e15c43a6530ed03eaae775f1fcfbd4142949f52eb7e0a1d12637179a131c7c46

Analysis

geolocation tags

eueuropefrfrance
user interaction
yes
max time kernel
899s
max time network
873s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/08/2026, 21:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
download.html
Size 29KB
Sample260804-1cvbca1bph
SHA256 e15c43a6530ed03eaae775f1fcfbd4142949f52eb7e0a1d12637179a131c7c46
MD5 b1d2ff5c481d68826513ccbafe920541
SHA1 b0f5560318ee156d0c70c5353f7e07d9b8223534
SHA512 957f9c7a40492dbfd015dcffca92435850bc388479d13ef20fe09029d3126d7f2c7ca09023ef62683e8698b72ab2cb7241d1b70d76e2c4e912496ca78e72ae42
SSDEEP 768:g+Kz42HtQ/zB/VvWOGIIYER/L62z3VE0tG:g+fTvvlGIIYER/f39A
TLSH
T10ED2C5B332544D2E217743DCF6E43626D0E7B35ED24C24F0B49A4AF56451FA0B83A8AB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery phishing

Malware Config

Signatures

A potential corporate email address has been identified in the URL: [email protected]
phishing

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
18	discord.com
19	discord.com
1	discord.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4452	chrome.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303526726696883"	chrome.exe

Modifies registry class 6 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2824035265-2271499813-2042964211-1000\{57E549AB-344F-4549-84D9-C7062AD4C55E}	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
3112	chrome.exe
3112	chrome.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 33 IoCs

pid	Process
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1904	chrome.exe
Token: SeCreatePagefilePrivilege	1904	chrome.exe
Token: SeShutdownPrivilege	1904	chrome.exe
Token: SeCreatePagefilePrivilege	1904	chrome.exe
Token: SeShutdownPrivilege	1904	chrome.exe
Token: SeCreatePagefilePrivilege	1904	chrome.exe
Token: SeShutdownPrivilege	1904	chrome.exe
Token: SeCreatePagefilePrivilege	1904	chrome.exe
Token: SeShutdownPrivilege	1904	chrome.exe
Token: SeCreatePagefilePrivilege	1904	chrome.exe
Token: SeShutdownPrivilege	1904	chrome.exe
Token: SeCreatePagefilePrivilege	1904	chrome.exe
Token: SeShutdownPrivilege	1904	chrome.exe
Token: SeCreatePagefilePrivilege	1904	chrome.exe
Token: SeShutdownPrivilege	1904	chrome.exe
Token: SeCreatePagefilePrivilege	1904	chrome.exe
Token: SeShutdownPrivilege	1904	chrome.exe
Token: SeCreatePagefilePrivilege	1904	chrome.exe
Token: SeShutdownPrivilege	1904	chrome.exe
Token: SeCreatePagefilePrivilege	1904	chrome.exe
Token: SeShutdownPrivilege	1904	chrome.exe
Token: SeCreatePagefilePrivilege	1904	chrome.exe
Token: SeShutdownPrivilege	1904	chrome.exe
Token: SeCreatePagefilePrivilege	1904	chrome.exe
Token: SeShutdownPrivilege	1904	chrome.exe
Token: SeCreatePagefilePrivilege	1904	chrome.exe
Token: SeShutdownPrivilege	1904	chrome.exe
Token: SeCreatePagefilePrivilege	1904	chrome.exe
Token: SeShutdownPrivilege	1904	chrome.exe
Token: SeCreatePagefilePrivilege	1904	chrome.exe
Token: SeShutdownPrivilege	1904	chrome.exe
Token: SeCreatePagefilePrivilege	1904	chrome.exe
Token: SeShutdownPrivilege	1904	chrome.exe
Token: SeCreatePagefilePrivilege	1904	chrome.exe
Token: SeShutdownPrivilege	1904	chrome.exe
Token: SeCreatePagefilePrivilege	1904	chrome.exe
Token: SeShutdownPrivilege	1904	chrome.exe
Token: SeCreatePagefilePrivilege	1904	chrome.exe
Token: SeShutdownPrivilege	1904	chrome.exe
Token: SeCreatePagefilePrivilege	1904	chrome.exe
Token: SeShutdownPrivilege	1904	chrome.exe
Token: SeCreatePagefilePrivilege	1904	chrome.exe
Token: SeShutdownPrivilege	1904	chrome.exe
Token: SeCreatePagefilePrivilege	1904	chrome.exe
Token: SeShutdownPrivilege	1904	chrome.exe
Token: SeCreatePagefilePrivilege	1904	chrome.exe
Token: SeShutdownPrivilege	1904	chrome.exe
Token: SeCreatePagefilePrivilege	1904	chrome.exe
Token: SeShutdownPrivilege	1904	chrome.exe
Token: SeCreatePagefilePrivilege	1904	chrome.exe
Token: SeShutdownPrivilege	1904	chrome.exe
Token: SeCreatePagefilePrivilege	1904	chrome.exe
