7e9dc16a19285fc6c9424f91f171d15212c8ccdcd79b485a83be6092bf7c0b09

Analysis

geolocation tags

cacanadananorth-americatoronto
user interaction
yes
max time kernel
1259s
max time network
1260s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/07/2026, 01:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Empty.png
Size 142B
Sample260729-b7mgjsde38
SHA256 7e9dc16a19285fc6c9424f91f171d15212c8ccdcd79b485a83be6092bf7c0b09
MD5 c9477b1f1820f9acfb93eebb2e6679c2
SHA1 367cb99605afe884495c36feaa02c800a8b8b552
SHA512 b31b64884e8ee7c5b91504cdc68ce40f35605ddbed0af19a0fdeda7ff924d8248b3ef120fca53e5ba5fe0cacb0467e1b18d90f52794658ceed36a96a7e20d497
TLSH
T147C092B25A520C78C2583932944E82568E5A00286528075B4212782B6EA1A4889A964B
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1280	chrome.exe

Checks SCSI registry key(s) 3 TTPs 14 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	svchost.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134297635136042087"	chrome.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3576	mspaint.exe
3576	mspaint.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
920	chrome.exe
920	chrome.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 29 IoCs

pid	Process
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe
Token: SeShutdownPrivilege	4632	chrome.exe
Token: SeCreatePagefilePrivilege	4632	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe
4632	chrome.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3576	mspaint.exe
3576	mspaint.exe
3576	mspaint.exe
3576	mspaint.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4632 wrote to memory of 2944	4632	chrome.exe	96
PID 4632 wrote to memory of 5256	4632	chrome.exe	97
PID 4632 wrote to memory of 1280	4632	chrome.exe	98
PID 4632 wrote to memory of 5256	4632	chrome.exe	97
PID 4632 wrote to memory of 5352	4632	chrome.exe	100
PID 4632 wrote to memory of 5352	4632	chrome.exe	100
PID 4632 wrote to memory of 2376	4632	chrome.exe	101
PID 4632 wrote to memory of 2376	4632	chrome.exe	101
PID 4632 wrote to memory of 2532	4632	chrome.exe	102
PID 4632 wrote to memory of 2532	4632	chrome.exe	102
PID 4632 wrote to memory of 3740	4632	chrome.exe	103
PID 4632 wrote to memory of 3740	4632	chrome.exe	103
PID 4632 wrote to memory of 4944	4632	chrome.exe	104
PID 4632 wrote to memory of 4944	4632	chrome.exe	104
PID 4632 wrote to memory of 1984	4632	chrome.exe	105
PID 4632 wrote to memory of 568	4632	chrome.exe	107
PID 4632 wrote to memory of 3980	4632	chrome.exe	106
PID 4632 wrote to memory of 3980	4632	chrome.exe	106
PID 4632 wrote to memory of 568	4632	chrome.exe	107
PID 4632 wrote to memory of 2576	4632	chrome.exe	111
PID 4632 wrote to memory of 3032	4632	chrome.exe	112
PID 4632 wrote to memory of 2576	4632	chrome.exe	111
PID 4632 wrote to memory of 3236	4632	chrome.exe	113
PID 4632 wrote to memory of 3032	4632	chrome.exe	112
PID 4632 wrote to memory of 3236	4632	chrome.exe	113
PID 4632 wrote to memory of 4400	4632	chrome.exe	115
PID 4632 wrote to memory of 2248	4632	chrome.exe	114
PID 4632 wrote to memory of 4400	4632	chrome.exe	115
PID 4632 wrote to memory of 2248	4632	chrome.exe	114
PID 4632 wrote to memory of 4236	4632	chrome.exe	116
PID 4632 wrote to memory of 4236	4632	chrome.exe	116
PID 4632 wrote to memory of 4248	4632	chrome.exe	117
PID 4632 wrote to memory of 4248	4632	chrome.exe	117
PID 4632 wrote to memory of 3008	4632	chrome.exe	118
PID 4632 wrote to memory of 3008	4632	chrome.exe	118
PID 4632 wrote to memory of 4600	4632	chrome.exe	119
PID 4632 wrote to memory of 4600	4632	chrome.exe	119
PID 4632 wrote to memory of 4660	4632	chrome.exe	120
PID 4632 wrote to memory of 4660	4632	chrome.exe	120
PID 4632 wrote to memory of 1316	4632	chrome.exe	121
PID 4632 wrote to memory of 1316	4632	chrome.exe	121
PID 4632 wrote to memory of 3144	4632	chrome.exe	122
PID 4632 wrote to memory of 3144	4632	chrome.exe	122
PID 4632 wrote to memory of 3476	4632	chrome.exe	123
PID 4632 wrote to memory of 3476	4632	chrome.exe	123
PID 4632 wrote to memory of 4468	4632	chrome.exe	124
PID 4632 wrote to memory of 4468	4632	chrome.exe	124
PID 4632 wrote to memory of 4732	4632	chrome.exe	125
PID 4632 wrote to memory of 4732	4632	chrome.exe	125
PID 4632 wrote to memory of 3420	4632	chrome.exe	126
PID 4632 wrote to memory of 3420	4632	chrome.exe	126
PID 4632 wrote to memory of 4028	4632	chrome.exe	127
PID 4632 wrote to memory of 4028	4632	chrome.exe	127
PID 4632 wrote to memory of 700	4632	chrome.exe	128
PID 4632 wrote to memory of 5160	4632	chrome.exe	129
PID 4632 wrote to memory of 2392	4632	chrome.exe	130
PID 4632 wrote to memory of 5692	4632	chrome.exe	131
PID 4632 wrote to memory of 5692	4632	chrome.exe	131
PID 4632 wrote to memory of 4776	4632	chrome.exe	132
PID 4632 wrote to memory of 4776	4632	chrome.exe	132
PID 4632 wrote to memory of 3276	4632	chrome.exe	133
PID 4632 wrote to memory of 3276	4632	chrome.exe	133
PID 4632 wrote to memory of 920	4632	chrome.exe	141
PID 4632 wrote to memory of 2112	4632	chrome.exe	142

