5e8dd35b36d3fbe2ea0429eed712a44be6812d351daf8357ec95bb5256d520e2

Analysis

user interaction
yes
max time kernel
898s
max time network
524s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/08/2026, 14:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
loader.exe
Size 255KB
Sample260808-rb7evagl2t
SHA256 5e8dd35b36d3fbe2ea0429eed712a44be6812d351daf8357ec95bb5256d520e2
MD5 49662a4ff83ef86c87b83a8e089d43c6
SHA1 a7b274c9391a2b452a8e8f065ae6be74846074b6
SHA512 2e9d0d86febf069be1bd6262f4aae3ad8b56119c098c3c1300fe0b80cea93498efbd17717a7f7aded8ac7857430400dc5ebe904853ae03487dca3d8dec502475
SSDEEP 3072:MRYyGJwDsUAoyV0CdWvH+YdoTSBEegmIWZu1V1XnWO8j9XQIvn5bfIQ7SairKDy/:MRYfaDsh7WmYq2n9AoxgrKD1/XOv
TLSH
T19F4419443BF95619F3BF5F79A8B050504AB6F92BAD1AD30D1C8620EC2E31B51EE50B63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

collection discovery persistence privilege_escalation spyware stealer

Malware Config

Signatures

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	loader.exe
Key opened	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	loader.exe
Key opened	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	loader.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
3	icanhazip.com
5	ip-api.com

Drops file in System32 directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jcp	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00002.jrs	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.jfm	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.log	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jtx	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSStmp.log	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00001.jrs	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat	svchost.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
4100	netsh.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1428	chrome.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	loader.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	loader.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134306714156643113"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings	mspaint.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 45 IoCs

pid	Process
5008	loader.exe
5008	loader.exe
5008	loader.exe
5008	loader.exe
3476	mspaint.exe
3476	mspaint.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
1768	chrome.exe
1768	chrome.exe
1768	chrome.exe
1768	chrome.exe
1768	chrome.exe
1768	chrome.exe
1768	chrome.exe
1768	chrome.exe
1768	chrome.exe
2356	chrome.exe
2356	chrome.exe
1768	chrome.exe
1768	chrome.exe
1768	chrome.exe
1768	chrome.exe
1768	chrome.exe
1768	chrome.exe
1768	chrome.exe
1768	chrome.exe
1768	chrome.exe
1768	chrome.exe
1768	chrome.exe
1768	chrome.exe
1768	chrome.exe
1768	chrome.exe
1768	chrome.exe
1768	chrome.exe
1768	chrome.exe
1768	chrome.exe
1768	chrome.exe
1768	chrome.exe
1768	chrome.exe
1768	chrome.exe
1768	chrome.exe
1768	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4828	OpenWith.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
660	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 64 IoCs

pid	Process
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5008	loader.exe
Token: SeDebugPrivilege	5008	loader.exe
Token: SeDebugPrivilege	5008	loader.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3476	mspaint.exe
4828	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5008 wrote to memory of 2140	5008	loader.exe	85
PID 5008 wrote to memory of 4100	5008	loader.exe	87
PID 4292 wrote to memory of 1768	4292	chrome.exe	106
PID 4292 wrote to memory of 1428	4292	chrome.exe	107
PID 4292 wrote to memory of 2468	4292	chrome.exe	109
PID 4292 wrote to memory of 2468	4292	chrome.exe	109
PID 4292 wrote to memory of 4684	4292	chrome.exe	108
PID 4292 wrote to memory of 4684	4292	chrome.exe	108
PID 4292 wrote to memory of 1828	4292	chrome.exe	112
PID 4292 wrote to memory of 1828	4292	chrome.exe	112
PID 4292 wrote to memory of 4844	4292	chrome.exe	111
PID 4292 wrote to memory of 4844	4292	chrome.exe	111
PID 4292 wrote to memory of 4712	4292	chrome.exe	113
PID 4292 wrote to memory of 4712	4292	chrome.exe	113
PID 4292 wrote to memory of 4088	4292	chrome.exe	114
PID 4292 wrote to memory of 4088	4292	chrome.exe	114
PID 4292 wrote to memory of 1644	4292	chrome.exe	115
PID 4292 wrote to memory of 4576	4292	chrome.exe	117
PID 4292 wrote to memory of 4576	4292	chrome.exe	117
PID 4292 wrote to memory of 1248	4292	chrome.exe	118
PID 4292 wrote to memory of 3864	4292	chrome.exe	119
PID 4292 wrote to memory of 4624	4292	chrome.exe	120
PID 4292 wrote to memory of 2800	4292	chrome.exe	127
PID 4292 wrote to memory of 2800	4292	chrome.exe	127
PID 4292 wrote to memory of 4856	4292	chrome.exe	128
PID 4292 wrote to memory of 4856	4292	chrome.exe	128
PID 4292 wrote to memory of 2120	4292	chrome.exe	129
PID 4292 wrote to memory of 2120	4292	chrome.exe	129
PID 4292 wrote to memory of 3712	4292	chrome.exe	130
PID 4292 wrote to memory of 3712	4292	chrome.exe	130
PID 4292 wrote to memory of 2764	4292	chrome.exe	131
PID 4292 wrote to memory of 2764	4292	chrome.exe	131
PID 4292 wrote to memory of 4348	4292	chrome.exe	133
PID 4292 wrote to memory of 4348	4292	chrome.exe	133
PID 4292 wrote to memory of 3364	4292	chrome.exe	137
PID 4292 wrote to memory of 3364	4292	chrome.exe	137
PID 4292 wrote to memory of 4752	4292	chrome.exe	132
PID 4292 wrote to memory of 4752	4292	chrome.exe	132
PID 4292 wrote to memory of 1416	4292	chrome.exe	134
PID 4292 wrote to memory of 1416	4292	chrome.exe	134
PID 4292 wrote to memory of 3388	4292	chrome.exe	135
PID 4292 wrote to memory of 3388	4292	chrome.exe	135
PID 4292 wrote to memory of 1156	4292	chrome.exe	136
PID 4292 wrote to memory of 1672	4292	chrome.exe	138
PID 4292 wrote to memory of 1156	4292	chrome.exe	136
PID 4292 wrote to memory of 1672	4292	chrome.exe	138
PID 4292 wrote to memory of 2952	4292	chrome.exe	139
PID 4292 wrote to memory of 2952	4292	chrome.exe	139
PID 4292 wrote to memory of 824	4292	chrome.exe	140
PID 4292 wrote to memory of 824	4292	chrome.exe	140
PID 4292 wrote to memory of 2580	4292	chrome.exe	141
PID 4292 wrote to memory of 2580	4292	chrome.exe	141
PID 4292 wrote to memory of 1044	4292	chrome.exe	142
PID 4292 wrote to memory of 1044	4292	chrome.exe	142
PID 4292 wrote to memory of 5124	4292	chrome.exe	143
PID 4292 wrote to memory of 5124	4292	chrome.exe	143
PID 4292 wrote to memory of 5148	4292	chrome.exe	146
PID 4292 wrote to memory of 5140	4292	chrome.exe	145
PID 4292 wrote to memory of 5148	4292	chrome.exe	146
PID 4292 wrote to memory of 5140	4292	chrome.exe	145
PID 4292 wrote to memory of 5132	4292	chrome.exe	144
PID 4292 wrote to memory of 5132	4292	chrome.exe	144
PID 4292 wrote to memory of 5624	4292	chrome.exe	147
PID 4292 wrote to memory of 5624	4292	chrome.exe	147

