f79d248c05860
SHA1 52efda4ba402c793d4c75e6ce185720ae1432249
SHA512 d2165032403277ba10bfbb7861bbe7395a8b0847a669588d3780953d07c1b0ea4461acc49753e8d4978840307b1c50f9e814ab5b62b8e341159e02109bcbab71
SSDEEP 384:fWEhWmy36q0GftpBj4PERHRN7lmlfgOBU/g:POkiuPEBtW2g
TLSH
T1FB923AD5CABC9443ED939D7053A8EA477D3CEBC61D20955A0596F2E92CC33D0E724A2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-heap-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI36122\api-ms-win-core-heap-l1-1-0.dll
Size 19KB
SHA256 eca63fc5c873ce8b36c507e2b9a88caaea9617c84669886b15f6bc38bd0024c6
MD5 e93f34fdcd8e5ffc34af48c90f6f95d1
SHA1 1cdafb0dfb29712d37307bc5e5edefab0eef6d78
SHA512 3bf430a6a20b020f60627ae68d6385f3abb7a89b16cccc4aed1939c28527680fce7a426f69353041c7ac50a177a8e7c3a631078e46bc73a8bf0e2b2e83a779a8
SSDEEP 384:VlzWEhW9Moq0GftpBjEwkcERHRN7AuhlCADZgJAq:LHaiwcEB4ADZgN
TLSH
T107923AD5CABCD543EDA75C7063A8ED473D3CA7C61920461605AAF6E92CC33D2D728A2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-interlocked-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI36122\api-ms-win-core-interlocked-l1-1-0.dll
Size 18KB
SHA256 2f2f9660f4ffa814f465676d5b9cb9bb70d0b7c5fc5eb14c34cfe94a50883b21
MD5 28fd20b58320f0ed023d9ca19da3a06d
SHA1 b7948da624d84596055a9ae2a45aea3a9b2d7b9b
SHA512 822e34cacc70ee151ff534f960d0820ae7d184a764b41ce23828e8e0e80daf4888f528c9b1351a76883eea2c6eb9674c8418f1787c1999ea06191d67d3928418
SSDEEP 384:GWEhW4C2Jq0GftpBjG/ERHRN7YlTIw3R/E/Mp1:cRLiKEB+R/mU1
TLSH
T128923AD1CABC9543ECE75C7062A8ED877D3CABC71920852601A6F1D92CC37D5EA24A2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-kernel32-legacy-l1-1-1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI36122\api-ms-win-core-kernel32-legacy-l1-1-1.dll
Size 12KB
SHA256 b563112cfddf1623cd157e77981c1d21cb65cb5efab510e8d909e5aae69ed01d
MD5 a05aeaf59a8b353e690041489fc2b2d2
SHA1 92ce0c1a16a1b03cea3c47e4bda8a832538e8217
SHA512 6f29cc6081cbdc3e52eafd207493541b55f59ad910fdbb168aea40cc38e23f006aef2ae0f04d523b64a5b4d2526a512a45eb0fa2a1586f8e4a7fdcf26034a34b
SSDEEP 192:MYldWphWAUD1S8f4DBQABJJq0E39blDJ5iqnajVss1xPb:MsWphWZD1IDBRJJql95DKlxT1xPb
TLSH
T115422BD287788583FAAA7E7012A9E5077D3D67C21820417A05D9F6EE2CC33C6DB0076D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-libraryloader-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI36122\api-ms-win-core-libraryloader-l1-1-0.dll
Size 19KB
SHA256 2f9c3b077da02c587964a59e9c4e2f383ff8357229eab4b4f04814df94d78ff0
MD5 b45f933a57e388cfc5399645cdb696f3
SHA1 d85450a4169c79b249d4ef64ad475f6645dc311c
SHA512 e0df0637bdaa4293ef0b4c0a5b9e40e5d2ea891dbb2ce465394efef8a1f07df52630069e63d5e800575ba55c78c79ce095aace3983258b4c576cde500ef3a3be
SSDEEP 384:svuBL3BXWEhWDy36q0GftpBjxCnERHRN7n81lZwHcK:fBL3B3RkiCEB8xwv
TLSH
T1749228D5CEBC9483EDE79C7052A8DD877D3DABD31920996505AAF1E928C33C0E714A2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-localization-l1-2-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI36122\api-ms-win-core-localization-l1-2-0.dll
Size 21KB
SHA256 6ed17fb3ca5156b39fbc1ef7d1eefa95e739857607de4cd8d41cecfcd1350705
MD5 b402ed77d6f31d825bda175dbc0c4f92
SHA1 1f2a4b8753b3aae225feac5487cc0011b73c0eb7
SHA512 ec04013139f3fd9dbf22b92121d82b2eb97e136f8619790cde2d0b660280e838962f9006d3e4c3a359627b017f2b6ade7edff3bbc26e559c3de37540585602d9
SSDEEP 384:NOMw3zdp3bwjGjue9/0jCRrndbkWEhW9Moq0GftpBjciv9ERHRN7h3olfgOBU/J2:NOMwBprwjGjue9/0jCRrndbyDaiysEBY
TLSH
T135A23BD5CABCD243FC4E9C703266D9437C3CA7861820995512E6FBA838D33D5E764A2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-memory-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI36122\api-ms-win-core-memory-l1-1-0.dll
Size 19KB
SHA256 76a3aa52d49dd0d8e0451f4045f4d8ba05d2332d0db2a39408b85cd2e43b84a3
MD5 ca3906b115461654eed0db5933eef5d5
SHA1 0f03527a70c14413a7d114431f60d610d1805b8b
SHA512 ce6e067c528c76714c01cd2aaf052e170c2db0f77eec6486d15f08df357abe06a849b56506f89b95f1431a942b2b515f9cc626c7ec2847f4289fb613c91f6122
SSDEEP 384:QqWEhWdfC2Jq0GftpBj42ERHRN7LXLlZwHc6k:riLi5EBDLwu
TLSH
T1709249D9CABC9443ED936C3023A8DE877D3D9BD31D609A1601AAF1D92CC33D5A72492D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-namedpipe-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI36122\api-ms-win-core-namedpipe-l1-1-0.dll
Size 18KB
SHA256 b1b2595494072a52f1fc44586debf52312eab1a245a7a16185d7b1af37b159a6
MD5 f24f386cfa5f097b523ccfba5c8cdca3
SHA1 fc97363843226bb69b8a1f56d8b8735a087ac103
SHA512 eb6c38a7ca3b627fc52b8de65e8564004923b4533b9c4c920666d1d4c32c762e65cc181742b39c688654c8639df6a385f7ea1fbe50a89471b2f938f897df4278
SSDEEP 384:XWEhWCy36q0GftpBj/2QERHRN7nlkETk0:3qkil2QEByET/
TLSH
T100922AA5CABC9583ED976C7023E8D9437C3DA7C61D208925159AF5E92CC33E1EB3492C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-path-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI36122\api-ms-win-core-path-l1-1-0.dll
Size 3KB
SHA256 e39ca111d81e6e5d90cf13fa0aee525d8a2740b84d2c5cd378dd69e4f79f8b0f
MD5 2cd77f6e2fa6a502e352369426eae1c1
SHA1 abb54114f3677944af582afb6ea1f4a7785537c8
SHA512 47d47a49b8f89f64bd0d4bda344456784e8b0721f9ba32ce3b88e6dd5bec06bfb781dc44495ac17b4c50dfe679e1d18594fa91ccdfa26bed055a2c4a5c7c2906
TLSH
T114519A2913F84965F0F64F7145BA0792A16AFF11FA71D3BD1B9C200D2C722688A31BA3
MD5 SHA1 SHA512 TLSH

