56791fd065358e899c581ebefe2ad871399b7c7ae83fb85e1154c08a75a44147

Resubmissions

29/07/2026, 16:19

260729-tswqsaxejd6

29/07/2026, 16:15

260729-tp63caxdpf6

Analysis

user interaction
yes
max time kernel
119s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/07/2026, 16:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ReShade_Setup_6.7.3 (1).exe
Size 3.8MB
Sample260729-tp63caxdpf
SHA256 56791fd065358e899c581ebefe2ad871399b7c7ae83fb85e1154c08a75a44147
MD5 d1aade32886987db543fc171027b865d
SHA1 816cfb69d8f262a2c6073b5f8d28e1b56a147a6d
SHA512 788813cf2529cdc7c83726737887f453c2b681d6e7c8cb5bd1cf09e2bbd25cd50020a84340b45bf310927b7fdd0f03da5ec951f9f979bed42d5840a4a603d9d8
SSDEEP 98304:NSZN5qt2fPnfaf65RCfC3Xs89C3RWA1aGD34OpFLoTz2:NS35CY/faARV4gijI6Fe2
TLSH
T1B20633C702D91458EAF7AF39B4324A4285B3B8822631D69836DE388C5FF0798D5357B7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
338	discord.com
317	discord.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
836	chrome.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134298154409791423"	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{2BAECAC1-6EF0-414F-B43E-463AE5B33732}	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2608	ReShade_Setup_6.7.3 (1).exe
Token: SeShutdownPrivilege	1884	chrome.exe
Token: SeCreatePagefilePrivilege	1884	chrome.exe
Token: SeShutdownPrivilege	1884	chrome.exe
Token: SeCreatePagefilePrivilege	1884	chrome.exe
Token: SeShutdownPrivilege	1884	chrome.exe
Token: SeCreatePagefilePrivilege	1884	chrome.exe
Token: SeShutdownPrivilege	1884	chrome.exe
Token: SeCreatePagefilePrivilege	1884	chrome.exe
Token: SeShutdownPrivilege	1884	chrome.exe
Token: SeCreatePagefilePrivilege	1884	chrome.exe
Token: SeShutdownPrivilege	1884	chrome.exe
Token: SeCreatePagefilePrivilege	1884	chrome.exe
Token: SeShutdownPrivilege	1884	chrome.exe
Token: SeCreatePagefilePrivilege	1884	chrome.exe
Token: SeShutdownPrivilege	1884	chrome.exe
Token: SeCreatePagefilePrivilege	1884	chrome.exe
Token: SeShutdownPrivilege	1884	chrome.exe
Token: SeCreatePagefilePrivilege	1884	chrome.exe
Token: SeShutdownPrivilege	1884	chrome.exe
Token: SeCreatePagefilePrivilege	1884	chrome.exe
Token: SeShutdownPrivilege	1884	chrome.exe
Token: SeCreatePagefilePrivilege	1884	chrome.exe
Token: SeShutdownPrivilege	1884	chrome.exe
Token: SeCreatePagefilePrivilege	1884	chrome.exe
Token: SeShutdownPrivilege	1884	chrome.exe
Token: SeCreatePagefilePrivilege	1884	chrome.exe
Token: SeShutdownPrivilege	1884	chrome.exe
Token: SeCreatePagefilePrivilege	1884	chrome.exe
Token: SeShutdownPrivilege	1884	chrome.exe
Token: SeCreatePagefilePrivilege	1884	chrome.exe
Token: SeShutdownPrivilege	1884	chrome.exe
Token: SeCreatePagefilePrivilege	1884	chrome.exe
Token: SeShutdownPrivilege	1884	chrome.exe
Token: SeCreatePagefilePrivilege	1884	chrome.exe
Token: SeShutdownPrivilege	1884	chrome.exe
Token: SeCreatePagefilePrivilege	1884	chrome.exe
Token: SeShutdownPrivilege	1884	chrome.exe
Token: SeCreatePagefilePrivilege	1884	chrome.exe
Token: SeShutdownPrivilege	1884	chrome.exe
Token: SeCreatePagefilePrivilege	1884	chrome.exe
Token: SeShutdownPrivilege	1884	chrome.exe
Token: SeCreatePagefilePrivilege	1884	chrome.exe
Token: SeShutdownPrivilege	1884	chrome.exe
Token: SeCreatePagefilePrivilege	1884	chrome.exe
Token: SeShutdownPrivilege	1884	chrome.exe
Token: SeCreatePagefilePrivilege	1884	chrome.exe
Token: SeShutdownPrivilege	1884	chrome.exe
Token: SeCreatePagefilePrivilege	1884	chrome.exe
Token: SeShutdownPrivilege	1884	chrome.exe
Token: SeCreatePagefilePrivilege	1884	chrome.exe
Token: SeShutdownPrivilege	1884	chrome.exe
Token: SeCreatePagefilePrivilege	1884	chrome.exe
Token: SeShutdownPrivilege	1884	chrome.exe
Token: SeCreatePagefilePrivilege	1884	chrome.exe
Token: SeShutdownPrivilege	1884	chrome.exe
Token: SeCreatePagefilePrivilege	1884	chrome.exe
Token: SeShutdownPrivilege	1884	chrome.exe
Token: SeCreatePagefilePrivilege	1884	chrome.exe
Token: SeShutdownPrivilege	1884	chrome.exe
Token: SeCreatePagefilePrivilege	1884	chrome.exe
Token: SeShutdownPrivilege	1884	chrome.exe
Token: SeCreatePagefilePrivilege	1884	chrome.exe
Token: SeShutdownPrivilege	1884	chrome.exe

Suspicious use of FindShellTrayWindow 54 IoCs

pid	Process
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2520	CredentialUIBroker.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 1884 wrote to memory of 4412	1884	chrome.exe	89
PID 1884 wrote to memory of 836	1884	chrome.exe	91
PID 1884 wrote to memory of 804	1884	chrome.exe	92
PID 1884 wrote to memory of 804	1884	chrome.exe	92
PID 1884 wrote to memory of 4560	1884	chrome.exe	93
PID 1884 wrote to memory of 4560	1884	chrome.exe	93
PID 1884 wrote to memory of 3252	1884	chrome.exe	94
PID 1884 wrote to memory of 3252	1884	chrome.exe	94
PID 1884 wrote to memory of 328	1884	chrome.exe	95
PID 1884 wrote to memory of 328	1884	chrome.exe	95
PID 1884 wrote to memory of 3564	1884	chrome.exe	96
PID 1884 wrote to memory of 3564	1884	chrome.exe	96
PID 1884 wrote to memory of 2028	1884	chrome.exe	98
PID 1884 wrote to memory of 2028	1884	chrome.exe	98
PID 1884 wrote to memory of 5032	1884	chrome.exe	99
PID 1884 wrote to memory of 532	1884	chrome.exe	100
PID 1884 wrote to memory of 532	1884	chrome.exe	100
PID 1884 wrote to memory of 3872	1884	chrome.exe	105
PID 1884 wrote to memory of 3872	1884	chrome.exe	105
PID 1884 wrote to memory of 408	1884	chrome.exe	106
PID 1884 wrote to memory of 408	1884	chrome.exe	106
PID 1884 wrote to memory of 4488	1884	chrome.exe	107
PID 1884 wrote to memory of 4488	1884	chrome.exe	107
PID 1884 wrote to memory of 3680	1884	chrome.exe	108
PID 1884 wrote to memory of 3680	1884	chrome.exe	108
PID 1884 wrote to memory of 2188	1884	chrome.exe	109
PID 1884 wrote to memory of 2188	1884	chrome.exe	109
PID 1884 wrote to memory of 4608	1884	chrome.exe	110
PID 1884 wrote to memory of 4608	1884	chrome.exe	110
PID 1884 wrote to memory of 3416	1884	chrome.exe	111
PID 1884 wrote to memory of 3416	1884	chrome.exe	111
PID 1884 wrote to memory of 456	1884	chrome.exe	112
PID 1884 wrote to memory of 1788	1884	chrome.exe	113
PID 1884 wrote to memory of 3260	1884	chrome.exe	114
PID 1884 wrote to memory of 2216	1884	chrome.exe	115
PID 1884 wrote to memory of 2216	1884	chrome.exe	115
PID 1884 wrote to memory of 3788	1884	chrome.exe	124
PID 1884 wrote to memory of 3788	1884	chrome.exe	124
PID 1884 wrote to memory of 5020	1884	chrome.exe	125
PID 1884 wrote to memory of 5020	1884	chrome.exe	125
PID 1884 wrote to memory of 356	1884	chrome.exe	128
PID 1884 wrote to memory of 3624	1884	chrome.exe	127
PID 1884 wrote to memory of 356	1884	chrome.exe	128
PID 1884 wrote to memory of 2336	1884	chrome.exe	129
PID 1884 wrote to memory of 2336	1884	chrome.exe	129
PID 1884 wrote to memory of 812	1884	chrome.exe	130
PID 1884 wrote to memory of 812	1884	chrome.exe	130
PID 1884 wrote to memory of 2732	1884	chrome.exe	131
PID 1884 wrote to memory of 3088	1884	chrome.exe	133
PID 1884 wrote to memory of 2896	1884	chrome.exe	134
PID 1884 wrote to memory of 2896	1884	chrome.exe	134