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	loader.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	loader.exe

C:\Users\Admin\AppData\Local\Temp\loader.exe
"C:\Users\Admin\AppData\Local\Temp\loader.exe"
1⤵
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:5008
- C:\Windows\SYSTEM32\netsh.exe
  "netsh" wlan export profile key=clear folder="C:\Users\Admin\AppData\Local\Temp\UnixStealerWifiExport_4c2837979ec14a449f4a758a2a9b921a"
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:2140
- C:\Windows\SYSTEM32\netsh.exe
  "netsh" wlan show profiles
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:4100

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\MountUpdate.jpeg" /ForceBootstrapPaint3D
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3476

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s DsSvc
1⤵
- Drops file in System32 directory
PID:700

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4828

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffb5888c728,0x7ffb5888c734,0x7ffb5888c740
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1616,i,2653887801315997099,9964829255927418844,524288 --field-trial-handle=2052,i,15098304260441096445,1324003386530628309,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2220 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1688,i,13740104119965855337,983348955800989320,262144 --field-trial-handle=2052,i,15098304260441096445,1324003386530628309,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2044 /prefetch:2
  2⤵
  PID:4684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2324,i,2977026066506841786,2317553482063485222,524288 --field-trial-handle=2052,i,15098304260441096445,1324003386530628309,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2500 /prefetch:8
  2⤵
  PID:2468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3268,i,17492405597902660470,3700500163805655215,2097152 --field-trial-handle=2052,i,15098304260441096445,1324003386530628309,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:4844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3232,i,14051611208538963341,6696615545503516088,2097152 --field-trial-handle=2052,i,15098304260441096445,1324003386530628309,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:1828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4372,i,5780028147560855985,549246170362366265,2097152 --field-trial-handle=2052,i,15098304260441096445,1324003386530628309,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4488 /prefetch:2
  2⤵
  PID:4712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4752,i,649254007743607559,15077970266313726030,2097152 --field-trial-handle=2052,i,15098304260441096445,1324003386530628309,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4628 /prefetch:1
  2⤵
  PID:4088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5516,i,9826715168833184286,7594086456062549270,524288 --field-trial-handle=2052,i,15098304260441096445,1324003386530628309,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5524 /prefetch:8
  2⤵
  PID:1644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5900,i,5374125721299729777,16478046485685522153,2097152 --field-trial-handle=2052,i,15098304260441096445,1324003386530628309,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5920 /prefetch:1
  2⤵
  PID:4576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3692,i,5481352474660467945,13808408708105622711,524288 --field-trial-handle=2052,i,15098304260441096445,1324003386530628309,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3652 /prefetch:8
  2⤵
  PID:1248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3688,i,10410082485962034504,938477858818377638,524288 --field-trial-handle=2052,i,15098304260441096445,1324003386530628309,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3668 /prefetch:8
  2⤵
  PID:3864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3704,i,14331583635291107378,226527320345930943,524288 --field-trial-handle=2052,i,15098304260441096445,1324003386530628309,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3264 /prefetch:8
  2⤵
  PID:4624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=3416,i,14607617776978356979,6456164000473754548,524288 --field-trial-handle=2052,i,15098304260441096445,1324003386530628309,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3392 /prefetch:8
  2⤵
  PID:2800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=4620,i,11110982361330623406,14188172024368860887,2097152 --field-trial-handle=2052,i,15098304260441096445,1324003386530628309,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4464 /prefetch:1
  2⤵
  PID:4856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=4492,i,16495942479762527589,15620262587564102822,2097152 --field-trial-handle=2052,i,15098304260441096445,1324003386530628309,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:2120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=3640,i,16755652118432364498,12393676882578064994,2097152 --field-trial-handle=2052,i,15098304260441096445,1324003386530628309,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5844 /prefetch:1
  2⤵
  PID:3712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6264,i,14452162382050436942,17979435634883859949,2097152 --field-trial-handle=2052,i,15098304260441096445,1324003386530628309,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6260 /prefetch:1
  2⤵
  PID:2764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5520,i,7864438308302173724,10451827756544616451,2097152 --field-trial-handle=2052,i,15098304260441096445,1324003386530628309,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6384 /prefetch:1
  2⤵
  PID:4752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=5884,i,14837342290993292999,11589910405281089710,2097152 --field-trial-handle=2052,i,15098304260441096445,1324003386530628309,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6416 /prefetch:1
  2⤵
  PID:4348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6540,i,3612914759546136809,17051497511600245722,2097152 --field-trial-handle=2052,i,15098304260441096445,1324003386530628309,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6544 /prefetch:1
  2⤵
  PID:1416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6580,i,12894610066345820203,3333759779261426946,2097152 --field-trial-handle=2052,i,15098304260441096445,1324003386530628309,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6588 /prefetch:1
  2⤵
  PID:3388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6624,i,10667218502815439036,9786008449160289837,2097152 --field-trial-handle=2052,i,15098304260441096445,1324003386530628309,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6640 /prefetch:1
  2⤵