Submit Download

api-ms-win-core-processenvironment-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI36122\api-ms-win-core-processenvironment-l1-1-0.dll
Size 19KB
SHA256 bf11319eb6be15633e47ab8f247d1acc9a9ecdf37181fc0ddfe9388ab82ac90a
MD5 04729245832e3bf24cb5b28f9c2e9c1c
SHA1 1aacea212ea11758ab8c6c64cf7c501a3f713696
SHA512 11001746aa23c5999778d9a17892da029dff5e8e34265efb40ab5704f4d5f52cc4750efbe0d8b911e1aeb1875e4f0a4398655e1bf63143abad83b39643c00b5a
SSDEEP 384:TWWEhWcaCIc3q0GftpBj6Iz4ERHRN7soIslfgOBU/g:oti34EBsdW2g
TLSH
T1EE924AD6CABC9003FE935C7023A8E9573C3C9BD72D104569119AF6A92CD33D1EB64A2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-processthreads-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI36122\api-ms-win-core-processthreads-l1-1-0.dll
Size 20KB
SHA256 7646eba0c683fc3e1b00f0b3b2b5912621b2016a6ceb7d53181cd1c3fa64785a
MD5 c9dbb0de9907bb628f5733c81f973462
SHA1 dd51e5840ba634f8ff0d6b57510622c16ba4706a
SHA512 e9b754b6a79808ef353f3991ea98b951867308ab73cae2a666b039922190394a73bcc849744823a77754519c3e5178213d75e5b787b18032ab9be0a5dcb2a813
SSDEEP 384:OWXk1JzNcKSImWEhWqC2Jq0GftpBj1vzt6ERHRN7+OlTIw3R/E/Mb:ObcKSdjLirAEB1R/mU
TLSH
T111A229D5C9BCD683FC8B9C7062A9E9533D3EC7C61D20852505A5F2E93DE73C2D628928
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-processthreads-l1-1-1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI36122\api-ms-win-core-processthreads-l1-1-1.dll
Size 19KB
SHA256 4de821884cbef4182b29d8c33cfe13e43e130ad58ee1281679e8d40a2edcb8ea
MD5 3d872be898581f00d0310d7ab9abaf2b
SHA1 420e0ab98bb748723130de414f0ffed117ef3f7e
SHA512 35cfb9888a5f4299403a0d9c57f0ba79e3625431a9acc5e04ae2ae101b3dc521a0dcff5d4a1bf508b25dbf05dd432f6987d860ff494d15538ed95673a8b7376b
SSDEEP 384:9DfIeAWEhWdC2Jq0GftpBjDL8ERHRN79j9lkETk8O:Gem6LiJ8EB9gETPO
TLSH
T1B0922AD5CABC9483EDE75C7063A8E9837C3DE7C61A20852515A5F1E92DC33D1EB24A2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-profile-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI36122\api-ms-win-core-profile-l1-1-0.dll
Size 18KB
SHA256 4ca44ede30b46f1f23905cecfa27f0edb26ee960dba10f9bf8002d79ed77c3e5
MD5 aec5ebac6404b541565026c3cb290e0b
SHA1 e541075842de9dd7d0400ca0e55019d080697ab5
SHA512 74f4d501460c4a6f93888ae9b25d9732584c07efd86ed9487b0d75e71e2eb03a840c37002c74967738088804192d42b9b443f5a826c8d66f1171232f6166d93e
SSDEEP 384:uVhWEhWoC2Jq0GftpBjJnERHRN75QrrhlkETkFd:q1Li3EB5UrwETgd
TLSH
T1BF823BE5CABC8443EDA36C3063E8DD937D3DA7C61D2095160566F5E928C33D1EB24A2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-rtlsupport-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI36122\api-ms-win-core-rtlsupport-l1-1-0.dll
Size 19KB
SHA256 09b7f0a7f68a12602e7f4dbd5a7f1cdfb3e93fd54326884e48f36e2e200acce9
MD5 b8cec282fb1491eb1d2be2d969e96fe2
SHA1 f9011802509b3bf617e76d5b0f16a2802749a5bf
SHA512 339b6d129b4660f2fd377bf28f6819e941ba7d36377c9b59a1b9098c3bfef0a62d4955e9a5338f09174c6a875ac1f420eff5c422f63ab00194e2ba206fd42ed3
SSDEEP 384:cGeVdWEhWm4y36q0GftpBjjQJykGERHRN7zQTlfgOBU/pMw:cGeVFpHki5SZGEBzbW2pL
TLSH
T133923BE58ABC8043FD935C7023A8DA977D3CABC72960452604AAF5E91CC33D5EB2492D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-string-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI36122\api-ms-win-core-string-l1-1-0.dll