C:\Users\Admin\AppData\Local\Temp\ReShade_Setup_6.7.3 (1).exe
"C:\Users\Admin\AppData\Local\Temp\ReShade_Setup_6.7.3 (1).exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2608

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffb980fc728,0x7ffb980fc734,0x7ffb980fc740
  2⤵
  PID:4412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1896,i,2275779803964393503,13711434587600167611,524288 --field-trial-handle=2040,i,16625878990921504552,1548334071010662205,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2156 /prefetch:3
  2⤵
  - System Time Discovery
  PID:836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1752,i,1001263871700886863,5533209029186287158,262144 --field-trial-handle=2040,i,16625878990921504552,1548334071010662205,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2036 /prefetch:2
  2⤵
  PID:804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2216,i,8514594036570455483,14943001629740158873,524288 --field-trial-handle=2040,i,16625878990921504552,1548334071010662205,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2376 /prefetch:8
  2⤵
  PID:4560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3184,i,831290208443048821,7671116772349461879,2097152 --field-trial-handle=2040,i,16625878990921504552,1548334071010662205,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:3252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3216,i,1666729307787800711,10631620992383318080,2097152 --field-trial-handle=2040,i,16625878990921504552,1548334071010662205,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4312,i,11089466960239371685,14152074486963819603,2097152 --field-trial-handle=2040,i,16625878990921504552,1548334071010662205,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4320 /prefetch:2
  2⤵
  PID:3564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4772,i,4964177728119206424,7698487524116963122,2097152 --field-trial-handle=2040,i,16625878990921504552,1548334071010662205,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4656 /prefetch:1
  2⤵
  PID:2028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5556,i,6550858756157529571,1998476824418419599,524288 --field-trial-handle=2040,i,16625878990921504552,1548334071010662205,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5564 /prefetch:8
  2⤵
  PID:5032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5644,i,11633957864130105844,16942235074158116166,2097152 --field-trial-handle=2040,i,16625878990921504552,1548334071010662205,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5656 /prefetch:1
  2⤵
  PID:532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3492,i,13130525539786682794,11527699677717458410,2097152 --field-trial-handle=2040,i,16625878990921504552,1548334071010662205,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:3872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=3356,i,8777879483851952801,4879540005360069675,2097152 --field-trial-handle=2040,i,16625878990921504552,1548334071010662205,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=3372,i,13941044034080925964,9700478690197194889,2097152 --field-trial-handle=2040,i,16625878990921504552,1548334071010662205,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:4488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5564,i,12803873188302470890,2015538458462432658,2097152 --field-trial-handle=2040,i,16625878990921504552,1548334071010662205,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4792 /prefetch:1
  2⤵
  PID:3680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5716,i,8902318885415933235,9925362608815142796,2097152 --field-trial-handle=2040,i,16625878990921504552,1548334071010662205,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5696 /prefetch:1
  2⤵
  PID:2188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=3468,i,6897105793461306098,4532497608626220575,2097152 --field-trial-handle=2040,i,16625878990921504552,1548334071010662205,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:4608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=3220,i,5462655787174471929,17091119079090538469,2097152 --field-trial-handle=2040,i,16625878990921504552,1548334071010662205,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5952 /prefetch:1
  2⤵
  PID:3416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3308,i,1215071500591755665,12604835349390634738,524288 --field-trial-handle=2040,i,16625878990921504552,1548334071010662205,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3224 /prefetch:8
  2⤵
  PID:456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5768,i,10294977414354450260,16563879560557760046,524288 --field-trial-handle=2040,i,16625878990921504552,1548334071010662205,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5560 /prefetch:8
  2⤵
  PID:1788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5736,i,8252944972091332578,18211370952276092313,524288 --field-trial-handle=2040,i,16625878990921504552,1548334071010662205,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5976 /prefetch:8
  2⤵
  PID:3260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6120,i,11358842763270133755,14217937108342716705,2097152 --field-trial-handle=2040,i,16625878990921504552,1548334071010662205,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:2216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=3064,i,17797609233768350758,2499871293048852273,2097152 --field-trial-handle=2040,i,16625878990921504552,1548334071010662205,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=868 /prefetch:1
  2⤵
  PID:3788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=5740,i,16382393058641497130,1261652890624037660,2097152 --field-trial-handle=2040,i,16625878990921504552,1548334071010662205,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:5020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3232,i,15687518503633141783,10904725645879245272,524288 --field-trial-handle=2040,i,16625878990921504552,1548334071010662205,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3252 /prefetch:8
  2⤵
  - Modifies registry class
  PID:3624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=4808,i,14927889093257793302,9130729736375054187,524288 --field-trial-handle=2040,i,16625878990921504552,1548334071010662205,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5944 /prefetch:8
  2⤵
  PID:356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=6236,i,4320657765614824283,9158391658371198908,2097152 --field-trial-handle=2040,i,16625878990921504552,1548334071010662205,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6228 /prefetch:1
  2⤵
  PID:2336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=3188,i,11381119552911893994,12430656674025529513,2097152 --field-trial-handle=2040,i,16625878990921504552,1548334071010662205,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6360 /prefetch:1
  2⤵
  PID:812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6712,i,13449761663068044234,15759273010212641254,524288 --field-trial-handle=2040,i,16625878990921504552,1548334071010662205,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6484 /prefetch:8
  2⤵
  PID:2732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=7620,i,2333994228799764132,3191270898707278774,524288 --field-trial-handle=2040,i,16625878990921504552,1548334071010662205,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7636 /prefetch:8
  2⤵
  PID:3088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=7640,i,2508464241382299546,9309625233459278305,2097152 --field-trial-handle=2040,i,16625878990921504552,1548334071010662205,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7716 /prefetch:1
  2⤵
  PID:2896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=7664,i,13522049411764740584,4714272343938064649,2097152 --field-trial-handle=2040,i,16625878990921504552,1548334071010662205,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6636 /prefetch:1
  2⤵
  PID:3308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=7004,i,15939885241924908907,15198452272897179477,2097152 --field-trial-handle=2040,i,16625878990921504552,1548334071010662205,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6940 /prefetch:1
  2⤵
  PID:4124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=7960,i,359121965137532798,6328215651963810484,524288 --field-trial-handle=2040,i,16625878990921504552,1548334071010662205,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8176 /prefetch:8
  2⤵
  PID:740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5868,i,14445710672038527015,5191270777939840174,524288 --field-trial-handle=2040,i,16625878990921504552,1548334071010662205,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7872 /prefetch:8
  2⤵
  PID:4912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=8248,i,2782006520338181799,1840136577660533226,524288 --field-trial-handle=2040,i,16625878990921504552,1548334071010662205,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7844 /prefetch:8
  2⤵
  PID:5016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=8300,i,1685217559303163707,51015845125831228,524288 --field-trial-handle=2040,i,16625878990921504552,1548334071010662205,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8224 /prefetch:8
  2⤵
  PID:1816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=7968,i,14922958380957900664,272766314142117280,524288 --field-trial-handle=2040,i,16625878990921504552,1548334071010662205,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8332 /prefetch:8
  2⤵
  PID:1120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=8228,i,15421813515432915697,5591604341892787932,524288 --field-trial-handle=2040,i,16625878990921504552,1548334071010662205,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8344 /prefetch:8
  2⤵
  PID:2696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6724,i,15804830237863352925,14170381184786770117,524288 --field-trial-handle=2040,i,16625878990921504552,1548334071010662205,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8380 /prefetch:8