  PID:1156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6672,i,17379942535901719594,5322666397148361346,2097152 --field-trial-handle=2052,i,15098304260441096445,1324003386530628309,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6684 /prefetch:1
  2⤵
  PID:3364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6704,i,6196895071429920204,8343522882010182606,2097152 --field-trial-handle=2052,i,15098304260441096445,1324003386530628309,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6832 /prefetch:1
  2⤵
  PID:1672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=7416,i,12550051408877831020,10920107653103840484,2097152 --field-trial-handle=2052,i,15098304260441096445,1324003386530628309,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7420 /prefetch:1
  2⤵
  PID:2952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=7560,i,16759656017212483510,2501256362683407347,2097152 --field-trial-handle=2052,i,15098304260441096445,1324003386530628309,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7564 /prefetch:1
  2⤵
  PID:824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=7712,i,5579794949459488485,498664066437538682,2097152 --field-trial-handle=2052,i,15098304260441096445,1324003386530628309,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7724 /prefetch:1
  2⤵
  PID:2580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=7696,i,5165876388271683152,15579675925788883241,2097152 --field-trial-handle=2052,i,15098304260441096445,1324003386530628309,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7764 /prefetch:1
  2⤵
  PID:1044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=8032,i,249214149664546322,9241354315174556103,2097152 --field-trial-handle=2052,i,15098304260441096445,1324003386530628309,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8000 /prefetch:1
  2⤵
  PID:5124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=8056,i,4093498889369803674,15080962775956710393,2097152 --field-trial-handle=2052,i,15098304260441096445,1324003386530628309,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8036 /prefetch:1
  2⤵
  PID:5132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=8216,i,15692146789869069832,8059786444241410726,2097152 --field-trial-handle=2052,i,15098304260441096445,1324003386530628309,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8232 /prefetch:1
  2⤵
  PID:5140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=8264,i,10405065976218263409,10453238477523092581,2097152 --field-trial-handle=2052,i,15098304260441096445,1324003386530628309,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8272 /prefetch:1
  2⤵
  PID:5148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --metrics-shmem-handle=7712,i,8451643040445258510,9874891972005473918,2097152 --field-trial-handle=2052,i,15098304260441096445,1324003386530628309,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8796 /prefetch:1
  2⤵
  PID:5624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --metrics-shmem-handle=8876,i,17152657518076302159,1377903628075633656,2097152 --field-trial-handle=2052,i,15098304260441096445,1324003386530628309,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8896 /prefetch:1
  2⤵
  PID:5632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --metrics-shmem-handle=7204,i,14155262884732072267,15508253827520692997,2097152 --field-trial-handle=2052,i,15098304260441096445,1324003386530628309,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6964 /prefetch:1
  2⤵
  PID:5748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --metrics-shmem-handle=9044,i,12936305958498557683,13620207620554949780,2097152 --field-trial-handle=2052,i,15098304260441096445,1324003386530628309,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=9060 /prefetch:1
  2⤵
  PID:5756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --metrics-shmem-handle=9248,i,3364415131888390243,16940979911468416643,2097152 --field-trial-handle=2052,i,15098304260441096445,1324003386530628309,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=9288 /prefetch:1
  2⤵
  PID:5908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --metrics-shmem-handle=6832,i,14756940432771377022,2711172512019309607,2097152 --field-trial-handle=2052,i,15098304260441096445,1324003386530628309,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6440 /prefetch:1
  2⤵
  PID:5916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --metrics-shmem-handle=6600,i,6485068671577551186,9860216680471388697,2097152 --field-trial-handle=2052,i,15098304260441096445,1324003386530628309,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7184 /prefetch:1
  2⤵
  PID:5924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --metrics-shmem-handle=6840,i,4518686996654028578,17577316249717184933,2097152 --field-trial-handle=2052,i,15098304260441096445,1324003386530628309,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7904 /prefetch:1
  2⤵
  PID:5932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --metrics-shmem-handle=9336,i,15534842368742334083,16015588233923569013,2097152 --field-trial-handle=2052,i,15098304260441096445,1324003386530628309,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=9340 /prefetch:1
  2⤵
  PID:5940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --metrics-shmem-handle=9476,i,8687263021908600785,4628195503018662756,2097152 --field-trial-handle=2052,i,15098304260441096445,1324003386530628309,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=9348 /prefetch:1
  2⤵
  PID:5948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --metrics-shmem-handle=9516,i,7875697579034870809,3274902143181733190,2097152 --field-trial-handle=2052,i,15098304260441096445,1324003386530628309,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=9528 /prefetch:1
  2⤵
  PID:5956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --metrics-shmem-handle=9560,i,997731941803855062,9519707062930827578,2097152 --field-trial-handle=2052,i,15098304260441096445,1324003386530628309,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=9576 /prefetch:1
  2⤵
  PID:5964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --metrics-shmem-handle=9604,i,5202406936486859044,16127539370079793856,2097152 --field-trial-handle=2052,i,15098304260441096445,1324003386530628309,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=9616 /prefetch:1
  2⤵
  PID:5972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --metrics-shmem-handle=10028,i,3753527453522945712,17274952446513890314,2097152 --field-trial-handle=2052,i,15098304260441096445,1324003386530628309,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=10040 /prefetch:1
  2⤵
  PID:5980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --metrics-shmem-handle=10092,i,9864614716838957132,366979837180214268,2097152 --field-trial-handle=2052,i,15098304260441096445,1324003386530628309,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=10104 /prefetch:1