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\Empty.png"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3576

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
- Checks SCSI registry key(s)
PID:3260

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff9e70cc728,0x7ff9e70cc734,0x7ff9e70cc740
  2⤵
  PID:2944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1640,i,15048227401008726779,16502372828944998421,262144 --field-trial-handle=2028,i,2722668098801710772,11830039881880263165,262144 --variations-seed-version --mojo-platform-channel-handle=2024 /prefetch:2
  2⤵
  PID:5256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1492,i,5811717548133111977,17578126597755060351,524288 --field-trial-handle=2028,i,2722668098801710772,11830039881880263165,262144 --variations-seed-version --mojo-platform-channel-handle=2060 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2384,i,7817722664585601568,1606999433698666322,524288 --field-trial-handle=2028,i,2722668098801710772,11830039881880263165,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:13
  2⤵
  PID:5352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3240,i,8822113631940542827,15944877430068607338,2097152 --field-trial-handle=2028,i,2722668098801710772,11830039881880263165,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:2376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3316,i,14715311095328226380,8994204128016162391,2097152 --field-trial-handle=2028,i,2722668098801710772,11830039881880263165,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:2532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4696,i,9719603162211786850,10916432461191180770,2097152 --field-trial-handle=2028,i,2722668098801710772,11830039881880263165,262144 --variations-seed-version --mojo-platform-channel-handle=4704 /prefetch:1
  2⤵
  PID:3740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4876,i,16486172525606386104,11860879661231024668,524288 --field-trial-handle=2028,i,2722668098801710772,11830039881880263165,262144 --variations-seed-version --mojo-platform-channel-handle=4892 /prefetch:14
  2⤵
  PID:4944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5384,i,2763774342106099537,5311490777263246753,524288 --field-trial-handle=2028,i,2722668098801710772,11830039881880263165,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:14
  2⤵
  PID:1984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5484,i,4107260988978941484,5034778267567419936,2097152 --field-trial-handle=2028,i,2722668098801710772,11830039881880263165,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:1
  2⤵
  PID:3980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5472,i,6820890094121299315,4820484658895072338,2097152 --field-trial-handle=2028,i,2722668098801710772,11830039881880263165,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:1
  2⤵
  PID:568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5788,i,14534251609111597451,15166126445809034079,2097152 --field-trial-handle=2028,i,2722668098801710772,11830039881880263165,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:1
  2⤵
  PID:2576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5816,i,9265419016578185889,7100000698208772669,524288 --field-trial-handle=2028,i,2722668098801710772,11830039881880263165,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:14
  2⤵
  PID:3032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5672,i,10280342505911509008,7746258103294793953,2097152 --field-trial-handle=2028,i,2722668098801710772,11830039881880263165,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:1
  2⤵
  PID:3236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6236,i,11264236750678139198,16407804063275858267,2097152 --field-trial-handle=2028,i,2722668098801710772,11830039881880263165,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:1
  2⤵
  PID:2248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5772,i,14675458269511723894,9606152358656405138,524288 --field-trial-handle=2028,i,2722668098801710772,11830039881880263165,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:14
  2⤵
  PID:4400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6084,i,15648506876393195605,3389857278511908209,2097152 --field-trial-handle=2028,i,2722668098801710772,11830039881880263165,262144 --variations-seed-version --mojo-platform-channel-handle=5672 /prefetch:1
  2⤵
  PID:4236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5732,i,18314191931284169722,528671884997248875,2097152 --field-trial-handle=2028,i,2722668098801710772,11830039881880263165,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:1
  2⤵
  PID:4248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5792,i,15874042569923244910,17761862980184352058,524288 --field-trial-handle=2028,i,2722668098801710772,11830039881880263165,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:14
  2⤵
  PID:3008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6164,i,18435652019865369040,7838880966500293489,2097152 --field-trial-handle=2028,i,2722668098801710772,11830039881880263165,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:1
  2⤵
  PID:4600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6128,i,6136753109376161195,13307257535922644192,2097152 --field-trial-handle=2028,i,2722668098801710772,11830039881880263165,262144 --variations-seed-version --mojo-platform-channel-handle=4692 /prefetch:1
  2⤵
  PID:4660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6152,i,2410671812129574631,16920574989768794675,2097152 --field-trial-handle=2028,i,2722668098801710772,11830039881880263165,262144 --variations-seed-version --mojo-platform-channel-handle=5616 /prefetch:9
  2⤵
