hxxps://share[.]google/Zij1qv924PvxOFLx9

Resubmissions

22/06/2026, 09:30

260622-lgy3rsbs8w6

22/06/2026, 09:27

260622-leqzdabs6z6

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
22/06/2026, 09:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://share.google/Zij1qv924PvxOFLx9
Sample260622-lgy3rsbs8w

Score

6^/10

discovery

Malware Config

Signatures

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2444	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134265942967392253"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2058276091-3280583803-376660292-1000\{8DC392F7-CCB3-4A7C-A6AB-A7A2B541C9AF}	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
6644	chrome.exe
6644	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 64 IoCs

pid	Process
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1184 wrote to memory of 2408	1184	chrome.exe	83
PID 1184 wrote to memory of 2444	1184	chrome.exe	85
PID 1184 wrote to memory of 2276	1184	chrome.exe	86
PID 1184 wrote to memory of 2276	1184	chrome.exe	86
PID 1184 wrote to memory of 1180	1184	chrome.exe	87
PID 1184 wrote to memory of 1180	1184	chrome.exe	87
PID 1184 wrote to memory of 4912	1184	chrome.exe	88
PID 1184 wrote to memory of 4912	1184	chrome.exe	88
PID 1184 wrote to memory of 4040	1184	chrome.exe	89
PID 1184 wrote to memory of 4040	1184	chrome.exe	89
PID 1184 wrote to memory of 3088	1184	chrome.exe	90
PID 1184 wrote to memory of 3088	1184	chrome.exe	90
PID 1184 wrote to memory of 2072	1184	chrome.exe	91
PID 1184 wrote to memory of 2072	1184	chrome.exe	91
PID 1184 wrote to memory of 2848	1184	chrome.exe	92
PID 1184 wrote to memory of 2848	1184	chrome.exe	92
PID 1184 wrote to memory of 4628	1184	chrome.exe	93
PID 1184 wrote to memory of 4628	1184	chrome.exe	93
PID 1184 wrote to memory of 2540	1184	chrome.exe	94
PID 1184 wrote to memory of 2540	1184	chrome.exe	94
PID 1184 wrote to memory of 1676	1184	chrome.exe	95
PID 1184 wrote to memory of 1676	1184	chrome.exe	95
PID 1184 wrote to memory of 3972	1184	chrome.exe	96
PID 1184 wrote to memory of 3972	1184	chrome.exe	96
PID 1184 wrote to memory of 1504	1184	chrome.exe	97
PID 1184 wrote to memory of 1504	1184	chrome.exe	97
PID 1184 wrote to memory of 3316	1184	chrome.exe	98
PID 1184 wrote to memory of 3316	1184	chrome.exe	98
PID 1184 wrote to memory of 528	1184	chrome.exe	99
PID 1184 wrote to memory of 528	1184	chrome.exe	99
PID 1184 wrote to memory of 3356	1184	chrome.exe	100
PID 1184 wrote to memory of 3356	1184	chrome.exe	100
PID 1184 wrote to memory of 3104	1184	chrome.exe	101
PID 1184 wrote to memory of 1408	1184	chrome.exe	102
PID 1184 wrote to memory of 3104	1184	chrome.exe	101
PID 1184 wrote to memory of 1408	1184	chrome.exe	102
PID 1184 wrote to memory of 980	1184	chrome.exe	103
PID 1184 wrote to memory of 980	1184	chrome.exe	103
PID 1184 wrote to memory of 3716	1184	chrome.exe	104
PID 1184 wrote to memory of 3716	1184	chrome.exe	104
PID 1184 wrote to memory of 3328	1184	chrome.exe	105
PID 1184 wrote to memory of 3328	1184	chrome.exe	105
PID 1184 wrote to memory of 4940	1184	chrome.exe	106
PID 1184 wrote to memory of 4940	1184	chrome.exe	106
PID 1184 wrote to memory of 1404	1184	chrome.exe	107
PID 1184 wrote to memory of 1404	1184	chrome.exe	107
PID 1184 wrote to memory of 1232	1184	chrome.exe	108
PID 1184 wrote to memory of 1232	1184	chrome.exe	108
PID 1184 wrote to memory of 1120	1184	chrome.exe	109
PID 1184 wrote to memory of 1120	1184	chrome.exe	109
PID 1184 wrote to memory of 3628	1184	chrome.exe	110
PID 1184 wrote to memory of 3628	1184	chrome.exe	110
PID 1184 wrote to memory of 3844	1184	chrome.exe	111
PID 1184 wrote to memory of 3844	1184	chrome.exe	111
PID 1184 wrote to memory of 676	1184	chrome.exe	112
PID 1184 wrote to memory of 676	1184	chrome.exe	112
PID 1184 wrote to memory of 3212	1184	chrome.exe	113
PID 1184 wrote to memory of 3212	1184	chrome.exe	113
PID 1184 wrote to memory of 5468	1184	chrome.exe	114
PID 1184 wrote to memory of 5572	1184	chrome.exe	115
PID 1184 wrote to memory of 5572	1184	chrome.exe	115
PID 1184 wrote to memory of 5580	1184	chrome.exe	116
PID 1184 wrote to memory of 5580	1184	chrome.exe	116
PID 1184 wrote to memory of 5596	1184	chrome.exe	118