  2⤵
  PID:5988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --metrics-shmem-handle=10312,i,10967152933610408409,13926259376993725507,2097152 --field-trial-handle=2052,i,15098304260441096445,1324003386530628309,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=10324 /prefetch:1
  2⤵
  PID:5996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --metrics-shmem-handle=10456,i,5128449113228724256,8749753421169480600,2097152 --field-trial-handle=2052,i,15098304260441096445,1324003386530628309,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=10504 /prefetch:1
  2⤵
  PID:64
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --metrics-shmem-handle=10528,i,10036631409300447467,11275540240601014552,2097152 --field-trial-handle=2052,i,15098304260441096445,1324003386530628309,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=10488 /prefetch:1
  2⤵
  PID:2784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --metrics-shmem-handle=10472,i,17056040194266248225,12975672794815323931,2097152 --field-trial-handle=2052,i,15098304260441096445,1324003386530628309,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4500 /prefetch:1
  2⤵
  PID:3832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --metrics-shmem-handle=10780,i,17420431838683916355,10512651626692485469,2097152 --field-trial-handle=2052,i,15098304260441096445,1324003386530628309,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=10792 /prefetch:1
  2⤵
  PID:1656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --metrics-shmem-handle=10820,i,4910392187120006790,5548365525742224244,2097152 --field-trial-handle=2052,i,15098304260441096445,1324003386530628309,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=10836 /prefetch:1
  2⤵
  PID:3976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --metrics-shmem-handle=10864,i,12805069981810375287,326666907715045865,2097152 --field-trial-handle=2052,i,15098304260441096445,1324003386530628309,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=10880 /prefetch:1
  2⤵
  PID:1676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --metrics-shmem-handle=10908,i,1802914443481988521,907431105533139028,2097152 --field-trial-handle=2052,i,15098304260441096445,1324003386530628309,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=10924 /prefetch:1
  2⤵
  PID:2304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --metrics-shmem-handle=10952,i,269578721566556490,10765648884415272672,2097152 --field-trial-handle=2052,i,15098304260441096445,1324003386530628309,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=10968 /prefetch:1
  2⤵
  PID:5296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --metrics-shmem-handle=10996,i,617099735520752300,7430533634718642935,2097152 --field-trial-handle=2052,i,15098304260441096445,1324003386530628309,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=11012 /prefetch:1
  2⤵
  PID:5284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --metrics-shmem-handle=11852,i,7012618493107244261,4498227022197381065,2097152 --field-trial-handle=2052,i,15098304260441096445,1324003386530628309,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=11856 /prefetch:1
  2⤵
  PID:5304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --metrics-shmem-handle=11992,i,13862295220525123501,3364230285952007340,2097152 --field-trial-handle=2052,i,15098304260441096445,1324003386530628309,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=11996 /prefetch:1
  2⤵
  PID:5408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --metrics-shmem-handle=12132,i,2242202565772142482,3627064050952921418,2097152 --field-trial-handle=2052,i,15098304260441096445,1324003386530628309,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=12136 /prefetch:1
  2⤵
  PID:864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --metrics-shmem-handle=12272,i,2734964920701792924,5853071973299288648,2097152 --field-trial-handle=2052,i,15098304260441096445,1324003386530628309,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=12276 /prefetch:1
  2⤵
  PID:1464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --metrics-shmem-handle=12416,i,6740607867165896892,4402654401544449026,2097152 --field-trial-handle=2052,i,15098304260441096445,1324003386530628309,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=12420 /prefetch:1
  2⤵
  PID:4604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --metrics-shmem-handle=12556,i,9020013718001555076,1628380796900548149,2097152 --field-trial-handle=2052,i,15098304260441096445,1324003386530628309,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=12560 /prefetch:1
  2⤵
  PID:4404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --metrics-shmem-handle=13948,i,13009229215443844290,17387551097386135687,2097152 --field-trial-handle=2052,i,15098304260441096445,1324003386530628309,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=13964 /prefetch:1
  2⤵
  PID:7148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --metrics-shmem-handle=14104,i,3478943875833071427,11869217187965827722,2097152 --field-trial-handle=2052,i,15098304260441096445,1324003386530628309,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=14112 /prefetch:1
  2⤵
  PID:7152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --metrics-shmem-handle=14132,i,10479284113156633514,10827688545699067972,2097152 --field-trial-handle=2052,i,15098304260441096445,1324003386530628309,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=14268 /prefetch:1
  2⤵
  PID:5276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --metrics-shmem-handle=14412,i,10304622275712150888,11523504532335023526,2097152 --field-trial-handle=2052,i,15098304260441096445,1324003386530628309,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=14420 /prefetch:1
  2⤵
  PID:7172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --metrics-shmem-handle=14452,i,16808902161331283024,12585232666423795172,2097152 --field-trial-handle=2052,i,15098304260441096445,1324003386530628309,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=14464 /prefetch:1
  2⤵
  PID:7180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --metrics-shmem-handle=14600,i,15507792502067047587,17332287213840070165,2097152 --field-trial-handle=2052,i,15098304260441096445,1324003386530628309,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=14724 /prefetch:1
  2⤵
  PID:7188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --metrics-shmem-handle=14872,i,9245555371654026371,6031566202604591641,2097152 --field-trial-handle=2052,i,15098304260441096445,1324003386530628309,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=14880 /prefetch:1
  2⤵
  PID:7196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --metrics-shmem-handle=15008,i,5264352577173756300,12833955704534804025,2097152 --field-trial-handle=2052,i,15098304260441096445,1324003386530628309,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=15012 /prefetch:1