  2⤵
  PID:5128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=8396,i,11948807163808783747,2711053954192465207,524288 --field-trial-handle=2040,i,16625878990921504552,1548334071010662205,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8372 /prefetch:8
  2⤵
  PID:5140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=8456,i,5354701945504734564,14023457561374421942,524288 --field-trial-handle=2040,i,16625878990921504552,1548334071010662205,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8464 /prefetch:8
  2⤵
  PID:5148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=8512,i,13077972663776645950,11177648066289371607,524288 --field-trial-handle=2040,i,16625878990921504552,1548334071010662205,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8504 /prefetch:8
  2⤵
  PID:5160
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=8560,i,2191973654741554580,8632327053575671851,524288 --field-trial-handle=2040,i,16625878990921504552,1548334071010662205,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8548 /prefetch:8
  2⤵
  PID:5172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=8624,i,9895683506583352483,5237141673445705847,524288 --field-trial-handle=2040,i,16625878990921504552,1548334071010662205,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8648 /prefetch:8
  2⤵
  PID:5236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=8636,i,488295907653974104,11131633172061652369,524288 --field-trial-handle=2040,i,16625878990921504552,1548334071010662205,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8700 /prefetch:8
  2⤵
  PID:5668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=8780,i,12580597358762371634,11597626289146313012,524288 --field-trial-handle=2040,i,16625878990921504552,1548334071010662205,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8800 /prefetch:8
  2⤵
  PID:5792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=8892,i,14876429194147480549,12080552820257549972,524288 --field-trial-handle=2040,i,16625878990921504552,1548334071010662205,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8840 /prefetch:8
  2⤵
  PID:6140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=8920,i,30437790740944610,5814601857383217471,524288 --field-trial-handle=2040,i,16625878990921504552,1548334071010662205,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8876 /prefetch:8
  2⤵
  PID:6000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=8732,i,6839295341989801606,3469679156565807949,524288 --field-trial-handle=2040,i,16625878990921504552,1548334071010662205,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8884 /prefetch:8
  2⤵
  PID:6096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=8912,i,7808759861603897323,1934498963361606976,524288 --field-trial-handle=2040,i,16625878990921504552,1548334071010662205,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=9000 /prefetch:8
  2⤵
  PID:5632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=9068,i,1836227648536532256,222777428814746772,524288 --field-trial-handle=2040,i,16625878990921504552,1548334071010662205,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=9024 /prefetch:8
  2⤵
  PID:5424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=9128,i,10156400876864502257,6469950028267577859,524288 --field-trial-handle=2040,i,16625878990921504552,1548334071010662205,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=9124 /prefetch:8
  2⤵
  PID:5604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=9176,i,3171816673955408486,4044101636380144888,524288 --field-trial-handle=2040,i,16625878990921504552,1548334071010662205,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=9112 /prefetch:8
  2⤵
  PID:6244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=8176,i,11517665551786403411,15583269653500206267,524288 --field-trial-handle=2040,i,16625878990921504552,1548334071010662205,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7968 /prefetch:8
  2⤵
  PID:6352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=7636,i,9412428690963691999,10558428750278771301,524288 --field-trial-handle=2040,i,16625878990921504552,1548334071010662205,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8916 /prefetch:8
  2⤵
  PID:6428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=9268,i,10544868619980620202,12688631067898751159,524288 --field-trial-handle=2040,i,16625878990921504552,1548334071010662205,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=9300 /prefetch:8
  2⤵
  PID:6524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=9432,i,11280515613555530779,7256491967186802959,524288 --field-trial-handle=2040,i,16625878990921504552,1548334071010662205,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8744 /prefetch:8
  2⤵
  PID:6632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=8368,i,7846856656584342737,2795632121516024222,524288 --field-trial-handle=2040,i,16625878990921504552,1548334071010662205,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8408 /prefetch:8
  2⤵
  PID:6728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=9488,i,6431017693850182904,12191864088419576361,524288 --field-trial-handle=2040,i,16625878990921504552,1548334071010662205,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=9468 /prefetch:8
  2⤵
  PID:6804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --metrics-shmem-handle=8836,i,6631972811727757955,12483607469647548119,2097152 --field-trial-handle=2040,i,16625878990921504552,1548334071010662205,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8168 /prefetch:1
  2⤵
  PID:6976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --metrics-shmem-handle=8728,i,3034445604270159029,8984721295727775567,2097152 --field-trial-handle=2040,i,16625878990921504552,1548334071010662205,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8388 /prefetch:1
  2⤵
  PID:6984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --metrics-shmem-handle=8936,i,1017557892473965323,15790112981221879686,2097152 --field-trial-handle=2040,i,16625878990921504552,1548334071010662205,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=9436 /prefetch:1
  2⤵
  PID:6992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --metrics-shmem-handle=9548,i,12157384133708007062,13126868520502844965,2097152 --field-trial-handle=2040,i,16625878990921504552,1548334071010662205,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=9252 /prefetch:1
  2⤵
  PID:7000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --metrics-shmem-handle=9228,i,3609525384829533857,4363724003581078848,2097152 --field-trial-handle=2040,i,16625878990921504552,1548334071010662205,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=9580 /prefetch:1
  2⤵
  PID:7008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=9896,i,9392014984040141901,16487231445917043242,524288 --field-trial-handle=2040,i,16625878990921504552,1548334071010662205,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=9552 /prefetch:8
  2⤵
  PID:7044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=9916,i,8835775828228000844,18196562680536436313,524288 --field-trial-handle=2040,i,16625878990921504552,1548334071010662205,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=9968 /prefetch:8
  2⤵
  PID:6180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=9856,i,5967334293884299704,11461334438565420392,524288 --field-trial-handle=2040,i,16625878990921504552,1548334071010662205,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=9972 /prefetch:8
  2⤵
  PID:1044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=9848,i,15488639140657371506,8340791419587332405,524288 --field-trial-handle=2040,i,16625878990921504552,1548334071010662205,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=9864 /prefetch:8
  2⤵
  PID:5928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=9868,i,13511118892403780555,3468812821347813068,524288 --field-trial-handle=2040,i,16625878990921504552,1548334071010662205,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=10008 /prefetch:8
  2⤵
  PID:5864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=9996,i,1813258113194821078,13109180960451866805,524288 --field-trial-handle=2040,i,16625878990921504552,1548334071010662205,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6624 /prefetch:8
  2⤵
  PID:5272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=8592,i,13522871358593836215,1470423358697349083,262144 --field-trial-handle=2040,i,16625878990921504552,1548334071010662205,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6956 /prefetch:8
  2⤵
  PID:5500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6580,i,8679182459743245364,18116239759814417592,524288 --field-trial-handle=2040,i,16625878990921504552,1548334071010662205,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=9344 /prefetch:8
  2⤵
  PID:5848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=10008,i,2481245729549628859,5316163953021156424,524288 --field-trial-handle=2040,i,16625878990921504552,1548334071010662205,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6592 /prefetch:8
  2⤵
  PID:5856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=7968,i,1059166839523769574,1061609357589500488,524288 --field-trial-handle=2040,i,16625878990921504552,1548334071010662205,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6596 /prefetch:8
  2⤵
  PID:5908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=10016,i,10261513404271702734,8551901098573139397,524288 --field-trial-handle=2040,i,16625878990921504552,1548334071010662205,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=10020 /prefetch:8
  2⤵
  PID:7120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=9796,i,3778178628701468049,8423234274297629267,524288 --field-trial-handle=2040,i,16625878990921504552,1548334071010662205,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=10212 /prefetch:8
  2⤵
  PID:7132