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://share.google/Zij1qv924PvxOFLx9
1⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ff9fb5dc728,0x7ff9fb5dc734,0x7ff9fb5dc740
  2⤵
  PID:2408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1608,i,4767491320233914530,3086715814960239560,524288 --field-trial-handle=2084,i,5015244059602033823,4086669639725473995,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2100 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1724,i,14021076600490467630,13775095158307035619,262144 --field-trial-handle=2084,i,5015244059602033823,4086669639725473995,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  PID:2276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2440,i,12567966356716923821,10145844283622997608,524288 --field-trial-handle=2084,i,5015244059602033823,4086669639725473995,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2216 /prefetch:8
  2⤵
  PID:1180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3124,i,15006845438430406384,7502971745436845962,2097152 --field-trial-handle=2084,i,5015244059602033823,4086669639725473995,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3152 /prefetch:1
  2⤵
  PID:4912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3128,i,3832555691348836956,266651589579293007,2097152 --field-trial-handle=2084,i,5015244059602033823,4086669639725473995,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3192 /prefetch:1
  2⤵
  PID:4040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4380,i,11308265136609394531,148088135942633846,2097152 --field-trial-handle=2084,i,5015244059602033823,4086669639725473995,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4404 /prefetch:2
  2⤵
  PID:3088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4696,i,452218442422920848,13140557464803610601,2097152 --field-trial-handle=2084,i,5015244059602033823,4086669639725473995,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4712 /prefetch:1
  2⤵
  PID:2072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4840,i,7132860673135661827,3610009692615672682,2097152 --field-trial-handle=2084,i,5015244059602033823,4086669639725473995,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4872 /prefetch:1
  2⤵
  PID:2848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4904,i,4269951291649971533,6443015532987983816,2097152 --field-trial-handle=2084,i,5015244059602033823,4086669639725473995,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3396 /prefetch:1
  2⤵
  PID:4628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4684,i,4395794788312913384,2972915207172861489,2097152 --field-trial-handle=2084,i,5015244059602033823,4086669639725473995,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5072 /prefetch:1
  2⤵
  PID:2540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5500,i,3908116480454549349,1768537286372204760,2097152 --field-trial-handle=2084,i,5015244059602033823,4086669639725473995,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5516 /prefetch:1
  2⤵
  PID:1676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5660,i,1757770959337108035,2930834338493457367,2097152 --field-trial-handle=2084,i,5015244059602033823,4086669639725473995,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5692 /prefetch:1
  2⤵
  PID:3972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5960,i,6740874233674148902,4015778516654890600,2097152 --field-trial-handle=2084,i,5015244059602033823,4086669639725473995,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5940 /prefetch:1
  2⤵
  PID:1504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=6128,i,9578589900894705104,8062968470253621577,524288 --field-trial-handle=2084,i,5015244059602033823,4086669639725473995,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6156 /prefetch:8
  2⤵
  PID:3316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6320,i,704135473819174719,12473660162538457758,2097152 --field-trial-handle=2084,i,5015244059602033823,4086669639725473995,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6340 /prefetch:1
  2⤵
  PID:528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6488,i,11491430956235282715,3207133323167724136,2097152 --field-trial-handle=2084,i,5015244059602033823,4086669639725473995,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6508 /prefetch:1
  2⤵
  PID:3356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6116,i,13400542332119331139,8933948202974815194,2097152 --field-trial-handle=2084,i,5015244059602033823,4086669639725473995,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6624 /prefetch:1
  2⤵
  PID:3104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5988,i,1774732151724843916,9804685931864771028,2097152 --field-trial-handle=2084,i,5015244059602033823,4086669639725473995,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6636 /prefetch:1
  2⤵
  PID:1408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6780,i,2389487064870038766,14597265314665847987,2097152 --field-trial-handle=2084,i,5015244059602033823,4086669639725473995,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6304 /prefetch:1
  2⤵
  PID:980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=7028,i,16664852442269795036,16073355323456730648,2097152 --field-trial-handle=2084,i,5015244059602033823,4086669639725473995,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7048 /prefetch:1
  2⤵
