d1c28d20881e50fa7f05bcb7433a6a4a55c3bd3668c0aa5c9cb6f8888733b31a

Analysis

user interaction
yes
max time kernel
246s
max time network
247s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
25/05/2026, 01:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Red Dead Redemption 2 [FitGirl Repack].torrent
Size 346KB
Sample260525-bcs1vadv71
SHA256 d1c28d20881e50fa7f05bcb7433a6a4a55c3bd3668c0aa5c9cb6f8888733b31a
MD5 34d5266ba0d0a552b95cf6628f1d31ac
SHA1 dc687c104b7ff019e290af9a712689cd9db3e8b3
SHA512 a5989ee07afe659246f34c9e674e5f72ba5bc104f2cf3dbd67af5401a755a4442606f17088abe7c1416405f1638b302f4592d51b4b64d6f35e0d023d6ec2d46a
SSDEEP 6144:JzydH2tKhOkdmQPDeiyEqMk7c9YDJOzvVeUnaRMGvSEH9x+85LXqsf6gaHA:JzydHTIiPDUEqD75DieaaRpvX75eG6Ng
TLSH
T1D07423ED446DFE56622765A630180FE5DC2ABE56E7EB30F841605BDCECA354C33E9820
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery motw phishing

Malware Config

Signatures

Downloads MZ/PE file 2 IoCs

flow	pid	Process
116	5156	chrome.exe
789	5156	chrome.exe

Executes dropped EXE 3 IoCs

pid	Process
5528	qbittorrent_5.2.0_x64_setup (1).exe
8908	qbittorrent.exe
9076	qbittorrent.exe

Loads dropped DLL 7 IoCs

pid	Process
5528	qbittorrent_5.2.0_x64_setup (1).exe
5528	qbittorrent_5.2.0_x64_setup (1).exe
5528	qbittorrent_5.2.0_x64_setup (1).exe
5528	qbittorrent_5.2.0_x64_setup (1).exe
5528	qbittorrent_5.2.0_x64_setup (1).exe
5528	qbittorrent_5.2.0_x64_setup (1).exe
5528	qbittorrent_5.2.0_x64_setup (1).exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Mark of the Web detected: This indicates that the page was originally saved or cloned. 1 IoCs

phishing motw

flow	ioc	pid	Process
710	https://storage.googleapis.com/script.aniview.com/ssync/62f53b2c7850d0786f227f64/ssync.html	5156	chrome.exe

Probable phishing domain 1 TTPs 1 IoCs

Phishing

T1566

description	flow	ioc	stream
HTTP URL	57	https://sourceforge.net/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=a0109baaafa93eb9	5

Drops file in Program Files directory 40 IoCs

description	ioc	Process
File created	C:\Program Files\qBittorrent\translations\qtbase_de.qm	qbittorrent_5.2.0_x64_setup (1).exe
File created	C:\Program Files\qBittorrent\translations\qtbase_gd.qm	qbittorrent_5.2.0_x64_setup (1).exe
File created	C:\Program Files\qBittorrent\translations\qtbase_hr.qm	qbittorrent_5.2.0_x64_setup (1).exe
File created	C:\Program Files\qBittorrent\translations\qtbase_ja.qm	qbittorrent_5.2.0_x64_setup (1).exe
File created	C:\Program Files\qBittorrent\translations\qtbase_sv.qm	qbittorrent_5.2.0_x64_setup (1).exe
File created	C:\Program Files\qBittorrent\translations\qtbase_uk.qm	qbittorrent_5.2.0_x64_setup (1).exe
File created	C:\Program Files\qBittorrent\qbittorrent.exe	qbittorrent_5.2.0_x64_setup (1).exe
File created	C:\Program Files\qBittorrent\translations\qt_sl.qm	qbittorrent_5.2.0_x64_setup (1).exe
File created	C:\Program Files\qBittorrent\translations\qtbase_ko.qm	qbittorrent_5.2.0_x64_setup (1).exe
File created	C:\Program Files\qBittorrent\translations\qtbase_nl.qm	qbittorrent_5.2.0_x64_setup (1).exe
File created	C:\Program Files\qBittorrent\uninst.exe	qbittorrent_5.2.0_x64_setup (1).exe
File created	C:\Program Files\qBittorrent\qt.conf	qbittorrent_5.2.0_x64_setup (1).exe
File created	C:\Program Files\qBittorrent\translations\qtbase_fi.qm	qbittorrent_5.2.0_x64_setup (1).exe
File created	C:\Program Files\qBittorrent\translations\qtbase_ka.qm	qbittorrent_5.2.0_x64_setup (1).exe
File created	C:\Program Files\qBittorrent\translations\qtbase_sk.qm	qbittorrent_5.2.0_x64_setup (1).exe
File created	C:\Program Files\qBittorrent\translations\qtbase_zh_CN.qm	qbittorrent_5.2.0_x64_setup (1).exe
File created	C:\Program Files\qBittorrent\translations\qt_lt.qm	qbittorrent_5.2.0_x64_setup (1).exe
File created	C:\Program Files\qBittorrent\translations\qtbase_cs.qm	qbittorrent_5.2.0_x64_setup (1).exe
File created	C:\Program Files\qBittorrent\translations\qtbase_es.qm	qbittorrent_5.2.0_x64_setup (1).exe
File created	C:\Program Files\qBittorrent\translations\qtbase_bg.qm	qbittorrent_5.2.0_x64_setup (1).exe
File created	C:\Program Files\qBittorrent\translations\qtbase_da.qm	qbittorrent_5.2.0_x64_setup (1).exe
File created	C:\Program Files\qBittorrent\translations\qtbase_he.qm	qbittorrent_5.2.0_x64_setup (1).exe
File created	C:\Program Files\qBittorrent\translations\qtbase_lv.qm	qbittorrent_5.2.0_x64_setup (1).exe
File created	C:\Program Files\qBittorrent\translations\qtbase_pt_BR.qm	qbittorrent_5.2.0_x64_setup (1).exe
File created	C:\Program Files\qBittorrent\translations\qtbase_ru.qm	qbittorrent_5.2.0_x64_setup (1).exe
File created	C:\Program Files\qBittorrent\translations\qtbase_zh_TW.qm	qbittorrent_5.2.0_x64_setup (1).exe
File created	C:\Program Files\qBittorrent\qbittorrent.pdb	qbittorrent_5.2.0_x64_setup (1).exe
File created	C:\Program Files\qBittorrent\translations\qtbase_ar.qm	qbittorrent_5.2.0_x64_setup (1).exe
File created	C:\Program Files\qBittorrent\translations\qtbase_ca.qm	qbittorrent_5.2.0_x64_setup (1).exe
File created	C:\Program Files\qBittorrent\translations\qtbase_fa.qm	qbittorrent_5.2.0_x64_setup (1).exe
File created	C:\Program Files\qBittorrent\translations\qtbase_tr.qm	qbittorrent_5.2.0_x64_setup (1).exe
File created	C:\Program Files\qBittorrent\translations\qt_pt_PT.qm	qbittorrent_5.2.0_x64_setup (1).exe
File created	C:\Program Files\qBittorrent\translations\qtbase_fr.qm	qbittorrent_5.2.0_x64_setup (1).exe
File created	C:\Program Files\qBittorrent\translations\qtbase_hu.qm	qbittorrent_5.2.0_x64_setup (1).exe
File created	C:\Program Files\qBittorrent\translations\qtbase_it.qm	qbittorrent_5.2.0_x64_setup (1).exe
File created	C:\Program Files\qBittorrent\translations\qtbase_lg.qm	qbittorrent_5.2.0_x64_setup (1).exe
File created	C:\Program Files\qBittorrent\translations\qtbase_nn.qm	qbittorrent_5.2.0_x64_setup (1).exe
File created	C:\Program Files\qBittorrent\translations\qtbase_pl.qm	qbittorrent_5.2.0_x64_setup (1).exe
File opened for modification	C:\Program Files\qBittorrent\qbittorrent.exe	qbittorrent_5.2.0_x64_setup (1).exe
File created	C:\Program Files\qBittorrent\translations\qt_gl.qm	qbittorrent_5.2.0_x64_setup (1).exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\qbittorrent_5.2.0_x64_setup (1).exe:Zone.Identifier	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qbittorrent_5.2.0_x64_setup (1).exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5156	chrome.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134241444425327027"	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = ffffffff	qbittorrent.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Mode = "1"	qbittorrent.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	qbittorrent.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616193"	qbittorrent.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	qbittorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\qBittorrent.Url.Magnet	qbittorrent_5.2.0_x64_setup (1).exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	qbittorrent.exe
Key created	\REGISTRY\MACHINE\Software\Classes\magnet	qbittorrent_5.2.0_x64_setup (1).exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent.File.Torrent\shell	qbittorrent_5.2.0_x64_setup (1).exe
Key created	\REGISTRY\MACHINE\Software\Classes\qBittorrent.Url.Magnet\shell\open\command	qbittorrent_5.2.0_x64_setup (1).exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 3a001f44471a0359723fa74489c55595fe6b30ee260001002600efbe10000000ecdf7df450e3dc0105e4da8857e3dc015473e834e2ebdc0114000000	qbittorrent.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\NodeSlot = "1"	qbittorrent.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = ffffffff	qbittorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent.File.Torrent	qbittorrent_5.2.0_x64_setup (1).exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.torrent\Content Type = "application/x-bittorrent"	qbittorrent_5.2.0_x64_setup (1).exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\LogicalViewMode = "3"	qbittorrent.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	qbittorrent.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	qbittorrent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent.File.Torrent\DefaultIcon\ = "\"C:\\Program Files\\qBittorrent\\qbittorrent.exe\",1"	qbittorrent_5.2.0_x64_setup (1).exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	qbittorrent.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	qbittorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	qbittorrent.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1"	qbittorrent.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	qbittorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	qbittorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	qbittorrent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent.File.Torrent\shell\open\command\ = "\"C:\\Program Files\\qBittorrent\\qbittorrent.exe\" \"%1\""	qbittorrent_5.2.0_x64_setup (1).exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\magnet\URL Protocol	qbittorrent_5.2.0_x64_setup (1).exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings	qbittorrent.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	qbittorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	qbittorrent.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	qbittorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	qbittorrent.exe
Key created	\Registry\User\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\NotificationData	qbittorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	qbittorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	qbittorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	qbittorrent.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	qbittorrent.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	qbittorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\qBittorrent.File.Torrent\DefaultIcon	qbittorrent_5.2.0_x64_setup (1).exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent.File.Torrent\shell\open	qbittorrent_5.2.0_x64_setup (1).exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	qbittorrent.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	qbittorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	qbittorrent.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupView = "0"	qbittorrent.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByDirection = "1"	qbittorrent.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 = 3a002e803accbfb42cdb4c42b0297fe99a87c641260001002600efbe11000000e84180f450e3dc018a014ed056e3dc018a014ed056e3dc0114000000	qbittorrent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent.Url.Magnet\shell	qbittorrent_5.2.0_x64_setup (1).exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	qbittorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	qbittorrent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent.File.Torrent\shell\open\command	qbittorrent_5.2.0_x64_setup (1).exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	qbittorrent.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 00000000ffffffff	qbittorrent.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\NodeSlot = "2"	qbittorrent.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	qbittorrent.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	qbittorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\MACHINE\Software\Classes\qBittorrent.File.Torrent\shell\open\command	qbittorrent_5.2.0_x64_setup (1).exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\qbittorrent_5.2.0_x64_setup (1).exe:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\Red Dead Redemption 2 [FitGirl Repack].torrent:Zone.Identifier	chrome.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
8908	qbittorrent.exe
9076	qbittorrent.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
5528	qbittorrent_5.2.0_x64_setup (1).exe
5528	qbittorrent_5.2.0_x64_setup (1).exe
7684	chrome.exe
7684	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
6096	OpenWith.exe
8908	qbittorrent.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
696	Process not Found
696	Process not Found
696	Process not Found
696	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 64 IoCs