  PID:1316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=5380,i,16322820653859845801,643476062694079563,2097152 --field-trial-handle=2028,i,2722668098801710772,11830039881880263165,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:1
  2⤵
  PID:3144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6072,i,5463293579675625753,14966903089382479489,2097152 --field-trial-handle=2028,i,2722668098801710772,11830039881880263165,262144 --variations-seed-version --mojo-platform-channel-handle=4736 /prefetch:1
  2⤵
  PID:3476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=3676,i,2837572604648157578,767149119467198042,2097152 --field-trial-handle=2028,i,2722668098801710772,11830039881880263165,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:1
  2⤵
  PID:4468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=4500,i,18227401844711794225,1573054598961696462,2097152 --field-trial-handle=2028,i,2722668098801710772,11830039881880263165,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:1
  2⤵
  PID:4732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=6172,i,16222624460945641869,8371578929066921534,2097152 --field-trial-handle=2028,i,2722668098801710772,11830039881880263165,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:1
  2⤵
  PID:3420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=3444,i,9181370140424064791,13129702527687254624,2097152 --field-trial-handle=2028,i,2722668098801710772,11830039881880263165,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:4028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6364,i,7275208732991649380,2887841447247809990,524288 --field-trial-handle=2028,i,2722668098801710772,11830039881880263165,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:14
  2⤵
  PID:700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6292,i,1231352976808324658,11547043942369115703,524288 --field-trial-handle=2028,i,2722668098801710772,11830039881880263165,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:14
  2⤵
  PID:5160
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6112,i,5998980490836437288,14563032723800283931,524288 --field-trial-handle=2028,i,2722668098801710772,11830039881880263165,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:14
  2⤵
  PID:2392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=3664,i,6167748367383218876,8980041417384961733,524288 --field-trial-handle=2028,i,2722668098801710772,11830039881880263165,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:12
  2⤵
  PID:5692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=5744,i,2704671468474237011,7977004211378174050,2097152 --field-trial-handle=2028,i,2722668098801710772,11830039881880263165,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:1
  2⤵
  PID:4776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --metrics-shmem-handle=900,i,282638595676527142,11387114801006757103,2097152 --field-trial-handle=2028,i,2722668098801710772,11830039881880263165,262144 --variations-seed-version --mojo-platform-channel-handle=6560 /prefetch:1
  2⤵
  PID:3276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6572,i,6615450726178223979,3187871847651471359,262144 --field-trial-handle=2028,i,2722668098801710772,11830039881880263165,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --metrics-shmem-handle=6276,i,4559495990799203583,1792779498106299698,2097152 --field-trial-handle=2028,i,2722668098801710772,11830039881880263165,262144 --variations-seed-version --mojo-platform-channel-handle=4684 /prefetch:1
  2⤵
  PID:2112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --metrics-shmem-handle=5480,i,16794133377827551471,5235710213947734843,2097152 --field-trial-handle=2028,i,2722668098801710772,11830039881880263165,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:1
  2⤵
  PID:2276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --metrics-shmem-handle=3704,i,849392281341316789,6174173581533667781,2097152 --field-trial-handle=2028,i,2722668098801710772,11830039881880263165,262144 --variations-seed-version --mojo-platform-channel-handle=6680 /prefetch:1
  2⤵
  PID:2140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --metrics-shmem-handle=4688,i,6129788300735813727,7964172838013704319,2097152 --field-trial-handle=2028,i,2722668098801710772,11830039881880263165,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:1
  2⤵
  PID:4964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --metrics-shmem-handle=1556,i,11485656846323697997,17307194004545863542,2097152 --field-trial-handle=2028,i,2722668098801710772,11830039881880263165,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:8
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --metrics-shmem-handle=6680,i,2792083379926139744,7947636372372733254,2097152 --field-trial-handle=2028,i,2722668098801710772,11830039881880263165,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:1
  2⤵
  PID:2248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --metrics-shmem-handle=6396,i,18132564157908117765,4590679386194365584,2097152 --field-trial-handle=2028,i,2722668098801710772,11830039881880263165,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:1
  2⤵
  PID:4924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --metrics-shmem-handle=3916,i,7765845802506964659,710777157000738171,2097152 --field-trial-handle=2028,i,2722668098801710772,11830039881880263165,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:1
  2⤵
  PID:468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=6388,i,3551417683483630027,10908757621699223025,524288 --field-trial-handle=2028,i,2722668098801710772,11830039881880263165,262144 --variations-seed-version --mojo-platform-channel-handle=4624 /prefetch:14
  2⤵
  PID:3396