  PID:3716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=7172,i,7984115867171213488,4845646748781953998,2097152 --field-trial-handle=2084,i,5015244059602033823,4086669639725473995,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7192 /prefetch:1
  2⤵
  PID:3328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=7324,i,4817653884248647975,1281803792050997816,2097152 --field-trial-handle=2084,i,5015244059602033823,4086669639725473995,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7344 /prefetch:1
  2⤵
  PID:4940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=7752,i,2836888064470749063,1840431399875068372,2097152 --field-trial-handle=2084,i,5015244059602033823,4086669639725473995,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7772 /prefetch:1
  2⤵
  PID:1404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=8028,i,13575560572479429362,6707682711309489589,2097152 --field-trial-handle=2084,i,5015244059602033823,4086669639725473995,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6788 /prefetch:1
  2⤵
  PID:1232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=8176,i,17663992792436792551,10075162683450357056,2097152 --field-trial-handle=2084,i,5015244059602033823,4086669639725473995,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8160 /prefetch:1
  2⤵
  PID:1120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=8288,i,10060703914677213747,311868931457237667,2097152 --field-trial-handle=2084,i,5015244059602033823,4086669639725473995,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8300 /prefetch:1
  2⤵
  PID:3628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=8440,i,12130474592816441508,15061759244958300568,2097152 --field-trial-handle=2084,i,5015244059602033823,4086669639725473995,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8448 /prefetch:1
  2⤵
  PID:3844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=8596,i,7916432502003812593,15050020993092590502,2097152 --field-trial-handle=2084,i,5015244059602033823,4086669639725473995,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8600 /prefetch:1
  2⤵
  PID:676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=8660,i,10650474161628765936,14810388202199644764,2097152 --field-trial-handle=2084,i,5015244059602033823,4086669639725473995,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8756 /prefetch:1
  2⤵
  PID:3212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=9084,i,6005918992282283824,4133063454538214377,524288 --field-trial-handle=2084,i,5015244059602033823,4086669639725473995,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=9408 /prefetch:8
  2⤵
  - Modifies registry class
  PID:5468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=8484,i,6497715118546502132,14249313768640144308,2097152 --field-trial-handle=2084,i,5015244059602033823,4086669639725473995,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=9172 /prefetch:1
  2⤵
  PID:5572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --metrics-shmem-handle=9308,i,6770754185573378156,18288301133056668875,2097152 --field-trial-handle=2084,i,5015244059602033823,4086669639725473995,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=9276 /prefetch:1
  2⤵
  PID:5580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --metrics-shmem-handle=9256,i,14824911611420406745,5758693169049054088,2097152 --field-trial-handle=2084,i,5015244059602033823,4086669639725473995,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=9244 /prefetch:1
  2⤵
  PID:5588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --metrics-shmem-handle=9528,i,3055343508017312876,13183197074990752298,2097152 --field-trial-handle=2084,i,5015244059602033823,4086669639725473995,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=9540 /prefetch:1
  2⤵
  PID:5596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --metrics-shmem-handle=9780,i,15016890967501373552,5199483318316618224,2097152 --field-trial-handle=2084,i,5015244059602033823,4086669639725473995,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=9808 /prefetch:1
  2⤵
  PID:5760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --metrics-shmem-handle=9492,i,15271604351136783724,2100809255473735641,2097152 --field-trial-handle=2084,i,5015244059602033823,4086669639725473995,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=9940 /prefetch:1
  2⤵
  PID:5856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --metrics-shmem-handle=10068,i,3603441953327330665,15707698046194794880,2097152 --field-trial-handle=2084,i,5015244059602033823,4086669639725473995,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=9924 /prefetch:1
  2⤵
  PID:5864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --metrics-shmem-handle=10096,i,7953735356347778728,835074391952111021,2097152 --field-trial-handle=2084,i,5015244059602033823,4086669639725473995,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=10184 /prefetch:1
  2⤵
  PID:5872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --metrics-shmem-handle=9516,i,5746984186295993968,11921672388383027395,2097152 --field-trial-handle=2084,i,5015244059602033823,4086669639725473995,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=10376 /prefetch:1
  2⤵
  PID:6072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --metrics-shmem-handle=9948,i,7610916445821539471,15022507132144747303,2097152 --field-trial-handle=2084,i,5015244059602033823,4086669639725473995,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=10532 /prefetch:1