Token: SeShutdownPrivilege	1904	chrome.exe
Token: SeCreatePagefilePrivilege	1904	chrome.exe
Token: SeShutdownPrivilege	1904	chrome.exe
Token: SeCreatePagefilePrivilege	1904	chrome.exe
Token: SeShutdownPrivilege	1904	chrome.exe
Token: SeCreatePagefilePrivilege	1904	chrome.exe
Token: SeShutdownPrivilege	1904	chrome.exe
Token: SeCreatePagefilePrivilege	1904	chrome.exe
Token: SeShutdownPrivilege	1904	chrome.exe
Token: SeCreatePagefilePrivilege	1904	chrome.exe
Token: SeShutdownPrivilege	1904	chrome.exe
Token: SeCreatePagefilePrivilege	1904	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1904 wrote to memory of 3452	1904	chrome.exe	81
PID 1904 wrote to memory of 4252	1904	chrome.exe	82
PID 1904 wrote to memory of 4452	1904	chrome.exe	83
PID 1904 wrote to memory of 4252	1904	chrome.exe	82
PID 1904 wrote to memory of 4664	1904	chrome.exe	84
PID 1904 wrote to memory of 2356	1904	chrome.exe	86
PID 1904 wrote to memory of 4664	1904	chrome.exe	84
PID 1904 wrote to memory of 2356	1904	chrome.exe	86
PID 1904 wrote to memory of 4840	1904	chrome.exe	85
PID 1904 wrote to memory of 4840	1904	chrome.exe	85
PID 1904 wrote to memory of 3800	1904	chrome.exe	87
PID 1904 wrote to memory of 3800	1904	chrome.exe	87
PID 1904 wrote to memory of 4944	1904	chrome.exe	90
PID 1904 wrote to memory of 5044	1904	chrome.exe	92
PID 1904 wrote to memory of 5044	1904	chrome.exe	92
PID 1904 wrote to memory of 1976	1904	chrome.exe	93
PID 1904 wrote to memory of 1976	1904	chrome.exe	93
PID 1904 wrote to memory of 2088	1904	chrome.exe	94
PID 1904 wrote to memory of 2008	1904	chrome.exe	95
PID 1904 wrote to memory of 2192	1904	chrome.exe	96
PID 1904 wrote to memory of 2012	1904	chrome.exe	97
PID 1904 wrote to memory of 2012	1904	chrome.exe	97
PID 1904 wrote to memory of 2224	1904	chrome.exe	98
PID 1904 wrote to memory of 2224	1904	chrome.exe	98
PID 1904 wrote to memory of 4460	1904	chrome.exe	99
PID 1904 wrote to memory of 4460	1904	chrome.exe	99
PID 1904 wrote to memory of 3992	1904	chrome.exe	100
PID 1904 wrote to memory of 3992	1904	chrome.exe	100
PID 1904 wrote to memory of 3060	1904	chrome.exe	101
PID 1904 wrote to memory of 3060	1904	chrome.exe	101
PID 1904 wrote to memory of 4588	1904	chrome.exe	102
PID 1904 wrote to memory of 4588	1904	chrome.exe	102
PID 1904 wrote to memory of 2080	1904	chrome.exe	103
PID 1904 wrote to memory of 2080	1904	chrome.exe	103
PID 1904 wrote to memory of 3592	1904	chrome.exe	104
PID 1904 wrote to memory of 3592	1904	chrome.exe	104
PID 1904 wrote to memory of 2028	1904	chrome.exe	105
PID 1904 wrote to memory of 2028	1904	chrome.exe	105
PID 1904 wrote to memory of 3224	1904	chrome.exe	106
PID 1904 wrote to memory of 3224	1904	chrome.exe	106
PID 1904 wrote to memory of 1352	1904	chrome.exe	107
PID 1904 wrote to memory of 1352	1904	chrome.exe	107
PID 1904 wrote to memory of 1700	1904	chrome.exe	108
PID 1904 wrote to memory of 1700	1904	chrome.exe	108
PID 1904 wrote to memory of 4988	1904	chrome.exe	109
PID 1904 wrote to memory of 4988	1904	chrome.exe	109
PID 1904 wrote to memory of 4144	1904	chrome.exe	110
PID 1904 wrote to memory of 4144	1904	chrome.exe	110
PID 1904 wrote to memory of 2088	1904	chrome.exe	111
PID 1904 wrote to memory of 2088	1904	chrome.exe	111
PID 1904 wrote to memory of 2208	1904	chrome.exe	112
PID 1904 wrote to memory of 2208	1904	chrome.exe	112
PID 1904 wrote to memory of 1004	1904	chrome.exe	113
PID 1904 wrote to memory of 5020	1904	chrome.exe	114
PID 1904 wrote to memory of 1004	1904	chrome.exe	113
PID 1904 wrote to memory of 908	1904	chrome.exe	115
PID 1904 wrote to memory of 908	1904	chrome.exe	115
PID 1904 wrote to memory of 3300	1904	chrome.exe	116
PID 1904 wrote to memory of 3300	1904	chrome.exe	116
PID 1904 wrote to memory of 1204	1904	chrome.exe	117
PID 1904 wrote to memory of 1204	1904	chrome.exe	117
PID 1904 wrote to memory of 756	1904	chrome.exe	118
PID 1904 wrote to memory of 756	1904	chrome.exe	118
PID 1904 wrote to memory of 1096	1904	chrome.exe	119