pid	Process
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2296	chrome.exe
Token: SeCreatePagefilePrivilege	2296	chrome.exe
Token: SeShutdownPrivilege	2296	chrome.exe
Token: SeCreatePagefilePrivilege	2296	chrome.exe
Token: SeShutdownPrivilege	2296	chrome.exe
Token: SeCreatePagefilePrivilege	2296	chrome.exe
Token: SeShutdownPrivilege	2296	chrome.exe
Token: SeCreatePagefilePrivilege	2296	chrome.exe
Token: SeShutdownPrivilege	2296	chrome.exe
Token: SeCreatePagefilePrivilege	2296	chrome.exe
Token: SeShutdownPrivilege	2296	chrome.exe
Token: SeCreatePagefilePrivilege	2296	chrome.exe
Token: SeShutdownPrivilege	2296	chrome.exe
Token: SeCreatePagefilePrivilege	2296	chrome.exe
Token: SeShutdownPrivilege	2296	chrome.exe
Token: SeCreatePagefilePrivilege	2296	chrome.exe
Token: SeShutdownPrivilege	2296	chrome.exe
Token: SeCreatePagefilePrivilege	2296	chrome.exe
Token: SeShutdownPrivilege	2296	chrome.exe
Token: SeCreatePagefilePrivilege	2296	chrome.exe
Token: SeShutdownPrivilege	2296	chrome.exe
Token: SeCreatePagefilePrivilege	2296	chrome.exe
Token: SeShutdownPrivilege	2296	chrome.exe
Token: SeCreatePagefilePrivilege	2296	chrome.exe
Token: SeShutdownPrivilege	2296	chrome.exe
Token: SeCreatePagefilePrivilege	2296	chrome.exe
Token: SeShutdownPrivilege	2296	chrome.exe
Token: SeCreatePagefilePrivilege	2296	chrome.exe
Token: SeShutdownPrivilege	2296	chrome.exe
Token: SeCreatePagefilePrivilege	2296	chrome.exe
Token: SeShutdownPrivilege	2296	chrome.exe
Token: SeCreatePagefilePrivilege	2296	chrome.exe
Token: SeShutdownPrivilege	2296	chrome.exe
Token: SeCreatePagefilePrivilege	2296	chrome.exe
Token: SeShutdownPrivilege	2296	chrome.exe
Token: SeCreatePagefilePrivilege	2296	chrome.exe
Token: SeShutdownPrivilege	2296	chrome.exe
Token: SeCreatePagefilePrivilege	2296	chrome.exe
Token: SeShutdownPrivilege	2296	chrome.exe
Token: SeCreatePagefilePrivilege	2296	chrome.exe
Token: SeShutdownPrivilege	2296	chrome.exe
Token: SeCreatePagefilePrivilege	2296	chrome.exe
Token: SeShutdownPrivilege	2296	chrome.exe
Token: SeCreatePagefilePrivilege	2296	chrome.exe
Token: SeShutdownPrivilege	2296	chrome.exe
Token: SeCreatePagefilePrivilege	2296	chrome.exe
Token: SeShutdownPrivilege	2296	chrome.exe
Token: SeCreatePagefilePrivilege	2296	chrome.exe
Token: SeShutdownPrivilege	2296	chrome.exe
Token: SeCreatePagefilePrivilege	2296	chrome.exe
Token: SeShutdownPrivilege	2296	chrome.exe
Token: SeCreatePagefilePrivilege	2296	chrome.exe
Token: SeShutdownPrivilege	2296	chrome.exe
Token: SeCreatePagefilePrivilege	2296	chrome.exe
Token: SeShutdownPrivilege	2296	chrome.exe
Token: SeCreatePagefilePrivilege	2296	chrome.exe
Token: SeShutdownPrivilege	2296	chrome.exe
Token: SeCreatePagefilePrivilege	2296	chrome.exe
Token: SeShutdownPrivilege	2296	chrome.exe
Token: SeCreatePagefilePrivilege	2296	chrome.exe
Token: SeShutdownPrivilege	2296	chrome.exe
Token: SeCreatePagefilePrivilege	2296	chrome.exe
Token: SeShutdownPrivilege	2296	chrome.exe
Token: SeCreatePagefilePrivilege	2296	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe

Suspicious use of SendNotifyMessage 43 IoCs

pid	Process
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
8908	qbittorrent.exe
8908	qbittorrent.exe
8908	qbittorrent.exe
8908	qbittorrent.exe
8908	qbittorrent.exe
8908	qbittorrent.exe
8908	qbittorrent.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe
2296	chrome.exe

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
6096	OpenWith.exe
8908	qbittorrent.exe
6464	OpenWith.exe
6464	OpenWith.exe
6464	OpenWith.exe
6464	OpenWith.exe
6464	OpenWith.exe
6464	OpenWith.exe
6464	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2296 wrote to memory of 6132	2296	chrome.exe	83
PID 2296 wrote to memory of 1340	2296	chrome.exe	84
PID 2296 wrote to memory of 1340	2296	chrome.exe	84
PID 2296 wrote to memory of 5156	2296	chrome.exe	85
PID 6084 wrote to memory of 5992	6084	chrome.exe	87
PID 2296 wrote to memory of 1220	2296	chrome.exe	89
PID 2296 wrote to memory of 1220	2296	chrome.exe	89
PID 2296 wrote to memory of 5300	2296	chrome.exe	90
PID 2296 wrote to memory of 5300	2296	chrome.exe	90
PID 2296 wrote to memory of 3548	2296	chrome.exe	91
PID 2296 wrote to memory of 3548	2296	chrome.exe	91
PID 2296 wrote to memory of 1108	2296	chrome.exe	92
PID 2296 wrote to memory of 1108	2296	chrome.exe	92
PID 2296 wrote to memory of 3564	2296	chrome.exe	94
PID 2296 wrote to memory of 3564	2296	chrome.exe	94
PID 2296 wrote to memory of 1160	2296	chrome.exe	95
PID 2296 wrote to memory of 5784	2296	chrome.exe	97
PID 2296 wrote to memory of 5784	2296	chrome.exe	97
PID 2296 wrote to memory of 5000	2296	chrome.exe	98
PID 2296 wrote to memory of 4780	2296	chrome.exe	99
PID 2296 wrote to memory of 4980	2296	chrome.exe	100
PID 2296 wrote to memory of 5868	2296	chrome.exe	101
PID 2296 wrote to memory of 5868	2296	chrome.exe	101
PID 2296 wrote to memory of 4192	2296	chrome.exe	102
PID 2296 wrote to memory of 4192	2296	chrome.exe	102
PID 2296 wrote to memory of 1504	2296	chrome.exe	103
PID 2296 wrote to memory of 1504	2296	chrome.exe	103
PID 2296 wrote to memory of 5060	2296	chrome.exe	104
PID 2296 wrote to memory of 5060	2296	chrome.exe	104
PID 2296 wrote to memory of 5208	2296	chrome.exe	105
PID 2296 wrote to memory of 5208	2296	chrome.exe	105
PID 2296 wrote to memory of 5940	2296	chrome.exe	106
PID 2296 wrote to memory of 5940	2296	chrome.exe	106
PID 2296 wrote to memory of 3500	2296	chrome.exe	107
PID 2296 wrote to memory of 3500	2296	chrome.exe	107
PID 2296 wrote to memory of 5568	2296	chrome.exe	108
PID 2296 wrote to memory of 5568	2296	chrome.exe	108
PID 2296 wrote to memory of 1764	2296	chrome.exe	109
PID 2296 wrote to memory of 2500	2296	chrome.exe	110
PID 2296 wrote to memory of 2500	2296	chrome.exe	110
PID 2296 wrote to memory of 6016	2296	chrome.exe	111
PID 2296 wrote to memory of 6016	2296	chrome.exe	111
PID 2296 wrote to memory of 4220	2296	chrome.exe	112
PID 2296 wrote to memory of 4220	2296	chrome.exe	112
PID 2296 wrote to memory of 5852	2296	chrome.exe	113
PID 2296 wrote to memory of 5852	2296	chrome.exe	113
PID 2296 wrote to memory of 2908	2296	chrome.exe	114
PID 2296 wrote to memory of 2908	2296	chrome.exe	114
PID 2296 wrote to memory of 5244	2296	chrome.exe	115
PID 2296 wrote to memory of 5244	2296	chrome.exe	115
PID 2296 wrote to memory of 3588	2296	chrome.exe	116
PID 2296 wrote to memory of 3588	2296	chrome.exe	116
PID 2296 wrote to memory of 2512	2296	chrome.exe	117
PID 2296 wrote to memory of 2512	2296	chrome.exe	117
PID 2296 wrote to memory of 5628	2296	chrome.exe	118
PID 2296 wrote to memory of 5628	2296	chrome.exe	118
PID 2296 wrote to memory of 2036	2296	chrome.exe	119
PID 2296 wrote to memory of 2036	2296	chrome.exe	119
PID 2296 wrote to memory of 1476	2296	chrome.exe	120
PID 2296 wrote to memory of 1476	2296	chrome.exe	120
PID 2296 wrote to memory of 5268	2296	chrome.exe	121
PID 2296 wrote to memory of 5268	2296	chrome.exe	121
PID 2296 wrote to memory of 884	2296	chrome.exe	122
PID 2296 wrote to memory of 884	2296	chrome.exe	122

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Red Dead Redemption 2 [FitGirl Repack].torrent"
1⤵
- Modifies registry class
PID:3604