  2⤵
  PID:6080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --metrics-shmem-handle=9492,i,2546665093643144615,6592023500718138183,2097152 --field-trial-handle=2084,i,5015244059602033823,4086669639725473995,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=10220 /prefetch:1
  2⤵
  PID:6100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --metrics-shmem-handle=10760,i,14638429446215480996,3186421117061885355,2097152 --field-trial-handle=2084,i,5015244059602033823,4086669639725473995,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=10800 /prefetch:1
  2⤵
  PID:6116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --metrics-shmem-handle=10940,i,14416562014403767480,10365577780437068033,2097152 --field-trial-handle=2084,i,5015244059602033823,4086669639725473995,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=10936 /prefetch:1
  2⤵
  PID:6124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --metrics-shmem-handle=11088,i,14634017988179073882,10899770703853200135,2097152 --field-trial-handle=2084,i,5015244059602033823,4086669639725473995,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=11092 /prefetch:1
  2⤵
  PID:6132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --metrics-shmem-handle=11240,i,14272546954189910813,15566599146226029268,2097152 --field-trial-handle=2084,i,5015244059602033823,4086669639725473995,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=11252 /prefetch:1
  2⤵
  PID:6140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --metrics-shmem-handle=11396,i,218449348619119664,1650983370877916623,2097152 --field-trial-handle=2084,i,5015244059602033823,4086669639725473995,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=11404 /prefetch:1
  2⤵
  PID:4184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --metrics-shmem-handle=11540,i,7357769257802122800,12614575677822145392,2097152 --field-trial-handle=2084,i,5015244059602033823,4086669639725473995,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=11544 /prefetch:1
  2⤵
  PID:1884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --metrics-shmem-handle=11680,i,5000591911398549190,800207255015303096,2097152 --field-trial-handle=2084,i,5015244059602033823,4086669639725473995,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=11664 /prefetch:1
  2⤵
  PID:4568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --metrics-shmem-handle=11864,i,9302381359040728814,14885993514588026858,2097152 --field-trial-handle=2084,i,5015244059602033823,4086669639725473995,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=11876 /prefetch:1
  2⤵
  PID:5340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --metrics-shmem-handle=10088,i,6632764447843523575,8740915383262810900,2097152 --field-trial-handle=2084,i,5015244059602033823,4086669639725473995,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=11384 /prefetch:1
  2⤵
  PID:5828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --metrics-shmem-handle=12080,i,1292964429401166142,11450456876184139183,2097152 --field-trial-handle=2084,i,5015244059602033823,4086669639725473995,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=12084 /prefetch:1
  2⤵
  PID:5820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --metrics-shmem-handle=12232,i,15696908722214260055,15238276420930665418,2097152 --field-trial-handle=2084,i,5015244059602033823,4086669639725473995,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=12240 /prefetch:1
  2⤵
  PID:5844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --metrics-shmem-handle=12404,i,10549469663813718720,3595153517091291105,2097152 --field-trial-handle=2084,i,5015244059602033823,4086669639725473995,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=12264 /prefetch:1
  2⤵
  PID:5852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --metrics-shmem-handle=12416,i,8553506574091135873,1153171398156159727,2097152 --field-trial-handle=2084,i,5015244059602033823,4086669639725473995,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=11444 /prefetch:1
  2⤵
  PID:5980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --metrics-shmem-handle=12664,i,14412485456426752777,1991973211248405286,2097152 --field-trial-handle=2084,i,5015244059602033823,4086669639725473995,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=12672 /prefetch:1
  2⤵
  PID:5988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --metrics-shmem-handle=12732,i,3590691152098121639,7516613788715273657,2097152 --field-trial-handle=2084,i,5015244059602033823,4086669639725473995,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=12696 /prefetch:1
  2⤵
  PID:5996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --metrics-shmem-handle=12748,i,12207819480657090978,1929858555392615899,2097152 --field-trial-handle=2084,i,5015244059602033823,4086669639725473995,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=12916 /prefetch:1
  2⤵
  PID:6000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --metrics-shmem-handle=12772,i,2556771780171053293,11586597038678520122,2097152 --field-trial-handle=2084,i,5015244059602033823,4086669639725473995,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=12948 /prefetch:1
  2⤵
  PID:6028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --metrics-shmem-handle=12820,i,18196164379003058995,3642056362775360047,2097152 --field-trial-handle=2084,i,5015244059602033823,4086669639725473995,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=13004 /prefetch:1