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\download.html
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff80b81c728,0x7ff80b81c734,0x7ff80b81c740
  2⤵
  PID:3452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1644,i,14023668641382297027,4227941024706701531,262144 --field-trial-handle=1936,i,5481218440315157495,2195615559459504605,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1932 /prefetch:2
  2⤵
  PID:4252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1448,i,17741458664639919737,2331688527756930262,524288 --field-trial-handle=1936,i,5481218440315157495,2195615559459504605,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2140 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2372,i,4315138409704152237,7893219123228467601,524288 --field-trial-handle=1936,i,5481218440315157495,2195615559459504605,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2476 /prefetch:13
  2⤵
  PID:4664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3056,i,4095269320048565912,7759057896268318827,2097152 --field-trial-handle=1936,i,5481218440315157495,2195615559459504605,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3080 /prefetch:1
  2⤵
  PID:4840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3060,i,4591746781165013826,6326359524428856738,2097152 --field-trial-handle=1936,i,5481218440315157495,2195615559459504605,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3104 /prefetch:1
  2⤵
  PID:2356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4276,i,7144241093948503840,13870813385810733296,2097152 --field-trial-handle=1936,i,5481218440315157495,2195615559459504605,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4304 /prefetch:9
  2⤵
  PID:3800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5308,i,17412990576148612550,4198822804662057567,524288 --field-trial-handle=1936,i,5481218440315157495,2195615559459504605,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5296 /prefetch:14
  2⤵
  PID:4944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5588,i,3376751402398754302,15946729710815777179,2097152 --field-trial-handle=1936,i,5481218440315157495,2195615559459504605,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5660 /prefetch:1
  2⤵
  PID:5044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=3168,i,2930718923881581645,14572237519059108881,2097152 --field-trial-handle=1936,i,5481218440315157495,2195615559459504605,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5700 /prefetch:1
  2⤵
  PID:1976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4436,i,10309645965994550515,7820158029775615456,524288 --field-trial-handle=1936,i,5481218440315157495,2195615559459504605,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4604 /prefetch:14
  2⤵
  PID:2088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3640,i,732998322415252826,11320791827390654795,524288 --field-trial-handle=1936,i,5481218440315157495,2195615559459504605,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5584 /prefetch:14
  2⤵
  PID:2008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3652,i,1971257238001710988,14582783812980321797,524288 --field-trial-handle=1936,i,5481218440315157495,2195615559459504605,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3608 /prefetch:14
  2⤵
  PID:2192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=4596,i,923597554535149721,11821824859103393545,2097152 --field-trial-handle=1936,i,5481218440315157495,2195615559459504605,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4340 /prefetch:1
  2⤵
  PID:2012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5696,i,12115853775879294463,4640148079257508580,2097152 --field-trial-handle=1936,i,5481218440315157495,2195615559459504605,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4276 /prefetch:1
  2⤵
  PID:2224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=4364,i,5318284701941127866,1589574079140453606,2097152 --field-trial-handle=1936,i,5481218440315157495,2195615559459504605,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3708 /prefetch:1
  2⤵
  PID:4460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=4296,i,2024160470673149406,6264985595739311414,2097152 --field-trial-handle=1936,i,5481218440315157495,2195615559459504605,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5588 /prefetch:1
  2⤵
  PID:3992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5608,i,11077463065026399507,14681300285581465495,2097152 --field-trial-handle=1936,i,5481218440315157495,2195615559459504605,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4448 /prefetch:1
  2⤵
  PID:3060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=4352,i,11398969369229964143,12560208807241825888,2097152 --field-trial-handle=1936,i,5481218440315157495,2195615559459504605,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5952 /prefetch:1
  2⤵
  PID:4588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6244,i,15825563946011118086,3428254154950606002,2097152 --field-trial-handle=1936,i,5481218440315157495,2195615559459504605,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5728 /prefetch:1
  2⤵
  PID:2080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=4292,i,8294492867352753821,16000795284663266960,2097152 --field-trial-handle=1936,i,5481218440315157495,2195615559459504605,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5912 /prefetch:1
  2⤵
  PID:3592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5676,i,7118065481670039648,673272782890609480,2097152 --field-trial-handle=1936,i,5481218440315157495,2195615559459504605,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6240 /prefetch:1
  2⤵
  PID:2028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6224,i,8288161087218439379,14697582900482483800,2097152 --field-trial-handle=1936,i,5481218440315157495,2195615559459504605,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5964 /prefetch:1
  2⤵
  PID:3224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=5608,i,18437749035217792227,13614416376662824792,2097152 --field-trial-handle=1936,i,5481218440315157495,2195615559459504605,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6380 /prefetch:1
  2⤵
  PID:1352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=5904,i,8925660960197469323,4367326347571439899,2097152 --field-trial-handle=1936,i,5481218440315157495,2195615559459504605,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5900 /prefetch:1
  2⤵
  PID:1700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=6624,i,3192924333471375160,10419112254967554752,2097152 --field-trial-handle=1936,i,5481218440315157495,2195615559459504605,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6632 /prefetch:1
  2⤵
  PID:4988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=6916,i,10249833280583623234,17935699912089897338,2097152 --field-trial-handle=1936,i,5481218440315157495,2195615559459504605,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6936 /prefetch:1
  2⤵
  PID:4144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=6812,i,12530634740722214586,9379155687982061668,2097152 --field-trial-handle=1936,i,5481218440315157495,2195615559459504605,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6984 /prefetch:1
  2⤵
  PID:2088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=6468,i,18283098293831885338,11605109763918794736,2097152 --field-trial-handle=1936,i,5481218440315157495,2195615559459504605,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5908 /prefetch:1
  2⤵
  PID:2208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=5584,i,16078605997951013778,6706268066794725997,524288 --field-trial-handle=1936,i,5481218440315157495,2195615559459504605,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6524 /prefetch:12
  2⤵
  PID:1004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5968,i,3743360640758730613,5667989322366183781,524288 --field-trial-handle=1936,i,5481218440315157495,2195615559459504605,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6952 /prefetch:14
  2⤵
  - Modifies registry class
  PID:5020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=5408,i,541925349631297213,4199632114356425033,2097152 --field-trial-handle=1936,i,5481218440315157495,2195615559459504605,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6556 /prefetch:1
  2⤵
  PID:908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --metrics-shmem-handle=5936,i,15437273927464040656,7719821783339018970,2097152 --field-trial-handle=1936,i,5481218440315157495,2195615559459504605,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5780 /prefetch:1
  2⤵
  PID:3300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --metrics-shmem-handle=6980,i,5673081549276217550,14284787344495254485,2097152 --field-trial-handle=1936,i,5481218440315157495,2195615559459504605,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6748 /prefetch:1
  2⤵
  PID:1204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --metrics-shmem-handle=6412,i,9492868605206825136,11835617204858401983,2097152 --field-trial-handle=1936,i,5481218440315157495,2195615559459504605,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4620 /prefetch:1
  2⤵
  PID:756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --metrics-shmem-handle=3712,i,12939606028378756466,10225878857575231778,2097152 --field-trial-handle=1936,i,5481218440315157495,2195615559459504605,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4300 /prefetch:1
  2⤵
  PID:1096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --metrics-shmem-handle=7172,i,11396963984108184937,1739522950863710446,2097152 --field-trial-handle=1936,i,5481218440315157495,2195615559459504605,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7048 /prefetch:1
  2⤵
  PID:1364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=7268,i,340370990067055857,6222007427447639931,262144 --field-trial-handle=1936,i,5481218440315157495,2195615559459504605,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3348 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --metrics-shmem-handle=7300,i,7637982141787263803,17287800685259467402,2097152 --field-trial-handle=1936,i,5481218440315157495,2195615559459504605,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6276 /prefetch:1
  2⤵
  PID:4036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --metrics-shmem-handle=6392,i,9210169148635059962,2136276195193812618,2097152 --field-trial-handle=1936,i,5481218440315157495,2195615559459504605,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7440 /prefetch:1
  2⤵
  PID:1868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --metrics-shmem-handle=7572,i,10643242530379956600,724260433148200282,2097152 --field-trial-handle=1936,i,5481218440315157495,2195615559459504605,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7560 /prefetch:1
  2⤵
  PID:4076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --metrics-shmem-handle=6880,i,18244757312927432547,10518208721689825484,2097152 --field-trial-handle=1936,i,5481218440315157495,2195615559459504605,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6820 /prefetch:1
  2⤵
  PID:1640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --metrics-shmem-handle=6132,i,16642667706948309334,16329274551885572294,2097152 --field-trial-handle=1936,i,5481218440315157495,2195615559459504605,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7292 /prefetch:1
  2⤵
  PID:2232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --metrics-shmem-handle=7272,i,10378956353704868247,6451367399026995217,2097152 --field-trial-handle=1936,i,5481218440315157495,2195615559459504605,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7764 /prefetch:1
  2⤵
  PID:2780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=7724,i,5416688129973557694,13300270052254075126,524288 --field-trial-handle=1936,i,5481218440315157495,2195615559459504605,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6168 /prefetch:14
  2⤵
  PID:1512