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1088

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1716

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:5568

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2332

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:3672

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:6028

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 4KB
SHA256 2497f1e1516dffcc4de5034be4b2f189868ba8ad3c5daa32fce737fa43bbe01d
MD5 d80674c86e49da97538ca4fbc427e96c
SHA1 7b47c9967708c19d47e9cb66e28a0e74c29d5ec8
SHA512 f3467ab3cca1d405dd9f346676b781db4834dacdf14e355fdeed7ecb15f86976576203c6d9ceb6f04911d370f97b561c3ff6e9cee72d8a0e74a57d781f20325a
SSDEEP 48:OnNolYLgIBxKmlE3BTAJOC/0K/U1bR5jo06pd111b+EP0Khs4a/ppD:OuKLgYCTvC/BUo06711l8gsr7D
TLSH
T1DB91FB355BF50090EB2CEEB157F5DA0A3336B369469BBEE6581AFC74104B3A8350D305
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 18f263945175606326286f1756c2f92016cb47b4b541f5d7dda5836f7e3c7e20
MD5 a6e58de22c722b3ad3abe6a40809a289
SHA1 3bb3328c3cca29582f9e125609afcf62122e75c3
SHA512 f5a9acbc8c96ce16b549a2cee847b8e5ef195a7aa90d2c127c0747c63951a3e5230b57151287228acb0ead57d7d0997a5815ce20a5aa861cc6b266c620fe10e5
SSDEEP 48:VW4NolYLgIBxKmlE3BTAJOC/0K/U1bR5jo06pd111b+EP0Khs4a/ppM:VWFKLgYCTvC/BUo06711l8gsr7M
TLSH
T1EE910B355BF50080EB2CEEB157F5DA0A7336B3658A9BBEE6581AFC70104B3A8350D305
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 14KB
SHA256 0249daa866d1e6ad765cf536be17856006190005dc8261bfb3862f1d21f6106a
MD5 dade587e3427b35851ae76ed425e2146
SHA1 16b7681256b037f86b42fcb4e7f342dd272aa031
SHA512 f72869b27d04991bf1c588ce68e2c6eff6d1d6fb1b44a0fc72f6742c0f90ea319105341e1ac40397d02f6a9c66c3612597800d8c7905c7daa7397bdd8447e262
SSDEEP 384:DO0umYCHG/zTYA2dGBBeyQFdOEKkdoLL7GaEd7hewQw9Qre8AopFEmw9E/M6ySJT:yc/eA6KeR
TLSH
T14A62DDFB53E0836D9A2656F59A852D1FCE5C1D28031C3D79CAD2AE0F57D1930E342B8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 15KB
SHA256 227e9e6ddd7980c7beb4de54902a9abaceebe3d8089455ef31288ec88926f065
MD5 29312af357b1d2d6ab88e74ec1d5e15a
SHA1 c6f7789ade4def5d766ca5ac7a72ff0bfc2edd5d
SHA512 e46266f590986478271f5ed4fe2cccdbba7ffd882b614ce8cd765430bf786eabf8fcc8293ba464b7eed6ea03379f3e64a43e50a340995966092169e68a22a6b4
SSDEEP 384:DIUZwY5wQ6jShHPiVHPBeYKH2L7GY627h+AwwQw9Qre8zopGEmw5QBM1E5ESJfOT:CB/e8MRri
TLSH
T18D62DCFBC3E4836D992616F59E912D1BCD5D1E1803183D2ACAD6AE0F53E1831E342B4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 14KB
SHA256 2cc91f62247a7f8d365b9213d0c3f1c7e9d81f793993e366ee0df8f00aade733
MD5 747d84b2d1ff8a8829c76ddf25156e9b
SHA1 d6018df4e1c6d44d80db935a4c080e583f0c4406
SHA512 8263a85d50ec797658b6fd768cf4396c8908d43b8def343af90e993d9fef1d46b76103c68e0b0665491a3d7ffc9c38b1afcb3811cc30bc1a5f3b5aeb353a4ba7
SSDEEP 384:DO0uYCHGzTYA2dGBBeyQFdEKkNDmoSWL7GaEd7hewQw9Qre8AopFEmw9E/M6ySJ6:x2/eA6KNl
TLSH
T1EC62DBFB53E0836D9A2656F19AC52D1FCE5C1D28031C3D79CAD26E0E57E1930E342B9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 14KB
SHA256 7a55472fff7fc09c2ba179698751319ca1db089e10c51a6feb91f82fdbfa7f21