  2⤵
  PID:6108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --metrics-shmem-handle=12800,i,7142419386182530530,15831860875260939506,2097152 --field-trial-handle=2084,i,5015244059602033823,4086669639725473995,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=12968 /prefetch:1
  2⤵
  PID:6088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --metrics-shmem-handle=13516,i,8665521379575375554,6595128000551910795,2097152 --field-trial-handle=2084,i,5015244059602033823,4086669639725473995,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=13520 /prefetch:1
  2⤵
  PID:6152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --metrics-shmem-handle=13656,i,5960350478667413617,3016182458217079736,2097152 --field-trial-handle=2084,i,5015244059602033823,4086669639725473995,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=13664 /prefetch:1
  2⤵
  PID:6160
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --metrics-shmem-handle=13800,i,14936688346216443955,6955098623553044890,2097152 --field-trial-handle=2084,i,5015244059602033823,4086669639725473995,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=13808 /prefetch:1
  2⤵
  PID:6168
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --metrics-shmem-handle=13944,i,5284085805129846465,9290559847319467418,2097152 --field-trial-handle=2084,i,5015244059602033823,4086669639725473995,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=13956 /prefetch:1
  2⤵
  PID:6176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --metrics-shmem-handle=12432,i,10580004905036585959,16986919251165248650,2097152 --field-trial-handle=2084,i,5015244059602033823,4086669639725473995,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=14320 /prefetch:1
  2⤵
  PID:6256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --metrics-shmem-handle=13656,i,4433814613910828391,17945530172078546134,2097152 --field-trial-handle=2084,i,5015244059602033823,4086669639725473995,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=12380 /prefetch:1
  2⤵
  PID:7136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --metrics-shmem-handle=11820,i,3422145660052474079,13287356040497874867,2097152 --field-trial-handle=2084,i,5015244059602033823,4086669639725473995,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=14608 /prefetch:1
  2⤵
  PID:5336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --metrics-shmem-handle=14728,i,9711132787874900937,2263247671780860562,2097152 --field-trial-handle=2084,i,5015244059602033823,4086669639725473995,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=14736 /prefetch:1
  2⤵
  PID:7172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --metrics-shmem-handle=10764,i,14994798851289334542,677209016150794914,2097152 --field-trial-handle=2084,i,5015244059602033823,4086669639725473995,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=14856 /prefetch:1
  2⤵
  PID:7180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --metrics-shmem-handle=14964,i,16194382509345063145,5650352791202135226,2097152 --field-trial-handle=2084,i,5015244059602033823,4086669639725473995,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=14968 /prefetch:1
  2⤵
  PID:7188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --metrics-shmem-handle=15104,i,5897361826933121573,13593581427058677547,2097152 --field-trial-handle=2084,i,5015244059602033823,4086669639725473995,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=15112 /prefetch:1
  2⤵
  PID:7204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --metrics-shmem-handle=14068,i,9512591435076782404,16372042919388152643,2097152 --field-trial-handle=2084,i,5015244059602033823,4086669639725473995,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=13304 /prefetch:1
  2⤵
  PID:7836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=500,i,15578746612007625247,9159553381204222050,524288 --field-trial-handle=2084,i,5015244059602033823,4086669639725473995,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8600 /prefetch:8
  2⤵
  PID:7572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=10956,i,2805362763909197469,222745006012263058,524288 --field-trial-handle=2084,i,5015244059602033823,4086669639725473995,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=13208 /prefetch:8
  2⤵
  PID:7580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=8592,i,16212935383925359380,1954224825366831705,524288 --field-trial-handle=2084,i,5015244059602033823,4086669639725473995,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=13228 /prefetch:8
  2⤵
  PID:7588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --metrics-shmem-handle=11116,i,11348877113855273204,2905543368709591527,2097152 --field-trial-handle=2084,i,5015244059602033823,4086669639725473995,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=13172 /prefetch:1
  2⤵
  PID:2324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=8052,i,2623561700860503890,8841537025632789452,524288 --field-trial-handle=2084,i,5015244059602033823,4086669639725473995,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8056 /prefetch:8
  2⤵
  PID:5860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=8352,i,1031469883915002873,17244133025938621373,262144 --field-trial-handle=2084,i,5015244059602033823,4086669639725473995,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=844 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6644