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4892

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1420

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 c2c1f6e9d8743f7cf58d33da6952be6f5b9194d6b552f3177b7a810c939a2327
MD5 283fc6bd9baaf900031da3a5df4919a2
SHA1 1419c2b283eeceedfd67e8208118e1a92fd5b8e6
SHA512 922d64611b647c7770fae5898cbc3894eaafb1c6d2d8a17255c381ba653bc8e4dc93c6b7a45883f6d17365e3f6af43defb6bad466ab359271bc14769b94994b6
TLSH
T1EEE022AAC831EC3708FD0B296955478AE725139B2A90854F3B3C920C8FB063A55A6D5D
MD5 SHA1 SHA512 TLSH

Submit Download

f_00001e

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001e
Size 331KB
SHA256 db4ffbf0ec662620013dc14bc1268bdad6256d19d7d511ec7eff8446887e6900
MD5 05ef8155cf66131654d3bb9c9cba5853
SHA1 e79d53fcb604921222dd1dbc2f1c10c631ff6075
SHA512 ee38793245d91683ddb1f847e5b56a09864fd32ec059055459b3ebe101abed79683ee59c80f30b8f6249d2bbd83fbf7bca83dafb4ef2b634ceff6969c80fed23
SSDEEP 6144:FljUD58FLTW53eaLkNv+Ps0dj1fpqaGjYf0NIcB3bM1rJZ24:FDm5uaLcv+PFj7ajJNImbM1rD
TLSH
T1247423A9B50E3C8AC94F9473827EAFD2A4356FF38D47BAA3634241F401874342E4676D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000025

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000025
Size 73KB
SHA256 6dbf4ce8bd7984da3b3dec2833e8107b11b10aa56a537a2e23284cc52a2d9ea9
MD5 86ab42d92e8aaa951eed274da507ad23
SHA1 311714e51063b0fa75cc3854c967f6a1d7ceaf10
SHA512 8272707b178435da9ec5a970dbfc34f76d6b0b0cfbdfa0fcc7c068507e0681318916ec3aecdd2f3227b153a5285bf1a4b9ab367ce2670223a925bee6e56ef655
SSDEEP 1536:moe3GAn1hvFY9yIeaRApCRxZNBo2TePOYqTvPOaYE6meGxfwpw3vidG7:mj1h9rIHApCReO9vWR+V317
TLSH
T1B17302C63DA8481B07FB429B47D08C556C2AB3A5CB7559446FB81C2CFEAA427132E58F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000029

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000029
Size 21KB
SHA256 c0973cf7fe203d43878a422dc0e448b1aec56c0e6fa58cff0bf95fa10aa804a5
MD5 649c76c706bbbfa4383ba9fb7798e78e
SHA1 b60d818d640ea2eb22d55c7e5d829a32aa8d88e6
SHA512 19efe475ca7a9c6528d93e03b3b3c847c7dbc680bee9b11a7b3c2364c05a7fec58ddd75a02729221afba4d9310eab7ecca7fc77cef227088e7d01cd4bc0d722f
SSDEEP 384:1PB+Zb0VIWMN59WPdPnHf5jfK0XhwLvtlqyhOHg3DqpDZ6vFCNBNcx38hampJNnj:+lBWMUlPnHBjvwLjjz4ZyCfNcx4Tpjj
TLSH
T13EA2D18411A61954DA0103BBC91CDEC73C6A79E3F7CDF1722A16B5FA013CEC52D25B98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00002b

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002b
Size 134KB
SHA256 0ed25aecb5ad618999aeaf8dc247a9ef9fd027a4b7be16d082431c1ba519c900
MD5 2c92353d8cff7b86bc0476bf804c638e
SHA1 ba98701d37721923b7110f89def36c815dc6be39
SHA512 f6a7013037a417db65d1a50740f46a85fe097670a802da2e4cd31aabcf1bc9acd2c277b93ee518bc0d5abf922d6916a08224e632a9b3ce7cfd4556afb62b7c5d
SSDEEP 3072:MVgHg+XkcIDOCqTlVa1E5B350ftAnbXQpDy5nzrDiZPG:GgAljvqTlVQEN0qXX5nzrz
TLSH
T1E7D3122CDA39C845FC813F06859DFD75469415F267A688FB16E39C5208BB84783EE2F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0af7fdb9c6b58ede_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\0af7fdb9c6b58ede_0
Size 3KB
SHA256 a9c18387f881972152cf4674d73af67b51ba60e286b2aa05ed21c3f06432a55a
MD5 b948e5f08ce0623f376587a7591c3755
SHA1 9ddb2c73027e3d7d1231a8406c0831874d319ecc
SHA512 a0f0c8315f34d8c13ac1a875fbee8cc106fd3c33076a4682f5de95d44aca0bb1c1c6297c7b8333229f85e24cb890e0c5f20a6f8ede85d2d28c5599b0a8231339
TLSH
T19A71749D66508A3ACA3283FE12638656333540146FD7D3237489DBB91C443FBB9A5E4E
MD5 SHA1 SHA512 TLSH