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3348

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3344

C:\Windows\System32\CredentialUIBroker.exe
"C:\Windows\System32\CredentialUIBroker.exe" NonAppContainer -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2520

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x49c 0x4d8
1⤵
PID:5108

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 a9bc91a3244e7d72467b656c5486d15c0ed9f92add88f691c3853e2b856cbd81
MD5 b1e1deec2c4182d0013a230b355f4c7d
SHA1 126437183b8f548051a3f561eea1eb0ee68fc9cc
SHA512 e718639402727b342725497f1be1fb31c240520b2883d9791df2e05dd851d0e309e06e9942c2a24d6090668922ba1d9f9a1ebf9b87311e7d55ee2d605549ce06
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 65c5f5e81d6c81996e7d8933de3ceb1a227ebd8938fcfeaf545f160c858e944d
MD5 a80dcf6b2824b5f363e078e85ced6b77
SHA1 8d17302622e2ae4a7405abddb26dc3b5e97078f1
SHA512 caaaa98a3f408bec7849d2b0c62243656820b4fe73d1ca8c862f0adf08252e9b360291100229bb4d0a9ce473053c59ec0a4432b5e9cc189639024c9d23b55959
TLSH
T116E02BA9C972AC3719F91718A46A4705EB4113176A41981F373D850C4FB473B468685C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000005

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000005
Size 70KB
SHA256 202f6947db28f364478faf1adfb51acbf040157ef4a3e26404b8f1075a0c5d8f
MD5 1f5c87e7e976d26a5d082bfbbb43e5cf
SHA1 25f240f331ff78dc584b3fc047eb9df63034d1b9
SHA512 7d7d174dc67deb8730918f064638cf9cf1bbaf6f2e7d04215b5a6977f940acd9143e2a299afa594f98d1cf6b3dcc15d729b321eb0e77a331a14008fa4d2d91f5
SSDEEP 1536:DGgRo2P4EXELm9zQFG44t0kgAoSuEhsqjwKELAr4Nvoygkm1A7vWPmQ7P:DGg5P4GE8zQFGhYE/EcUNvo0v4D7P
TLSH
T1496302E1CCF31F1103EDD73516A1556CE09EEA7B28E750D7B111B658862B34F9C90E8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000008

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000008
Size 38KB
SHA256 7165713d3e1a610399471a5e93d5677508f62ef072c1151e72273bf4bd54f916
MD5 9436affc97843765a966b3568fa7e5ec
SHA1 7bfda74bb30589c75d718fbc997f18c6d5cc4a0b
SHA512 473ec3a843c33e18d6d194651fe11353fcd03a7959225faeabf8c77484155ea6a7bccb72dbaf2093ed53c408faa3be9f6fc907f7a5ddf8223375f9d09b504456
SSDEEP 768:eUEh2+iKBVQbBhu8vjenqz2Ez6Y/AxHLEaP72sV9qKYbDblXqhP8qwFSE3uk:eUEEoBVQDjeQaLnP2pfZTqgSEB
TLSH
T11703F112148F7FA1C244F224A4EFE416ACC3F565ABA15E6980B8B7C7010E3C657A46FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000a

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000a
Size 84KB
SHA256 b02d81653438f2206e406fe74f198c4081b749f7ab9e5a2de8c1fcf349bf0f82
MD5 a06a101f4e9ae9bc3c7185f29d973177
SHA1 71ad19396030d4f261a2b79d182e107583b81016
SHA512 b022a01a0aadcaa3e9f8ede517d02121f852b5d20a3f0e07f76a01d73c412caff82f6ed33f8e8b459706741720002af2c8047988e7c4d96d360348d73cb8c1f4
SSDEEP 1536:X/Vo6Xtocjv/2uDQOwVIC+Qo+kgi1GbP5xunBQ+JPqiCEyDddmWOGPR7hjMHy5sK:X/Ntnj3BwVNfzq3lCEyYGPQHymvMNrY+
TLSH
T10A8302D04C3B7A5463A19924C5CF3A4CD4E1A65F9F97E8AD8C89B39B11F640E3C0E84C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000b

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000b
Size 436KB
SHA256 0b320d2cf00e9215763a5377904e2301b2edb7a5d299bd319259714cf8bcd9a9
MD5 38e965609b7e0769e6754549cfa3c2fd
SHA1 8ef9e62fa3ae6d8b371f5a9e9344a6cdf31515fe
SHA512 18cff962b979abf3e3d06261422f35502463a0e196aa0cf801cadcff8833a83f20c9e9f22fb3133041e406fdf2304088a0a5eaa4bbb8aff07ab15a0c1b46b0e4
SSDEEP 6144:HT+7EhQjYpz+XUGr9+7Km54TxcjJJEWv6p0qOJ7kuKtAiDL6GnkES7+S8HBWzDi2:6vj0iUI9EKFEJdU0p7riDxw7L8oviJ3c
TLSH
T147942367DF08D99BDA158361EA30EBDD1158EB6EE00A3CC844BB462CE54C0F9F6913C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000c

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000c
Size 510KB
SHA256 ff9fce5723264e517a8a2fcaa5412dd9fceb57e7ddd4285bec3d27cdc16e7a40
MD5 29329f6d409c79b530e42a5ab37a87a1
SHA1 6654bcdd92c016393766ee9c1934887cea536c0d
SHA512 6bf9889fb6d06785be8a82d511a13f665b926866809ddb32b36593af48a3d59d9ba7189ffc4e318bac0b99f30582a4f402a10ed0b484b3a62bc6d037e10ca5c2
SSDEEP 12288:Lj2/DZRVTAyv+no8vrE/Qh+EDN0vOpcK/Pb7rGZ:Li/D9v+ndILEDN0KcoPrI
TLSH
T1D8B423A38B2AAF3B9B158B6FFCC94DE534376D2A34D4016713425E8EE5F0433A46601B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000012

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000012
Size 17KB
SHA256 4287cf65babb198ede4c77324a5df7e2154a222b22a82bec49de79e31261e6a5
MD5 c541c0a16361997a6b4a2d9870c78522
SHA1 406dc176a3540c85725a716e2e9227c612b42589
SHA512 ca61fdd1b8aa9ff2bcb9c7beddf3919438525c2d3ddee908d6ed714721e83436e06b047538831c2f52801810939cbd22e605475412ffb98ba0723bc5d01f768c
SSDEEP 384:vX9DsUIVnkxVBVs72qgArSGOUZhe1Q8vwjcQccpITSTW+/XHWS:vxIVkxVBV8wUrf8Cce6IWs3v
TLSH
T1E772C08693BFD458CBCF2305DC45799E004A606E7019E187B09FAAB80D4BB2A75C71AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000015