MD5 c15af93a0db494049ff4c10d5574b8d7
SHA1 c16b880bdee969f9b01a110d78d6b74a584da336
SHA512 da9b07f241be433555ac441af7a8f74082d4af1778ab6f1092b3d0b4022f8323925de1f78653a4a980144f249aae2751fa6ed557154427c2b6570c81e217dfe9
SSDEEP 384:DO0umYCHG/zTYA2dGBBeyQFdEKkNDmbL7GaEd7hewQw9Qre8AopFEmw9E/M6ySJ8:yp/eA6Kq4
TLSH
T1EF62ECFB53E0836D9A2656F19AC52D1FCE5C1D28031C3D79CAD26E0E57E1930E342B9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 2af718b2d2ee94c6481232563da35429d0e26ee1219d3e8dd45b722af61cdc2a
MD5 85551731552550dd839d54aad7352009
SHA1 bb134c2c11f3fae04a2525a51952c3d947084b62
SHA512 b4b5eb5412d99f4b47d396b186bef073beb699425a64a43c9c406d1979ce306051d680713c7bf12a10866979baf9b2216129a8a59b7342ae4ad25110f4c816e5
TLSH
T1302159F7C7D8D67D891186F4A7256F1ACE290D18431D3C26C8E8AE1B57F18B1D20054E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 17KB
SHA256 be4dbca60cd9e30b74043e71681a5159ec1c2f3bfb312990f62b801790d29e4c
MD5 0f0c270c3b4ca3d0714bcd6e109339c9
SHA1 19ec998c88333ec124e2a8e887cea126ea271a3b
SHA512 7daaceb16bbe6054d6dbbed2e51ceaff4574640233a61985aa6923afcbe4f8ca5f95784068c61fa4edbeb705b9a857b45fe7f6d86a5511099353be0b3b72c04d
SSDEEP 384:DIUZwY5wQ6jShHPiVHPBeYKHtl11zdoLL7GY627hbwwQw9Qre8zopGEmw5QBM6E7:CB/e8GROx
TLSH
T13D82DBEBC3E4872D992617F59E942D1BCD5D1E1803183D2ACAD6AE0F53E1831E342B4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 3KB
SHA256 35d88b0cc9de81e23c51169e0927623d17491914481dfa48aadf8c8539b7c459
MD5 c6930aa0cd78c371174c21bdf04d7a67
SHA1 821b0d0e011638ca5f398e8bfc41b3c3802c17bb
SHA512 0d310c310caac925251a5583018f4db6217ba27810ba810bdb25462927d3fab5a8476b1d341c734e73cba636237fbbd1f238cc0d64c01765107e0f30c86b3489
TLSH
T1D9717BE395BEB457202C4EBB1D44B80A597AB8314282A4F4DF9BC27DB0D98F70B17466
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 001eaad5037cc81cb86d1f35b1b4e465e102a02dfd217651859829ba275de2a9
MD5 930df8031058d20587f9b7458f491cc5
SHA1 b2bf6c2da0545303069cab6cf7a88d27ead194c1
SHA512 5d610ad5637a654fb838499ddecd31c7bee5c79651ab92361063b01e6edf534c8477077e14f68d484d461a0093f126fc38721586980defe81dde16dd72846b94
SSDEEP 192:cRN/Cc9jtv7hAPRp2DwDOd8y98Hsb+WNnOIjpwVISeOA2jesBtMVyIsnAUgE:cRN//9NAXmiOuyuwO8p41ef2HoE
TLSH
T11B42B72EBA1469BB6DCBD32AF9217757E7F5102261D02E40E7FC8A6C15E75CC221B107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 6715afaeb267ba25b10dbb28c386c67573626fcbe65af671a7cf5796146748ce
MD5 c84e93b9a16b32449e4b5cab0249623e
SHA1 e9b02a425dc184d4cac12cbcfa3fa2049a4bf441
SHA512 2d8bcc767592a50989185f6582eb32a4800dccd90d04fca222e106711d497914662cfee83e7abc5747ca6f4d98c240baf4e480923d5a59b6a43b502c6a40e3d5
SSDEEP 192:cRN/CcLstv7hXPRpLTDwDOd8y98Hsb+WNnOIjpw6hEWA2jesBDM8yIsnAUgE:cRN//ANtXjiOuyuwO8pfEn2N3E
TLSH
T1E342A52EAA1469BB6DCBD329F9217B57E7F5103261D02E40E7FC8A6C25E75CC221B107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 4caf4c3e10669fac61960f9b94a23476af6d63e5272d46b7275b441eb9c29c44
MD5 edc8db198a5f17c31e35d3761b27a983
SHA1 c6d8fdccd51e666ae4f09d202cac38580316aa6b