Submit Download

127dc82602b19237_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\127dc82602b19237_0
Size 238B
SHA256 3ba4e5226bdef691463c5b6131f3f4ec247a284e2959a52cddbf09e73870fe0a
MD5 5da38418fb9ae530fcb306adb3e9167a
SHA1 b225a8719475aa696f3b685f058ed0ee745f8d9f
SHA512 0ceb71d42e4573bc88c4aca926446d97962b12a857d8a26d0016a49b94ea41d2288ede12403b13917c366da22adfa8164221ce446763c36a590c8e4a708b7671
TLSH
T16FD0A76B44B03A14C60C50F8E3BD50C7D313958A1948D29B9420A09A364997027DDA12
MD5 SHA1 SHA512 TLSH

Submit Download

a8a45b00991a9a22_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\a8a45b00991a9a22_0
Size 242B
SHA256 17028842270aefa5e50ef286125dd978e85b078d3cc3c843366a67bda4522d20
MD5 3cc631eb44f14b3a80fc1c7e148c4973
SHA1 1a355bbdec9060a5850cea981245eb07841a1386
SHA512 0f0e6e681e8b71a2f899fcaff46e0664b91ff16cfc10015dbf370b95f778566d750dedfab85c926ff0b0b14d64ed87a1fe83b38e9010f91e58861f5f3c5188fe
TLSH
T1F2D0A75FD0B0BD4CD80454F9D6BE54C3C2125AC9448AD25F562150A39605B62A289952
MD5 SHA1 SHA512 TLSH

