4e75f8ceb531e1b7ecd89b6b7aeb9ea286182989e74e5fb48fa3caee8cf4c2b1

Analysis

user interaction
yes
max time kernel
200s
max time network
204s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/07/2026, 11:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6e09852acdad7d26.jpg
Size 40KB
Sample260729-nav4msvsez
SHA256 4e75f8ceb531e1b7ecd89b6b7aeb9ea286182989e74e5fb48fa3caee8cf4c2b1
MD5 be459035f01794dd5e42656ee752b0ba
SHA1 c2716808ed66c65db5b06d1b7e1e1b748b62fec1
SHA512 e095d7480cab1df04e597e6ac037896ebd2d96d5ee6502e9bf3207f63a1c3532781f90604e90952d9cb75f773447c2fb10c1b4334b7ff40d8d931518352480dc
SSDEEP 768:StlGis8pxZCeQmGTBGFM4gN/QZpshBrxDFYBi09+iCOVE6i3qHjS/rc0sy8P:o0iGetMBBV+ItYBi0YUVg3q+jcxP
TLSH
T19803F1C70574B602CE60E3B4AFB26B27F75CFE02993953AA5F3DA8FC00D048658549B9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery persistence ransomware

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
4	mediafire.com
55	mediafire.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
252	chrome.exe

Checks SCSI registry key(s) 3 TTPs 8 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	svchost.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134297971539043966"	chrome.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1875162379-3804078649-638427191-1000\{EB703C21-4D9D-4BC8-8FC6-8A48AAC91F20}	AntilHood.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1875162379-3804078649-638427191-1000\{73DE6799-77B5-4781-9A7A-71AD5A4324EE}	AntilHood.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
5776	mspaint.exe
5776	mspaint.exe
4264	chrome.exe
4264	chrome.exe
4264	chrome.exe
4264	chrome.exe
4264	chrome.exe
3304	AntilHood.exe
3304	AntilHood.exe
3556	chrome.exe
3556	chrome.exe
1768	AntilHood.exe
1768	AntilHood.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 29 IoCs

pid	Process
4264	chrome.exe
4264	chrome.exe
4264	chrome.exe
4264	chrome.exe
4264	chrome.exe
4264	chrome.exe
4264	chrome.exe
4264	chrome.exe
4264	chrome.exe
4264	chrome.exe
4264	chrome.exe
4264	chrome.exe
4264	chrome.exe
4264	chrome.exe
4264	chrome.exe
4264	chrome.exe
4264	chrome.exe
4264	chrome.exe
4264	chrome.exe
4264	chrome.exe
4264	chrome.exe
4264	chrome.exe
4264	chrome.exe
4264	chrome.exe
4264	chrome.exe
4264	chrome.exe
4264	chrome.exe
4264	chrome.exe
4264	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4264	chrome.exe
Token: SeCreatePagefilePrivilege	4264	chrome.exe
Token: SeShutdownPrivilege	4264	chrome.exe
Token: SeCreatePagefilePrivilege	4264	chrome.exe
Token: SeShutdownPrivilege	4264	chrome.exe
Token: SeCreatePagefilePrivilege	4264	chrome.exe
Token: SeShutdownPrivilege	4264	chrome.exe
Token: SeCreatePagefilePrivilege	4264	chrome.exe
Token: SeShutdownPrivilege	4264	chrome.exe
Token: SeCreatePagefilePrivilege	4264	chrome.exe
Token: SeShutdownPrivilege	4264	chrome.exe
Token: SeCreatePagefilePrivilege	4264	chrome.exe
Token: SeShutdownPrivilege	4264	chrome.exe
Token: SeCreatePagefilePrivilege	4264	chrome.exe
Token: SeShutdownPrivilege	4264	chrome.exe
Token: SeCreatePagefilePrivilege	4264	chrome.exe
Token: SeShutdownPrivilege	4264	chrome.exe
Token: SeCreatePagefilePrivilege	4264	chrome.exe
Token: SeShutdownPrivilege	4264	chrome.exe
Token: SeCreatePagefilePrivilege	4264	chrome.exe
Token: SeShutdownPrivilege	4264	chrome.exe
Token: SeCreatePagefilePrivilege	4264	chrome.exe
Token: SeShutdownPrivilege	4264	chrome.exe
Token: SeCreatePagefilePrivilege	4264	chrome.exe
Token: SeShutdownPrivilege	4264	chrome.exe
Token: SeCreatePagefilePrivilege	4264	chrome.exe
Token: SeShutdownPrivilege	4264	chrome.exe
Token: SeCreatePagefilePrivilege	4264	chrome.exe
Token: SeShutdownPrivilege	4264	chrome.exe
Token: SeCreatePagefilePrivilege	4264	chrome.exe
Token: SeShutdownPrivilege	4264	chrome.exe
Token: SeCreatePagefilePrivilege	4264	chrome.exe
Token: SeShutdownPrivilege	4264	chrome.exe
Token: SeCreatePagefilePrivilege	4264	chrome.exe
Token: SeShutdownPrivilege	4264	chrome.exe
Token: SeCreatePagefilePrivilege	4264	chrome.exe
Token: SeShutdownPrivilege	4264	chrome.exe
Token: SeCreatePagefilePrivilege	4264	chrome.exe
Token: SeShutdownPrivilege	4264	chrome.exe
Token: SeCreatePagefilePrivilege	4264	chrome.exe
Token: SeShutdownPrivilege	4264	chrome.exe
Token: SeCreatePagefilePrivilege	4264	chrome.exe
Token: SeShutdownPrivilege	4264	chrome.exe
Token: SeCreatePagefilePrivilege	4264	chrome.exe
Token: SeShutdownPrivilege	4264	chrome.exe
Token: SeCreatePagefilePrivilege	4264	chrome.exe
Token: SeShutdownPrivilege	4264	chrome.exe
Token: SeCreatePagefilePrivilege	4264	chrome.exe
Token: SeShutdownPrivilege	4264	chrome.exe
Token: SeCreatePagefilePrivilege	4264	chrome.exe
Token: SeShutdownPrivilege	4264	chrome.exe
Token: SeCreatePagefilePrivilege	4264	chrome.exe
Token: SeShutdownPrivilege	4264	chrome.exe
Token: SeCreatePagefilePrivilege	4264	chrome.exe
Token: SeShutdownPrivilege	4264	chrome.exe
Token: SeCreatePagefilePrivilege	4264	chrome.exe
Token: SeShutdownPrivilege	4264	chrome.exe
Token: SeCreatePagefilePrivilege	4264	chrome.exe
Token: SeShutdownPrivilege	4264	chrome.exe
Token: SeCreatePagefilePrivilege	4264	chrome.exe
Token: SeShutdownPrivilege	4264	chrome.exe
Token: SeCreatePagefilePrivilege	4264	chrome.exe
Token: SeShutdownPrivilege	4264	chrome.exe
Token: SeCreatePagefilePrivilege	4264	chrome.exe