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:6096

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa11c2c728,0x7ffa11c2c734,0x7ffa11c2c740
  2⤵
  PID:6132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1600,i,9282327249030107690,8450766175987162638,262144 --field-trial-handle=1956,i,4127944075937915262,7497397795044940169,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1952 /prefetch:2
  2⤵
  PID:1340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2224,i,5485503577517981262,3831487095849056832,524288 --field-trial-handle=1956,i,4127944075937915262,7497397795044940169,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1472 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - Mark of the Web detected: This indicates that the page was originally saved or cloned.
  - System Time Discovery
  PID:5156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2352,i,11932097613149214952,16204038525870242784,524288 --field-trial-handle=1956,i,4127944075937915262,7497397795044940169,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2364 /prefetch:13
  2⤵
  PID:1220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3216,i,541716740335288350,5355736512295305564,2097152 --field-trial-handle=1956,i,4127944075937915262,7497397795044940169,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:5300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3220,i,4656778579838711713,7696508694079824544,2097152 --field-trial-handle=1956,i,4127944075937915262,7497397795044940169,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:3548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4316,i,3763744430647963643,2810052869914470264,2097152 --field-trial-handle=1956,i,4127944075937915262,7497397795044940169,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4328 /prefetch:9
  2⤵
  PID:1108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4768,i,2447426254929589599,4776602460371236141,2097152 --field-trial-handle=1956,i,4127944075937915262,7497397795044940169,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4776 /prefetch:1
  2⤵
  PID:3564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5572,i,3791360713028471136,14944333500724301495,524288 --field-trial-handle=1956,i,4127944075937915262,7497397795044940169,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5576 /prefetch:14
  2⤵
  PID:1160
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5908,i,1031588395152573740,15833223252818045659,2097152 --field-trial-handle=1956,i,4127944075937915262,7497397795044940169,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5612 /prefetch:1
  2⤵
  PID:5784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4736,i,13042235054364928362,15783901603899737634,524288 --field-trial-handle=1956,i,4127944075937915262,7497397795044940169,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5980 /prefetch:14
  2⤵
  PID:5000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5968,i,17807315188397098006,17486948531914860570,524288 --field-trial-handle=1956,i,4127944075937915262,7497397795044940169,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5932 /prefetch:14
  2⤵
  PID:4780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5920,i,4916695606068112770,9483757497078529941,524288 --field-trial-handle=1956,i,4127944075937915262,7497397795044940169,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5952 /prefetch:14
  2⤵
  PID:4980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6120,i,11207141239099582386,2362445768606438874,2097152 --field-trial-handle=1956,i,4127944075937915262,7497397795044940169,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6124 /prefetch:1
  2⤵
  PID:5868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5992,i,12074852384216471314,2043569277315234433,2097152 --field-trial-handle=1956,i,4127944075937915262,7497397795044940169,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6012 /prefetch:1
  2⤵
  PID:4192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6284,i,7471387741500765918,2893626785937512928,2097152 --field-trial-handle=1956,i,4127944075937915262,7497397795044940169,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6304 /prefetch:1
  2⤵
  PID:1504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6444,i,5919695703278073609,18142415680155126131,2097152 --field-trial-handle=1956,i,4127944075937915262,7497397795044940169,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6452 /prefetch:1
  2⤵
  PID:5060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6120,i,17202767779235367402,4044483152099099856,2097152 --field-trial-handle=1956,i,4127944075937915262,7497397795044940169,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6528 /prefetch:1
  2⤵
  PID:5208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6780,i,9896481941532197124,14201836441770976318,2097152 --field-trial-handle=1956,i,4127944075937915262,7497397795044940169,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6760 /prefetch:1
  2⤵
  PID:5940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6148,i,7653632542617121335,4239123658877423038,2097152 --field-trial-handle=1956,i,4127944075937915262,7497397795044940169,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6172 /prefetch:1
  2⤵
  PID:3500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=7100,i,14804215179599560850,16920422524197996871,2097152 --field-trial-handle=1956,i,4127944075937915262,7497397795044940169,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6136 /prefetch:1
  2⤵
  PID:5568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5992,i,12132644391094246709,17322650492413782603,524288 --field-trial-handle=1956,i,4127944075937915262,7497397795044940169,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6904 /prefetch:14
  2⤵
  PID:1764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=6876,i,5810597811073409345,12871892241502883335,524288 --field-trial-handle=1956,i,4127944075937915262,7497397795044940169,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6012 /prefetch:12
  2⤵
  PID:2500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=7336,i,11504804239315031970,10034793914499615262,2097152 --field-trial-handle=1956,i,4127944075937915262,7497397795044940169,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7372 /prefetch:1
  2⤵
  PID:6016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=7608,i,12200910804047336251,5638349655734629878,2097152 --field-trial-handle=1956,i,4127944075937915262,7497397795044940169,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7584 /prefetch:1
  2⤵
  PID:4220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=7680,i,9032125756712767551,16106722369858345353,2097152 --field-trial-handle=1956,i,4127944075937915262,7497397795044940169,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7712 /prefetch:1
  2⤵
  PID:5852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=7828,i,4683440465127636983,3320045312409632509,2097152 --field-trial-handle=1956,i,4127944075937915262,7497397795044940169,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7840 /prefetch:1
  2⤵
  PID:2908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=8020,i,696021480883472897,1200658616435074282,2097152 --field-trial-handle=1956,i,4127944075937915262,7497397795044940169,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8036 /prefetch:1
  2⤵
  PID:5244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=8200,i,7954487214490392329,2307992128787892812,2097152 --field-trial-handle=1956,i,4127944075937915262,7497397795044940169,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8152 /prefetch:1
  2⤵
  PID:3588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=8344,i,13284797364148867841,3812373916350628663,2097152 --field-trial-handle=1956,i,4127944075937915262,7497397795044940169,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8356 /prefetch:1
  2⤵
  PID:2512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=8504,i,7558394615607638570,16222063484320486022,2097152 --field-trial-handle=1956,i,4127944075937915262,7497397795044940169,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8380 /prefetch:1
  2⤵
  PID:5628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=8644,i,5208990121421807048,5052365049556820898,2097152 --field-trial-handle=1956,i,4127944075937915262,7497397795044940169,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8648 /prefetch:1
  2⤵
  PID:2036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --metrics-shmem-handle=8804,i,9251565709496016133,11129014670709650930,2097152 --field-trial-handle=1956,i,4127944075937915262,7497397795044940169,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8688 /prefetch:1
  2⤵
  PID:1476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --metrics-shmem-handle=8960,i,12903518750873082094,16575293251787811189,2097152 --field-trial-handle=1956,i,4127944075937915262,7497397795044940169,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8932 /prefetch:1
  2⤵
  PID:5268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --metrics-shmem-handle=9112,i,10750895864039285565,11674430232717923510,2097152 --field-trial-handle=1956,i,4127944075937915262,7497397795044940169,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8980 /prefetch:1
  2⤵
  PID:884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --metrics-shmem-handle=9256,i,9238834179668671340,12275732811432711125,2097152 --field-trial-handle=1956,i,4127944075937915262,7497397795044940169,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=9272 /prefetch:1
  2⤵
  PID:5844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --metrics-shmem-handle=9412,i,698954713678529707,10181754499433726797,2097152 --field-trial-handle=1956,i,4127944075937915262,7497397795044940169,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=9400 /prefetch:1
  2⤵
  PID:4776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --metrics-shmem-handle=9560,i,16195526932645253752,13687257234354301052,2097152 --field-trial-handle=1956,i,4127944075937915262,7497397795044940169,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=9576 /prefetch:1
  2⤵
  PID:3472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --metrics-shmem-handle=9708,i,7511004484739292098,17331561769043722143,2097152 --field-trial-handle=1956,i,4127944075937915262,7497397795044940169,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=9720 /prefetch:1
  2⤵
  PID:1428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --metrics-shmem-handle=9596,i,10492963596643268024,2429195114299052170,2097152 --field-trial-handle=1956,i,4127944075937915262,7497397795044940169,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8636 /prefetch:1
  2⤵
  PID:3620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --metrics-shmem-handle=9856,i,11553266827514179853,2181509802878115690,2097152 --field-trial-handle=1956,i,4127944075937915262,7497397795044940169,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=10016 /prefetch:1
  2⤵
  PID:5780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --metrics-shmem-handle=10172,i,3046945901352700327,413391951815587248,2097152 --field-trial-handle=1956,i,4127944075937915262,7497397795044940169,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=10004 /prefetch:1
  2⤵
  PID:6092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --metrics-shmem-handle=10336,i,10681817985508795729,12560350637194803975,2097152 --field-trial-handle=1956,i,4127944075937915262,7497397795044940169,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=10348 /prefetch:1
  2⤵
  PID:3604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --metrics-shmem-handle=10388,i,10511270042464698676,5091552634761425876,2097152 --field-trial-handle=1956,i,4127944075937915262,7497397795044940169,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=10408 /prefetch:1
  2⤵
  PID:5132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --metrics-shmem-handle=10656,i,14391436945263052500,10770374948179515678,2097152 --field-trial-handle=1956,i,4127944075937915262,7497397795044940169,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=10636 /prefetch:1
  2⤵
  PID:3820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --metrics-shmem-handle=10796,i,6442872930588271185,14912817307808348882,2097152 --field-trial-handle=1956,i,4127944075937915262,7497397795044940169,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=10808 /prefetch:1
  2⤵
  PID:4204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --metrics-shmem-handle=10948,i,12359246978667354955,5348243325206782520,2097152 --field-trial-handle=1956,i,4127944075937915262,7497397795044940169,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=10960 /prefetch:1
  2⤵
  PID:860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --metrics-shmem-handle=11104,i,2502974152567918173,17566808442902360423,2097152 --field-trial-handle=1956,i,4127944075937915262,7497397795044940169,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=11112 /prefetch:1
  2⤵
  PID:4936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --metrics-shmem-handle=11340,i,2050427004485856184,4252917835077965650,2097152 --field-trial-handle=1956,i,4127944075937915262,7497397795044940169,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=11236 /prefetch:1
  2⤵
  PID:6236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --metrics-shmem-handle=11524,i,12373434440018958562,3627446297709058553,2097152 --field-trial-handle=1956,i,4127944075937915262,7497397795044940169,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=11552 /prefetch:1
  2⤵
  PID:6852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --metrics-shmem-handle=11652,i,17208867024075796359,6942899949571831647,2097152 --field-trial-handle=1956,i,4127944075937915262,7497397795044940169,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=11676 /prefetch:1
  2⤵
  PID:6900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --metrics-shmem-handle=11916,i,13219319408832208286,10817527870237362313,2097152 --field-trial-handle=1956,i,4127944075937915262,7497397795044940169,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=11936 /prefetch:1
  2⤵
  PID:6912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --metrics-shmem-handle=12068,i,18182246262073899160,13681881139183960999,2097152 --field-trial-handle=1956,i,4127944075937915262,7497397795044940169,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=12088 /prefetch:1
  2⤵
  PID:6920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --metrics-shmem-handle=12220,i,16915541786590594490,14410413254937104891,2097152 --field-trial-handle=1956,i,4127944075937915262,7497397795044940169,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=12240 /prefetch:1
  2⤵
  PID:6932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --metrics-shmem-handle=12356,i,7694699276547238403,13597552488166605404,2097152 --field-trial-handle=1956,i,4127944075937915262,7497397795044940169,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=12376 /prefetch:1
  2⤵
  PID:6940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --metrics-shmem-handle=12508,i,1858891327690978334,2004866220735346292,2097152 --field-trial-handle=1956,i,4127944075937915262,7497397795044940169,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=12528 /prefetch:1
  2⤵
  PID:6948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --metrics-shmem-handle=12660,i,1900787337875678983,6300259274301785996,2097152 --field-trial-handle=1956,i,4127944075937915262,7497397795044940169,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=12680 /prefetch:1
  2⤵
  PID:6956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --metrics-shmem-handle=12812,i,15914874332390705859,16935765762948091180,2097152 --field-trial-handle=1956,i,4127944075937915262,7497397795044940169,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=12832 /prefetch:1
  2⤵
  PID:6964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --metrics-shmem-handle=12964,i,6846263581073294143,4095985833546254293,2097152 --field-trial-handle=1956,i,4127944075937915262,7497397795044940169,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=12984 /prefetch:1
  2⤵
  PID:6972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --metrics-shmem-handle=13116,i,11550580280386071263,3597894392877622831,2097152 --field-trial-handle=1956,i,4127944075937915262,7497397795044940169,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=13160 /prefetch:1
  2⤵
  PID:6980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --metrics-shmem-handle=13136,i,9737871790732702065,2873297111966366108,2097152 --field-trial-handle=1956,i,4127944075937915262,7497397795044940169,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=13168 /prefetch:1
  2⤵
  PID:6988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --metrics-shmem-handle=13436,i,11177215915925171754,2347182953269101974,2097152 --field-trial-handle=1956,i,4127944075937915262,7497397795044940169,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=13456 /prefetch:1
  2⤵
  PID:7000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --metrics-shmem-handle=13592,i,3843441934269313045,7453369181543566012,2097152 --field-trial-handle=1956,i,4127944075937915262,7497397795044940169,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=13636 /prefetch:1
  2⤵
  PID:6328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --metrics-shmem-handle=13784,i,4153929559164550669,5456646318909098900,2097152 --field-trial-handle=1956,i,4127944075937915262,7497397795044940169,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=13804 /prefetch:1
  2⤵
  PID:6340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --metrics-shmem-handle=13936,i,11756775259876582378,14935035328686560801,2097152 --field-trial-handle=1956,i,4127944075937915262,7497397795044940169,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=13956 /prefetch:1
  2⤵
  PID:6360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --metrics-shmem-handle=14088,i,11467712354281384600,5564681640364129658,2097152 --field-trial-handle=1956,i,4127944075937915262,7497397795044940169,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=14108 /prefetch:1
  2⤵
  PID:6428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --metrics-shmem-handle=14240,i,14517549144442484017,5267665390716222250,2097152 --field-trial-handle=1956,i,4127944075937915262,7497397795044940169,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=14260 /prefetch:1
  2⤵
  PID:6420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --metrics-shmem-handle=14388,i,14364255189517137377,14250479706596384276,2097152 --field-trial-handle=1956,i,4127944075937915262,7497397795044940169,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=14408 /prefetch:1
  2⤵
  PID:6436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --metrics-shmem-handle=14540,i,2880835729373154970,15039445849888235183,2097152 --field-trial-handle=1956,i,4127944075937915262,7497397795044940169,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=14560 /prefetch:1
  2⤵
  PID:6448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --metrics-shmem-handle=14692,i,3069073277277891829,6981201364193003357,2097152 --field-trial-handle=1956,i,4127944075937915262,7497397795044940169,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=14712 /prefetch:1
  2⤵
  PID:6472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --metrics-shmem-handle=14844,i,8193169807593116988,12346475206122601590,2097152 --field-trial-handle=1956,i,4127944075937915262,7497397795044940169,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=14864 /prefetch:1
  2⤵
  PID:6484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --metrics-shmem-handle=14996,i,2515145193207408918,11852660269582768058,2097152 --field-trial-handle=1956,i,4127944075937915262,7497397795044940169,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=15012 /prefetch:1
  2⤵
  PID:6488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --metrics-shmem-handle=15144,i,7958196073989691275,98728999373775634,2097152 --field-trial-handle=1956,i,4127944075937915262,7497397795044940169,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=15160 /prefetch:1
  2⤵
  PID:6500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --metrics-shmem-handle=15292,i,14979720210054702355,2110188154942400138,2097152 --field-trial-handle=1956,i,4127944075937915262,7497397795044940169,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=15308 /prefetch:1
  2⤵
  PID:6504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --metrics-shmem-handle=15444,i,2904440205177607867,16858838234237657258,2097152 --field-trial-handle=1956,i,4127944075937915262,7497397795044940169,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=15460 /prefetch:1
  2⤵
  PID:6520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --metrics-shmem-handle=15592,i,10268770680359984248,13225525603710514271,2097152 --field-trial-handle=1956,i,4127944075937915262,7497397795044940169,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=15608 /prefetch:1
  2⤵
  PID:6584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --metrics-shmem-handle=15740,i,10380713546259389994,1256881775622137113,2097152 --field-trial-handle=1956,i,4127944075937915262,7497397795044940169,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=15756 /prefetch:1
  2⤵
  PID:6532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --metrics-shmem-handle=11892,i,172043666748102524,6419051527171700778,2097152 --field-trial-handle=1956,i,4127944075937915262,7497397795044940169,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=11880 /prefetch:1
  2⤵
  PID:7992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --metrics-shmem-handle=12068,i,3509435011648689278,9963091767197505349,2097152 --field-trial-handle=1956,i,4127944075937915262,7497397795044940169,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=15780 /prefetch:1
  2⤵
  PID:8000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --metrics-shmem-handle=16180,i,2977229339328858463,13021861289603722097,2097152 --field-trial-handle=1956,i,4127944075937915262,7497397795044940169,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=16212 /prefetch:1
  2⤵
  PID:8060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --metrics-shmem-handle=16344,i,4296118099979716121,6667588655970309989,2097152 --field-trial-handle=1956,i,4127944075937915262,7497397795044940169,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=16360 /prefetch:1
  2⤵
  PID:8068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --metrics-shmem-handle=14844,i,1765453149863291902,12714865584304044077,2097152 --field-trial-handle=1956,i,4127944075937915262,7497397795044940169,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=14528 /prefetch:1
  2⤵
  PID:8132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=84 --metrics-shmem-handle=12496,i,640588080723004958,5469320164739563512,2097152 --field-trial-handle=1956,i,4127944075937915262,7497397795044940169,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=16512 /prefetch:1
  2⤵
  PID:8140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=85 --metrics-shmem-handle=16628,i,3030932010510961468,4595316227544672894,2097152 --field-trial-handle=1956,i,4127944075937915262,7497397795044940169,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=16644 /prefetch:1
  2⤵
  PID:8148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=86 --metrics-shmem-handle=16776,i,1000990020535538778,4265761497982624205,2097152 --field-trial-handle=1956,i,4127944075937915262,7497397795044940169,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=16792 /prefetch:1
  2⤵
  PID:8160
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=87 --metrics-shmem-handle=16924,i,8012330438404557405,9429846081544584758,2097152 --field-trial-handle=1956,i,4127944075937915262,7497397795044940169,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=16940 /prefetch:1
  2⤵
  PID:8168
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=88 --metrics-shmem-handle=17072,i,357305586529864858,12541528832154222434,2097152 --field-trial-handle=1956,i,4127944075937915262,7497397795044940169,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=17088 /prefetch:1
  2⤵
  PID:8176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=89 --metrics-shmem-handle=17220,i,3142323377502848273,14322510499235509665,2097152 --field-trial-handle=1956,i,4127944075937915262,7497397795044940169,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=17236 /prefetch:1
  2⤵
  PID:8184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=90 --metrics-shmem-handle=17368,i,15131251758694188662,7555237210250544064,2097152 --field-trial-handle=1956,i,4127944075937915262,7497397795044940169,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=17384 /prefetch:1
  2⤵
  PID:7180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=91 --metrics-shmem-handle=17520,i,4088838195473972962,6565575461801089260,2097152 --field-trial-handle=1956,i,4127944075937915262,7497397795044940169,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=17536 /prefetch:1
  2⤵
  PID:3184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=92 --metrics-shmem-handle=17668,i,11645051464056849649,17918575023570152496,2097152 --field-trial-handle=1956,i,4127944075937915262,7497397795044940169,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=17684 /prefetch:1
  2⤵
  PID:6588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=93 --metrics-shmem-handle=17816,i,14742955458327887371,13525260510765397468,2097152 --field-trial-handle=1956,i,4127944075937915262,7497397795044940169,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=17832 /prefetch:1
  2⤵
  PID:6576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=94 --metrics-shmem-handle=17964,i,17978723815732576895,13509106445947397388,2097152 --field-trial-handle=1956,i,4127944075937915262,7497397795044940169,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=17980 /prefetch:1
  2⤵
  PID:6564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=95 --metrics-shmem-handle=13920,i,13187466448251234401,7052470356611859803,2097152 --field-trial-handle=1956,i,4127944075937915262,7497397795044940169,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=13932 /prefetch:1
  2⤵
  PID:8264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=96 --metrics-shmem-handle=13676,i,667312285837725922,10266159294637440423,2097152 --field-trial-handle=1956,i,4127944075937915262,7497397795044940169,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=13592 /prefetch:1
  2⤵
  PID:8312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=97 --metrics-shmem-handle=18332,i,7755337859176025379,741997075975679190,2097152 --field-trial-handle=1956,i,4127944075937915262,7497397795044940169,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=18328 /prefetch:1
  2⤵
  PID:8320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=98 --metrics-shmem-handle=18468,i,16770778394567895668,17057349173051279840,2097152 --field-trial-handle=1956,i,4127944075937915262,7497397795044940169,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=18484 /prefetch:1
  2⤵
  PID:8328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=99 --metrics-shmem-handle=18616,i,10805523264602675704,7457269997931090747,2097152 --field-trial-handle=1956,i,4127944075937915262,7497397795044940169,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=18632 /prefetch:1
  2⤵
  PID:8336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=100 --metrics-shmem-handle=18764,i,11630100283010608441,10100040103185557911,2097152 --field-trial-handle=1956,i,4127944075937915262,7497397795044940169,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=18780 /prefetch:1
  2⤵
  PID:8344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=101 --metrics-shmem-handle=18912,i,10867495118948337433,6454560366199825088,2097152 --field-trial-handle=1956,i,4127944075937915262,7497397795044940169,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=18928 /prefetch:1
  2⤵
  PID:8352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=102 --metrics-shmem-handle=19060,i,17865258824151113978,6592672745892031757,2097152 --field-trial-handle=1956,i,4127944075937915262,7497397795044940169,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=19076 /prefetch:1
  2⤵
  PID:8360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=103 --metrics-shmem-handle=16816,i,1106909650675843076,8820291718530071090,2097152 --field-trial-handle=1956,i,4127944075937915262,7497397795044940169,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=13132 /prefetch:1
  2⤵
  PID:8544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=104 --metrics-shmem-handle=18276,i,8130068614247334526,7431490716459002740,2097152 --field-trial-handle=1956,i,4127944075937915262,7497397795044940169,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=19316 /prefetch:1
  2⤵
  PID:8944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=105 --metrics-shmem-handle=19448,i,281467482531391187,6657233539546141523,2097152 --field-trial-handle=1956,i,4127944075937915262,7497397795044940169,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=19492 /prefetch:1
  2⤵
  PID:8956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=106 --metrics-shmem-handle=16336,i,6150006853119565358,6750608068871335834,2097152 --field-trial-handle=1956,i,4127944075937915262,7497397795044940169,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=14392 /prefetch:1
  2⤵
  PID:8968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=107 --metrics-shmem-handle=19304,i,6415646694051608073,2964194803824380058,2097152 --field-trial-handle=1956,i,4127944075937915262,7497397795044940169,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=20016 /prefetch:1
  2⤵
  PID:9032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=11284,i,9834628966190750973,1823812823550512383,524288 --field-trial-handle=1956,i,4127944075937915262,7497397795044940169,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=11328 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:7632
- C:\Users\Admin\Downloads\qbittorrent_5.2.0_x64_setup (1).exe
  "C:\Users\Admin\Downloads\qbittorrent_5.2.0_x64_setup (1).exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:5528
- - C:\Program Files\qBittorrent\qbittorrent.exe
    "C:\Program Files\qBittorrent\qbittorrent.exe"
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    PID:8908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=9228,i,653701098889245866,12027002362834185310,262144 --field-trial-handle=1956,i,4127944075937915262,7497397795044940169,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=9644 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:7684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=1168,i,17977448689548812792,15445225126061482050,524288 --field-trial-handle=1956,i,4127944075937915262,7497397795044940169,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7548 /prefetch:14
  2⤵
  PID:344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=111 --metrics-shmem-handle=9652,i,9157059772379748421,5359264729486174665,2097152 --field-trial-handle=1956,i,4127944075937915262,7497397795044940169,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=9744 /prefetch:1
  2⤵
  PID:4216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=112 --metrics-shmem-handle=3456,i,16332416466296136546,10298049141287803205,2097152 --field-trial-handle=1956,i,4127944075937915262,7497397795044940169,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:4512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=113 --metrics-shmem-handle=3316,i,11226278886803378445,8741646625682305333,2097152 --field-trial-handle=1956,i,4127944075937915262,7497397795044940169,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3920 /prefetch:1
  2⤵
  PID:4852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=114 --metrics-shmem-handle=8448,i,10462430348039846543,4649949160935784152,2097152 --field-trial-handle=1956,i,4127944075937915262,7497397795044940169,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8360 /prefetch:1
  2⤵
  PID:8412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=115 --metrics-shmem-handle=10100,i,17394780720238009598,11238644324246202056,2097152 --field-trial-handle=1956,i,4127944075937915262,7497397795044940169,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=10024 /prefetch:1
  2⤵
  PID:5132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=19664,i,6210745745488159257,10088216270642326924,524288 --field-trial-handle=1956,i,4127944075937915262,7497397795044940169,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=19608 /prefetch:14
  2⤵
  - NTFS ADS
  PID:2572