SHA512 990b1f72457601821015afeb7d6b9ef98706a5ce2f490b4f26021779d4dabcb3f0febb4cec82e2f85d8dbce99de08ecad19971035da2595009ab0501c93c98ce
SSDEEP 192:cRN/CcVv7hXPRpLTDwDOd8y98Hsb+WNnOIjpwb8yDA2jesBDM8yIsnAUgE:cRN//ltXjiOuyuwO8pNyc2N3E
TLSH
T18842C72EB91469BB6DCBD32AF9217B53E7F5102262D02E40E7FC8A2C15E75CC221B107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 fc713e121e62d2aa30d413f0c3fda8df4f6c98912d92311335bcc43bfa2d436a
MD5 3f3f02b8b213d37496b7a09950b98a24
SHA1 d1d48b4b534b870d21bffc6edf9f061f03f315a7
SHA512 ad3344303a4a7f5d61cb3edd4db1687c608822911cb46b7d65d3f4a301f49b1070f3a3255a531dadeb75cb3be4956a2f70d2518519c5dee948cc695b41f97a28
SSDEEP 192:cRN/CcUv7hAPRp2l98Hsb+WNnOIjdFA2jesB1MVyIsnAUge:cRN//QAXauwO8dG2/oe
TLSH
T17032B72EBA14A9BB6DCBD22AF9317753D7F5102261D02E40E7FC866C15E75CC222B10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 2c27de69fc63b955492eae0081f5a168932d6bbada95da198c4e018fe5f819df
MD5 cd27fb5a0458ca5276de4014b8f6a302
SHA1 77e58baace6082bd0f60a05c7bb9559b062d2b6e
SHA512 13d95ab0d03b0b90bc453e23bc3a4fa3b46f8d842d497a9f7997079a28d087c30b02518d57d6167a45155b144bbbaaf149ecc3e04b3370cd278956b6d699ea81
SSDEEP 192:cRN/Cc5tv7hAPRp2x8y98Hsb+WNnOIjpw8IV2TA2jesB1MVyIsnAUge:cRN//5NAX1yuwO8plu2s2/oe
TLSH
T1FB32B72EBA1469BB6DCBD22AF9357753D7F5102261D02E80E7FC8A6C15E75CC221B107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 ab10e55d8b359ea6d9d8f010d49873e0ad6959cbd505a9114196fe1f865c3e6d
MD5 f01c73dc262785d5f080faeb17b1b9bc
SHA1 5aaceae7810a9ca4c8614151fe17f620417f0dd5
SHA512 63e8ea803eac38fd2fb5e10defbb401892c4adb8b6ff325b574cb8ebb00a328e2ee2bc45d7e1d154c256a3adfe4358843ce70f089b527249520fc95379ead768
SSDEEP 192:cRN/Ccbv7hXPRpLTDwDOd8y98Hsb+WNnOIjpwoRmIA2jesBDM8yIsnAUgE:cRN//jtXjiOuyuwO8pRmR2N3E
TLSH
T1EF42B62EB91469BB6DCBD22AF9217B57E7F5103262D02E40E7FC8A6C15E75CC221B107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 c19ab2c7dea4ddee5fad527d8c8134b97edb12425217f69638ac8805b78c8114
MD5 e35d283fa39404f6430b3beb8b964ae4
SHA1 b8ef5c19ee1e1454ab1fa9a198152d32fc24ebf9
SHA512 cac938af51cea58718d67d549571ceb5109bb3fce1227cc5fffd603662bb6545e65091af86f6c90a3577d6fb0c455aa70ab6c7086f5e905a2f3666bc9e10263a
SSDEEP 192:cRN/CcDv7hXPRpLTDwDOd8y98Hsb+WNnOIjpwNFcsA2jesBDM8yIsnAUgE:cRN//7tXjiOuyuwO8pyc12N3E
TLSH
T17F42B62EB91469BB6DCBD22DF9217B57E7F5142262D02E40E7FC8A2C15E75CC221B107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 ca6ab7d5c88f70ee8f618fdfdff693f5c11c8e23ac2c250572681609b865691e
MD5 aa350a5638062cade77f26c7d8269639
SHA1 bf8a971213455bee9151869d32e80d5a98050084
SHA512 8453f1672fb3583c243c4a243045d0147d00da44b69b007ae3240d966713f094fbccbf8816f383d80b7ec1c5a23c1590be95a955c53e841e0a00d96bcd43de95
SSDEEP 192:cRN/Cc1v7hXPRpLTDwDOd8y98Hsb+WNnOIjpwMdOMA2jesBDM8yIsnAUgE:cRN//FtXjiOuyuwO8pxOV2N3E
TLSH
T11E42C62EB91469BB6DCBD229F9217B53E7F5102262D02E40E7FC8A6C15E79CC221B107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 fa4b265f28b340b81e12cc2a40b66ca754b3239359aa3f46bb35937372e71eef
MD5 517563a3451123c5a8dfc54b78cac22f
SHA1 8c504e35d53f1a1867ed48d921c7c43492261b04