Suspicious use of FindShellTrayWindow 46 IoCs

pid	Process
4264	chrome.exe
4264	chrome.exe
4264	chrome.exe
4264	chrome.exe
4264	chrome.exe
4264	chrome.exe
4264	chrome.exe
4264	chrome.exe
4264	chrome.exe
4264	chrome.exe
4264	chrome.exe
4264	chrome.exe
4264	chrome.exe
4264	chrome.exe
4264	chrome.exe
4264	chrome.exe
4264	chrome.exe
4264	chrome.exe
4264	chrome.exe
4264	chrome.exe
4264	chrome.exe
4264	chrome.exe
4264	chrome.exe
4264	chrome.exe
4264	chrome.exe
4264	chrome.exe
4264	chrome.exe
4264	chrome.exe
4264	chrome.exe
4264	chrome.exe
4264	chrome.exe
4264	chrome.exe
4264	chrome.exe
4264	chrome.exe
4264	chrome.exe
4264	chrome.exe
4264	chrome.exe
4264	chrome.exe
4264	chrome.exe
4264	chrome.exe
4264	chrome.exe
4264	chrome.exe
4264	chrome.exe
4264	chrome.exe
4264	chrome.exe
4264	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4264	chrome.exe
4264	chrome.exe
4264	chrome.exe
4264	chrome.exe
4264	chrome.exe
4264	chrome.exe
4264	chrome.exe
4264	chrome.exe
4264	chrome.exe
4264	chrome.exe
4264	chrome.exe
4264	chrome.exe
4264	chrome.exe
4264	chrome.exe
4264	chrome.exe
4264	chrome.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
5776	mspaint.exe
5776	mspaint.exe
5776	mspaint.exe
5776	mspaint.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4264 wrote to memory of 3992	4264	chrome.exe	95
PID 4264 wrote to memory of 3004	4264	chrome.exe	96
PID 4264 wrote to memory of 3004	4264	chrome.exe	96
PID 4264 wrote to memory of 252	4264	chrome.exe	97
PID 4264 wrote to memory of 3116	4264	chrome.exe	99
PID 4264 wrote to memory of 3116	4264	chrome.exe	99
PID 4264 wrote to memory of 4652	4264	chrome.exe	100
PID 4264 wrote to memory of 4652	4264	chrome.exe	100
PID 4264 wrote to memory of 3972	4264	chrome.exe	101
PID 4264 wrote to memory of 3972	4264	chrome.exe	101
PID 4264 wrote to memory of 3344	4264	chrome.exe	102
PID 4264 wrote to memory of 3344	4264	chrome.exe	102
PID 4264 wrote to memory of 520	4264	chrome.exe	103
PID 4264 wrote to memory of 520	4264	chrome.exe	103
PID 4264 wrote to memory of 3564	4264	chrome.exe	104
PID 4264 wrote to memory of 3432	4264	chrome.exe	105
PID 4264 wrote to memory of 4152	4264	chrome.exe	106
PID 4264 wrote to memory of 3432	4264	chrome.exe	105
PID 4264 wrote to memory of 4152	4264	chrome.exe	106
PID 4264 wrote to memory of 4540	4264	chrome.exe	109
PID 4264 wrote to memory of 1364	4264	chrome.exe	110
PID 4264 wrote to memory of 4540	4264	chrome.exe	109
PID 4264 wrote to memory of 1364	4264	chrome.exe	110
PID 4264 wrote to memory of 3828	4264	chrome.exe	111
PID 4264 wrote to memory of 3828	4264	chrome.exe	111
PID 4264 wrote to memory of 3152	4264	chrome.exe	112
PID 4264 wrote to memory of 3152	4264	chrome.exe	112
PID 4264 wrote to memory of 704	4264	chrome.exe	113
PID 4264 wrote to memory of 704	4264	chrome.exe	113
PID 4264 wrote to memory of 2592	4264	chrome.exe	114
PID 4264 wrote to memory of 2592	4264	chrome.exe	114
PID 4264 wrote to memory of 4360	4264	chrome.exe	115
PID 4264 wrote to memory of 4360	4264	chrome.exe	115
PID 4264 wrote to memory of 5608	4264	chrome.exe	116
PID 4264 wrote to memory of 5608	4264	chrome.exe	116
PID 4264 wrote to memory of 3400	4264	chrome.exe	117
PID 4264 wrote to memory of 3400	4264	chrome.exe	117
PID 4264 wrote to memory of 808	4264	chrome.exe	118
PID 4264 wrote to memory of 3624	4264	chrome.exe	119
PID 4264 wrote to memory of 808	4264	chrome.exe	118
PID 4264 wrote to memory of 3624	4264	chrome.exe	119
PID 4264 wrote to memory of 3820	4264	chrome.exe	121
PID 4264 wrote to memory of 2908	4264	chrome.exe	122
PID 4264 wrote to memory of 3260	4264	chrome.exe	123
PID 4264 wrote to memory of 1488	4264	chrome.exe	124
PID 4264 wrote to memory of 1488	4264	chrome.exe	124
PID 4264 wrote to memory of 5224	4264	chrome.exe	125
PID 4264 wrote to memory of 5224	4264	chrome.exe	125
PID 4264 wrote to memory of 3700	4264	chrome.exe	126
PID 4264 wrote to memory of 3700	4264	chrome.exe	126
PID 4264 wrote to memory of 1868	4264	chrome.exe	127
PID 4264 wrote to memory of 1868	4264	chrome.exe	127
PID 4264 wrote to memory of 1584	4264	chrome.exe	128
PID 4264 wrote to memory of 1584	4264	chrome.exe	128
PID 4264 wrote to memory of 3772	4264	chrome.exe	129
PID 4264 wrote to memory of 3772	4264	chrome.exe	129
PID 4264 wrote to memory of 3172	4264	chrome.exe	130
PID 4264 wrote to memory of 3172	4264	chrome.exe	130
PID 4264 wrote to memory of 2356	4264	chrome.exe	131
PID 4264 wrote to memory of 2380	4264	chrome.exe	132
PID 4264 wrote to memory of 2380	4264	chrome.exe	132
PID 4264 wrote to memory of 1816	4264	chrome.exe	133
PID 4264 wrote to memory of 1816	4264	chrome.exe	133
PID 4264 wrote to memory of 5580	4264	chrome.exe	134

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\6e09852acdad7d26.jpg"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5776

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
- Checks SCSI registry key(s)
PID:4432