Size 18KB
SHA256 3eda46e395fad6ec222ab44188d6a46a468b0fd4aff28252938f4e6a9a3e3893
MD5 059bb41588d83c95caeac5d06cb0b59f
SHA1 c8b26d26ae2118d7ae25fc87399fb2cd03e7f4da
SHA512 0f4c0208bbea87ec54453d718fae2f4708524b3b6923b947e96a8c465dd8a9de00be2e5c90cb2b39a24d064dbed5417e7f954981689e89ea50b2c769c0be64e1
SSDEEP 384:9yMvfWEhWcC2Jq0GftpBjKuERHRN7l2wlfgOBU/2:9yMvP9LikuEBgxW22
TLSH
T108923BD5CABC9043ED935C7063A8E9877D3CEBC72D208566119AF5E528C33D5EB24A2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-synch-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI36122\api-ms-win-core-synch-l1-1-0.dll
Size 20KB
SHA256 83c1df33df30df48ab161a5a1d6c3cb4bdaebff330ee6e81e871afe3990d7a65
MD5 56be6b76756e6d4f81dfb8f251b63739
SHA1 bb1df800b0728d965fcc754dad08ae63d6b54c06
SHA512 c6b453ed68e2fefdba53928aac6ac6b79d1366c427370ba6043a795c0eaf79a77bac9e019f4413e24b8eea9a787125c01b839c08dad0099a79751c2bf73ac128
SSDEEP 384:Ldv3V0dfpkXc0vVaEWEhW3YDy36q0GftpBj0eERHRN7mlgHrIQ8:Ldv3VqpkXc0vVaSqBkivEBjrIl
TLSH
T11AA25C95DAF8E583F89BDC7053E9D943BC3897C70D204922149AF6A92DD33D0EB2492C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-synch-l1-2-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI36122\api-ms-win-core-synch-l1-2-0.dll
Size 19KB
SHA256 e000c6685719c2b07355c1eddbfdae7c6794aa6c0ac883d34af33dfc8bf40779
MD5 1742da4d8df54767064bcb50b4b5c32d
SHA1 50f0ae8e41f0eb2573f41b308882610c6897c574
SHA512 99823ea5553cede3a0c8c19a3bdd18e31e2ba92bf7ee4808257b660f621de66eb596cfcb7be5c13ebe8ddd3759809f258c4ecdd72d8d39d9c2d10b9624cb3d95
SSDEEP 384:xtZ3lWEhWtE8y36q0GftpBjEn9ERHRN71QUlfgOBU/ml:7t7kis9EB1QVW2A
TLSH
T199923AD5CABC9543FD979C7053E8E9837C3C9BC62D20592511AAF2E928C33D1A714E2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-sysinfo-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI36122\api-ms-win-core-sysinfo-l1-1-0.dll
Size 19KB
SHA256 f5bf492fe568eb57d2e7111b1c3927f1ee897b5a1109bc68ebe011a2dfdef2fe
MD5 79b6580c25f8c572376cbf39bb41be05
SHA1 40dba231ad9cfd891bce54c44dc9f73e54c8532b
SHA512 e5a64e4f7afc8693634f5d92aa5ef6f4c241ca2f246a641b728d54c1e82e856793dbec40f4fd9a2653e962c0b6a4f179221594b3084116a7995af5e3e769ddfa
SSDEEP 384:vB2WEhW3y36q0GftpBjPjERHRN7ogDlCADZgJz:vBslkidjEBoRADZg1
TLSH
T10F922AD1DABC9143F8975D7023E8DA473D3C97C619209A1901AAF3E92DD33C6E72492D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-sysinfo-l1-2-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI36122\api-ms-win-core-sysinfo-l1-2-0.dll
Size 11KB
SHA256 3cf71c707d57a00120f914f2ed020bdc76f87666278b4235443adfc168c355e8
MD5 d8bf60cd8ec0cc0232ee443a034b49ba
SHA1 19c5bb4125a331df822ff7a9856c69f4a8649b47
SHA512 0095585dd5e55c0ce89a4384d27018b101c08a13d9d7706b57477be71ced353870d2bcc3c1f40e69b81e79a394c442502ff141b8ecf2e33c1c96244b2020e211
SSDEEP 192:fYyzWphWAMD1S8f4DBQABJJl+N38Gw4ZLqnajVxo+tw:fYyzWphW9D1IDBRJJo38Gw6lx2+t
TLSH
T155322BD29BB89943F9667F70179DDA433D3C63C62820816805A9F2AD2C873D29F14B7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-timezone-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI36122\api-ms-win-core-timezone-l1-1-0.dll
Size 18KB
SHA256 630466fd77ac7009c947a8370a0d0c20652169824c54ddcb8c05e8df45e23197
MD5 6c180c8de3ecf27de7a5812ff055737e