Submit Download

df53bad28ea1e322_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\df53bad28ea1e322_0
Size 303B
SHA256 0c7d1a78ec94b562b1053522b4bee03c737a81c756a1238bc979e80a3c8aef32
MD5 8fe147ba458cf2f3ceb716bb662ab634
SHA1 5cdfe747f2bb975c9b6e24f73a9892bc4d9bf1db
SHA512 0e7ddd2a79d0885741bfbd4c1e758182b7e082e28d39e2deb3f608616f57eb302564d668513712464e3005842f9bb9ada07a64a9de39af701cc92a09432dd814
TLSH
T13EE02B97C4D47E51C55E45F0DA8E027BB22780D9549DF8CEA11460A2C148BF5A7C6233
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 fbbfbbb631f57beae067fbc7df9db0ff88313c29c635746621fa82b0fa289612
MD5 426adc3123270b95c21e2e07a5b7753b
SHA1 8f4531a550a5a79ea1cefc918e93e36e66f9330d
SHA512 dec5247032cfd58272e6e6cfb8b09cb43aa752754381fc24da3046781a9875b247cbf655230c094fba79765dc97b1e184fd4288a55a466adfa4055ce49b5d679
TLSH
T1624198915CB041A1EF21667929EDCD313CB042685B9BFFE7DB78103582AFB99AF03149
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 64b26524e0e146e88a1b638cd09177427ad16ebe82f90a95772a8e928206df02
MD5 8503581570ffe1484bb205fbc74ffc32
SHA1 ef1adaea45c6d6173f3517fea8baae245ccd1ce6
SHA512 a889436dc2f1dfdc857bef10094ad4084e6616db38528c3b6b8f8e2e05f02ca626a4e477b9812e95b52cb6b97adf80ca21c2d5425b2b5fa7a324b79dc7db1592
TLSH
T19A71CE1C88B000A3CFA212BE35D54C5639F1116ADB433FD7D5B81A78726F7DA6F22A45
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 eb73f54925623277a45066e5e8c46c00be1802761b33fa501413c1e00ef82894
MD5 7ab3b4447df61d576dbe5ee24d34fe77
SHA1 6bf9ae6db76bc4988048f433b43208deee995d7f
SHA512 df481db1e29b4dfd8a29bb1efbe59a41a79d412f9d99a13a260055c03d71ea04eac7ca250f28183d1fe1214b1705dd8a7ca846671dc2bd5923750db9931be523
TLSH
T1E061D11D88B000A2CFA112BF25D94C523CF1112ADA533FD7D5B81B7871AF7D66F22A45
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 3008b538fb4ebd07151b6ccba11cb4ff218cd88d2c4020c86f6aa34632f46e13
MD5 ac8c6503df4e025157139890d3dc60c2
SHA1 2829ae66dae29795ae60fa175febc37c3c9763ac
SHA512 75a23ec25e77859af68cfe438ea0401bb4b2781d8b1034d2587f37be2e305ce01ab83e012ced3b508a3fbf47b4be0f9cda276e5a86b64a787faf68ea8970629f
TLSH
T1DE51A95D98B000A2DFD3127B15EB88B538F041195A573FD3DA781CF472AFB9B6B02642
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 21KB
SHA256 9214a9749c3d0c6f6c0648fd984047cfaa0594ade0bcd6aff936d514c6fecf74
MD5 f4b2f2e87c4d81e202b7c8a377b50449
SHA1 61cf7ea17c1d3ae9eab07bb74882b56cc4b11305
SHA512 71b4fda86e52e32619ef1f1f2b28f41640b6327830c18732bfdf33268717004c1e3f387d8cbfe20fc912b0831e3fabd0a6293dfae50d1c8b469e7a48b9b3f019
SSDEEP 384:DwTsmGLxxH167xe2gU1IJ6JEKOqwuPBe7aJbJgwe4FaaEdURvFchwiuvMl3JZ407:p8v9Na51bnAi2l+fX
TLSH
T1AFA2CFF783F8866ECD11A2F0EA256E1BCE591515032C3C5B85D5AF0B97F2871E281A4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 20KB
SHA256 3fd5d39fdb7f0af0ac82570c920dc6d4c23b4016656b6c541f172de70ddba25b
MD5 8a7b4df3e16518a46195ece844ffe49f
SHA1 f91ffaea9de2a1549ca15e3a58b26dd1e365c4ed
SHA512 3b0e68b1f27d7d9aacf619aa2c811e884ec4da326e4b130da6a7ed9118cd9b1f436fe8c0c4a32731b5834f8572350f5bf1c22de402b4d89d1dbe60deed1a9029
SSDEEP 384:DTsmGLxxH167xe2gU1IJ6JEKOquJABeU8jqYaZJaaEdURvFchwiuvMl3JZ40rZX6:W8XibnAi1lqfn
TLSH
T17192B0F783F8866ECD11A2F0EA256E1BCE591515032C3C5B85D5AF0797F28B1E281A4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 20KB
SHA256 b7ab92dbaa2d2c4719b8f98c20112ca7dc0a80e45e1db3828660a77160dfb8a3
MD5 0e62a5954f09719c0b5f2ba564cc2474
SHA1 40b08a84e0df8e26104df0c6f79627eca357a4ef
SHA512 1f741579860e4e72a1ccf822555dbd32be84b617cb246b0db5025a63645bd395c673f2ca950bc7fb66271cb48189d39d64d73c3731e4d8e4c0a6f1dc52fca647
SSDEEP 384:DwTsmGLxxH167xe2gU1IJ6JEKOquJABeUaJbJgwe4FaaEdURvFchwiuvMl3JZ40o:p8XwNa51bnAi1lqfX
TLSH
T184A2BFF783F8866ECD11A2F0EA256E2BCE591515032C3C5B85D5AF0797F2871E281A4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 12KB
SHA256 5b492acc30ceebab28d1784fb3723a743ea9bd24c67b4708ca6496311b6eeaf9
MD5 130b706d834873acc97ef4eb0cf76fa5
SHA1 4ab5796f465da753a75596f9974d7e78c9d1a4e5
SHA512 352241db55e8362fb56fc1444da1a5c8ee55ef2b312cc48662a41acf2ddc1cbf036f1abcfa538886cae3f380cedade6b692abc042dba78bdebfe8852819c5e78
SSDEEP 384:D0XQMmfbbaIaEdUga/SFchBvuvswXIXMJmBb8AAlj1JXGT87y3N8UkkG0qkLqNNX:vQWjzGn4A6
TLSH
T1B6426EF7C3F88A6ECD1192F4AA256E17CE590915432C3D5BC5D4AF0B57E28B1E28094F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 19KB
SHA256 bfdc4250f13fc27a1da660db71f0245a0efeaf5908ad942f2d52a1dd361eafd3
MD5 386520257dbb48dc7af0bb07bccd5362
SHA1 9b6cd1323a1e22bb307ba8c9bf15ed51bee57671
SHA512 d6f7e78295636da6b64ecd3d22287f576eccfe91e779ea13903de680e8bb99da87b06565a351063bb049da42293281e7430141302c5093efed2dd1ca935dc0e2
SSDEEP 384:D0XQMmfbnRJ8yuueu5viwpvJEJklresaaEdURvFchBvuvMl36khL6Q8YV00qp405:eGFVuvdLfznfYys