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffc6f0cc728,0x7ffc6f0cc734,0x7ffc6f0cc740
  2⤵
  PID:3992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1632,i,17547429043361415,13675576371475310169,262144 --field-trial-handle=1836,i,12563430299180455971,5028616508459232230,262144 --variations-seed-version --mojo-platform-channel-handle=1832 /prefetch:2
  2⤵
  PID:3004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2184,i,8586806000852464471,12122260208079912170,524288 --field-trial-handle=1836,i,12563430299180455971,5028616508459232230,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:11
  2⤵
  - System Time Discovery
  PID:252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2352,i,12252210957182619238,2030939404390727003,524288 --field-trial-handle=1836,i,12563430299180455971,5028616508459232230,262144 --variations-seed-version --mojo-platform-channel-handle=2224 /prefetch:13
  2⤵
  PID:3116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3252,i,9578933771706303337,12707659152831707913,2097152 --field-trial-handle=1836,i,12563430299180455971,5028616508459232230,262144 --variations-seed-version --mojo-platform-channel-handle=2860 /prefetch:1
  2⤵
  PID:4652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3256,i,12316975640267701495,15987778980789432768,2097152 --field-trial-handle=1836,i,12563430299180455971,5028616508459232230,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:3972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4668,i,7742785373319434092,14939306402963172338,2097152 --field-trial-handle=1836,i,12563430299180455971,5028616508459232230,262144 --variations-seed-version --mojo-platform-channel-handle=4700 /prefetch:1
  2⤵
  PID:3344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4868,i,4918498784524654295,14509992194421641530,524288 --field-trial-handle=1836,i,12563430299180455971,5028616508459232230,262144 --variations-seed-version --mojo-platform-channel-handle=4880 /prefetch:14
  2⤵
  PID:520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5396,i,17532644176479095803,13826734344560252840,524288 --field-trial-handle=1836,i,12563430299180455971,5028616508459232230,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:14
  2⤵
  PID:3564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5472,i,9746787152727197950,16158968975650214023,2097152 --field-trial-handle=1836,i,12563430299180455971,5028616508459232230,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:3432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5484,i,7415231043204683001,1893002786407561277,2097152 --field-trial-handle=1836,i,12563430299180455971,5028616508459232230,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:4152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5940,i,9843711585733353442,6997520397853483759,2097152 --field-trial-handle=1836,i,12563430299180455971,5028616508459232230,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:1
  2⤵
  PID:4540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5548,i,13161719909122596044,10122368834508984593,2097152 --field-trial-handle=1836,i,12563430299180455971,5028616508459232230,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:1
  2⤵
  PID:1364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5536,i,1898915858318217641,5909957165706016791,2097152 --field-trial-handle=1836,i,12563430299180455971,5028616508459232230,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:1
  2⤵
  PID:3828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5488,i,6366903341729888621,9446700253276846652,2097152 --field-trial-handle=1836,i,12563430299180455971,5028616508459232230,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:1
  2⤵
  PID:3152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5940,i,11266795079161717002,15929428567949072777,2097152 --field-trial-handle=1836,i,12563430299180455971,5028616508459232230,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:1
  2⤵
  PID:704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5972,i,6922971157496088279,14731979221197893807,2097152 --field-trial-handle=1836,i,12563430299180455971,5028616508459232230,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:1
  2⤵
  PID:2592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6024,i,18315015829291909794,18398025258157915283,524288 --field-trial-handle=1836,i,12563430299180455971,5028616508459232230,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:14
  2⤵
  PID:4360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5724,i,17800771220842774306,3891920334752299294,524288 --field-trial-handle=1836,i,12563430299180455971,5028616508459232230,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:14
  2⤵
  PID:5608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5736,i,1403686526283334642,11168050986077284197,524288 --field-trial-handle=1836,i,12563430299180455971,5028616508459232230,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:14
  2⤵
  PID:3400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5820,i,10527942783390847227,3335592795855183699,2097152 --field-trial-handle=1836,i,12563430299180455971,5028616508459232230,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:9
  2⤵
  PID:808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5736,i,744200009144647762,5246450915379520408,2097152 --field-trial-handle=1836,i,12563430299180455971,5028616508459232230,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:1
  2⤵
  PID:3624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5532,i,11178634715438826576,18098894922976153914,524288 --field-trial-handle=1836,i,12563430299180455971,5028616508459232230,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:14