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:6084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa11c2c728,0x7ffa11c2c734,0x7ffa11c2c740
  2⤵
  PID:5992

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2964

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5484

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:72

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:6464
- C:\Program Files\qBittorrent\qbittorrent.exe
  "C:\Program Files\qBittorrent\qbittorrent.exe" "C:\Users\Admin\Downloads\Red Dead Redemption 2 [FitGirl Repack].torrent"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: AddClipboardFormatListener
  PID:9076

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Phishing

T1566

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qbittorrent.exe

Path C:\Program Files\qBittorrent\qbittorrent.exe
Size 41.2MB
SHA256 e7e35e443e6448ebbca051a0e675239aecd0b1f9eae5fe9b111b07181b118798
MD5 34933b455961676727a331ad048d9498
SHA1 7cdb1cdb28d60eefc8f497361806f1993b67f7dc
SHA512 7a6c1fabcad0a4a30c2e36671ef08c79b37571e8fd747a793111d5f91bb8e23c20c17f8a16b4b5be894d15d18e059207282b88f1b45b90ebd58e53774ac3973c
SSDEEP 393216:DxCuBxKKQbIKk618PcfvBf1wy08xnLvC5EUl+C9YvSuu1JnLaR3ya8kFuSnU213J:jgNLvC5EU/YKuuLI3B8bS31OoAM
TLSH
T17997AE1666F80195E1FBC27886A79113EBB1B806137457EF02A496B91F73BF05E3E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 0569bc417c2bbfe2b60b6425511f91b324e5ec70f02de579bb3a3681769632e8
MD5 7e88a01973014db4a910784fc2cb604f
SHA1 df5d569f5b8fb6830fdeca96547faac98f437aa6
SHA512 b9de58555702774787856ffc2d4b9b132b911aadac79ab1b5becb46fa803b9acf1975e6eedf02316e6b3714fef0a32d5276a9043a3fae8aedefb253614922789
MD5 SHA1 SHA512

Submit Download

0eed5fa2-9730-40f9-98d6-4bacbc161764.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\0eed5fa2-9730-40f9-98d6-4bacbc161764.tmp
Size 14KB
SHA256 fd25421987d8cbd03eb95513f6ad98ee4ad1ecb0044849fff8facf9d30e9682f
MD5 4bbc9f55e6ef77ac2494db9af6cafb90
SHA1 db896fac95a5c337969c12e05d6b0e9228aa0057
SHA512 6d1de3d68e92d69c5809adec480a64499d37eb48a370408d06194f366a0009ec428a138c76ba1c3d82f5506b88e8e048ec0fef9e0b90885e366cc47a768718ed
SSDEEP 192:xRicBzf5T7MdQaTNv7pp+PRpctd1XyXH9wHsb+WNEm0NGj4c7WS62a7nYkwyazWF:xRimzfJQdDt9GXJOwAajW12P02e
TLSH
T13362E52FB960593B5CD6C62AFA26B757E7F8102266945E84E7FC8B1C04D76CC321702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 072909dedd5be9db06820de90547b703fdcbd98cf9f312eb6dd820aa74eed106
MD5 ae703a6894f75136b025f4fd61c89b9d
SHA1 999ed5155a913161f6d0410a0c0c039cefe05bfc
SHA512 3d6333b6debc8ec32d8408a53cc38aca682bf939ae47ff1dfdb63920f7cee0f377e387dbb73c035ae5c691e2f29bf4eee1533072e268ff360bfedde461b2b442
TLSH
T145F0F9AACD20DC7714FC4B2960544B4BE78513572B40499F3A3C820C4FB563B468682C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000008

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000008
Size 81KB
SHA256 74bb87079ed46b17750701b528befa2b52175b25c1d42714f62c98799207c3d0
MD5 51258a2c2fec7a175e798cca18405036
SHA1 e1d50bad3dffed6a1418efc2453437837b53d18d
SHA512 b3d0edbd1f4704b1467dcddcba01da13ee2c15c647d2cf829072a5cd66c6e33f8e4a018d15eaf2c120bcae765a472b63f78fd3745acb5e6158814764f0c9bb65
SSDEEP 1536:yCe8ROKClMoKUIFJ4CI7T1KRJwErK1bO3tiu/avDAyfX1m0Z9:y4RONltIFJ4CCZyVKtO35/YDAy1
TLSH
T18B8302CD81A2F6305E6B3C772DC56CC20D3A2A5E3A0468F22B427C19A2FE86769D7545
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000a

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000a
Size 38KB
SHA256 7165713d3e1a610399471a5e93d5677508f62ef072c1151e72273bf4bd54f916
MD5 9436affc97843765a966b3568fa7e5ec
SHA1 7bfda74bb30589c75d718fbc997f18c6d5cc4a0b
SHA512 473ec3a843c33e18d6d194651fe11353fcd03a7959225faeabf8c77484155ea6a7bccb72dbaf2093ed53c408faa3be9f6fc907f7a5ddf8223375f9d09b504456
SSDEEP 768:eUEh2+iKBVQbBhu8vjenqz2Ez6Y/AxHLEaP72sV9qKYbDblXqhP8qwFSE3uk:eUEEoBVQDjeQaLnP2pfZTqgSEB
TLSH
T11703F112148F7FA1C244F224A4EFE416ACC3F565ABA15E6980B8B7C7010E3C657A46FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000b

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000b
Size 507KB
SHA256 b22a5ea9ca1a528874fbad6b07566ba15fd905106df8c653e2c4ab5512275a80
MD5 5226f4e19964a18588e942a24bd5687a
SHA1 8af354c972259c7bdcaf02bc93b736fee98276e0
SHA512 93e48916cbf5fb6d313f28e60f7a5df6b8aa0c73c7ac4f989957b9fc4dd5840f22a729f72d0e91f2ec5ad15742c0c5d5896e33258214f49c3b89c5390f11a8fb
SSDEEP 12288:M8s0JPG2BA8rdh387rLiAX7rTVgUiRVSIaqaIO:M8s0h3T87rLiAXjVgWZIO
TLSH
T1C6B423711B081D703ECB6DEB546E2E069ED142B3A250BDD8B3C5B52FD9F662115BF820
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000011

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000011
Size 24KB
SHA256 a3cf4861c7d0c966f0ed6564f6aad6b28cbd3421a9ca4f60e2246848d249f196
MD5 344ee6eaad74df6b72dec90b1b888aab
SHA1 490e2d92c7f8f3934c14e6c467d8409194bb2c9a
SHA512 2a9a9162d610376512a8fae2cf9eb7e5146cc44c8ebde7a12e9a3985da1718c62ae517c25b00de7c0269efab61b4850a0becfbf04382a25730dbe9cf59825a62
SSDEEP 768:RMxowxdaCb0WaY4P8keYUej86bykBRWIsna:RM1r0NY4P80j86bHtqa
TLSH
T1EEB2E0EEEE552E4CE2F059B4962B734B8A46F022191F947832E7844E8F494C24EDE477
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000012

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000012
Size 41KB
SHA256 0e2e6d1994902577a3d3a7f0e37875dd22de26342bec8403ebe262f92f2eddd7
MD5 a587d1a659231c3c59460569a5564da7
SHA1 eb542e028c0b1d2fd44d24b15f20176a26255d07
SHA512 73c9bfccbe137b51140469d22c9469ccda975e6caee5402a819a4629d1d5a23664e062e5f96271c1ca37b2f737e39cba6f7c25d25c0f1a3d7a31394ab8ecd814
SSDEEP 768:aS1GIh+o3q6EIwVfpJWMT3PHw1ALy+wBAPYqaia1PsbtUZE5JCaUvZGJatEG2fhN:aq9/EIwVTT3PHGAmPXRiMPmoKkHZGJau
TLSH
T17313F1CCED8DD55C266FF1E788F8B6B35468BF818819D336A4A067DC0724803743BAA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000013

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000013
Size 22KB
SHA256 c3e646e385b7f7fa06a4ff8d6a1c628b92948b58fec797f37c357257ed61e7c5
MD5 90e674debc9d7bce78410cb337936c31
SHA1 a7159ecf0dd298a9414fc45631d14669d89513b5
SHA512 80ad48b9cdbd3654670acc4b8a2c8d5e617f7aecfac27c93403ed3b9e4431c731bf9accecae54467f24bb84d0b76806c94caef4dfb739f8fa9831ddad11093d1
SSDEEP 384:EcACbhepNJOjNJXTLJUjPsNEWQvKTqS2i2gf60T9JdR7VW5yi9GHVQj:ESMOhxKjENMKTqy2gys9JP7VURQHVQj
TLSH
T1D8A2E0A12E0E7B88F9080E52FB5CF4E67D4D84566128AF14B4055B981EF3E1A3E5FC74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000014

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000014
Size 21KB
SHA256 d2263711c4bed4e203c88ed278049c80d1d3b1fff690be0b3a516749cbb38c58
MD5 59273bff8128028304bb9e3d453c25cf
SHA1 51e3d3334f3269e3c262f9a9a47590ca73ec871f
SHA512 53655fba1f72533014c66442bd7274dde3f02366a70f1f4783f4e22b06a1f70752d511542991bc4997d91938ee2c25571a2c6a537ea7e4af406579ef0bd69b46
SSDEEP 384:dTEX8Wm9sWw25hJf1o6ePOfv9J0ov4n1vZlnb+TmW3PZPHu+aYkxMUzvFb3PZf1Z:dTEjWXfOhPOfvYov4nXlb+qgGlZfZRXd
TLSH
T146A2D0BB2CE4803A8F1271A4FE2C5D0606106E974EF9466E4A39F190395936DCF623F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000015