TLSH
T15892BEF7C3F8866ECC11A2F0AA252E17CE590915432C3D4BC5D5AF0B97F2871E290A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 4KB
SHA256 fae2ce681074680e8519e09ff9fed1689218142dd36dd6c38e9119fa8676c65f
MD5 97e27170e2c5b9df555a608d48c5f78b
SHA1 c7c9b7bbb30cb20a4cb979ab602361634c7721d6
SHA512 25862f8a3d504ef2f2f1d66529e72fb14c97d1561d00586c57e17a5a197d2fd5ad1e64174f93c733df817ea9684594d178057932804fe86ab2354ff0dc238bbe
SSDEEP 96:d7Uh00UoNUdUBUNvU/ieUMBsUkUT2UOUFU/bdUA4UMAUusgUOnRUQUztKUeKUjbx:d7UhfU+UdUBUpUxUisUkUT2UOUFUTdUC
TLSH
T15A918C93DBBFB46B103979AB1D847C0925BAA4320292B4F4EB56C16CB0855F71F12077
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 15310d96e35be5a1847d59531b0479e6c02d54276425a274b11b120fac395055
MD5 abea552730762566cfdfb0472e57d2fc
SHA1 0f3bc5a86f583c44e96fc6f87095049104fa4508
SHA512 f89ef2d8cea8ef43bed456f7e4d85447ac55a1c73a19989beca73cee36509fb9dd5370c3abe8826fa3686d065e6d4d0d4d1c8951526a5901dcffea3dc295a6bf
SSDEEP 192:RRmFvYIk9A+HTv7zS+pEKPRpgX39LR6H9WHsb+WNl1ZJZyOQaxauO+t5ovu98kwH:RRm1Fk9vr/5pXTUwfp/CGoHoaWtE
TLSH
T13F62C52BA960297B8DDAC229F9217767E7F6207261D01E84E7FCC92C21D76CC211741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 f9c39be3e621151e8d17f0fbc0fce77ae9f98166054a038094e00db022728944
MD5 e24f70003a8851583c7c5014dee59245
SHA1 a17063c2398337fe985ee506a8d71291b7c5c8ad
SHA512 9de511c7bc7ce7e0f7b46db2287429c28c04cadf28cf40801e83fd3acde82f8e0684fd8c60d4d960d8123c373c9fbbb150971aea29cf4d79ba7969ce1a10ede6
SSDEEP 192:RRmFvYIk9A+TJv7H+pAPRp2rJ9WHsb+WNnyOP8u98kwH+7aeKVyIsnAUge:RRm1Fk9rJiUXSUwvPWoaeKe
TLSH
T15642B53EAD54793B9DCAC329FA667763D7F9202161D02E84E6FC892C10D75CD222742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 2bd62f07b5fdf2b561d7c4d3cfba5cc40a2fac0f94790147bedf6cc37c4766d1
MD5 d251f44c33ea60d534b5b1843fa01396
SHA1 6b6c904cb344bf3766de614e308a00d98813d864
SHA512 d4d594e24f00b24f4ab620b5923f082af6bec83618c06bec4808659b52898dce70c629db5e055baec809f9f8cef4f9443d185670e785d01055eb571a1957ed22
SSDEEP 192:RRmFvYIk9A+H4v7H+pAPRp2r4p9WHsb+WNnyOJyS2Yu98kwH+7aCKVyIsnAUgE:RRm1Fk9vkiUXjUwvR2ioaCKE
TLSH
T1B552D63EB954693B9DCAC229FA567763D7F6206121D02E84E6FCC92C10D75CC222742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 2eff7b549b0fa183cb226b26a018166d08deeea9b57a63f2c79b49d25443f61f
MD5 8631d78dcf45a66f6fd1df27f8fdc7f0
SHA1 c576242e575b74b0ec985692534dc99019264c1c
SHA512 6b080430fac22ae9aa022cfadece6face26d38130ff4eed02d956e552525b23008024febb3ef0c6b2f9f3171662840fd7e8e1757a829926ed82000be0dbb06cb
SSDEEP 192:RRmFvYIk9A+H8v7H+pAPRp2c946+9WHsb+WNFKyOJuOe8u98kwH+7aCKVyIsnAU3:RRm1Fk9voiUX0UwIpeWoaCKE
TLSH
T13C52D63EB950693B9DDAC329FA127763E7F6206161D02E84E6FCC92C11D76CC221742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 5dcb6852db0589ae8f9c035c6fae7ab91dc149abe0d2559f3badc16d984e077a
MD5 0900e29d5e9dc07ed20be3ea8ef3d77f
SHA1 99ac9dd6ddc55a4b3daa98e60780f81f73395586
SHA512 64b45bdf507f3fc90c139b0ea79ee0d66f6a52ba0d7991359bb2b73622e68ca48983bcd883aa937a378103d74c9e09eba6a1b769f831fa834b3668d9015dbb4b
SSDEEP 192:RRmFvYIk9A+H8v7zS+pEKPRpgX39LR6X9WHsb+WNFJZyOJuO+QH2Gu98kwH+7aW5:RRm1Fk9vo/5pX7UwlpZ2IoaWKE
TLSH
T19362E62BA960697B9DDAC229F9617767E3F6207261D01E84E7FCC92C11D36CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 42ebf9c411169efa37b23288911586ac055952f54e5c18b75ee387e14ca5f72b
MD5 3f5e05ab9509aa42a42e2e0fd6557b80
SHA1 d28850f5832d855105d6a6bd508201ca0b87f1a3
SHA512 676295d79284383320b2125e1cf7d1c284726adedaf742e18264996e416e298fc848feb0d050e48c59314e38eb7a24b85798ebd024ab07c53bc757cc95a660f5
SSDEEP 192:RRmFvYIk9A+Hsv7zS+pEKPRpgX39LR6H9WHsb+WNl1ZJZyOQaxauO+t5ovu98kwH:RRm1Fk9v4/5pXTUwfp/CGoHoaWtE
TLSH
T1FF62C52BA960297B8DDAC229F921B767E7F6207261D01E84E7FCC92C21D76CC211741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 fea1733956ab8a51a08a12822b21fbbfc31210b0acab029f9729d16838fcb85d
MD5 e8957f5a98310df5c6f5dba935375f90
SHA1 7af9d73d7e2525c9c8b172209bf7718c06af79c7
SHA512 5c76ee6e35f195c0f0394d24394a914a4d2bf2e0786a52e34f4d45759833939fe61b73c54ba22f8efa5f28c446891018aeaa57f4f79932fe397f655288f0e4f1
SSDEEP 192:RRmFvYIk9A+Hjv7zS+pEKPRpgX39LR61h9WHsb+WNl1ZJZyOQaxauO+QH2Qu98kF:RRm1Fk9vb/5pXphUwfp/CZ26oaWKE
TLSH
T12E62D66BA960297B9DDAC229F921B727E3F6207261D01E84EBFCCD2C11D76CC211741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 02563b7788e6e062b34e5130f7781cb2176e9115710ce6b4619435ace10a2eb2
MD5 614047841715199adbfba09dfd51516e
SHA1 b8a14dc953ad96462a5d6bf27395f992a6f35519
SHA512 88c49916e61bb1ed0c939b67b5fbaa592d5415187175d1f62e6b2a6dfc95bd967663f31e305ded43154e0b8673b24e38f3dc4fbcd4e5f951f79301936b2ecc3f