  2⤵
  PID:3820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4784,i,1186104916762823710,5151274311857136292,524288 --field-trial-handle=1836,i,12563430299180455971,5028616508459232230,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:14
  2⤵
  PID:2908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6032,i,15963694358530548903,513665665812281792,524288 --field-trial-handle=1836,i,12563430299180455971,5028616508459232230,262144 --variations-seed-version --mojo-platform-channel-handle=4712 /prefetch:14
  2⤵
  PID:3260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=1236,i,9494425636626529232,18355970864014032152,2097152 --field-trial-handle=1836,i,12563430299180455971,5028616508459232230,262144 --variations-seed-version --mojo-platform-channel-handle=4776 /prefetch:1
  2⤵
  PID:1488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=6140,i,14286763316943996245,9093190758229852652,2097152 --field-trial-handle=1836,i,12563430299180455971,5028616508459232230,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:1
  2⤵
  PID:5224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=4904,i,17526604198800421976,2959470948281528638,2097152 --field-trial-handle=1836,i,12563430299180455971,5028616508459232230,262144 --variations-seed-version --mojo-platform-channel-handle=3920 /prefetch:1
  2⤵
  PID:3700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=5640,i,12994548637167777404,14927661543622955507,2097152 --field-trial-handle=1836,i,12563430299180455971,5028616508459232230,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
  2⤵
  PID:1868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=3012,i,16775025126185595757,10368940096877855447,2097152 --field-trial-handle=1836,i,12563430299180455971,5028616508459232230,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:1
  2⤵
  PID:1584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=6052,i,4094883237727645100,3096092309246209980,2097152 --field-trial-handle=1836,i,12563430299180455971,5028616508459232230,262144 --variations-seed-version --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:3772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=6568,i,5386138459291145323,4824453687846470043,2097152 --field-trial-handle=1836,i,12563430299180455971,5028616508459232230,262144 --variations-seed-version --mojo-platform-channel-handle=6632 /prefetch:1
  2⤵
  PID:3172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5952,i,14150889905571124749,2833556379425359445,524288 --field-trial-handle=1836,i,12563430299180455971,5028616508459232230,262144 --variations-seed-version --mojo-platform-channel-handle=6932 /prefetch:14
  2⤵
  PID:2356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --metrics-shmem-handle=7052,i,11901045629299552632,3617395307060579749,2097152 --field-trial-handle=1836,i,12563430299180455971,5028616508459232230,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:1
  2⤵
  PID:2380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --metrics-shmem-handle=3492,i,10526885097986519264,13943274572890776382,2097152 --field-trial-handle=1836,i,12563430299180455971,5028616508459232230,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
  2⤵
  PID:1816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --metrics-shmem-handle=4756,i,16176295124592365220,11536448644355608582,2097152 --field-trial-handle=1836,i,12563430299180455971,5028616508459232230,262144 --variations-seed-version --mojo-platform-channel-handle=2860 /prefetch:1
  2⤵
  PID:5580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --metrics-shmem-handle=6280,i,17021146426541461791,2378633161062851114,2097152 --field-trial-handle=1836,i,12563430299180455971,5028616508459232230,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:1
  2⤵
  PID:3484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --metrics-shmem-handle=7068,i,6178156202362260514,18074436124806448799,2097152 --field-trial-handle=1836,i,12563430299180455971,5028616508459232230,262144 --variations-seed-version --mojo-platform-channel-handle=7024 /prefetch:1
  2⤵
  PID:1496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --metrics-shmem-handle=6872,i,17046697076722566115,11844603764043779445,2097152 --field-trial-handle=1836,i,12563430299180455971,5028616508459232230,262144 --variations-seed-version --mojo-platform-channel-handle=7012 /prefetch:1
  2⤵
  PID:5900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --metrics-shmem-handle=7308,i,9990310546349228102,11368935009232163642,2097152 --field-trial-handle=1836,i,12563430299180455971,5028616508459232230,262144 --variations-seed-version --mojo-platform-channel-handle=7336 /prefetch:1
  2⤵
  PID:2036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --metrics-shmem-handle=7276,i,1708941426169678496,10808035139456812638,2097152 --field-trial-handle=1836,i,12563430299180455971,5028616508459232230,262144 --variations-seed-version --mojo-platform-channel-handle=7380 /prefetch:1
  2⤵
  PID:1876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --metrics-shmem-handle=7644,i,3898411105542201895,5190820283230655315,2097152 --field-trial-handle=1836,i,12563430299180455971,5028616508459232230,262144 --variations-seed-version --mojo-platform-channel-handle=8008 /prefetch:1
  2⤵
  PID:3844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4660,i,10285100521716761893,3573382110219106787,262144 --field-trial-handle=1836,i,12563430299180455971,5028616508459232230,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5888,i,8962153251428303203,8642720617901670883,524288 --field-trial-handle=1836,i,12563430299180455971,5028616508459232230,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:14
  2⤵
  PID:5852