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:632

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5604

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 d2247aed29ffae7e94ace8f7fc8ecab9d532b7714acafd597a0e50b5210f4c52
MD5 f304966876841fe3ea689002bca1ed69
SHA1 9fa6a0150841d395bfcb7d08af032d249a16d50a
SHA512 c00ea6e25fdc03dc6a942193c655a14866cc08c9b72b081a3dff8f40fce4d56ae33227d904c2309f017761c17754571f84b259fe32c3b394d6f5f107f8f55298
TLSH
T14DE02B66C821DC2B08FD1F59B0504681E640236B2F508F5F373DC20D8FB5B368EA281C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000021

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000021
Size 61KB
SHA256 bb5bdf0ce3047bfe597bd534465a73a0c94da2f56b843ed0cbd0034ed84c62f6
MD5 5b1abc8f37956cecb205b28a314d99c1
SHA1 879f3eb72ad06730261a4fe53c312f8af15a3e88
SHA512 f6fb31ab40f0ad9d670f210783174ab34a0a65ad97f935bdea84f9c4372dafadb52fd93ca513953a2575399cd1fa79b4d04c46006db93ed0be05e2058a804763
SSDEEP 1536:i2dj5M8MFBitJkOF0kfJPaCZV27TyAdt09eo9mlb:jZuz/g0kn0/yOQ39mlb
TLSH
T1D453022A416DFD412BA9E5B254D1F2CEECB079C808ACD9B7CB2940778323B1EB7A0555
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00002f

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002f
Size 158KB
SHA256 60072b4eb6fc5f1f1214a34fcd55b3cbd1d05eddf778f85611f9b352c4c6452d
MD5 83266658f29f5cb762001d5d9f6985a7
SHA1 9ff52157193e1e798944e6a3172d938183f5e550
SHA512 60b2a8749bb597b71c6cb7113c4ea6c430ab90c6f6a5f78a36ab5fbd2676fbc173ade236be939e862569c786fbdc8e0aa984f1ae4263e91de2ba681cc8ce5d66
SSDEEP 3072:pqj6fcYjfI87fn/NWUEu+Y4rwgnWSPrrGh9SC2VRvkQdv45cf+Fg:pTvjg87fnVTEu+W3rSC2VRpBf+y
TLSH
T196F3232CABB1EF2298ADD32D789EF491C870553AC097303BB84FDF8575154348A7684E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000047

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000047
Size 1024KB
SHA256 bcc6870ff2bb029afee8a2c6245b8565ee1daf6d6d56e6af07a4e3f25e21f55a
MD5 251c0db736962b8c1629cf422523bea9
SHA1 ba8c07199ded3e47256a15d5dee3037696b2880d
SHA512 cce8893b103a9097a23b768ef31d4aa5862017992a5eafc7849f5065113432b2d2b8e5397d8e543dafcdf48af6631d83f61a74db5591d510a1a05324749ff2d6
SSDEEP 24576:Iom2ctjEy0juEFvKPzC61roBiov7fE5sdD/Si1wDJ8n1jdfJ:3ctjI2onv7fE+DqiuDJ4Zdh
TLSH
T1A32523084BD28C86CEEDA8F144D4536A33A7E79896060F6FA61D2FF65D07A018CC9FD5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00005c