SHA512 865d729f0956305d64781f051ff5c055dd9953e37447a97042fc0eb399fb79169525514705ad3a6399ae209dc5a66ec65e44d25d4fb1322c98ce6047c45b02a0
SSDEEP 192:cRN/Lcov7hXPRpLTDwDOd8y98Hsb+WNnOIjpw4vUoA2jesBDM8yIsnAUgsZ:cRN/w0tXjiOuyuwO8pPUx2N3sZ
TLSH
T1C852B66EB91469BB6DCBD229F9217B53E7F5102262D02E44E7FC8A2C15E79CC231B107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 6da66291d97e87cf7f81c8136542c0bc9dc628b32440ca360114bf9a9815901b
MD5 bb94652744912ef576cd0fa7829ae680
SHA1 604f4c4c66e0a3bbf2753ba48c3c71a1ed2a9206
SHA512 083f445fd35afd0d09c0d910f80747a6e32a44ff99e7d75a04ce233d8fc0683f52f5379f57286cd42fcdf953fd188396d35d68fd5e72e85572ee472710dc5ce3
SSDEEP 192:cRN/Ccov7hXPRpLTDwDOd8y98Hsb+WNnOIjpw4vUoA2jesBDM8yIsnAUgsZ:cRN//0tXjiOuyuwO8pPUx2N3sZ
TLSH
T1C442B66EB91469BB6DCBD229F9217B53E7F5102262D02E44E7FC8A2C15E79CC231B107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 21ae81520b52440b858539f558cf14227344ecb49b88a2f04f08021d5aaa8148
MD5 4f1fe3d36da271760f1af4cdac915552
SHA1 c003a4b0d0edabbfc6e248e7e2aa3a31704e9dc7
SHA512 b2bdd1c77ca625724bbf45bbca57764abf490fb7f4d9a4aba73a61f03f23ec050249f8d38efbf5e889c1b9ff6c9c8d8a42c2675ed0cb807bf21deb574052e243
SSDEEP 384:Majm97KxkXqKf/pUZNCgVLH2HfgslN1XODmd+ErU3kHHG8t2rlpBge:MKm97KxkXqKf/pUZNCgVLH2HfgsLROqA
TLSH
T11252F867684D9A7B0FC8D58CDC166F8BACB5015762780D2456FB5D0803A57CF114A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 144B
SHA256 699299e1356548c91608b23d90575e48ff851ca4152375a38450a7d83730cc00
MD5 9dea609a55c2256f6aca3bc4bd93a060
SHA1 93b2ae8155e04ef6a5465864c3734d7294e372f3
SHA512 fd98a6cdc5a1df1b7373aafcb249940550764671814ed000bd53a367b462ce3d9be12c825edecb6dd44cb0eecc3dfd816c0b548ef8a904bbb6ac2ac6e79eda21
TLSH
T143C01201C15E9842C800C6B0ED05648C3250AE3586015607DFE16DE6EC4B1B102319D8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 521450e60e75a932eadc80a8eee5648443f15d0f34be490386220750da84ec3b
MD5 53392a4e23bed8cd98dfb27fcaccfb28
SHA1 d787392f37b4ffbabae844411abc64a72e6c6445
SHA512 29253befe842ba58d5c587fd78d190baa9a6477bdacea070f425ecb02af9b67bb398ad8475efd62aa8db7a23c341741dc8bdf995c83485127465b25de713eb8d
TLSH
T1F7A00211D5D10819CD174770616209452372481E7953E34764928C55CE5F1C06561101
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 c371362356333bda48e78d824868382aecb345b5d925b0368e6dfd3b8251da0d
MD5 04356a3e1f4681d5aac218d9aec6d7b9
SHA1 ed210cc0007f765d1d28afa55c08651d4ad96baa
SHA512 9538b6fc8537b268ef6e1bc3d4c7dee24872feb58c44a026a059b7af90c7c131080dfb2b04bf03446bdfcfd7c68ff8a0a58ddb4b50d1a8ec18b505239e33ee9d
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State~RFe5f6e53.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\Network Persistent State~RFe5f6e53.TMP
Size 59B
SHA256 c257f929cff0e4380bf08d9f36f310753f7b1ccb5cb2ab811b52760dd8cb9572
MD5 78bfcecb05ed1904edce3b60cb5c7e62
SHA1 bf77a7461de9d41d12aa88fba056ba758793d9ce
SHA512 2420dff6eb853f5e1856cdab99561a896ea0743fcff3e04b37cb87eddf063770608a30c6ffb0319e5d353b0132c5f8135b7082488e425666b2c22b753a6a4d73
TLSH
T1D2A0026ADA612D881B4A839026187553807B0445130982FDE43877A841561AE582C865
MD5 SHA1 SHA512 TLSH