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4112

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3920

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:5172

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:964

C:\Users\Admin\Desktop\AntilHood\AntilHood.exe
"C:\Users\Admin\Desktop\AntilHood\AntilHood.exe"
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3304

C:\Users\Admin\Desktop\AntilHood\AntilHood.exe
"C:\Users\Admin\Desktop\AntilHood\AntilHood.exe"
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1768

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 cab39ec6f4eb63d064c26cff4d6b8280dafd6cdf860f324d588a5b48e9a4004b
MD5 54f91bccd4e156eea9e77ab5636c095d
SHA1 c26344a294afc1f85144197baab316e80094e0a4
SHA512 04d1f4d3c8a8a86b933b604aabb3ec320ef3a2bf2d504956730fba8a67135c6ed9ca42db4fcceaa442433ed2683209381f81a31bd00baa75b1158f4b5444c09e
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 4568947a970df51ca851c25048bbd62b441a172a5e84125efa26537c54785684
MD5 c68d5cba45e3e86783a277a0c71f9f86
SHA1 dbceda9a00f8465a79221f18a2fe38e9d0a22de1
SHA512 6bfcf89ed01be74c4a9f0658fda4bc78dd4c54b704673860c909ef5861e47efea0d512674655d6cc15c9d39f03e22793f818a0d104ba030e144c5cff7f39639c
TLSH
T16D41861AF0C37115EB2523F7A9DA1E55B2358119881F1FEF018ECAB1230F3ED99554A6
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 27KB
SHA256 eeef826230c13eeac2b981130222368d84bb62874f206999ce08006f7ea7e674
MD5 4cde4af82f22665910f001c55d4f3830
SHA1 324074b6f52ef339183ebd7c4c0b99f958fe8871
SHA512 de93a1b5e7eb0398145eb398a2437a82735755db35820e9e19919dd5ff68249d444cf36244d327f92bed7dbc4849973fae2ab52b871c5c4ae21c3cb6bc8fdf34
SSDEEP 384:DeUky7e54TsBKpe29V1KLeixJZSgJhl16aBereWe+zo0llP2z46/4oyR4VYECY+s:IZr6i+6nJ+OuSjdZm9JNa
TLSH
T191D29BF383E5D92E8A0157F89610AE1BCE1C1759432C3C1689D5EE8BE3E2472D16E64F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 d1c31e3446f2be98c04f685e6b1869ca6dc029440833aad2b62296e79b50cea5
MD5 1c499b18a8f87663e286e6be24186eba
SHA1 5fe3bea18501e7e114d528321d60c10efa4e467c
SHA512 7093c6da1fbce1208f328a259bf38c584c07defdb19249fd88ed9f35bc1caa48dcf2f41a2e824fda89fc273308483453232f1e41ee10a24e26fc5e5225148e79
TLSH
T1E2519BF7D7D8866E851152F4DB217E1FDD2D0A28522C3C22C8D8AE9F53E2872D25134E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 5c9729d8a9ac6481e20ff4acc32e1e0c2af3fe37341873b89214ab1c8cac462c
MD5 24db00511a98522533a068e4f7afc4bd
SHA1 4ce0536f64345c798c4cf48c5d65051b7f101da8
SHA512 9e2836eb0c9ae5d9e8f602e8da4cb200b024ef35a49cb84c74a8b6354ac86292d6513c816c167a08a5a12de685dd83919112c0817893842eb4af1ab3837f2dea
SSDEEP 192:2Rvjfydv7z2PRpsgsEL9NLHsb+WNndqjuX2Dz24UAkwhVyIsnAUgE:2Rvj6dIXn3wAo2H2onE
TLSH
T1C742962FBA24297B6ECAD61AF9127753D7F9142166D02E84F6FC891C14E76CC3217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 3e2fb9da1f0c146b0130e88d98aa9596e85feb0201488986cfd3844be3854c02
MD5 b2e2d642d47c448fe13be92fbbff1756
SHA1 e7f7ebe9666e1bfc524d43efaffc0bf1bfbe6d45
SHA512 c20cc8925bf9ca5c79ca6fd29f7f7dcb3641273938160939ee63e2af917b26a514f68b33792f3833b05115df17a46e8a8f4330bc16e896f89d0fe6f4ce24275d
SSDEEP 192:2R1jfiWv7zAPRp2Q9NLHsb+WNndq08z24UAkwBVyIsnAUge:2R1j6iCXD3wA0C2oHe