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000015
Size 24KB
SHA256 f254eb93b015455a3c89aaf970631bc989fe2bd387f79e871b514992359651aa
MD5 5366c57b20a86f1956780da5e26aac90
SHA1 927dca34817d3c42d9647a846854dad3cbcdb533
SHA512 15d7127970436f2510344600f3acecc19c39a05f8e82c8a7950095386382b2e2da55883a5a9faa97b84452e67315b9ac1693b6592274c8c1c35c813dfeb543a2
SSDEEP 768:ZfRLYs8uBykIQZ6yXBeQOS9JUmBgKYTbgVec:vsbmrDXwEfUmBgKYTc4c
TLSH
T18DB2D004F02ACA26E53655B371E82BD54CB6C4CAABA9935C113520AF3ED3F48C991673
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000016

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000016
Size 76KB
SHA256 159fbdcf23c881aafd14988ec140e6a4c532c2faa03067df29fac4d79dee4e8b
MD5 02e287a7857163061f07497ed84907ab
SHA1 96db842f3d831a90f4b46a9febdebc5d05a6068e
SHA512 f752d34aa896e6a64d30838e913204937b9fdbfe24d3727e1c8bf07ed5bddde4fada1c4a8ae55dac8c8a50d566f4690ab613f2d525fa8fbfc1a6129a7ff1d959
SSDEEP 1536:NP2s592WtuNCJEuH5rHhf22SyFAuegfuBDRwP2joLdgRo:N9592yEC3H5rBu2fAQfuBDRwejoJv
TLSH
T1827312D532B5CB2FC9C9F63F5A9DEA6220F8A05975A4D04078D5FBC59F2C2A39006A70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000028

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000028
Size 32KB
SHA256 449dac135b065708da7bf716edda6d7b538866dd207d010e64ff39f65ca7b7bb
MD5 85413f0214643cf46ad4da7b01a82b32
SHA1 2643a994a0bfbc31c1340acbca6079d84eb4cd02
SHA512 a7428589fdb4b67ff872398bae635a8efce01c10945e4bce32b31ee8d494f1f8102f5e10465680c29a041e047090dd417bb87aefa0104461d52f4acdff12bafa
SSDEEP 768:JQ1/zpK/TXqnDvnm0Eusj55U2vJbCKi2L1QsTTzVK:JIYX8vm0razVi2Ll9K
TLSH
T104E2E1597EB9825E152AB2A6CCC2F778825DAD487F3F366892026C58730D83301D7BD7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00002b

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002b
Size 72KB
SHA256 3f629f74dfd693b38686debb1a1a0b263259e0c6eed716bf618c0f1e0d02131e
MD5 98eb7c7f71843a290091076bcf5a94d4
SHA1 dcbba412efa0951f77ccf15e522282ace00eaa98
SHA512 5e8443d9631542f8f3f39e3450a4c17217683f5cf5b0a29acf8cd7ec385bd1491dfc9edb1bf370551980e3b4e3f3db969bcbac242926d09c14eed41db8022f5a
SSDEEP 1536:83TkiGGcTGOrLqF4EMHukBoFupJitrH1wPEGkalVeVKGf:833cTGOr+4LoFvtrViVKKGf
TLSH
T1927312F40EDEE07CC77E29DEA90E7349D37E3056AAD89D6BA150B44A1414C0D0ADACF1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00005b

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00005b
Size 61KB
SHA256 7c00ab4a9c7f9bb013b8902f8f0f0e7af5c0236b1e142a07ee9fe80c4ee5ce03
MD5 218ac5ab2c7b659c74ac5b97b224c184
SHA1 ea5df0e3382824b74692dfcf8faf43e3bcc3987f
SHA512 01a28cd9aca57d1eb65c81bd0992e8ceb0cce5c7eaa6bc1bf95c45620c59f41c02043bf16dcf97af7f482c21b64c4210b39d1ebd5ddfd48d1fe3ce90736ba578
SSDEEP 1536:Wg0/p38I4rO9S95sEovQm8PV8MoccALDH2AwqrJqgR:5ECI4rO9WsEHGMJPrwqtLR
TLSH
T1AD5302A3F269BF3D3B074395D87C6EA833B05DC7A58440B06955C8E21607B4B58BD32B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00005d

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00005d
Size 73KB
SHA256 fb69de564c55a631541f30a26e52223a2b422597eefa5a9e4edf9bceb8231067
MD5 8822fe579701e42c5e040b1744724840
SHA1 0c416166b448914abe086a784c24a83078a1b499
SHA512 016813d4e5539b4e3d6cb4ec59c91afe114a9e530115727c49a21f98b9624bae968083443a1c554716fd6a19da056d9c1d57206484c1f8db58e28ecea3804927
SSDEEP 1536:yfMXjpph2FzFBd9el1ehoPgjakxvP8Cmm4gTkQ7yo3DR24fxvyyEX2v9iFJ:+MXjpphqzF7ElfgBvPlmKTNyoPfxvykc
TLSH
T10C73025D799F1FDB1D648642F0ECB084892E687229317AB8D5C89000BF3F625EB1F579
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000067

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000067
Size 158KB
SHA256 60072b4eb6fc5f1f1214a34fcd55b3cbd1d05eddf778f85611f9b352c4c6452d
MD5 83266658f29f5cb762001d5d9f6985a7
SHA1 9ff52157193e1e798944e6a3172d938183f5e550
SHA512 60b2a8749bb597b71c6cb7113c4ea6c430ab90c6f6a5f78a36ab5fbd2676fbc173ade236be939e862569c786fbdc8e0aa984f1ae4263e91de2ba681cc8ce5d66
SSDEEP 3072:pqj6fcYjfI87fn/NWUEu+Y4rwgnWSPrrGh9SC2VRvkQdv45cf+Fg:pTvjg87fnVTEu+W3rSC2VRpBf+y
TLSH
T196F3232CABB1EF2298ADD32D789EF491C870553AC097303BB84FDF8575154348A7684E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006f