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000015
Size 61KB
SHA256 31c14618e8c3338191650835e5f33cdd5d3f392249fa002d5c5ba00ab30d974b
MD5 5aa7cd80ffd1aacb3c1834c642c17ff9
SHA1 af0bd3e9d0da2979fec781b3977af0b0ee5d5539
SHA512 87123d2bf58bb580c19002cd34f1205fff7e58ef6b99d95ef9156a8ac39725fe3a8a406a0cf3332951d6ca8fbfc432393b0e627facb9cb2e236f6583a0350a01
SSDEEP 1536:YA4492vkjK7Vckx2zPZp63JlOg2Xnj97R9VWXf:d449feKXp65Mh3J7R2Xf
TLSH
T11E5302B5B9CF83D4CCDE77786A8950266BDFB20131CE70E0D78BA1699251380D73998B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000016

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000016
Size 45KB
SHA256 99cb14a6afc6c298d1a54a8772edeac8277c4bc6693ac9b5b92e3eb32652d525
MD5 853d71b687482aa0c0d1236dbdd35ef8
SHA1 f8a412266a87536c11944a2ac0532e4d95137514
SHA512 794e871887ec421a081e4cb3854f954ac45f6313e1238f88a924e2c63fee72d3338142f4acbd01cfaf8003eca8759c91fd6526366dd71647d1ab6d085c5ab72c
SSDEEP 768:p95vGArBLJy7jH9CEiFJ0KysCz9yv1m4KrybzOwgtWqEhKji9ipRg:1+Sy7r9CEsJeyv1m4KrezY3EhKji9Z
TLSH
T1FD2302E6F6040E6E7470C84E52ECB3DC3611FBC32648A23BE6E48480D2658DE7973947
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000018

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000018
Size 74KB
SHA256 c2d36b0ddba25ce09000453df449a31c78314eb9975dbf3244092f8c3674c22f
MD5 a4621e1d952818afb0dc453cd3cee59f
SHA1 19b81b1c825c47199773af8b609705d20200a690
SHA512 66910862f102d1136409701902983478d5c2d37513b6cf1f5e4dafba8bf5297f5cf2a410ff2832820e178ab8e0d496e98438c9f7aecdcfe577e9e1134e462ac4
SSDEEP 1536:JrrzR2xB5hQR193C3m5N6VHPoryfNpAYKX6SF5K4ZAPQ1tEPreENKA9dcU:Jr/snXQR1LO9oUNeYfSXAPKEP7KO7
TLSH
T1817302383A5A8E4E56DFD300B2E977408FF516894D7E26A508F6DB0D0DAC1F385C3695
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00002f

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002f
Size 309KB
SHA256 df3aa18db7c24769209f9c652d0e5344c7fa82530b39b78d8d22ca92e52380c0
MD5 dffbf601ded0361c5ed27c760e4bf84e
SHA1 460228da0a5965608866da23038dcfcde01de24a
SHA512 e4bd950502df65a79c96fa7b04bf0f1bc221d4888e2f316de8161e5fa8f9e732ab5cea31dff65ed5b18e6cb826ea466dd1c23614ca34e0966c7d352a6ecd9485
SSDEEP 6144:kPuiIo2PI6h6yjmaRfpntuG0ALL3/rdtp5cFLILzfEDLYi272f:AuQ6hla89SA/3DdTOF8L7EDLYi272f
TLSH
T1846423599E2DAA57BE52E83816D2230C7F440BD6B4670FF90326960EB076E0E9C3D032
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000042

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000042
Size 58KB
SHA256 36311afd0b3611d8523e4553a5d1098a3573d4b2d8c7ca774b72bcdedcc54e13
MD5 88a755418dd4c58c709c30818c3235de
SHA1 6f0458e00d994b1afdb069a8eb6d4ac3c3a1066a
SHA512 0b36f053889dfc320e7fb016e1e0229685a56251df8d259281f08fa37c0c1d6e07f0d1f99143192b01d4c5ff5c499a95a59cba01bd57ac0593d2f4a2b331cef7
SSDEEP 1536:okHpqX9OJ8nmrjAu1VOrlbnNxrxKaoLK6QUjC:TJq2PAKorlbnvrxK/dC
TLSH
T17B43024B117F3894847AD5F42BC1165F0EBB40EF36EB6C28B88FAE48A96D794B11074C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000047