TLSH
T17432A62EAE14697B6ECBD22AF9127753DBF9102175D42E84E6FC892C14E76CC3227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 bb4ecd9c251098760ddaf4e0a2ea0eb350dcc395f786dba14e0d143e31bd2050
MD5 10feb5d94adb205e9b8602c6586f3316
SHA1 21670260d28855798b42f8ae7505cd9a097a4deb
SHA512 bc32e2176b54191fbb86be47d182231495038132e865a6ac11733828406890abc05c910af3cfc5ea72f8cf2cd3807108c4899bab3b814d9f7d002d1098f9c647
SSDEEP 192:2R1jfydv7z2PRpsQ9NLHsb+WNndq0Ez24UAkwhVyIsnAUgE:2R1j6dIXN3wA0q2onE
TLSH
T11142C72EBE14297B6DCBD61AF9127B53DBF9102166D02E84E6FC8A2C14E76CC3217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 aeaff3d66402bd791940f6894305deec6267ff83c1c652a50dac052b8ff3afbe
MD5 ea340a3437aa5ca4c481d377e938bb4e
SHA1 64cc5b0cc4d3f2b979524a4b0652a3397c732479
SHA512 98255ce8d48a9ba32afc1d6d393c95df931e29335fde21cf95e4c610ebf5b214d83ede1116fa909e473b7d1c96dfcaf4f0fa6b2e5e76614790513baf623b921d
SSDEEP 192:2RCffydv7z2PRpsgsEL9NLHsb+WNTvdqjGnebz24UAkwhVyIsnAUgE:2RCf6dIXn3wk0e/2onE
TLSH
T1CB52B62FBA24297B6EDAD21AF912B753D7F9142166D02E84F6FC8A1C14E76CC3217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 b1cf54c48fd5c21922f4d6c0361d1b08b0651bdcb92ce11a3f7b52cadcd707f4
MD5 74e8afe1496efa7cffba62592729804a
SHA1 734c6cd04f71662be9241b0a0cdeee31f00dc05c
SHA512 6a2558399ae4ade0bd7558b7b2a1203049db45160fbe00325a77755a25515fd1e2ed199a225d34c0fa1a8af2fc3086d18f8bf185b6285026c2e4d5947f252152
SSDEEP 192:2R1jfNWv7zAPRp2Q9NLHsb+WNndq08z24UAkwBVyIsnAUge:2R1jViCXD3wA0C2oHe
TLSH
T1B032A62EAE14697B6DCBD22AF9127753DBF9102175D42E84E6FC892C14E76CC3227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 c3c2e37b6b7175ba3b600c444da16eeafef11c99b016ac6bfb458ddbbfd5247a
MD5 4de0e4af2a66b5262fea1d68ed3ecc52
SHA1 7aa25f8104d2da0af810f76914be6364fe2f49c9
SHA512 0dfcefeaefd2c5c76ca78bd85ab112ded219ab09883781adb53fc55496390c02041e816102f69d813b2ae37da9c742ddb64a86df1375ef1ed586df79fb3b036b
SSDEEP 192:2R1jfLWv7zAPRp2Q9NLHsb+WNndq07z24UAkw1VyIsnAUgE:2R1jTiCXD3wA0f2oDE
TLSH
T1F942B62EBE14697B6ECBD21AF9127753DBF9102165D02E84E6FC8A2C15E76CC3217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 55af3198ca620a2679b96d0cb28ad8361481127a3c66fc0baf955312c62cf213
MD5 6874f3795a6419e397b45001b4e38d59
SHA1 00093b06c28fbe7d7b4a1b358f30d9cd7668719e
SHA512 663d13dee47c9b952eabdba408b3dd7b81d217f40710431c3b222de438072888cb0999721009f0466a17406b8f2ad49134fb4390e1eee82092975c20bb184c93
SSDEEP 192:2R1jf9Jv7zAPRp2Q9NLHsb+WNndq07z24UAkw1VyIsnAUgE:2R1jlJCXD3wA0f2oDE
TLSH
T16E42B62EBE14693B6ECBD21AF9127753DBF9102165D02E84E6FC8A2C14E76CC3217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 671ef27e60254e76bc74b8a59daff4fd387e5df13faaa6fdaccff9cb579baa91
MD5 258bb719888282be9d511059f6651856
SHA1 a35449b5ab811d1a12da4f8a075acb120ae4024c
SHA512 1493f0e7316ce2faaa3a596b590a801b01d2a5e04d46a379cbd82ef5ca5dea941969b40e59b8c4c272ce661d35bc546ad256b2a6113069ce2ad7d6e8e560bbc9
SSDEEP 192:ecP4K63X7KxkXqK4I40pUZNCgVLHrKHfFKslE1rxXzKD/6h+ErUkKN9Yr0XAn57C:ZPjwX7KxkXqKf/pUZNCgVLH2Hfgsl8xG
TLSH
T1AF32F927A48D5A7F0FD8E50DDC126F4B6DB5029377681D2492FB9D0803A87CE214A6FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