SHA1 3aad20b71bb374bb2c5f7431a1b75b60956a01fd
SHA512 e4aa79eb2b6b3be9b545e8cb8b43cd6052036dc5cce7077be40441b9942931b30d76c475d550a178d4e94c9c366cabc852f500e482b7fdcd361fc2a08e41c00e
SSDEEP 384:MWEhWhy36q0GftpBj+YERHRN7nwlCADZgJc:KLkiHEBnJADZgy
TLSH
T1AA9218D5CABC8043EC976C7017B8E9877D3CEBD71D20961604AAF5E928873D5E72492C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-util-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI36122\api-ms-win-core-util-l1-1-0.dll
Size 18KB
SHA256 187d47ebcc1e96abe635f23c92d2c63fc8cd741fcb03fe2dd5fc3054cb3d6d92
MD5 0c33a3762c1e583342d80e9b6483f74b
SHA1 0ef41c8c68be764d6c2f23e04279d6f12f32603c
SHA512 93c907ae0c864a4fba5eef82aa2473fcbb5f376906a6918896294a4259f5b062a6fe4d9e455fc43741004ed928d8c6bb4d4bc10479bc9a4ac81a711542ec229f
SSDEEP 192:/PWEhWvaNy3WUuDBks/nGfe4pBjSHdWm78RFAII1RHnhWgN7acWcrD+Rqnajjvun:nWEhWIy36q0GftpBjtERHRN77elZwHc+
TLSH
T1FF9219D5CEBC8483ED939C3053A8DE877C3CA7C71920951605AAF5E928C33D5EB18A2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-conio-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI36122\api-ms-win-crt-conio-l1-1-0.dll
Size 19KB
SHA256 91f4db05c69c58ecb2493e30acc5297043c41b1ce6db50cee4e2922cd4bcd7f2
MD5 84a950e3c162d67f98516bb1744139e0
SHA1 05ff2fe60c5748c33ba8605aaf609b3bdfe2772f
SHA512 7328c6a512d450f2538efeabf3f467489a898ed7c1d45c1952b98d118d898083510c9849182bc425411a408c113a351a28b41bedeb5b8de61427144b3fa87c80
SSDEEP 384:LN+WEhW0C2Jq0GftpBjNgfERHRN79lCADZgJJ:mpLiUfEBiADZgn
TLSH
T1819229D28ABC9943E9935D3063F8DE877D3DABC729206565045AF1A838C33D9FB1492C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-convert-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI36122\api-ms-win-crt-convert-l1-1-0.dll
Size 22KB
SHA256 e64fbac3491b4693e79a3f7b0db1d788f93608d3fc82133edf25a868c80d2153
MD5 d749afffa2b3be4b2a9edac50c20b28b
SHA1 972253ed12c344b85290f7b3d5f9608a7f7b0670
SHA512 4447b6960a6c178f7c37dbd38e9aec24ba5a0c58e19afcfaa2b70dca7d7bbe87ad7aa1ac9d48ab9b56b1f375768d4c4cb28d5afcf714102f9757faa2b3e728d9
SSDEEP 384:WDyuWEhWYy36q0GftpBjBt6ERHRN7Kr3lgHrIQDm:yokiTt6EB0ArIz
TLSH
T127B219839AE86A52E9DB5B7122FDDBD77D389B82195003B58207E09C38833D1BD67C1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-environment-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI36122\api-ms-win-crt-environment-l1-1-0.dll
Size 19KB
SHA256 dd054e4de84144c2130fa8d28d563252a7c4089a58872e49d63bc43c9a1a3cb8
MD5 7a2874fe036f7dc86ed5f712adaa38e6
SHA1 440f2dc5379ceee35d29571c195dc7a76e8b70e7
SHA512 d20811025f714b5fd3754d607422f4fb5cd6c456ffceef139edcb0cfaacd9b63a694ce2ea737db78385f0b23ddcfc283282a319b79e7a0e4bd50034e87aacb9a
SSDEEP 384:BWEhWxy36q0GftpBjUERHRN7QklgHrIQQ:RHki+EBQRrIN
TLSH
T14A9229D58ABC8583E9939D7063F8DE877D3CEBC72D105626056AF5A918C33D0AB2492C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-filesystem-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI36122\api-ms-win-crt-filesystem-l1-1-0.dll
Size 20KB
SHA256 966a7f15bfb2e0ff7888d583638ebd675d8f46b264194cf332f78140b7c129e1
MD5 73e14d927d075ca273b3237116351e8f
SHA1 0c15cea3c83c7f7e692dc6f8bd856b615c727d49
SHA512 664f72d7adf48f8499321f8a5df952c6043532aae09bae9ffbd59da77b161cd43211a3aaef1ba85529dfe00498d1ac3a933a7c9cf437095c6a337c9bc0816b3f