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000047
Size 1004KB
SHA256 6a75bf09726c80587b0707a64acba14310bf015fc20fe420ce7fdf74170dba7e
MD5 45ae57ad97abadd76c23164a8f9d37c6
SHA1 94c5609c2920aba30f51bad02b82b3c18b3e129e
SHA512 ec19910174f18d3c72a61a95ca970dc4c6b64bc24c73b47bbfb267b991e2c0b8b8f5b169db4252448189d611d30da15dbe8365e7ef24c82669b9920ef4a34860
SSDEEP 6144:1Jn7omY0rmHhHf/Tc5fEhHRZpQzD2fa9gYXACgNiNNRPs:1tFYTh2EDZaz6f+giA7iNHs
TLSH
T1A425E0997718A52FEE55033034E963473730E9706393828F8960635D8CB53EAEE5A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 b87f22dfdef9c4d05c46a86cc0a94be1619cc16220011a77795a15c98e66c250
MD5 1403b72ac48fe387b753f51fc99c2b0b
SHA1 49e4dd7095608dc13acc41811cf31d88bdd5bae3
SHA512 6b032435e4676fe7a29b7cbc39f80f277a0a58fc7d16e04cf52fc2197de444d4eef80270b68c7d01c358a084848a6e5887ae8faad63216f08f25eb4c8f6b9881
TLSH
T1AA21CB2B6F53CC60DFCEAC3044B6CBD56A584AF9535C020E01C0401B6A9657EE9FC5D3
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 e78c45d6079e89d3ec9bd2dc0bf8781f09fff968042b5dd39673091d0f82516c
MD5 dc937b63787cab645b926f6e2a51e410
SHA1 18971769fa5b24a193ea6bba2176f524d3675ded
SHA512 2c0117a233c2a634fb20809d02451a80139169fd302ce45e1f6181e23ddd8ff87651e506492ab75cec234ffd09c883b0ae98f51bb36383d645145c13dd8520b9
SSDEEP 192:DkXchUFsaIJlJThVOaaSHpXB+aPfvI2xJCfP1NPmI1I+Iz8Irsf9CIw+rJ2:DkXchUFsaIJlJThVOaaSHpXB+ang2xAe
TLSH
T10D12AEF7C3D8C52DC85156F49B26AF1FCE2A0A18431C3C26C9D8AF5B93E2972D21564E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 838ba7694230761eb90cdb8bcc24f2539b34dcf9e6fc945898cfefbb0101b4b0
MD5 0b05e10636dd73ded13422465d6b41c2
SHA1 aa638b06e3e964be0ffa403e0b9aa9d25a9cd832
SHA512 f386b25d57557aab88c6fb21fca4c2f1a22437da05cba69e42f3f1adcf2f766026c736adf6f039c6a074a969bdd35a392b2cff99f7bc979527e1402c298cd2a1
SSDEEP 192:PRncBzTq1Tqe5jkiv7MF+pAPRp2z/I9HHsb+WNKuqOU4O8E5UkRLI3a0ClVyIsnB:PRnmzTk7gugoUXV1woKE5dR2aPTe
TLSH
T1CF52C55FAE10697B6CDBC229F9127B63D7F1202661D42E80E6FC8A2C15E76CD221705F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 e8a8661fa7c053da54ce16623d60241b95a1cf9d47114214cb3850edb36268e6
MD5 d4bffb30e7792e505fd7c2f1a6c1aeb4
SHA1 5ef8390de1747f5263193ac9c8c6119f636d06ee
SHA512 ed7022d46d2117753dd349111eae5df00fe2606bfe9ad251c468d66a75bd3c7b843e4019efae5b3c4dc027c7dbe1171451b705c986c9e149b2bcaf246d2f608b
SSDEEP 192:yRncBzTq1Tqe5jkiv7MF+pAPRp2zpB9HHsb+WN/D2UB0S2hRkRLI3a0qlVyIsnA4:yRnmzTk7gugoUX21wxr2hGR2aDT8
TLSH
T1F852C66FAE10697B6CDBC229FD127B67D7F5202161D42E84EAFC892C14E76CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 3c3e680e7521e382b29a678253d1a4073aa9e6d3b2994325156c38f3e3f765d7
MD5 b968459c848386062abbbdf6eeb0197b
SHA1 2c61db3ebf733cafff1a055979e74ee37abc0daa
SHA512 65b9db166ddec0c06e1e748cce69d611c8eb4930b1e0ab6ef8f0e8b040e4ac02d3441da691bc26bbeaed706b93af6bb5f600e401006f5fc31ad17eafbf2cbb6a
SSDEEP 192:PRscBhTq1Tqe5jd+v7xF+pFPRpVzirA9HHsb+WNWSo2XFSEoLkRLI3a04lVyIsnB:PRsmhTk7p6lojX11wlYEoYR2arTe
TLSH
T12B62E85FBA1029776CDBC229FD127B63D7F5202662D42E84E6FC8A2C14E76CD221705B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 9c24ee68d554c65b9732db02d2ca8c2fd3d2a1cb000c43f573e743e2ca7b0192
MD5 e2de9e4090739b1f67a336072c695fcf
SHA1 c9befd4abb6a74a61ccc3bdb6a325d676af4a42d
SHA512 c92f7573c7988c59c124697250a376f324aee9666bd2d7a0a92cb45efb414fe35dd9b8d438dd8624e5713ccce196b56e2cd12f18dcbc0d2aa4b5f519d573ab36
SSDEEP 192:PRncBzTq1Tqe5jdkv7MF+pFPRpVzGt9HHsb+WNKuqo2XU1kFLkRLI3a04lVyIsnB:PRnmzTk7pAgojX81wEokFYR2arTe
TLSH
T18262E75FA91029BB6CC7C229FD127B63D7F1202665D42E84E6FC8A2C15E76CD321705B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 624fafc50bcd19efd08cdfbec1c930e4f739f2f9d835d176351dd4ddd8ddfb5f
MD5 72e0cfb29ba574b5e47c9c2ca9d1a517
SHA1 645eed515549d2007b0beacc70f850aea4e5b997
SHA512 a98fe9cf5bd63e0f27991c086876e60ce3f91fcfc952ef4ae9ef6fb3ec19092db56acb3efd3288f6ba46b8a69e65d6f9ce68bd8dac871cb68d2645971aed382e
SSDEEP 192:sRXcBh/q1Tqe5jE+v7xF+pFPRpVY8irA9HHsb+WNWSZ2Mz0gFSEELkRLI3a04lVK:sRXmh/k7A6lojXp1wi5VEEYR2arTe
TLSH
T12862E85FA91029776CDBC229FD52BB53D7F1202662D02E84E6FCCA2C14E76CD221705B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 11d0c2dce24f772f8d7a8ba038ce0ecedbe5299e68853e531d3847979821f2c3
MD5 b846804c6ca027a28bf1a6050f9fd169
SHA1 4be0bfa6ef950ac038f884474a92088b6cc225ce
SHA512 4952fa6d806434285463375882e292fb246913e13ab23c0ae1adb125db6da42d8a5894bf46720fe0acab2a1169a5f79628362153b1c76bbe97caebfa68989c89
SSDEEP 192:sR8cBhLq1Tqe5jE+v7xF+pFPRpVY8irA9HHsb+WNWSZ2MMI4EFSESDLkRLI3a04y:sR8mhLk7A6lojXp1wiZZECYR2arTe
TLSH
T17962E85FA91029776CDBC229FD12BB63D7F1202662D02E84E6FC8A2C14E76CD321705B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 d4014437f1cf1262dc371ab5ef329249dcf161a2c88c436731ffebe20a8db2c1
MD5 7d6259c1f2d922d20c07b6a356904651
SHA1 151af711f69b53a3f3db01b13915fdebb984f1b7
SHA512 ee4b0b1f0bf74869b3479ec414d97c16b785eb9353ba796a6063266cff85f3595b183f509456acfad9b110f6a37724c3f00e55d73e1597f9fa19d14c735b1077
SSDEEP 192:PRncBzTq1Tqe5jd+v7xF+pFPRpVzGt9HHsb+WNKuqo2XFSEoLkRLI3a04lVyIsnB:PRnmzTk7p6lojX81wEYEoYR2arTe
TLSH
T18662E75FAA10297B6CD7C229FD127B63D7F1202266D42E84E6FC8A2C15E76CD321705B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 34d3b150d9ebc3413240a436dcd8cc4d2da0e46d00a681d2118263aea9d32f3e
MD5 73285efb9f7ee0bd384426865ccccf8e
SHA1 51903f2b7a36fa90857257254c2bebdfe5da7eef
SHA512 e9bab3e8a04453bd7ca516137298f57170d38058ccd5df170108532fdb6eefb2d5ae94de47967a5242cb07be597050bef4f69d7f740877c626e131f01424e28d
SSDEEP 384:TRjPq7KxkXqKf/pUZNCgVLH2HfgslT37pLuLcSjFgXODPO+ErU3voHGjBm2oR0h9:TxPq7KxkXqKf/pUZNCgVLH2HfgsV37pM
TLSH
T1287219676C4C8E7B0F94CACCDC167F4F9DB5025B65EA886482FA582903D5ADF01061FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 8adb8da1c0c8ea3c1e77c0225c8e93e0d9543c4fe416f43c26b2f26d28f1ffed
MD5 21fcaaff5b4b879fb0673eb269e80e5e
SHA1 73315bf2e2ceaa74dde7c89bf5e4102fef3ed6dc
SHA512 1048bfb45ab2279f59ed350735e89b755e538c64ec55d1de8018f914b6541a1111e2f97901a132f2bbead6caccc3289d31b2d4c741fa12d067fe9c280ec2d61c
TLSH
T1A9B0124180416542C04602F8156254C87174DF15DA0A170243E0AF27882759080195E0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58f23b.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58f23b.TMP
Size 96B
SHA256 ab5ac900eeda85426215a57da93989d148ba0fb8f3c97f874caa94bbdb7b2991
MD5 02a15a5b04bf3df7804e063d04d74641
SHA1 67de2a15734c234928d870a9667b4eba6427dfb8
SHA512 36072c267a670406d4284db8271544875ef3475a03da4793036699244ba16a6b92301880df0a7d309318aded5000c487ba3ecc97e9231b64cd3c11a2ef03d69d
TLSH
T149B00296C2426393C28203F129A9A9D87261DF26E743221A92E16B67DC2A7749529560
MD5 SHA1 SHA512 TLSH