61a90bea8e902ef7_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\61a90bea8e902ef7_0
Size 63KB
SHA256 0fc44b7cdc06cc3ab0651812f6d19df7c20e3ec1e8bd439a5602bb62ee95b425
MD5 ad6e08cacd84a7e1a1e72765d51ffa4d
SHA1 cdce0d4000a286188475628ce8d5bcc4191dbd13
SHA512 1ec7092b253c78d7291acff715a64b037cd47a343e2088f36e7f78264678b8a985a1000bbbc4f798b74d257b26a9df26e7070d887ad1aeaf38d8161c3f7a5dff
SSDEEP 768:Ue1DiIGTUmireEFfgoAaWhrJTt9/XoZ+UynxOp2cR74UAMq6xm3BoWm38lFkvTBN:+I9mtRXyynxOjp4gU3iml8dVYuEf
TLSH
T1D5536C96336078B7827BA1B1909F170B713AE167F004C5F8A194EEE54A44BAA1277F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 9a6d8efd658ba4ef957f326b62ee9ceaa03309fc46c6921c5b85d6c3b77f0018
MD5 5fe737a22227928095a3865e668a73b8
SHA1 bc45cf29029b9d25ff69fe67696dab018c7eb1af
SHA512 71e827a0463572f57ed1541bf0869354df9b929e49fb72bb486ae5ee8655893af840e6cdce7c0e70540f028af5212e5a5a7f54922e487e5f4af880a071d29690
TLSH
T1B6A0041043D5D441D0051F7117CD07447731CD5011C51343C0F004C4CC74DC54F4D534
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 7e52fe5f552558bfff7ef3351dd9b69ddde0f45c72d92cce3f679d1c05a53713
MD5 6aa336be3a29196412adde82fc76564c
SHA1 15158c58c98324b68a42c3e1f74babb464142589
SHA512 f60a0a921cceb8ae3b271bacb7de97d21a6dd3c55ddef8b8848d91b491ec8fc650f519b5ab19bfe7d39a0a0c3c54f4e0009211e8c5f8cc2b5ad7addd147c74c7
TLSH
T132A0223802C08020CC0C8232A8332000222A8E0000828303008300008B0F2E38E00200
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59c366.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe59c366.TMP
Size 48B
SHA256 d2005a1617c65eb6c5cc32c3964e7ce0ab39c06f196c1ec0afd468b6e7e96323
MD5 16878152789a2f4e328cab8335d6d50e
SHA1 8f22c020d25a3a60b76f038be44c45f31bb67f89
SHA512 2ce96737dbd523c616870c6482ec267f2a50fbd5dd4b5eb2b3c2db6b89f25306f98483871ee616b2034fc667b9d6f632a71a9f56e1438bba8da5f9b758ccf928
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 125KB
SHA256 f0b2e4db07e2385752c8fe5bcc256239d433926d4457b4349500752ec0b5d0bc
MD5 a85cb593c43a0034a734e8b51b40b49b
SHA1 bd40b8e6c44d0dd93e7ec487e89f4a3d44e2f9f3
SHA512 65222ea0d0b0a67140da0336f5c1aff650108b411541da638b71441306cdd20a9b7a4758c634e441fa6c47641a25f62f6a831594502b2035a786f5c670381254
SSDEEP 3072:SsQ1SfBqC8QAa/qKYhcc3sM6+MeV+8hTtTHiA+9wCUedCOaq:SskyBtza5n1+IuA+9wCUedCo
TLSH
T118C31232BF3C5E5332E5676464AF8757CC707264EDA635F483943A0B81C38E16A9EC4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 126KB
SHA256 f7afcbaaec8edbe321de6a2ca46887e91a759a5b5053fb2d91d5db801b4009dc
MD5 13fb8214ac487bbbc2ea977cfb2f013f
SHA1 ee5719f523a49fa5d6bc497774f4b2e36d90a20d