  2⤵
  PID:7204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --metrics-shmem-handle=15048,i,12906410167239219457,13050305470923667681,2097152 --field-trial-handle=2052,i,15098304260441096445,1324003386530628309,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=15052 /prefetch:1
  2⤵
  PID:7212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --metrics-shmem-handle=14140,i,9630090528158471992,3143165039782211769,2097152 --field-trial-handle=2052,i,15098304260441096445,1324003386530628309,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=15548 /prefetch:1
  2⤵
  PID:7636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --metrics-shmem-handle=15576,i,10241113306692830554,9096899193741003350,2097152 --field-trial-handle=2052,i,15098304260441096445,1324003386530628309,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=15216 /prefetch:1
  2⤵
  PID:7644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --metrics-shmem-handle=15824,i,13971348566585835676,17379859129991170059,2097152 --field-trial-handle=2052,i,15098304260441096445,1324003386530628309,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=15836 /prefetch:1
  2⤵
  PID:7652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --metrics-shmem-handle=16540,i,7887274825969793128,13875002475039755272,2097152 --field-trial-handle=2052,i,15098304260441096445,1324003386530628309,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=16552 /prefetch:1
  2⤵
  PID:7836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --metrics-shmem-handle=16584,i,7276584358923001520,18133908129159300538,2097152 --field-trial-handle=2052,i,15098304260441096445,1324003386530628309,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=16596 /prefetch:1
  2⤵
  PID:7844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --metrics-shmem-handle=16684,i,3062639940707159993,3674820008703376527,2097152 --field-trial-handle=2052,i,15098304260441096445,1324003386530628309,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=16696 /prefetch:1
  2⤵
  PID:7852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --metrics-shmem-handle=16772,i,12075054262722915624,8646356634690475544,2097152 --field-trial-handle=2052,i,15098304260441096445,1324003386530628309,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=16780 /prefetch:1
  2⤵
  PID:7860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --metrics-shmem-handle=16816,i,6808544912235616677,6265054502675261283,2097152 --field-trial-handle=2052,i,15098304260441096445,1324003386530628309,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=16828 /prefetch:1
  2⤵
  PID:7868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --metrics-shmem-handle=16864,i,6469816835405812886,12475551452816314106,2097152 --field-trial-handle=2052,i,15098304260441096445,1324003386530628309,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=16868 /prefetch:1
  2⤵
  PID:7876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --metrics-shmem-handle=16728,i,12457229496986090430,5239896820071359329,2097152 --field-trial-handle=2052,i,15098304260441096445,1324003386530628309,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=16744 /prefetch:1
  2⤵
  PID:7884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=84 --metrics-shmem-handle=15444,i,10846227310223603732,12005294365639094708,2097152 --field-trial-handle=2052,i,15098304260441096445,1324003386530628309,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=15328 /prefetch:1
  2⤵
  PID:2004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=85 --metrics-shmem-handle=16448,i,16037093445990440687,8822148282823859915,2097152 --field-trial-handle=2052,i,15098304260441096445,1324003386530628309,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=16472 /prefetch:1
  2⤵
  PID:4276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=86 --metrics-shmem-handle=11040,i,7676524334843816730,6530278271929026718,2097152 --field-trial-handle=2052,i,15098304260441096445,1324003386530628309,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=10524 /prefetch:1
  2⤵
  PID:8344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=87 --metrics-shmem-handle=13880,i,2622037152992735880,13433630982470026454,2097152 --field-trial-handle=2052,i,15098304260441096445,1324003386530628309,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=9644 /prefetch:1
  2⤵
  PID:8352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=88 --metrics-shmem-handle=14400,i,14680732131422977990,4804456657698559641,2097152 --field-trial-handle=2052,i,15098304260441096445,1324003386530628309,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=15584 /prefetch:1
  2⤵
  PID:8600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=89 --metrics-shmem-handle=14148,i,8969906130753579101,14406926930489612333,2097152 --field-trial-handle=2052,i,15098304260441096445,1324003386530628309,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=15984 /prefetch:1
  2⤵
  PID:8608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=90 --metrics-shmem-handle=16124,i,17180375001893559659,16439816882903560018,2097152 --field-trial-handle=2052,i,15098304260441096445,1324003386530628309,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=10472 /prefetch:1
  2⤵
  PID:8668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=91 --metrics-shmem-handle=10660,i,10753178200606824223,9342132262333364535,2097152 --field-trial-handle=2052,i,15098304260441096445,1324003386530628309,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=10656 /prefetch:1
  2⤵
  PID:9008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=92 --metrics-shmem-handle=12832,i,13529634844111666562,9534818991472878443,2097152 --field-trial-handle=2052,i,15098304260441096445,1324003386530628309,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=20372 /prefetch:1
  2⤵
  PID:9116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=93 --metrics-shmem-handle=20904,i,8516598825974379761,6772370512790976952,2097152 --field-trial-handle=2052,i,15098304260441096445,1324003386530628309,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=14716 /prefetch:1
  2⤵
  PID:9180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=94 --metrics-shmem-handle=20884,i,5517690638693420320,1195790643169331272,2097152 --field-trial-handle=2052,i,15098304260441096445,1324003386530628309,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=16864 /prefetch:1
  2⤵
  PID:9020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=15944,i,7095424919826172028,15386632375063285017,262144 --field-trial-handle=2052,i,15098304260441096445,1324003386530628309,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=15848 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2356