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00005c
Size 21KB
SHA256 bb915f6e3e29924292b507c72c064b60c4f82b3f97ae287747dae1535bf82e9f
MD5 669f4950d396755d3eb21e25e9168e21
SHA1 98ac48cfd56f2d6060e20990ec6388ac924e416f
SHA512 1a897cb58ce40dfa56fd5cae0b0dbff25e8d7acf9bf3fb57b913a26bca39be4e145fd439f5143d1e03ce2d668e760f8924de1b71c6dc85e6ec2dbefb1e7dec40
SSDEEP 384:DaNpMRbIcXAochrXEDjn/O79+B9X96iHHxeh+Pv2ky:DaNpKbIcXchrYDWB+Bl5sh+32v
TLSH
T10AA2E16F1E4E1544866FE9E1E48F23503535779C7AC8B8453B8F861BEA26973F09C40C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9420a5ce7b04ae3c_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\9420a5ce7b04ae3c_0
Size 245B
SHA256 0a0e0e72731264aa19b79df7bd012d68e341cc83d0f45bd699a37b708a9f64c3
MD5 db936359e20d3ff825faa400cd54d0ac
SHA1 f0310066cfc952dd2dfb60bff415910ea2138520
SHA512 21a39f4d9c55d0b6875db6ff5a2640b212260dd204c9c7e173c5377fcceaa5572f7c4dacc9c7d8b28a3fadc2d434299fba9d3ca5d9edf24f005427e3ac88d926
TLSH
T1DED0A797C652AB03E9ED50B8DC9A1186C206D11AA0DAF4E6842976EB2D414F51694210
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 fd3291734c7dd783098e97ac4b0cfe244779498f7a495013a6df96b3411e259b
MD5 f3e2b58daf6a5dec38e55fbc1996308f
SHA1 20bc5e43a1cde57aaada6c6d26547c873a707c61
SHA512 99060319a0a42494f3d3cd6deeb04fd055f15c83afc733ee5db468ef57c55a0fe487fba9715e7fa7f472cbdb34479b6f5bb774f30b8a0124d5743d7f12c432c8
TLSH
T15141B68150E60145DBC14E74EDDAEAD5FBB20D9AB3332FAF4C856679B41AFC649B0210
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 50KB
SHA256 9ab29c431b701324d14704849ab8cd5b395885bd6900e2f5adc9bbe3e927cc98
MD5 ebc1eae91e9e3d276e71ee79d06963b8
SHA1 0003a00eef4fc40557716c5b1f32bcc5aa738326
SHA512 5ded2e671333f62fcc79454eb8a615987529048890f4d21a3050cd3fea74c5a8ed616dbf4f4e3716d9a6655966973711ee372c31d53facf721690515ff0c4bf2
SSDEEP 384:DFMelYbkrPsoUPG/j/jIrA8BeTeQeBew29JW9M9gVgpASH9u67MGDx5V+Ja0TeEz:OUEYFMHVkKafeBx5dr8OW3wu9B0Z
TLSH
T123338DE783E4466D981E52F4EB947E2FCF191E14432C393A85D99F06D3F18B2E105A8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 605bb6ad73518181e82495e294ad59eb1f48cb8360b6dd7cda2021d0b1fd7f67
MD5 fe93cae88e701e9cb1fdb2597700b448
SHA1 201845aa0431cdce10495732710172955010b3e3
SHA512 99e27145efbc6d45de76d323612f6cbe3b7e90e8855022b7b866076094b38d7cc68422725b2db35858c4af81b82292b3847921eeff18d390c661f08577b08d9f
SSDEEP 192:CROkYle7CO0v7FpAPRp2+v9/Hsb+WNn2mnq87kmu2WdoerOnaqVyIsnAUgvC:CROkOehwxUXb1w2G9kh2WdKaqvC
TLSH
T1C152B92EB920653F6CDAD21AFD167767D3F5202221D02E80FAFC8A1C15DBACD621751B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 9ec6eb693e6e00b1d126f55e60d88d5d97dea0be8b9044b3fd53aa8564bf38ca
MD5 8e2ab58dfe76628ce39d908417a1d423
SHA1 1b2e6ec6df6e653f1b1523bd3a6dcb380057a7a3
SHA512 6db114e4d5b84f6bf3a403639c0fe1dbb6b397ed81134eef19ca73448a2e6a0e2528416d70e4e58ef0d6cb08f0323344ca89745e06b40bbaf33c107e0d69e7f1
SSDEEP 192:CROkYle7COjv7bpAPRp2+v9/Hsb+WNn2mnq+12Fu2WdoerOna0VyIsnAUg5C:CROkOehbPUXb1w2Gx2s2WdKaw5C
TLSH
T1DD42B82EB920653F6CDAD21AFD167767D3F5202221902E80FAFC8A1C15DBACD621715B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 d671d6cc3daae5bf2e4501c61f5ca03d872d7e3d9d9c6ffae6d0bfc2e1b6b6d7
MD5 a628b2c1338fd884d3142fecd11e346e
SHA1 a758e2376fb71a70d935ee76dbcba8ea903c6258
SHA512 bf5d5b31b2289de78a0c8d077ec2bf0d7bc95e2aaf72f5636272019593ca9f1c5ca3e860a7b592cd9f094f7c435e71ed808ab72a3defeef83f4a58fd3b3cab91
SSDEEP 192:CROkYle7COhv7FpAPRp2+v9/Hsb+WNn2mnq+12Fu2WdoerOna0VyIsnAUg5C:CROkOehxxUXb1w2Gx2s2WdKaw5C
TLSH
T18142C82EB920653F6CDAD21AFD167767D3F5202221902E80FAFC8A1C15DBACD621751F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 4a8de811b93ad52e9d4022e9fa8a9091cc20b5ffab88a1e0f530f17ec1f4af83
MD5 469645fc081cfe6eb6c54d3ab7d6055c
SHA1 a833172ee1a4cfdf987c031a33c493f52999a2a9