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00006f
Size 21KB
SHA256 b2763289d939485183b991096aad765904a9a2f5e14f94fecbb4fc1b75f94e5b
MD5 5775caaafd1e945c5a0c180b08c77bd9
SHA1 dd659d7762862c5019d92cceb45c6ae0dc76d647
SHA512 891c59d518fada958fb2c0200bde3f122826cd55699695288d85ed63ad6f2cfcf29879a4d8a178366ca37dccd8d25dd2824f55733c2e8a667277e4389b8f3ca1
SSDEEP 384:nmB+9a+QeFvqaQNWvIl5VD2HkGR6HoxaxYgPB3iZMzFOFTF0TCX93ln4:nb0+QCLIB2H1soxaxYgp3ioFATF0TY14
TLSH
T13BA2D0474A84BCA8D182BE11FA971517522EAD94C4BB1F8A2B80B51EA531CFDE3FC171
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 034e211ab6e0fdab5eb14a4d30a275a972642ccf0ec72a68c1b67392b86f2fec
MD5 be60ff67646e729a829fcc232ac9d442
SHA1 00febfe5c3211e18a10baaf405893293e18a1326
SHA512 1aacb2140bbef967e6466c0e67fc3e6485ab351e51e148097dfb01f5702fae4484aaea0b915a6bc38acba2694f99593a3b7a65e49227e5c60d912c7b2e74e39d
SSDEEP 96:Q+WXmdCGVQzSUswdVag4sbpuPnOdyROQSmrLiISBFWG/BUjY8SuJXjB:Q+WyKfvd3F8t7iKK+jYgB
TLSH
T168B1EB86D1C22E4ACF851AB01DC65A1075A4E8EE5C130BD3C36DDC76B98F3F948A2E57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 32d481b56c3d9cc9276107d7f91187556c00ef916f4b3b5c9dd5cb2f786ca260
MD5 f4bc93c86869344f7dd9163e69d86486
SHA1 eed7eec598b1f0efc21349df273f0505d26498db
SHA512 11eecec302e66b61b9176c073a15db2c27775434c0a57f1433f67e7f98e2b2440e6d4f9d4fa5ae18f383321e01944e08c63ad2507566cb758c877a3246b12a52
TLSH
T1C281FA86E0D16F09DF8846F01DC79A10B8F0E86F1C525BE3D36D9D74A9833A689E4E17
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 15KB
SHA256 9534b23be118736918fa7190564b84296884b40e67380724f6b4f02c7d8efef7
MD5 51174657c8c2b24b4e8e1334de23ff34
SHA1 b820d44115c79f66becb0add9719ef4991fb40d5
SHA512 10528d0b720fc1f0db4560a6b328a311c18de0933ea0530a68653b9af13efc370d25e218ba15038cac921f9ec85bf02ef3e4fb42fd8be2ca65f6a1e969b374cf
SSDEEP 384:DwMKegdS9hle5JOCzhYsF9nrFrXhZ6hikcs6isltCVwITq62fX803CU3yqT+ZEuo:3uxDY+Fa8
TLSH
T10272AAF7C3E8C66D892256F5AB242F1FCE5D092853183C66C8E5EE4F63E2471E24164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 62KB
SHA256 522862721576642f1efc4a350285d0418ee27762ff46ad83f69202420930c626
MD5 6093d431e2006ef6740c34478124d5a2
SHA1 87c8efb33bf1037624570734bcdd9f0b8f32ad64
SHA512 2c325775fad564e238db3ce0253daa02d381699cdb98398f1e23d62bfc293a87db8345222c65a31453860c831ef349a414ad8d0be04f82879800415c57b33915
SSDEEP 384:DwMKegdS9hle5JOCzhYZ8T0y3e5CpIaPq6BeyIw8eJe7eJbJKQeyvlk55/hrHgQr:385ZpKxeiYL42IlErqrBNb3LPFM4
TLSH
T1495379F783E4956D8A2169F0AB246E1FCD6C0D5A031C3D66CDD8EE8753E2432E60275E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 3f6b93d1e1f65e03aaf507d6d1850b6f2f6f2e5c823ba734a135246c28e9ff6b
MD5 31268abd61ddc3bd0ccb5d3618076f8c
SHA1 cc1cbe681dd30fae91b5ba6f696cca263d144e70
SHA512 9303c35fe3e324901f961652a30465371238c281237c33b59ee0107598b5ecdf6f1db16f6d6f5a7948c47855172a0741cd579b7157bf8a9ed7dc2d6acebd7437
SSDEEP 192:nRSfpT7MdQaHhv7+pAPRp2O9wHsb+WNnJ+n262a7nYkwyazFt+VyIsnAUgtaJ:nRSf5Qd3x6UXpOw0nx2PD28
TLSH
T1D842E82EBE60653B6CCBC62AFA257753D7F5102631985E84E6FC8A2C15D75CC222702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 8dc2b8949ec5cabdf15ee4bfd4ab223c7fd2b25aa0cbd90423d141604578f18f
MD5 635ed7dbfcb2ac8940d63e61c820fad4
SHA1 78413a4b5856d13dbc8979878d311b4763ec0b6f
SHA512 f7e7b66968c189599a24689a7167ca8be6694e368f119afe57cf63109637a142d0b29e74edb99157df4b6bdae4bcfb025c333f9b702a1df60049d96a0d8be11f
SSDEEP 192:xRvcBzfuT7MdQaTKv7pp+PRpctd1XyxH9wHsb+WNEmsIaNGj4c7WNHO62a7nYkwq:xRvmzfEQdDG9GXPOweajWr2P02e
TLSH
T13C62F52FA960593B9CD6CA2AFA25B757E3F9102265C45E84EBFC8B1C04D76CC2217427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 389f7bae5d24fe7325925e6f29356aaaee5972cafa0e980484d4fba64d5336ca
MD5 35ceda9ec628ff49eb0914f069e8c963
SHA1 948f0837bbc896c2cab7f3578921b351ffab0ac2
SHA512 d0e34e529b551847a79d82f0bdcbf16b50d7a7ebc91d7db1355ec572a170d25a16a5e2f0f2cf73772755adc0c1a6c66de33c3813be046f9d33b136d1556e466e
SSDEEP 192:xRWcBzfvTyMdQaZKv7pp+PRpctd7IpyxH9wHsb+WNKzsIaNGj4esYNHQ62a7nYkJ:xRWmzfbldJG9GXUOwLayYV2P02e
TLSH
T1DB62F72FB9605A3B9CD6CA2AF916B757D3F9102266945E80EBFCCB1C04D76CC2217427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 9bba2cd128b7bd541e36d12e8321cb37956f9c38f64cfefff00f43f13fcf42c2
MD5 1b8aafaac8674785d84f3ef19f6503fa
SHA1 37cc3be8a618a7a73a9b9e7b6f37649b77d74642
SHA512 48981d1b823e2a1bc934931b45f344928de46ad6c8abe2bd576adc8134eb4c40ba8572c87be69faf402f0688f6faf58c5f1dbba302180d6d1c5d942cf975c7a3
SSDEEP 192:nRicBzfpT7MdQaHTv7+pAPRp2tdH3yA9wHsb+WNw30J+BtK2X62a7nYkwyazgt+M:nRimzf5Qd3r6UX+OwkW2K2P62e
TLSH
T1DF52E62FBD60653B6CD6C62AFA267757E7F4102265985E80EBFC8A2C04D76CC2217427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 d7d48f1db130e7e17739f22fb1db26690a35bb5d6d1b6d0e2f36ab9a24d0d7c9
MD5 f543d50e0fd6db31cfc4265a693a9a90
SHA1 263374599b2d521f8cc285ea1e378da6589f739c
SHA512 7c8f7a51d1af502550ee04c46a27ef7f698afb779b8c892dfede6927fd918b1981b4a9661f374f625df28db41ac127edeae48e0ccb993267028687ece9f5de99
SSDEEP 192:nRicBzfpT7MdQaHOv7+pAPRp2tdH3y19wHsb+WNw30J+BtK2X62a7nYkwyazgt+M:nRimzf5Qd3q6UXzOwkW2K2P62e
TLSH
T11252E62FBD60653B6CC6C62AFA267757E7F4102265D85E80EBFC8A2C04D76CC2217427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 41f57156dfce856979cf2cf1aa024f134b321f5b1bed7a778a8d8146f2336262
MD5 11c67e154da9cd1833634b6af2f76641
SHA1 232dca45222b6b6af0551494fc2099d673d36c3b
SHA512 980a6f4f93d83e9aa2f1cbc8d0bc09fdae465794ca38f6fc1ba56209330e9f3f4438322924e995d63dbaffec2db0c6c23182101c9258d32ebc2ac690a48d9993
SSDEEP 192:xRicBzf5T7MdQaTOv7ppAPRp2td1XyXH9wHsb+WNEm0NGj4c7WG62a7nYkwyazgF:xRimzfJQdDq9UXXOwAajWh2P62e
TLSH
T11952E52FB960653B5CC6C62AFA267757E7F9102665C45E84EBFC8A1C04D76CC222702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 fcc86d95e1f6dc110e2a42a5695c2ba04b64330b4b26f77728f785cddf2b2707
MD5 aa0382c435549a92afa74c3210fe060f
SHA1 fa49ff985d5d50c9cf28d9397e0df16bbd025a24
SHA512 8e324b42f2c4bfcaa5021c2620e1e16e7513dc85ea9cc8ec103180ea87b0f73502d2294614af46291db8f70f0bb32343cf9d699a2548d95c574953fbe5b4f70b
SSDEEP 192:xRicBzf5T7MdQaTKv7pp+PRpctd1XytH9wHsb+WNEmsIaNGj4c7WNHO62a7nYkwq:xRimzfJQdDG9GXLOweajWr2P02e
TLSH
T12562F52FA960593B9CD6CA2AFA26B717D3F9102265D45E84EBFC8B1C04D76CC2217427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 3c5aafb18cebf903927872511a7b7d4cca96ca69e6b0553fb3de15924b31df33
MD5 1d570d9e02e2919f76a144b639e6e8c7
SHA1 04911ef7418b1c438b9028f7b77b5501aa461c29
SHA512 a12a67a3d57648fa3e04d251edeb80b0b46e77405e695355ef9aed310ad4aa405879ba8f080ca63a55e747d8c665dba7769323ee4b33b64f69abf90b3ba31092
SSDEEP 192:xRWcBzfuT7MdQaTKv7pp+PRpctd1XyfH9wHsb+WNEmsIaNGj4c7WNHO62a7nYkwq:xRWmzfEQdDG9GXhOweajWr2P02e
TLSH
T16D62F52FB960193B9CD6CA2AFA25B757E3F8102265C41E84EBFC8B1C04D76CC2217427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 dddc2d96d6d3094e6545ab564f2a060c0d309d3b906f22288a0b777c7cee2461
MD5 9cc9ba409647e37abe3fbae031313c99
SHA1 491e35c31e83b9c4684204c63b44bddbd0ea8aeb
SHA512 472588784b5fe0462bfe041e77db85db95103e40399fbd2382575ee76d11d16896d732bca290148b419e000044c7170bee03107c1df8a765789cc80fb35d55f5
SSDEEP 192:xRWcBzfuTyMdQakKv7pp+PRpctd1XyxH9wHsb+WNEmsIaNGj4c7WNHO62a7nYkwq:xRWmzfEldUG9GXPOweajWr2P02e
TLSH
T1D662F52FB960593B9CD6CA2AF925B757D3F9102265845E84EBFC8B1C04D76CC3217427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 d182f78487f51d56869ea64e53a67f6a6aa404d46bd165d42f0b1896043fc486
MD5 c3fceffe982753c9679a52670532538b
SHA1 7424436d782bcd9dde7f1d1ecd16ad78a8b0c27c
SHA512 2299cf57a2243966147c7c2e290a1ff07a295d2b62a38450a5cd9031bf86a117de4c46aff29c9de599d57304f04305b9abd5d3bf7be511af715c779ffbe1e16b
SSDEEP 192:xRicBzfuT7MdQaTKv7pp+PRpctd1XytH9wHsb+WNEmsIaNGj4c7WNHO62a7nYkwq:xRimzfEQdDG9GXLOweajWr2P02e
TLSH
T1E662F52FA960593B9CD6CA2AFA25B717D3F9102265D45E84EBFC8B1C04D76CC2217427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 31a5ce04ae67b5403f3453ceb77ece590798531384f472283d145995727d92f5
MD5 b28f8d2c357e9f30dbd5f6faec9be3a8
SHA1 7045d97913533ca8a4d3fd4bcccacb31200659fb
SHA512 0c3fd52647169605cd7ffcc7ff7895b9d1008ecd2a828bc0aac93f78a5c3515c5bf2ae9dd7335970687bfc199d7d6444d158da461151c200b0fb87c211b0d77f
SSDEEP 384:sejIb7KxkXqKf/pUZNCgVLH2HfgslHH7pLuLcSj2XXODIX+ErU38xHG6QDzXU:suIb7KxkXqKf/pUZNCgVLH2HfgshH7pZ
TLSH
T17072F8676C489A370F94CA8CDC267B4FADB5024B65EDC86483FA581903D5BCF114A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 b3ab3356084b2eb8e145aab45ef3535bdb19f10058d608930362bc1a4d27b4b0
MD5 8927ace359b68085c784c3b690c71e9d
SHA1 4832ce52d2b57565edd3d594329c69b18a5d8744
SHA512 f6971c727be15bb6d912beb7f3d86dae5a0da820e670c574289752d8f6ca431824a2f43ba23a43a2c40a27389ff10446a4d58a957d46c7876c94a8bb4104b2c3