SSDEEP 384:r81nWm5CcWEhWMLy36q0GftpBjhERHRN7qEOlZwHcs:rOnWm5C6rmki/EBIwv
TLSH
T103A22A978BF8AD43EED31E7122F8DBC73E3D9B82195156224057E5A839C33C17B25818
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-heap-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI36122\api-ms-win-crt-heap-l1-1-0.dll
Size 19KB
SHA256 742bb9bf4c232f84ad8008af4af8eda7a1ec3eb76f05d9d7ebb95f6a5cabd2d8
MD5 01370c79ebabd534e7b58d35072d2866
SHA1 8cd0cd21ff838a2a314246def4bd858bab184a5d
SHA512 b07d9634ac804b476d61b6a0fc87894947e88744cc3eecf7d68ede3714acd938fae14452e43f9110919b8f8f9f5d4222e9de2ca97a915dd07b3231d674729761
SSDEEP 384:4QWEhWJC2Jq0GftpBj+WU9ERHRN7LlgHrIQ3m:4WyLiC9EBMrIf
TLSH
T128924CD6CABC9583ED935E3063E8EA8B7D3D97C22D5049164066F1E918833D0BB2592C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-locale-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI36122\api-ms-win-crt-locale-l1-1-0.dll
Size 19KB
SHA256 25905676b543c4f05e9dae135f929c03a57686a6941ce59be2b3450521feb943
MD5 bacb72fa56de18d5ac63e4a0a3fe768f
SHA1 7db19efe649d30337781afd62616c0549255046e
SHA512 78d82962c11e5928e77c5bd0377ecb6b00c2eca242d637f76e68fbf907bce7381f3a5294100d055c30f6e2aee164db0b95dcf0c0c77e39edcec4a046cfc63ed4
SSDEEP 384:b9DWEhWIy36q0GftpBjyK5ERHRN7WlgHrIQsa:NEkizEBTrI7a
TLSH
T1A3923BD5CABC9543E9C35D7053F8EA8BBD3DA7C329104A660497F5E91C833D8AB1492C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-math-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI36122\api-ms-win-crt-math-l1-1-0.dll
Size 27KB
SHA256 08e34f12de24e89379a0533f21a23ce6fecbea05d4062796d4ffd4adc3012316
MD5 85893a96a568ba9781f50f876ed303cd
SHA1 fb7473bc5b1e88e978b7e5664b45d69770c8f4fa
SHA512 864fa39423b8ca9c43fa177aca1484ec2ffae4868a434e7a8016efe88f396b67fb8ca3766f611de7218e9983653a8b7b88b07c2591b252dd93a0d9638980e7ff
SSDEEP 384:FZVacWM4Oe59Ckb1hgmLiWEhWXy36q0GftpBjbERHRN7RlgHrIQE+:FZVJWMq59Bb1jQ9ki5EBqrIT+
TLSH
T106D2E48789ECFF53D58B4BB312F4CBCE69385BA258D0A675C85BA0C834927C47E53908
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-process-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI36122\api-ms-win-crt-process-l1-1-0.dll
Size 19KB
SHA256 c68a61c260454c0aeb051ddb2bed52cbca44b96d50046017cbc351b41f225dc0
MD5 9ee275466394a2088d7dfbbc0c716671
SHA1 4d2f94674587251c60805889395ab7377e8c5e17
SHA512 996212d07b0b6e55f54e17d6a053f017b1fd00f50906db9de25b8ae5632eeac9c197e91db1c293e7abf0e8b823937cb18e26f43e166f76c02a6914c9776a72b3
SSDEEP 384:OitIlWEhWHy36q0GftpBj05MrERHRN7lQkklfgOBU/Ux:v6dkiomEBPW2Ux
TLSH
T1E9923AD6CABC5943EAA35E3053B8DA837E3E87C36C1085654467F0E928C33D5BB2492D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-runtime-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI36122\api-ms-win-crt-runtime-l1-1-0.dll
Size 23KB
SHA256 4c787ff8d40bb803e75fe6218fec36a672cfa6cfc7f6e80e68a7eb0b77a10e5a
MD5 55b80c522731ecb92914bf9cded028c2
SHA1 424c61bc659caf04281959ede1b1f03b703934ed
SHA512 3779b530c7dba624369cb0f5d15154d89547adc3c4c7cc0571f1e8326588165098b9b5768d0052ecf1ea4f2dc84ae7dcf4712e3bc9ebdadb5fca4b0f4de43812
SSDEEP 384:E42r77WEhW+y36q0GftpBjLleERHRN7lXMl8tazs:E42r7DSkiNleEBzt9
TLSH
T11AB209878AFC6E53E9876F3212F8DAC72E3A97821910453A8457F0D938C37D1FE26519