Submit Download

b2da9e4be4a6758d_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\b2da9e4be4a6758d_0
Size 1023KB
SHA256 1a1c35f8c000d66069eda94013531f81e443e33e15f46e4e4e589fa6bbd1056b
MD5 7af2a7af586b97e7ce0bf442f9dbb8be
SHA1 3c634c469b2b0ecc911086a81f2b1c719c624241
SHA512 3c848466e81b66f6ce1c4d1e0f48efb31d63400a5f5fe5c09ca3dcfcf8e3e772ba156645003a0ed0876a4113dab1509a2c3252fcb28bb4713b51bf8f84fb92a1
SSDEEP 24576:iZf5bDY1+2dPObPSa4wlDRcCxekVGMKIz:iZFDY1+/PSa4wlDRcCxekVGMKIz
TLSH
T1D7253CD873A2B463A375F1A4426F42C7F2AEE892B449886CB598DCD12E74C5540F7F38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 c601dfd2d78af98320c846e74e93ca612845f4bff0a52b16d276f4d622c94177
MD5 d4929d2f5ec5fd558af16b5b62a94cc8
SHA1 f8e8577cf33c5a84642a4a2fe12c0ebc3387d97d
SHA512 3ab2b32fa405161f7f791e50d5cf271bfc97e7c81957671c995747f4c9764765f1005770c71bf6801e7bf847149d65b58e5163ea6391c2210abbf7ba8a23818e
TLSH
T148B0022901651A2BF914277427EB148533658D3D2383911795B014AE845E7D7A329F94
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt
Size 150B
SHA256 307b28d45f86cba29be5ebef13c318f1ec8ffc909bb54acf51021d40b812c53d
MD5 8da5f2e8437c0a277ecf36905dd5ca85
SHA1 30e87434538487be4441617e5b4ddf4f21c34b60
SHA512 c5f8f3b7b1ba57244e26be45bdaa2c47c582e6a5fda83cc150c958d2e6032094862861f37c4d10c8e14c9b440d25d5e4f42fc98c62076d38008eee1e862f1425
TLSH
T17DC04CE31424468B5E34AADD2028B12DD517628C9CC4CCE8D854614665B9E274503A39
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5a0996.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt~RFe5a0996.TMP
Size 157B
SHA256 9c63582b3e263936f837c28aa8cf8b89e5626051e47b7718dbcb23f14075a855
MD5 244ee6143a173e5baaa62cf08cfd0305
SHA1 19a7658e32382d1f0f4081f51854a972166a1eac
SHA512 299e8b6c554f0b302f5a44f851002ba3f7a4ff6f443a80891e595eddba42eaf0ce2f293b7900d2d079813b1f47c0e8c6723d525e241ed648d57e09c577815165
TLSH
T1BCC04CE3182446875F70A6DE2038B11DD927AD8D9CC5CCE8D855714665B4D274506B39
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 237KB
SHA256 5b44515d4e2e4f465904a8f2acf1eb00323b15253cb39bdf0bb4be10d2201b87
MD5 09e9ff69ecc9e08ed3e34152f47c51b7
SHA1 40b35b50bc7f84d54cf4e3e00578cba49df7106a
SHA512 b27ce94c7f00c47b4f25f745ebb964bef456146ac2772982a5a1a8ac4e8625daaef1db909bb9d6ab186baa4d88fb97895df2c01a270739956625dd488ef00e98
SSDEEP 6144:XxtkyBtza5n1+IuA+9wCUedCGm7Rkm1tYpBeh2BAok:X7BtdRAoeYCx9oBGcAok
TLSH
T100341237AE38AD3229E97B5C608E171F4CF07BA6DD25A9F481C87B08A2D74945D4DC28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 237KB
SHA256 2124ed1f0b13c16f97d3283b6b725f7f88d58b6d7f6df5011b08f9ddd2d44d1f
MD5 45ce1d933f5975b1414634d5d8b08173
SHA1 1c91832c6f375efbc11e7ad005efc28da01d75b7
SHA512 9c104ddf27c38f8991a392f99be1657bbb7bd7c2066157c8984302d5ef5a04813010bb4132556be5013a61c29176ad2a1a26be888983b3a875833735b54cf41c
SSDEEP 6144:XstkyBtza5n1+IuA+9wCUedCGm7Rkm1tYpBeh2BAok:XuBtdRAoeYCx9oBGcAok
TLSH
T12B341237AE38AD3229E97B5C608E171F4CF07BA6DD25A9F481C87B08A2D74945D4DC28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 237KB
SHA256 6bac12285d68675c7a32b2c55add6a82ae46b085da54880ad88ca5d4bb458f7e
MD5 de494b6180f618e661a42a26339ba1c5
SHA1 0f570d7e099c6a6f386c3330ec4915d1c545dc70
SHA512 d95c7629d9b2ab2e6575d107f50fa1a2ef4d07b6ca246e7b97f2840491074b87fc2437d2b611193d74b9fc3df0b349c82e73c3676d2777b8936235d314935ed9
SSDEEP 6144:XVtkyBtza5n1+IuA+9wCUedCGm7Rkm1tYpBeh2BAok:X3BtdRAoeYCx9oBGcAok
TLSH
T10C341237AE38AD3229E97B5C608E171F4CF07BA6DD25A9F481C87B04A2D74945D4DC28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 8434ae07633b92f7076a041bc069e814e709ba5acb155d61d39f49cc6b217b1f
MD5 7ca2d9ea8979fea124bcc0c44c6b229b
SHA1 e15585a59d1b8e4f3f64f6c1ebcaeba5f942a105
SHA512 d7b465b6828a721c6098ecc20d76a8d15df5439b66d85af4b92423e3a28296919b852a51953d5c80d6c581c8e2cbdd460739167452a28b27e49b2caab0ba0845
SSDEEP 3072:/YGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMM:/Tm7Rkm1tYpBeh2BAoM
TLSH
T101C312275E75E9375878BB0EB08E0B1F1EF14AA6C930DA92C8D86B0467F97CC1A05D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 38c00837b07c23cfe839d724e71de98893fe02d9d585110371a62e942a382727
MD5 36ebb1e970c44e3b4c9ce8ca306ead3e
SHA1 001339d67da93ec64435ce6deabb9f7dd06be8d7
SHA512 01a9953ab5e0cfe9a46b18e1328c5dbbd95675542ede6b306abcbcdd2b9a57808d1ddafd4a25c873bf5ba47ffbeb0d798a250db6fb02ac2c5d78280d36566476
SSDEEP 6144:XrkyBtza5n1+IuA+9wCUedCGm7Rkm1tYpBeh2BAok:X/BtdRAoeYCx9oBGcAok
TLSH
T1FD342227AF3CAD3225E9775C60CE0B1F9CF166A5D825AAF481C47B08A3D35D52E4DC28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 237KB
SHA256 ef34700ac91bc7ed42b5e2b3fd61d2ea49509469c5645ec11285dc3bbc314ea7
MD5 29c62bcf37bf768a87dd765722ba5feb
SHA1 9ec04043eb68ecff42245e429729211b6a74fd84
SHA512 1cdad2614f46b5dd4151419d0ee2886f7bad6058302054941eeac312384f49c8a57d18261328ba9cc670404ad75049057890230a07fc47a8c27f848b231404f9
SSDEEP 6144:X4tkyBtza5n1+IuA+9wCUedCGm7Rkm1tYpBeh2BAok:XyBtdRAoeYCx9oBGcAok
TLSH
T189341237AE38AD3229F97B5C608E171F4CF07BA6DD25A9F481C87B04A2D74945D4DC28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 15bbc1390a316c9e25a8fa5c88f68efedc27e84f3e16628bde08cf9b03c75db7
MD5 50b156a60a0c4735067d42930551eef5
SHA1 d456b8a5a4050fbe4e6637fba45b226a7759054d
SHA512 860dc76f0bbf58a2d261778705483627b97977b76b53217b3011fd848b0a2cb037ebcb52f7a1c86235bae357fcd0a25b98b103b3d73782c12fabee9f8c9d1d8a
SSDEEP 3072:tAGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMx:trm7Rkm1tYpBeh2BAox
TLSH
T1E0C312275E75EC3759B9B71EB08E0B1F1EF149A6C920DE52C8D85B0423F97CC1A49934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

media_images_grubyptok (1).jpg.crdownload

Path C:\Users\Admin\Downloads\media_images_grubyptok (1).jpg.crdownload
Size 149KB
SHA256 f9197ec99fb6cfccca9b5ad6af20c455f7e0b5cf15c9baf197164b2e6f7bfe78
MD5 26a2c7b4bddada15f52a82e4b8a1a4a1
SHA1 12d0ffae14529df8e771db4fff4e13b6ba56008d
SHA512 b99c657f18d79b8154752d4c995d8c768bffd6a0358eb5be7c2cff9d26dd2946c59c64fd91d70fe8cb3417dd129d288c474626bebceb6b54d8566cb0c5d469c5
SSDEEP 3072:C2GgAUugk4mxDZnm1u6PMJW+vvRo/tx5vKqR/V+UyTA05ydd:CzLJxDZn2u94+vG/tx5yqZV+UyTA05e
TLSH
T169E3239E1D8A56EB659C3014E532128F76016BF919F460B900B8EFD4EC116ACF1E37AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