TLSH
T184B0124088415601C40602F41E9658887154AF30960A170593F0EE22882D5508414050
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58eccc.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58eccc.TMP
Size 96B
SHA256 1eb3454ea576e56d984a75e517dec6e9dc66bbfb9fe91cca86982fdeb9ed1896
MD5 2fcb906c86d5819f2e4c61e904bd567b
SHA1 09ca9e010e6f91f4548cab5d51e5900aecd513f6
SHA512 6fafd84066a1b806317cd763c825c7c121831fa0e86edd937dda9f6f187b0e57f8bd74482352500ad467cfaddf374cbdbed7507895d0d9139d15604ae60f0d5b
TLSH
T179B02282C0022202E08203B23C80C2CC3220CF20C303030AE2F00B23CC2222008300A0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 e1160d33664f53972e7193fb7ebe8c0a7797490e000f6ca067aef71c6ea361df
MD5 844f389ab885cf2604cb79fefe86e446
SHA1 91bead1f95272ebf4abf9c66bd19d6cdfe0c4f9b
SHA512 ff9650995e4cca7f7adccc609010aca12e53ff804b0d749dd1b16ef2e1fe8bfcab2756a53b7d65ee8ef8a94ae0535be7311ccb327db7cdc35e7e5f1970ef0f13
TLSH
T1C5A0022003D55926DE914771578151C563314A1B6341924384951145889B9464505700
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 c39dc1deaceb410b90fdf9a920da8bda4e30d8253680805327642a6565b7cb38
MD5 11485fbbff67db78acbbde3ecb534606
SHA1 1bcd093f91a732629ce3f93dd466e6bf32f7b425
SHA512 a7387491bed5c769120ff5b38897f361b227e36d2ac0fa8c73d8d19eab70ff37940a860c749a94b2d2e98978edc740e8c5cfc98091e99351ca030a10f356ae27
TLSH
T142B00210C39A1423C56553F097DF19C23371DD6D578356C7C5D400A5B929F8A9511B00
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\4\CacheStorage\index.txt
Size 150B
SHA256 eac147b6b89dc67a56d025db6a160d756ffad7e4f71e3ec6710a3564cc39a774
MD5 d50903783eaa77d76c9e8525751c59c8
SHA1 5016b477b15311c264c49a165e5d1de3f395c4d9
SHA512 6a8115000b7fcf8343ad3c404cc4356086b3b362355494fc9f3e580b63a54506169fe7dbfad1aacefc71ad173d29d157f1e4ea25a20c677a6d2c0dd097b0df35
TLSH
T18BC04CD7151089CF0B34DAD9A018721DD55B82488CC5CDE8A94545561179E634802539
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5bf9be.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\4\CacheStorage\index.txt~RFe5bf9be.TMP
Size 157B
SHA256 ae161fd81d57960151462074a4923c0c95c05641d34bab05b02947f9e0c388bd
MD5 d1c213e4d0b9866b3897c7c677bf69d2
SHA1 a955b6af0e118b6d40994af821e5cbc06e9fd248
SHA512 cb257f7eee2f099aa89844da8e103b7be502309c8ad312974c4e13de2e7877f0d0878e2b1de256ffdf4968dcb1bec811f5752f1130a9b2c37bfc992a51e8c9b5
TLSH
T1C9C08CD3051084CB0B30EAD9A028720CD46B8E088CC5CCE8A806700620B9E238802438
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\4\IndexedDB\indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\5\CacheStorage\index.txt
Size 244B
SHA256 ccdbaffd2d583888de8bc953e42d51924dc0709ace743186a4f13953402e7c8d
MD5 2c533520d737c4e9b4cdfe2d35482009
SHA1 3803f1394cd38151154c3a371482615d820dc91e
SHA512 b303f89da35f5ae7efdb53e3d1d409216cb2eef087b7b989fe79129917ecacf1cc51ded402e374da960dd74b5f85ee2ce4bffc8d429a19e949d2faf2d8e925ab
TLSH
T1BDD0A7DE46718D4663709F95A028715FE09AAD1DCCCDED906A04B1D269B8162810AAB4
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\5\CacheStorage\index.txt
Size 160B
SHA256 0c1d449e9011aebcc13cc3979ee642b7648c785ae19228bc043554e574cc10f2
MD5 7ae7139fcdf8af96795118e714e58748
SHA1 3cb3fea5a85a1e359288b09363f956e235921cc4
SHA512 b30f1a969512c31aef1ab5dbf2a9c66e0e3c2855dac54bc924b4d6e3fd2efda677bbc53b915815240dda1284874398d5607f256f3793f75799c63d77fab59b46
TLSH
T199C02BEF4A508E8A17B0DFE86028B32ED09F460CCCCCCEF0A60C94C12578473014B634
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5bdb97.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\5\CacheStorage\index.txt~RFe5bdb97.TMP
Size 167B
SHA256 fccab299567f748e47dd273994976f533a1234f8746aaf5fbd2edf6e1820e19d
MD5 6f7b18cdff63e66f5033e14e9dcca62d
SHA1 37fcedac6bf4fbbe03320a68ae06b8dadf923f1e
SHA512 f57bfa297ec326b34b9953406731346b25522a0536d9483fc6db249ab972b3aa886411e40817412e2977131d19990dc8102e706944116672d2f0de87cb3c8cc2
TLSH
T1A7C08CEF4A604E860BB09BE4A028B21ED0EB4D1DCCC8CEE09508B4C12578463424A624
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\6\IndexedDB\indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 8b38c07eb9cbb3045f9f3162f93fde51b31a857415dd6bf84f63f08fe76f85f2
MD5 6fd3ffdce2a94f197fee5a65d81fa225
SHA1 9e197a50aed1dfcae6e618bc0229017ba1f677de
SHA512 f2a6c64d402ebb1c11036c63d641cd4a17251727327e455353208602db821a18581dc8e74ad72b46c14caa722f9838f1f702212633261c53ce38455f83841c4e
SSDEEP 6144:jt/m/kPmN86MiPEURFgI1PTDFWDfxA3OnjrYQ9EU0/hEb:IcONRsi8Dfxjjs+Ck
TLSH
T1063412715C2F7D260DB8EB95A40C72659FF0F9AF96870DCAA2DC0F8948FE8811625C74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 231KB
SHA256 ad716e35f1c758506ba2d35dc513927dbd0df8088d41d5018d54cf1d3cc89dcf
MD5 c3447e1ea400f786ad3fb2bc26d0e7eb
SHA1 921c28a4a9f5cbfa66983c2d3ccb42f0543038cb
SHA512 06f95212ff3b9a6ad87cff788396424850d15f5968a2b8bb3396565fc20062d66cfa279ae529c8aa8ba716b7fee25093d37ff459a9790586a0f5e980799a01ce
SSDEEP 6144:uwS/m/kPmN86MiPEURFgI1PTDFWDfxA3OnjrYQ9EU0/hEb:uwfcONRsi8Dfxjjs+Ck
TLSH
T1CC3412619C2FBD160D78FB91B50D7665AFB0F8AA96870DC692DC0F8E08FD8C52225D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 d2fc0bca54890f5bb03dcb75eeb94e61b3d7c5764ec655f524be1fb1f20aa891
MD5 39ce61587d93cd7adb75d569f1469459
SHA1 7c06314a674057150b50ec05ba6713467e1bbf4e
SHA512 daafde1c25b2a8555dcc6ef0d746f69e769ecbd709c3c03eb26e2ce73a76ba8be22d3f34affc2fd82c3c7be110c9c7dd8acac3512ae3d09aef8a79ad429895eb
SSDEEP 6144:L//m/kPmN86MiPEURFgI1PTDFWDfxA3OnjrYQ9EU0/hEb:icONRsi8Dfxjjs+Ck
TLSH
T1C73412715C2F7D260D78EB65A40C72659FF0F9AF968B0DCAA2DC0F8948FE8811625C74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 ea5afdc54195ecab9602ab6a32fbdca51debed26acfc7af03ad2fd5b6d59cba4
MD5 e9e71ae5ca918b61d598d085e7a1d75b
SHA1 c9cf3c46dcc7fe6d4e40521e2669b8ecfb828da5
SHA512 5d4339dee11100ac03fabef9b478e0395b826e8f1aa0399d4e9a09a6cc6a905ce837b9bc64077c72943ba1d35f43b74e60c31ef22dd28e7323dd53eb99eb7689
SSDEEP 6144:a//m/kPmN86MiPEURFgI1PTDFWDfxA3OnjrYQ9EU0/hEb:XcONRsi8Dfxjjs+Ck
TLSH
T1063412715C2F7D260D78EB65A40C72659FF0F9AF968B0DCAA2DC0F8948FE8811625C74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 89ed957c89086436ad0afacd3c11aa5bd480448b082f2772ec4793975fff0124
MD5 258ee5bcfd8bbe95f489c3e0f8ad3170
SHA1 5ee5cb1e99f47cd66829e42eed6a39b5be85a211
SHA512 1781bb0d81dce4397017700ab8eed634485e38e4506775ae0c253192eeb94a62c22936475b73c66f80bfae248629728d71a3c1784d7cc7f4500bdd65ed91a125
SSDEEP 3072:wzWs4B7zxAQ0xVOnXTZpY3g9DzcU0/DlblAITog:eWDfxA3OnjrYQ9EU0/hEg
TLSH
T1E4C302A15C39BC660CB8EE95B44C3F60BFF4AC9A91879DC362E91B0D24FB5C81139930
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 231KB
SHA256 91563e4c7888cac09537fead0ab6532108a23cc0df02f614d9f5d852c2092a42
MD5 13b1ff0fb06cfd24e4c12c1416cb1083
SHA1 a97c087fe25e28ba2798c27ff94b6d921c6a56fa
SHA512 add05fe204111f885ff7e3f5282cd258b45677e573aff1a042e6cc13d1acbd07b921113dda653fd611073958456f837e3d59a913c60d376247035f868afe090e
SSDEEP 6144:xwS/m/kPmN86MiPEURFgI1PTDFWDfxA3OnjrYQ9EU0/hEb:xwfcONRsi8Dfxjjs+Ck
TLSH
T1823412619C2FBD160D78FB91B40D7765AFB0B8AA96870DC692DC0F8E08FD8C52225D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 231KB
SHA256 c20c35b31c120c8213eb4a61fa85a0bd5049690c0d19d2f2919bcb1aa21e488d
MD5 fdcd2c01626f4ea6d6e5edb8a7d425e9
SHA1 3111c0710064261fde23c2be555fc85c284b8aa5
SHA512 73ff1755987ac533dd21e431de5f415f1cda92305622d0a98839115f2b35d98a4cc96f7ef61728f2a3e30a133a883690bf1608756efa928a2a1d0f5a87ec4057
SSDEEP 6144:5wS/m/kPmN86MiPEURFgI1PTDFWDfxA3OnjrYQ9EU0/hEb:5wfcONRsi8Dfxjjs+Ck
TLSH
T1CC3412619C2FBD160D78FB91B40C7665AFB0F8AA96870DC692DC0F8D08FD8C52225D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 9a29f908d2048e4a470bf8b81f29d823298c828ddf3495904d75db6c01c49fdc
MD5 9af7526a8117a80e4609707662ab6f98
SHA1 c81662ad58e4c51c2ec517d7898f2ea53cd103ae
SHA512 3521689f2eda04baf8541a08e39952451975a8194cd9ce89f42f2194b9cec88e7b2419d4abc7b761330f14ee7691353881be04801fc51644b134265fd619059e
SSDEEP 6144:J//m/kPmN86MiPEURFgI1PTDFWDfxA3OnjrYQ9EU0/hEb:AcONRsi8Dfxjjs+Ck
TLSH
T1DE3412715C2F7D260D78EB55A40C72659FF0F96F968B0DCAA2DC0F8948FE8811625C74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 4896d97c31dc274e649c4a40bcf49b1665a41140a5230aba1910c0133abb180c
MD5 13af997a40a58dc2c8292c162adcf1d5
SHA1 f11cb283fd08d7babaeeaa42d6aadb4c6c8458fe
SHA512 6e681ae57b4cb327c394090ad3606ac299bc151b54c4dbb7da11b6fc9a9c5d2fad92d8bd19362cacbc8176cc6aae7a5b0767e42bdbbf53e1cf46492179df376c
SSDEEP 6144:3//m/kPmN86MiPEURFgI1PTDFWDfxA3OnjrYQ9EU0/hEb:2cONRsi8Dfxjjs+Ck
TLSH
T1983412715C2F7D260D78EB55A40C72659FF0F9AF968B0DCAA2DC0F8948FE8811625C74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