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3128

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1224

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:6396

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Wi-Fi Discovery

T1016.002

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5a40bb87-f195-4e78-9625-211585ea278a.dmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\reports\5a40bb87-f195-4e78-9625-211585ea278a.dmp
Size 423KB
SHA256 e1bfa6b7397dd011d3ceff28876350257673d1ce7eeef88830d933f397cb305b
MD5 e2f79ed519c5102ad6ec2ef25eb40398
SHA1 03c9e001e23685e22dca8805081d31b413c34b98
SHA512 006d1bf88bec4354086c4d097ca74703aee3785f8a6501e3650e5e4a768e743d8a83af170944231df2bf1a5fed495066995282a809db3b65d0483435ae7c5c1a
SSDEEP 1536:6UbzPHDf8BSaAcjWiEX0WjUhcC1UzzsUtSrszOf4MbUuFJJK/sogG/2Oy4k8+jAm:BPHDwKiG6hcC1Uz9SiNHgGuOLD7LcRl5
TLSH
T15294DA17A7C04C5AF2A89A7548D3F751F7EAE4981B63B30623914A2B1D7F7D83F21A40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f3531ec4-baa3-4cfb-980c-217a7051a391.dmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\reports\f3531ec4-baa3-4cfb-980c-217a7051a391.dmp
Size 369KB
SHA256 4b868c514586a67020e240e1b7bfff9de87a28fffafed22b9ac556a1beb6f483
MD5 131fb42df9ea9e703ff4edc1d80d1bd6
SHA1 d86e7ef4802fe6253d8f63a11c5ceb97a280f2e3
SHA512 de0601500630d631aec3b2b0c0fe954a66cb437a27cc6d9b496d873d6320598fa3d63093d26196a6fedfbb90037d18688dadbbfbcbfa5a442cfdf4cb65c704b0
SSDEEP 1536:qz96/o0iDtEUyS28sDT06Xb+5yNj2KzLdsMavGLuTEtQg7c60DCHeP9/:n/k7ySeD1CU9WEahg7c6uGa/
TLSH
T163846397E7D11867F02B827559D36B53F7F6E8680B97030A8281422D1C6F3E95F21E8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 89d8c54ff863243ca824204cb875a0a034ae4d9d764a70ef9aca26c1b5f92ef3
MD5 5b4acce08e3ebc69435d0d2ad5f11cad
SHA1 ae0e337a3d11ed2b35ca88e6dacff0062193a2aa
SHA512 8fa049bd2049eff81e1096dc0e3767f9df05b30fba243d26e9fc36375f6d8caf6d4facab852c31f822379aa3f50156f1f2c82f32d32d6234f08e85f61b3a252a
TLSH
T1A7E02BA5CC61EC3718FD0B5DA0102741DB64135B2A50894F7A3C910C8FB563A4685D1C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000007