media_images_jaczup (1).jpg.crdownload

Path C:\Users\Admin\Downloads\media_images_jaczup (1).jpg.crdownload
Size 63KB
SHA256 25539eb30a24e86165f9611f8c658617a3ab337e6c683ac788d14e7172152ef1
MD5 7625ec198fa4f96f2eb3f48a9792ca98
SHA1 e1b255e4029ecdca97489d39102113fe6fcd6cf1
SHA512 598dfeccd4293990061cdc6117e96ac5d133ad60766fa81431341caa255ef3ac620bc32b7579e9a67eecf78d92d04b11015b3f37aedd1f540a246d066279ff44
SSDEEP 1536:ZQdX/A7u78+wbFOliAYmAWmmKPpI0PK6dc4f:ZQdX4SO8gAYmAHlPKYc4f
TLSH
T1E853025811135693D7C895F0486E6B590A0B39EDB3AAC77AD11939EC13B8C927CF80F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

media_images_lubieptoszki (1).png

Path C:\Users\Admin\Downloads\media_images_lubieptoszki (1).png
Size 22KB
SHA256 2b9fe468dc52059f3a207414600eeb8d787423d5ea5d45bc5442a8c0158bd4e3
MD5 064e97d007644379c202d10e85aa7b61
SHA1 67de184fe063c2ab06ca40f5704620229cf94e76
SHA512 2270990af3b489dc3928823289a62cdb0dceaffa0e550505dafcb749966302120896832cc722a5a138c675f4cf142ea97ea43e49f4807f0a9e2c9e16082376d2
SSDEEP 384:7gqYvfUrUm/cRqvFKaXnq9CdXa0zXOB+100Fmh3HcT3jFfVrqHeDjGq/1bbbR3yd:7g+UCci3qqTXKe00FmpHcTbrypgb92mc
TLSH
T114A2D14564BDF163DC4FCC1E3CBFA3927A9BCA2CC8A098518B418D0067C59B1BD27316
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

media_images_ptakwspodniach (1).jpg.crdownload

Path C:\Users\Admin\Downloads\media_images_ptakwspodniach (1).jpg.crdownload
Size 46KB
SHA256 1480e09300dde94453bbf45950edbd2bcee237629c59c4930ae3dffa675ca75b
MD5 9987455160273726f5894678429d5abe
SHA1 5291675ba62eb06953ea2543d139eb8d8ba1dd4f
SHA512 75086a0cd7c6768c1a004871ce73e2da80a4b8b55134a881729b81067610e5fc61b5db5d9f4c1840a55f7fa74a782a8d3e33df10cb37c3d50eb6d6a560e1ae1d
SSDEEP 768:/yJ5hj4MA0IAdPvTlCX3QF58j+Tnupwusb+Yq47rhRsuD4SUtJNpe1qkw62fPW90:/yXN4M7dPvqQr8jIupw9bVq47rUSUtJz
TLSH
T1B92302ED296162B0F4ECAD04FF030E4A31EF8F26265B6203D0E81E29E5263E9375574D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

media_images_ptiszka (1).jpg.crdownload

Path C:\Users\Admin\Downloads\media_images_ptiszka (1).jpg.crdownload
Size 10KB
SHA256 619a41865dbdb6f37d8e6fed65a128b2f3791ede35e8ede22db60fb0f2dcaceb
MD5 fbc857e1bdb52d3fc0a7f28d27a28e02
SHA1 c11b78f2b6c24bd095078c8b6cf202b4ed00f5ec
SHA512 c44efed1c902ca686109b01c7f4b47ae27b921c63da811d73c1ec7d4c48e0277833e5ced2989a71a404cedcf0e643cf7be22c14b9fc72c13581ed940a452b396
SSDEEP 192:bPl6pgqEMbk2ZV9yNB+2ShR+7Vi990k8g6GbBIF5J+HD+fIDvh:bOJHZGBFmYZigyGF5EHqfM
TLSH
T14522AFEA73D04ADFEE533631692C49AAC40AEB5173627A7EE1BA451654C03F88D30869
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

media_images_ptokzjajami (1).jpeg.crdownload

Path C:\Users\Admin\Downloads\media_images_ptokzjajami (1).jpeg.crdownload
Size 63KB
SHA256 78641a7c60d94958af90ff35f315f16f03cd7b12315afaf666d67901fa36e6db
MD5 3de185f7cacd59a67bfd65a34f0d6c30
SHA1 f4b642e4beeadc4501cb25fe39ba30b5c0b1642c
SHA512 51c2d71e1303b3123e8a6afd2069e847d1c432e46dade54cd6c5c68b9ff3d3ea04682ecf8feca2a56bebff8f77b6b866b1ff55e62bcb2cfd8fd6ac885ac3febd
SSDEEP 1536:slnbjiEJ19SokpB4FjBAl+sEBYjdB/Hnm0LJnW1aWyrRINb:+bjifoEB49BAlTEmjddHmuhWkWGWb
TLSH
T19B53027D00382286BBF7DEB4D51388A2F139E2155CD20EB44BAA4DE2F297DB8352003D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

media_images_ptoszek (1).jpg.crdownload

Path C:\Users\Admin\Downloads\media_images_ptoszek (1).jpg.crdownload
Size 27KB
SHA256 2bf3b01afc66b991275909dae575ed1185ac3356d537844fd4f0cd9a1804fb97
MD5 9e4b1b3e7c52e090c8e70df1a98bad85
SHA1 f4367b1f35b1032f0f1112e7af4c016a52a033bf
SHA512 753dc9f3329b8630baa22b0a513e5d659b2c9ed0ecd62894527dc37c03ef688f27368bc342766b6aae10755d11277c466e409b5a677428779df89b0f1db68e5b
SSDEEP 768:9YyaRnf71mZ73n+tmDzzeCl10cxA/Pul/Lbtygpy:9uf8Z73n+te3X0cXD5y6y
TLSH
T110C2D0B6A8DA4723EFF3E03006B537486290772EC6945EFEE194875400B08A666DD0FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

media_images_zimowyptoszek (1).jpeg.crdownload

Path C:\Users\Admin\Downloads\media_images_zimowyptoszek (1).jpeg.crdownload
Size 221KB
SHA256 8925047466d708bf7bae0b1ddf70c302790f4388b2c747a03fe769e8eb8da39f
MD5 d022efd45e61d3834c4c04d1592ad8ed
SHA1 d021d763e742b2e859d5ae2a6be10615bc65c198
SHA512 c80b5b7f29eaf1c7c9a78661cd055b54316ca70bef6737e11468bbc66bcca1eb7fc05ead65b238094aa026e854f16fd12f3384818342586c3cc2f6814804e917
SSDEEP 6144:AByITd5c7FDEbRk5cY9oc4IIKV9yCt4+Vnw1ni8d:AI+iSlj8NfV9r43ik
TLSH
T1AA2413F82B073168A580FAF0952A496C70DAD9C1710EDF1C6557DA7878E1FC1CDB2ACA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2608-5-0x000001B6F5990000-0x000001B6F59A0000-memory.dmp

Download

memory/2608-3-0x000001B6F5C50000-0x000001B6F5C88000-memory.dmp

Download

memory/2608-6-0x000001B6F5990000-0x000001B6F59A0000-memory.dmp

Download

memory/2608-4-0x000001B6F5AB0000-0x000001B6F5ABE000-memory.dmp

Download

memory/2608-2-0x000001B6F5AA0000-0x000001B6F5AA8000-memory.dmp

Download

memory/2608-1-0x000001B6F5990000-0x000001B6F59A0000-memory.dmp

Download

memory/2608-0-0x000001B6F3CC0000-0x000001B6F3CEA000-memory.dmp

Download