SHA512 2da1e192d81ec6164c9032c06cd05f461b82fbd2687047609303c1551b0dc2f5429df6e75bf0835bec452fa681d27b7c641244bcc5b09cae6a8612739772f6ea
SSDEEP 3072:2noQ1SfBqC8QAa/qKYhcc3sM6+MeV+8hTtTHiA+9wCUedCOaq:2nokyBtza5n1+IuA+9wCUedCo
TLSH
T135C31232BE3C5D5226F62B5C109F6613CCB07365ED6675FCA2983A0AC1C34A1AE5FC49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 814292b0b5d4cc02d92902a2966825f0a7cfd49453e8e94532850a9b2a23327a
MD5 7851d79cd80b512ff8ed1c4b14159fb2
SHA1 4d09612217acc3686d8f6370681bbd1701d92edb
SHA512 90d7046a95d40319a1d3828db943dfae7d5c4bcb795d73d9648f486b138167eaf545eab8fd3327335d0e590e92c0ea585d35f54c567a7111510eff874624e77e
SSDEEP 96:BC0d+hDK+UyKovbfaNQYYeteRDotok5KqDhB6WGyvUU+WsbL/Mmv4a:BC0qDHUgvIdaDUDTXCI+WsbL/N
TLSH
T138A11A32A46D4DB76A76D509F8662E43DEB46027EA31BE84D9DE0E0C11F71EC1302617
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 161KB
SHA256 dc51812df8756038c9b59cc559525349603909032d80166cef0a6a4b615c9525
MD5 67b84aec7b45972b116577257af13e48
SHA1 0880fb51243fe54e777c6cadc368985c3170d70a
SHA512 bb8f5de3cd0657795bf7eea36ad481916a765554556dc58a54bd19151ede4d6db0cd4653a9c24c0815b6a7576533cdc35664e2d15a3098cf7d50bdf5fa8d7caf
SSDEEP 3072:S9fL2daL/rxhfAjTQ1SfBqC8QAa/qKYhcc3sM6+MeV+8hTtTHiA+9wCUedCOaq:StL2do/ltAjTkyBtza5n1+IuA+9wCUeJ
TLSH
T1A9F312336E3C5C522296276861AFB7A3CCF57375DD2176F892583E0692C38908FAEC45
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 aa9afc99fd2210325d60893b7472fdf22dc91df6353033317bdeef8f02767a6b
MD5 18d92f784edc50e32d7301c7bb4ab399
SHA1 62c97e498848f9ca3f10e00d098f875205eac00e
SHA512 78d62aa81fe17d00fa58f6c7f06586861989ac2dc9255f736d27a886caa9c8f1bd135d7e857977fb698c43c3f038248604758e0e888bf24ccaaa349ec67ff34b
SSDEEP 96:hC0d+hDK+UyKovbfaNQY6tYSl8h4otop5K6DhB6MGyvUgIlG1QzbOQzEfWb0j9Il:hC0qDHUgvId5iU27X4sIlTLzEfWbU8
TLSH
T17CC12976B86C9D732AB2D516F4132A83CDF5606BDA51AE90DADA0F0C01E75EC2343927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4264_342639431\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1768-863-0x000002365D040000-0x000002365D092000-memory.dmp

Download

memory/1768-876-0x00007FF670840000-0x00007FF670B7B000-memory.dmp

Download

memory/1768-878-0x00007FF670840000-0x00007FF670B7B000-memory.dmp

Download

memory/3304-856-0x00007FF670840000-0x00007FF670B7B000-memory.dmp

Download

memory/3304-852-0x00007FF670840000-0x00007FF670B7B000-memory.dmp

Download

memory/3304-847-0x000001602C8D0000-0x000001602C922000-memory.dmp

Download

memory/3304-846-0x000001602C8B0000-0x000001602C8B2000-memory.dmp

Download