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007
Size 331KB
SHA256 db4ffbf0ec662620013dc14bc1268bdad6256d19d7d511ec7eff8446887e6900
MD5 05ef8155cf66131654d3bb9c9cba5853
SHA1 e79d53fcb604921222dd1dbc2f1c10c631ff6075
SHA512 ee38793245d91683ddb1f847e5b56a09864fd32ec059055459b3ebe101abed79683ee59c80f30b8f6249d2bbd83fbf7bca83dafb4ef2b634ceff6969c80fed23
SSDEEP 6144:FljUD58FLTW53eaLkNv+Ps0dj1fpqaGjYf0NIcB3bM1rJZ24:FDm5uaLcv+PFj7ajJNImbM1rD
TLSH
T1247423A9B50E3C8AC94F9473827EAFD2A4356FF38D47BAA3634241F401874342E4676D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 92a930905c8de3da17b3d5ae7ed83c6f662a94a5af269b79f471492f2be395f8
MD5 de87dea5d7ea96415eef4f963ac33a1a
SHA1 ca5f09c0da3947e3bf548b4cbea8235155b00d05
SHA512 3c00c8925df8f5522e3f3e5a1b3a70474846d33cfbf251e8e8eee13bd98312f03e7ea2596b3c12d9c01142629dbbeda5ea56c3884ebbbe213ff9c4d579aa7695
TLSH
T14441C06768DA519ECFB8FCF426CB0A1270FA53D374838DF95302EEB45116351E06A914
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 f1e730dc5ef4cab79771e61cfa169367779a6ec6f01ffa82965fae280e7bddfe
MD5 aeb5c2091dd401161867e70b0a133463
SHA1 a92645308feda697e8f6e7bb67acf0b4bbaca820
SHA512 8ec6d08e58b2909954b50454bd031dcf0d5442ffc43d61df0c0c8eac13f4ad8c18bcc67a363857e21964468fa99f8c980b809cde6b2e5d25309eb848e239f146
TLSH
T196C022A88022A00AC3AC8AB802A200C020A03BB0080200A203E08E8AC8222A8C822008
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 049e413f30512efdbfd45ba56204cb4ec550a9ee82d6e01ba0c2e6f23418f8d9
MD5 c03e685d9dab75d2ec2f9dc13c9a3149
SHA1 6f0e9d7e3ab2d88a5a239a4776c0c13c3f36972f
SHA512 3e12a1c271d051c57e1519a4c93acf5c08fa9e3784d49a77541dd3bdad2c644429b5230e1419c9cf5d297a6c44f0f84170da4bc279cad522d0b1334f900198f6
TLSH
T1AA716FF7C3D8C56E855156F49B156F1FCE2A0A28431C3C67C8D4AE5B53E28B2E25134E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 5e7f73c240b9970e0ec59e6e86cb760cd88403900e721e1cc700510242f9c933
MD5 a645e8093492e4b857f9efd761566244
SHA1 33b09f931ff6c9cc2fab1eb50ba2772d8c963fa5
SHA512 db644f8f27b69c81e386aceca5482c7eb85de274f259f3b6024ce8ccbddaa2b753835f61e03094f3a7d1a8cf127f3403b18eb464e89fd85ebd83faf9b51471c9
TLSH
T100716FF7C3D8C56E855156F49B156F1FCE2A0A28431C3C67C8D4AE5B53E28B2E25134E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 52KB
SHA256 34f547376a2b445e4fe54fcc3d13c0ebaa6821777817b564de3c6eca3dd0e856
MD5 75a491726c6c5574491e35aa17138452
SHA1 676874ffb16f209d833fe91c5d5839fc1d64c6ca
SHA512 5423d78d36a48d10ce9e716848e13a617b94542c67a0aa4cd33ea09a96abaac8007334df9b6e79ab9efd81837404fa0cf2ac9548e38f9ca12900c338f2a53311
SSDEEP 384:DJQ4pWiUCzUJP5boUBeHQYuBeJvES6n2ekONot/bgkg1UuG3kbfDbfl39aIX/yL1:mLZcXL0pcwIuashhgjWMRxT
TLSH
T1AF338AB7C3E4956ECA1169F09B246E1FCD6C186A031C7D65CDD8EE9763E2432E20271E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 9KB
SHA256 de7c0d016e9da2feda6ed3da5cdd341f6b271a6214509865c00991d329e23af4
MD5 c6b6dd6785216826b7e77192da27919c
SHA1 e7ed4783a932753ea8fea61464c3f355aa4a6105
SHA512 80cbf9fc88719031ce0ca543f18537fca68ba7691f6ac6c5f2a8c4e206bc80f549d6b8884ec8c6ad1939952aefc77780c94686feab5cdc90b3e84e1af0d3d54e
SSDEEP 192:SUKeUxlUp/URUfAUjUVUNUyUDsUHU/lUTUvU1UAU1UyUsU9U1URUPcU6bU+UwIU2:S9eSlw0aAKqqzqsCsly245s7TCgKpNje
TLSH
T1B1129E57C6BEA86B103C59AB1D94BC19197DF8310285ACF9DF6B916CB1E68F30B16033
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 6ac4ee9b2445a067f9475c867ad1e105d814bb0b963b58390cd2180f08a6fd7f
MD5 1a92a98b0da8b3a505dc3c542087f9b0
SHA1 7c27e0794a6279a0a9222b2492e91689fd814092
SHA512 e313e0f88b4e3b30a9b6c10351ee473b2970ff431d5ca526f36933d4a6ebadecc75c33b7e99b0852f574eea4af221cbe6974aef59068eeb2d8098fbb1472cf33
SSDEEP 192:XRrcBzTrrZgoJYqv70hoPRpxdAdAM9+Hsb+WNuFdXfl4IWerD82N7qtSkwOZUPyr:XRrmzT3ZmmgwXe8w02R2AS5e
TLSH
T10C62D52EAE10297B9DDAC22DF9517B16D7F2102625911E84FBFC8E2C19EB6CC3217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 0fd1f35d497dc38be69e347ba901f4f35faa61d593067bbd55c9e35d41001e73
MD5 a849a5a10b9e4065496cf1d6270e9aaf
SHA1 c809055c972c71ed03aef3b5abf12eddba949cf4
SHA512 1a6d77a8efa6e48b6a231c2243ae80abd1a430dcfeb786c20f424d69c2ae5dce6e4ff8b8763e0c57590ba9c0475747c9b5423bfabae65cf9eb09948c17fd7168
SSDEEP 192:XRrcBzTrrZgoJYGv70hoPRpxdAd+9+Hsb+WNnfl4IWgUtSkwOZ5VyIsnAUgraJ:XRrmzT3ZmygwXb8wt2gcS4e
TLSH
T17052D62EAE10693B9CCAD22DFD517B17D7F6102625951E84EBFC8A2C19E75CC322701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 4603bf72d783c77d6acef07c22848778226defface7e528a33820e6ffe072efe
MD5 c55993aea5076028e16bd02d89b9cad9
SHA1 96b64f16e4427e6d8b921c63c0556e86b37db6bc