Submit Download

a02b9fb7-4a79-454e-b682-d332dde9bc64.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\a02b9fb7-4a79-454e-b682-d332dde9bc64.tmp
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

00000000

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\FileSystem\t\00\00000000
Size 1B
SHA256 6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d
MD5 93b885adfe0da089cdf634904fd59f71
SHA1 5ba93c9db0cff93f52b521d7420e43f6eda2784f
SHA512 b8244d028981d693af7b456af8efa4cad63d282e19ff14942c246e50d9351d22704a802a71c3580b6370de4ceb293c324a8423342557d4e5c38438f0e36910ee
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 160KB
SHA256 10d0d5dfaf56b827e3fb01fb4699fb920e3298ce664ae8691f00483564d95df0
MD5 5282c76f8390cec8abb35651e4ec309f
SHA1 215cd0b2cd0038fc9e7bbb3cd0a2f9666d3c2ef1
SHA512 7cba439bda9b5f41bbcd3095b25f6714634614e3bc42e7a14651b65946f1473912f33a329c0546e561344b4acf5be6965b68e7497c43934b026f228f86345aa5
SSDEEP 3072:ztEiESzhsq0ATY+NwiAkpBSi9X66sfNa4ydukMRjtkoEOOgVxwqlYbqq:ztTzhsqZMSbAkpBSi9PrvukqxdVJLq
TLSH
T131F3127329DB04EF3DF89B96651696430CE9C6439966EEA953209B0F05BF78B4303D06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 0ef00ba34401e4dd155da2c0b646d6e3ea231abd327230b1a055d4a7f809b62b
MD5 341b8b67d407d90ad571393b17fe0c68
SHA1 7b3cefb56517a827585a54f5af6bfebe5187cf0b
SHA512 63385736652d3eff5413cccbfb8b8722d5e3d2bab3f5c4998de184ff58d1da1ebb59474f979da71f05a19cbf514c3617562d4a5e0af1236475349cb72fe4ca8c
SSDEEP 96:5KC0d+oJm4V0FH+pqf+HBKyoytsRDotok5/aHD3B6eGyvkon3ob1v4a:MC0HJm5FHuPgXDUD/YxW8n3obZ
TLSH
T170A11AB1A4AD4CB759B7D745F8822A83DEA4A227A991AF80D9DD1F0C11F31E81341627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 126KB
SHA256 3589007dbaf1ab0e5c87eb6bd949f0c4b636a831de2daecff07631c33d2c67e2
MD5 2fb514bce2667e1a25ee003597df7d56
SHA1 dffb5f524f6b8a34b81390a6fa5e891a2986a3a5
SHA512 6b418880ba86a2774581ac62849faab2c1bbafd20f4f58b21eb9925f6d5e10e6b6f685dd77006b2671c8e604436e88b5e6ad0f084b10634f3ff3d186be03fac5
SSDEEP 3072:NiAkpBSi9X66sfNa4ydukMRjtkoEOOgVxwqlYbqq:IAkpBSi9PrvukqxdVJLq
TLSH
T10CC30273299B44EB38F59F87201656435CE9C2839A56CF9863689F0F19B738F4303E0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 125KB
SHA256 e6bf4d85a623cc782d06ab9a2e33c657005c685917cd6d492f4e9a72ed9ce2b2
MD5 dd978f1eb8c3255843865d8a13cf08c1
SHA1 10398ee9b0ddd3ecfcab459230888caf96442945
SHA512 cca3ad5cd2ea28c163b03d05c2e80366754e44a2467dd84bd760b77d7f9e09088d5f462adb1a8f6320b7c4dec5bd427d8435c9fd002a98fbfb4cdf7a5f19fcdd
SSDEEP 3072:PiAkpBSi9X66sfNa4ydukMRjtkoEOOgVxwqlYbqq:KAkpBSi9PrvukqxdVJLq
TLSH
T1EEC31273299B45AB34F89B97601A55835CF9C283A552CFD563688B0E1AF738F0303E0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 125KB
SHA256 bae20125062adaf05a7a15fa395e5af2e0e50199ee8de3c6a9155aaa1781cc73
MD5 0803879d24cfbe41911c2f8d30dff1ad
SHA1 b4cbae0577d799421a727d94a5e228ea53730fe8
SHA512 3df8730adca475d4cc6e133819845884d06e58b649622b3e1874a4045525c1eeb72ec98d840c716a67adde50654cf6bab6e5a969420dbc1bc53b187b828f434e
SSDEEP 3072:iiAkpBSi9X66sfNa4ydukMRjtkoEOOgVxwqlYbqq:lAkpBSi9PrvukqxdVJLq
TLSH
T1A4C30273299B45AB34F89B97601A55935CF9C283A552CFD563688B1F1AF738F0303E0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4632_983066574\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

default.exc

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download