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-stdio-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI36122\api-ms-win-crt-stdio-l1-1-0.dll
Size 24KB
SHA256 c7919be431ce2fa1906ff9eeb19e4cb19a30a4680107ef8737ce894654b21a5a
MD5 4614d03a94d46c0e9d1c5d96a3fe1d78
SHA1 cacb73ca3c7e31a4b8f749854060b7a422497050
SHA512 4f30e8c5893662d7889a049c206b08559ad1a34eb7927be313086d6dae40dca3571de3852dba2ad9324e028fa86e8a391a58ec48ba5dbd5c4a88660ffe8b30df
SSDEEP 384:u3vAmiFVhFWEhW/y36q0GftpBjpq+cpfERHRN7ulZwHcP1:cvYjNki5eEBSwu
TLSH
T1F3B2F787C9FC6E42D6878B3226F9EFDB6A398783280075798017E4D835C63D8BE17419
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-string-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI36122\api-ms-win-crt-string-l1-1-0.dll
Size 24KB
SHA256 92f72f495a6897f7d7cf2c2064b2b65f6b4fbd4f30911a534a5cd0de73395ebe
MD5 7a2799f4bc45505e7104e06dc8e254f8
SHA1 323bc35e0101b351a4abde1fce698520832518a8
SHA512 2627da183779f17fcc9709a6da2e2916a296f61124adb9bf563c80d723ada9b769806cab8fbc4ed916f54fd4cde18f25e7ad53ed6c75e7e61fdef37c2f1ec9b2
SSDEEP 768:a5yguNvZ5VQgx3SbwA71IkFZjkiJ9EBj8r95j:a5yguNvZ5VQgx3SbwA71Iijkm9EBwx5
TLSH
T172B2F88786F83F52D98B5BB256F9CBC72A388F4615101375C467E4D834827E2BE6B90C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-time-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI36122\api-ms-win-crt-time-l1-1-0.dll
Size 21KB
SHA256 46cb7b3a9f8aac5adcdbe23494e458f3195adf4b8ed1c71f2d934ddde651e57e
MD5 38b633f132f8e2b3abc268537fa415ec
SHA1 ccccb8c3e31dce7b6b952022d245c11ff3ae8122
SHA512 23bd77d61c20b1af7f13b5bcbeb9fa74ee807f809bb3d4dd40c7709ca4870078fa6e8e94eefc83a725c0245c0ce02e3adbd4f370d6b986f0c9442ccbc2c2ab96
SSDEEP 384:OPEzaWEhWIZC2Jq0GftpBjxERHRN71YXlgHrIQD:E0YPLi7EB3rI2
TLSH
T13CA22A8389E8AA47EDD34F3123FDDBDB7F3857C21A9061668156E49835833D4BE2681C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-utility-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI36122\api-ms-win-crt-utility-l1-1-0.dll
Size 19KB
SHA256 111f6dd2e7247071a33d75bf98d521a8d09c4071f90483a82e6ed9af69bb52c4
MD5 5cde35104a68606913af6e5bd3b1adea
SHA1 f1f28141585c000753ab4db9ffc61f90929d4a1a
SHA512 caa5f80ac380a6e0242104f297fbfe6091260d743ef967fb1010720dbcba2a575baf8cb1f666b11fe780428d71a04767e2cc63d1bd9638d5f1af1063e3f43f91
SSDEEP 384:lBf5WEhWGy36q0GftpBjAwERHRN7vulgHrIQiJ:Hf56kiawEBv7rID
TLSH
T108922AD58EBC9543ED979D7053E8EA877D3C9BC32D208665006AF5E928833D4FB2492C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI36122\base_library.zip
Size 1.3MB
SHA256 4bb5d87c8ede3e3733dad63fe29483af875949f3a51deba10b94b6876bc0979c
MD5 97e733f87dd396f0ec54a90030eec139
SHA1 ed8b011ea590f8848c3c9c89382b5e60f5ce78d9
SHA512 456aa693c7fc27091934d00148546a33a8b85f95e4f17133929c09224d2a2fdd54d7428e28cf1c5bf04afc0b8a5970eb976b3e8c9ea538b3785902680a1bda15
SSDEEP 12288:VdjdTeyCMWfviyL+DkW7WpKXuIva80201jwCVRDVoioSYBMDwt3i2cPPdxhYai3h:VdZ77Wp4liE5cPPdxhYvUqiSeT1ub
TLSH
T14E550992B9527953FF64F37B80B7484CF31E86A2EF00C207355E42661EFE6B09E59588
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI36122\libcrypto-3.dll
Size 5.0MB
SHA256 ccfffddcd3defb8d899026298af9af43bc186130f8483d77e97c93233d5f27d7
MD5 ae5b2e9a3410839b31938f24b6fc5cd8
SHA1 9f9a14efc15c904f408a0d364d55a144427e4949