modern-wizard.bmp

Path C:\Users\Admin\AppData\Local\Temp\nsi3BC4.tmp\modern-wizard.bmp
Size 25KB
SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
TLSH
T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsisFirewallW.dll

Path C:\Users\Admin\AppData\Local\Temp\nsi3BC4.tmp\nsisFirewallW.dll
Size 8KB
SHA256 53be5716ad80945cb99681d5dbda60492f5dfb206fbfdb776b769b3eeb18d2c2
MD5 f5bf81a102de52a4add21b8a367e54e0
SHA1 cf1e76ffe4a3ecd4dad453112afd33624f16751c
SHA512 6e280a75f706474ad31b2ce770fa34f54cb598528fac4477c466200a608b79c0f9b84011545595d9ba94331ad08e2f51bd42de91f92379db27686a28ba351256
SSDEEP 96:8SMPv+eLDUDp+weLv2lstU+0IgNB2Aa20kdArfOwJKbFrMiRsuHdRYL:wnxLDUwp6sgN2RDrzJMMmsuYL
TLSH
T16DF1F936B7E18171C26F02B09F4F569DE1F8E66067E0013377628B5D2EB029DE836526
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unconfirmed 608994.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 608994.crdownload
Size 31KB
SHA256 e401174b64317153787930a86b7eca27a8fc1a2cb66ead0ed9050f641a97e89c
MD5 ffe334d916b24053db421d93904bca20
SHA1 9376d01f07ede473d400dfe522296c5bc3e20b44
SHA512 44387bfc2222e680e1064ed89fc83fee9b1209140521f44c8a11f5b74e946e5c5e0acd8130a9459f57c24435f874a7e934d1bf66d4e9e493a399d4861b85e361
SSDEEP 768:7tFX46WhQH9mfcnUjrwLPp6Zvzx2eMoWrotE4j9icGh:7rX4tpfcUjrwLxZYE8kh
TLSH
T144E27E5537F0C8F3C9630B305E7A2777AFEA822112E45B0B57106F987D63992D90E792
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download