SHA512 e6874d4c0de8dab37c06cfe06c0e7f6a0485f59eca431899ec8c9501c7f2f35d5061c79cd8a90a2176dfdb88432ceb4ee67ce09a6e5a875caf924a573ae28e55
SSDEEP 384:RrjNI7KxkXqKf/pUZNCgVLH2Hfgsl4Tv7pLuLcSj/6XODNI+ErU3BtvHG+lGGEVP:RHNI7KxkXqKf/pUZNCgVLH2HfgsmT7pL
TLSH
T13D7209677C4C9A3B0F94C6CCE8177B4FADB5025B26E9886543FA582503D5ACF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 0d267e5677f4be660094efd678b36eb665f3c2bb971cab0b61d76a09b5c0fc4d
MD5 740dbda7c9250767fdc50ebb8190cc75
SHA1 edfb32f95409b09f8100343e274041c02b4ea954
SHA512 ab0f3cd2dbd7844edc7fd445eb8c6839e142f8d8e7c4124debc90fbca5b8cc9bced3f53c706a6fd58b271745ab35d14c021c3f943cac321eff5457e656f27ca3
TLSH
T155B01201C041A141C09202B0114218DCB154AF20AA0A170583E06E37C8256A18015092
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe588095.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe588095.TMP
Size 96B
SHA256 7bfe52a553bac07f0386b846bdc3f7a9d4fd391c5cfd86f1f495d52725e46de4
MD5 a70fe9cbe009cf92c53dff4859b4bc58
SHA1 fbd1c445f6719091dd32a99affd00429feb7680f
SHA512 9e7120019e1837a7cbb7fdd211e9906c24bed00c56ab067b3aea8407f21ef7e982d0b690b52aee1942785c01c374160a7c4bf222e20560866704e908c44fccef
TLSH
T143B02228C2023232C08203F032C0C0FCF0B0CF20C303AA0382F00A2ACC202300828020
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 da48027bdb05e2ad589ea64fe3a82fc84393464639d4cf14ec425dde97f9700c
MD5 1ff5f1086c06916f8420e5d585d138f9
SHA1 08f2d7be53a3f2847145254eab3fd4dddfb925fe
SHA512 aa473f6114c39b9a700acf319875d9e5cefd2e46c9a4047e7579c85e66af3b93906bf7dace9ea8294db2c42a21433aebd43a366766a7a6415754f1c08f22cea4
TLSH
T1D6A00252AA445001E84346B114D28284A660AC50210653B7B4D44B96CCA51854D02469
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 b20a8365bdd7508ecda426e6f1daedc8709730a25d0c1ab5369462f7db105a7f
MD5 7838ecccd07ea4f680addd4a02674eae
SHA1 d315cd8fe75ff87b231f5cd1a750ca1dba03d017
SHA512 3151cb1dd64ca9d93d1434406ce68d5f8b39ea784f39d8c8d657f947bad3fc7a06d0ce6d5bc31321920c3c931c45527ba66ee39557cea0d33d69204ff73444af
SSDEEP 3072:9Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrM1:Um7Rkm1tYpBeh2BAo1
TLSH
T166C302379D75A83B4DB9BB0EB04E0A1F1DF149A7D920EE52C8D85F0423E9ACC0A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 f096e8905afa0b271998abde4be21b2c5057b518cade762a1c0c299e309c8be1
MD5 87a1de1168da778c1be35338cff69a1e
SHA1 2a3cad40675185d26d88fe80c2a93b876e866ae0
SHA512 a2d4e093bfb594302ef5ea2f9c13c78f730aa9e220f40965f496d7c15b30f8cca55a05f8e57494b7ae0014ecec165f25771928c06a9a1aff1d343f6c8ee479ea
SSDEEP 3072:4TGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM1:4qm7Rkm1tYpBeh2BAo1
TLSH
T1B5C312275D71E9375D79AB0EB48E0B1E1EF249A2C920DE8288D85B0477FA7CC0A44938
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 c16c0e308e8f03ab7abc1f07b0ec27d641d44fabc3d0f82a0f6f9f80df191465
MD5 5fa017e7a151f2b1cb69400ee2b60872
SHA1 c70768f5b1d5510899c8308af10ac598d9abb5c8
SHA512 1a4eef49f1fa5503d4dc2dce3d6f43ee0970424b79470b60fa6e3b209382259a7302972897e72479942fda2499b5f6202b5a937a03cbc9d202a5b9f2a7370c7c
SSDEEP 3072:tGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM1:km7Rkm1tYpBeh2BAo1
TLSH
T12CC312275D74E9365DB9BB1EB08E0B1F1EF249A7C920DE52C8D85B0433EA7CC1A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 43cceb4203acaff57f5d3c9e8e29f5e7221ac2d2e068303bc45a96f86d6d9cd4
MD5 d0b3fb905415a38ca570093df1dead3a
SHA1 1fd752bfd0d262cab52f4e18cd8c85c770eb8067
SHA512 074abaa4126ddfc2750e60071f4c1ce8ee518ac22f1c459554e1a2655e5c494688def35004166f8d7c7621f85f1ec24945b5eab69e2637232dacffdd731f3cc2
SSDEEP 3072:EGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM1:nm7Rkm1tYpBeh2BAo1
TLSH
T168C312275D74E9365DB9BB1EB08E0B1F1EF249A7C920DE52C8D85B0423EABCC1A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download