SHA512 36ea760a7b56ea74174882155eddfb8726828240fcfc6b34d90ecdb7e50a7e632374dcbc9b2889081c0973cc51f50967e7d692498c4abd1f2cba3f7fe8d659cc
SSDEEP 98304:M3+lrVT/8LpQmNPMRLuPWv1CPwDvt3uFlDCJ:6yrVT/8LvPMRLui1CPwDvt3uFlDCJ
TLSH
T1F8368B6AA7A80148E4BAC13CC9534617D2B1F85A57B097CF18A1967D0F37FDA2B3E740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI36122\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI36122\libssl-3.dll
Size 776KB
SHA256 007142039f04d04e0ed607bda53de095e5bc6a8a10d26ecedde94ea7d2d7eefe
MD5 8d4805f0651186046c48d3e2356623db
SHA1 18c27c000384418abcf9c88a72f3d55d83beda91
SHA512 1c4895d912f7085d6e46f6776034c9e3d8d7bf934be858683bf6dedb13abca360ba816d8a5528ec7a3ac6e33010fdb6fc89b2699b5cfeedaabfdd5df143dffd1
SSDEEP 12288:SLN1sk7YJkC4IAXjdA372WWLmyhTs2bmFe9Xb:SLglJkC4IAhA372WWL3YBFe9Xb
TLSH
T1D8F44BAD73B8059CD8B6C17D86934623E3B6F4563330EBEB06518A790F277D51B3A248
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pyexpat.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI36122\pyexpat.pyd
Size 201KB
SHA256 719dc29fee125f0d5026319da9a3001c130c84419db7ef7c5473fb496d56cfc2
MD5 a877f83ec14b229921c9103c18be5fa7
SHA1 a63db675471ddac6a73eb9f161c6277f249c8351
SHA512 d6a663344fc7e6c719a094bb8e6774f0a0c9befba7c1af5e685a2eb86982f309c10e36ee0990b914a3459ffeff963464fced807b1e4c4cd5328750fe396d7d9d
SSDEEP 3072:j+hkhnGnW2mlktH8pEpe24Rd2atrIWkXXxqmqx+MNoJQaiJ+B/tN5rm/tN5MtN5/:LhGnPml0H8epe2TatrIWkx/dioPmevdj
TLSH
T1F0145C8BB2A5C0A7D8538038D6D78A17DAB1F86503509BDF22C4EB7D9F2B7413B68315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI36122\python3.dll
Size 70KB
SHA256 4ae581aa4e65fef9f92c84c428c990892da538b4d9289592df51fa31fd879770
MD5 6ca946631d8011ee1c2813637efe06fe
SHA1 46feb03c544c38d616d9af02ced161f2c44f8296
SHA512 0d35012e1345b7ce99251cc18b949a0790d0ee6ab2149fb530df0707ad6572a220f5321bebe92ace958fc40a21d5183b32cb1d227865165f0f71fe9d472c0f20
SSDEEP 1536:LotssyKcunV8PGRIsy0ZyEJ7Q97yfIW44D9rn:MtssyKxRIsy0u7W4IRn
TLSH
T171633BC25B5BF8A2D6F669FC78DDD9CD242B12CC53258D9FA47893920F1A310A22734D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python313.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI36122\python313.dll
Size 5.8MB
SHA256 41ec4fc4e5bc8b207258590238f7f050b13fdfee84c4a7b1ecff6e945d031a10
MD5 cfbfd5ca1d563466687e53a638eed93c
SHA1 63bffe9d62dcc870b1601ae7a04b042df88fa219
SHA512 0eb973271a12ff17dc443ee3289695bb2134d66120690d067b3f67b4b52a5ac2831f326fe85635ef43799b43574e4e1809e20db6ae1d32b5e5f4711cfa12df36
SSDEEP 98304:efqPAKrV+hOhkH0pwgJYt5FO8vUHDMiEJV0KL:DPAC+hOhZaic0A
TLSH
T11F568D12729D50ACD97B8078CA178A4BF7B27C113F60434B61E6BB5D2FB33624A6E705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI36122\ucrtbase.dll
Size 1.3MB
SHA256 f7d8e245f35e8c595ac1cbb712b66e6ce4a304653e80a3ac5037ff8784e5803f
MD5 231faa81f1c1108dbb909f107acbe826
SHA1 211e0b58cf3262e4784b3597d414e99d6e3cb7f6
SHA512 8d668d7afb28d730734b303c7594b5cd0e929617954cbb25150ea0a83e2c356a4346a8418f3068c7b99a1beb4be1cab13f510ef58afaf655e6e03f132d02c5a6
SSDEEP 24576:RM6VUOf5DUVOb+uifkfEee3siuEXBlwmN1v2yT/BoEzJszO7vmxvSZX0ypOpTC:RM62ODUVOb+uiMfE+nSTv26pvzrkp
TLSH
T18155BE6576AD01E9C1BFD139C64B4A06E5B27C1503708ACB03E94E792E3BBE9177B321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bocchi-hero-1672352739701.webp