SSDEEP 192:RRmFvaIk9A+HTv7zS+pEKPRpgX39LR6H9WHsb+WNl1ZJZyOQaxauO+t5ovu98kwH:RRm1/k9vr/5pXTUwfp/CGoHoaWtE
TLSH
T1B662C52BA960297B9DDAC229F921B767E7F6306261D01E84E7FCCD2C21D76CC211741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 a487a90aa586ffb722bc45a76d1e954f5a6f5ff4286551d2445a524e0f1cc25d
MD5 a6b03dd39d632b77a2b691136935ce1e
SHA1 660afa8fb43d4f28bf93dfee7ad6659850a1dd80
SHA512 fd42fd771a90c2ac5460f1c04885199c7f6c1ae3796cb236a749714522d06dac63689becd9a9f638977639774ddf2dbbc07689355940492b636644edffad801d
SSDEEP 384:6kj+F7KxkXqKf/pUZNCgVLH2HfgslzO7pLuLcSjsNXOD+F+ErU3JbHGvYKD0S:6o+F7KxkXqKf/pUZNCgVLH2HfgsJO7pT
TLSH
T15F72F867684C9E370FD4CACCED167A4FADB5024B65E9886443FA582503D5ACF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 5387ebb378732447c8024630e580af83f83e9aada63eb65bdc9fd12fdba96aa4
MD5 953bb6ae485b0675bf701d21c594fd83
SHA1 de28770c54893f3d6f19a9d9258a3a9567d06195
SHA512 19b4d8d7cf298683c5edea1883e102e82193e805af90d878eff1d9e5c2f5a5569e25a5667d6c563aecc660238350918c427dfc8ed56a56d7e5e834087c97d21e
TLSH
T1E3B0120480025501C04202F4354214D8B1145F10960E1F0A83E0AD22D8351A18A24061
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58b13a.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58b13a.TMP
Size 96B
SHA256 59a4c1132a770ed24bb2e26c845fe084693fa4421e5e1f220e3072fe56554bd5
MD5 bd91ac3be015a6f6ddb01a2e35826f62
SHA1 314fcd7d2b798dacdb3aff1b0e4e0a0d1aeb1eef
SHA512 7c6a0ed188a7258bd0595cb4ffc76f8cc4071c4137f8c8088f52911d990f3406dae5f11ffbd223770ed085358620129a73c00298244ec3c4336c1b928ea9f449
TLSH
T1BFB02200C203A223C00303F0208BA0C8B220CF32C2030202C2E00E22CC382F2822A232
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 90a275c5c2b008275ba9519a500f259d5ac5b831b884167c74d83a6072adb1e4
MD5 fcf4276b26f3443b13e35e69041f4196
SHA1 9c2c5357a282739086f0e209387978943b4c4c94
SHA512 f5b2dce9a748f4a940800572b86df2b3b1b1a68363d846823115cdd98cca145818bcc929a6a3d09a6a0e7340dbb4263a7f4de89fea4aa9704cbb65c8ea7f702f
SSDEEP 3072:QHzWs4B7zxAQ0xVOnXTZpY3g9DzcU0/DlblAIToV:QWDfxA3OnjrYQ9EU0/hEV
TLSH
T1DEC302A11C3ABD660DF8EE98640D3A60BFF4ACAA91835DD392ED1F4C14FA5C81179D31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 117KB
SHA256 40be5803dc7a297802e21b7950e805f7f87eaacc02a6d78e5b0c1592fae9851a
MD5 5bf3278bc12190754927ecfe95dab546
SHA1 9a3e0f97ea230bfe5f79f97a3ee27a1b85ffef8a
SHA512 6ca196914c8ea05e93bc0dedfc55aea622594ff233479f9e52f4833d8ae32b925b107d82067b29e1dd5f51aca0c45f68fbff207d88120a08bc68038e64ed54d2
SSDEEP 3072:3yjzWs4B7zxAQ0xVOnXTZpY3g9DzcU0/DlblAIToV:34WDfxA3OnjrYQ9EU0/hEV
TLSH
T13EC302A15C3ABD660DF8ED98640D3E60BFF4ACAA91836CD2A2EC1F4C14FA5CC1175931
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 2a05fa5b4b8d74dd163dad9a2ff4f9557a7fd19fdef47873fb7f5a4e23a4d7df
MD5 97a13e4828d092fa9ac04c3c260f5d96
SHA1 80d4ece0b82550acc64b06f09b7603b3f70b702b
SHA512 364c706d9ac40bdf04281da2329defa6368689f6cfb04549043d73a9e420daf68e63da2959126d079ad3aa257e6199fb10c2ca252b538786a6b77e675be35a7b
SSDEEP 3072:5zWs4B7zxAQ0xVOnXTZpY3g9DzcU0/DlblAIToV:dWDfxA3OnjrYQ9EU0/hEV
TLSH
T196C302A11C36BD660DF8EE98B40D3A60BFF4AD9A91835DC361ED2F0C24FA5C81179970
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 e7825e58323aadf107559ba1b30947397c0574a9a53fd27bf30054647813c0a8
MD5 59b185704649341e22c49edec02a38c2
SHA1 edce6bdda172e38c12368b80e2fe9c082aea92f8
SHA512 57d100694e4c92cb2a39bbb4bb9cd78aebf99b4c20553923f4429d5d8ac9cbb75edd6121ad7212953b76daf3bdade7acb71f739a36898642d6274fb16cab8532
SSDEEP 3072:/HzWs4B7zxAQ0xVOnXTZpY3g9DzcU0/DlblAIToV:rWDfxA3OnjrYQ9EU0/hEV
TLSH
T169C302A11C3ABD660DF8EE98640D3A60FFF4ACAA91835DD352ED1F4C14FA5C81179930
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 117KB
SHA256 e206d4c1bee77cb88e9a73c90a1dc54db00294e42861c248812ed1d854ec60d5
MD5 76447d75cd8003634f9e00b130fba369
SHA1 8c55d0e74b8dc6e28720a3ce0337fb1fa29565bd
SHA512 ce7eeb1f04b1704a17b29d67e75968833996ae34433ef2a77a49654b59df4b628f14450f62a589071f72c25c0e60852f34d85dbbf4608733314352766a74393a
SSDEEP 3072:+ykzWs4B7zxAQ0xVOnXTZpY3g9DzcU0/DlblAIToV:+PWDfxA3OnjrYQ9EU0/hEV
TLSH
T1AAC302A15C3ABD660DF8ED98640D3E60BFF46CAA91876CD2A2EC1F4C14FA5CC1179931
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 117KB
SHA256 ec1879ffe2e7a8fceb52a8bfdbb327aacaad43c448e297110ecf3d4c0f135767
MD5 125fed4ee810ea8f9264b70218cec685
SHA1 76a4219cdb972c341b16db7923283a717a404b26
SHA512 b80a6174f9f9e2c80cc8d8845a7f094041ce74afe4cd50ddcc4d3e034d86dbe1687efaffd34b986b6488329f3fe938726345270db8e18fdd8e367285ca56d89d
SSDEEP 3072:byjzWs4B7zxAQ0xVOnXTZpY3g9DzcU0/DlblAIToV:b4WDfxA3OnjrYQ9EU0/hEV
TLSH
T1A8C302A15C3ABD660DF8EE98640D3E60BFF4ACAA91875CD2A2EC1F4C14FA5CC1175931
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download