Path C:\Users\Admin\Downloads\bocchi-hero-1672352739701.webp
Size 52KB
SHA256 637700be05fc3fb0d2d885839759e8a90030dc6b59ac0de0fd849da11c5c1167
MD5 fa380122069476a66b9c96d659e504c1
SHA1 5fd3cc597b22a7319bc489dda56c2176a808975b
SHA512 d49c7953ce2fa8c24ae5525c49cf4a93d322dd81545ff1025e4a755feee184da2a9341e77fe56cfa593c44cda457880ca47168127f41fba19434edc10b27d620
SSDEEP 1536:f/qSWlBz/npSkg6SIBdKPLX3lCVG0htEMp5v5f4:fyS+VnpSBu2PTlCVG0h5/i
TLSH
T1203302DB20DFED39F36E15499BC50FDD6C861368E0E9888851F78744778846F5848772
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1748-1083-0x00007FFB71A60000-0x00007FFB71A89000-memory.dmp

Download

memory/2172-1815-0x00000219E3860000-0x00000219E3861000-memory.dmp

Download

memory/2172-1816-0x00000219E3860000-0x00000219E3861000-memory.dmp

Download

memory/2172-1817-0x00000219E3870000-0x00000219E3871000-memory.dmp

Download

memory/2172-1818-0x00000219E3870000-0x00000219E3871000-memory.dmp

Download

memory/2172-1814-0x00000219E37D0000-0x00000219E37D1000-memory.dmp

Download

memory/2172-1812-0x00000219E37D0000-0x00000219E37D1000-memory.dmp

Download

memory/2172-1810-0x00000219E3750000-0x00000219E3751000-memory.dmp

Download

memory/2172-1803-0x00000219D3460000-0x00000219D3470000-memory.dmp

Download

memory/2172-1799-0x00000219D2BC0000-0x00000219D2BD0000-memory.dmp

Download