SHA512 9004a092fafd4a49015a606ab9b9940d0b21b8e93455e425f9dad575fffe41d439c2099c27023197b48ebfe39e0b5e0c3d96d98d079fcbdb49c43b35429f7218
SSDEEP 192:XRXTrrZgoJYGv70hAPRp2dAzbS9+Hsb+WNnfl4DJ21tSkwOZwVyIsnAUgtaJ:XRXT3Zmyg8X28wtK2vSd8
TLSH
T16D52C52EAE10693B9DCBD22DFD517717DBF6102625951E84EAFC8A2C18E75CC322701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 9a63a02af86b793bc7723ea8579017000fbde21723150ca89cdaa0102d54150d
MD5 3db4d2ed90c53237037f403d9b6c10cf
SHA1 91febd0c861f52fac9b9c081f7e738838423da4a
SHA512 20a5acab3273b075187518ff1d84bdfb24fb19e0881b09c9805647d3b805dc5e2037a9ee22124705cac465e1ac8b91972117ed00cd2d49a563818ec658fd5de0
SSDEEP 384:W4jyR7KxkXqKf/pUZNCgVLH2Hfgsl/97pLuLcSjIpXODyJ+ErU3MrHGRxVJZU:WMyR7KxkXqKf/pUZNCgVLH2HfgsR97p9
TLSH
T183720A676C488E7B0F98CACCD8267B4FADF5024B65E9886453FA582903D5BCF11091FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 a170c2e5ff4cac615f41aa41a1275f97976c0de896a574dcd6c81cb52f8b56cc
MD5 67302dbd21b300353591ec5c799b77d0
SHA1 fe702019be34e0048b4462d86fab63169be54bbc
SHA512 31769c05a184d989b00a31fb8cac177028d6864278d762d7bfc5370b60d362e639c17c15a2150d5845ea804375538a56716f31b44742699bb0cb9747948cacd0
TLSH
T13AB0120080015151C44302B03546289C71747F50960A370383E079A2DC25271C055050
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58dcaf.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58dcaf.TMP
Size 96B
SHA256 51ade46c9aa13740f038dbf2dd5ce89273e369e64d5df3a21efb892733b06636
MD5 30fc8576e6a63552dfc16e5d12c9f1fd
SHA1 d492955b0c5cf59a23a49b8817f8cb0a0f9d94b9
SHA512 e9750dcccb4754262e93a06f97a3ad161540d6be0108a5c17cd76eb9af8e88acadffd7e63031482c4f804ea1938c67f91ef3ca20b271ae5d913b23caee62f9d6
TLSH
T174B02200C0022202C08203B022E0C0CC3320FF20C203020282E02A32CC222308A3223C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 418b60688e17341ac045906c1b8bd7daffec592a1f2627e8f86e6e383ade7db7
MD5 cebcf43e29159954d917d058f30786f2
SHA1 f5a030f3273f0515d8aae5be6e49fdd37a61343f
SHA512 099c2d15c348d8421c00c015214ac8b2b1e4bc909b0757a882b3591356afa3541e6ffda570ec3d212b2b8fa7eef1d6a85045256810ccb1b4f99b97f653f321e2
TLSH
T102B0222032C20C0BFA088BBC0CC2CB8030333C2083CB08A2B2A800B8CCA3280CB03800
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 120B
SHA256 396bc0a4a7c0866a006fe0c13b9b6b5c154567d2af99c6d71b8567540c883c8c
MD5 2a0bb3911da9e08d0efe9be273d03850
SHA1 7fb502efca2f74094fe21c3033a6666466d30e68
SHA512 e873c726136bdb1b6b6f3717e829d927c9d2c855297df80735fdb4131cf8b13ea66ab0c98896e9e120e29ed1b2f107f9a950961c38a9ea050ede43d2346dcfd9
TLSH
T13AB0121045835D15EC08477849F3814016210D0183CE230692D44018C4170C09841114
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 25aa281dedf4b496cad1b49c619fedb3f2d1d8a7741f91ca419ba35b0b02c1df
MD5 c60071098bb68d5d6553058243d54817
SHA1 00e7dff1aa311bab15ba6cbb4c35dd52c44408ef
SHA512 3b4543b00daf20df0bd708ae40d2a15ff28e7d563fa377fbc2524c2188e0047fc9848a40730fba50658554a5c74b4d1b265c4d89ca1db8559b97f66fc84e5d9a
SSDEEP 3072:86XQSg/TxNP9n3RM2usEnhdFaeqag2Y5ZUVncNBzIDqfd7NtZL8cHQRZEQ6Spsg:8thxNPRW2PYddqmY7U52F0qZ/ZLW3Exg
TLSH
T166341332BFD21F354C87DE6836432D1A6FF689DD90B4A785E9687F4B2C47810A85389C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 6106f3ead6e400a5ea6970af4d57b1badedbbc417ccca53457998dd19f4d3bfd
MD5 bf46cabed1487d557fd454d7638dfb9e
SHA1 eea8eaa54508f75bc764c1622b8c578bae62dc93
SHA512 6cfcc6da7c6a3d8a004704798987b5cde78c92dd67bd205bad16f5caee83359eaac07a848d7f2b26bc5675c9f67919fdec29b904e9a8e3f31fa21c4e6e00d517
SSDEEP 1536:bMdLyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICb0:cqfd7NtZL8cHQRZEQ6Sps3
TLSH
T183C30237EBC21F339D92CB64B9530FD6A7B644A99030D301AAAD37EB7C93591644249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 c62ff823c576c45e8bb440ac5dfb82b8cdb26853db1331c04d6dae267965e4b0
MD5 17eb14cc969da6454357049e5458b078
SHA1 af59dd03c177a4f12e4d585585551d4fcadb9486
SHA512 14bec271daf784bc983c10f25a5fa8ad6f6a4bd89087dd28f302c2a07242ce07c4560d3c3fcb296d95101ce7d69b58e863b0747f252a782b10bf9f30ff9d50fe
SSDEEP 3072:vLXQSg/TxNP9n3RM2usEnhdFaeqag2Y5ZUVncNBzIDqfd7NtZL8cHQRZEQ6Spsg:0hxNPRW2PYddqmY7U52F0qZ/ZLW3Exg
TLSH
T1DF341322BFD61F354C86DE6832432D2A6FF68DD860B4A781EA697F4F2C43C51645389C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 157601e71f24ca37e382e2f7e8636201604f1b81ab8e7d01426599eb162cc9a1
MD5 c1a5fd82c754647289a1b5412e9a3305
SHA1 52de43c971e8387544c1954de105b0defb69444b
SHA512 79c04878a63b8a66e9fddde5d297d5a6510bb7ceb8c05f7f083279362add2325a78da6343055a44255af57907afa0a2462306896dd8502479731073f61d6925d
SSDEEP 3072:CnXQSg/TxNP9n3RM2usEnhdFaeqag2Y5ZUVncNBzIDqfd7NtZL8cHQRZEQ6Spsg:CghxNPRW2PYddqmY7U52F0qZ/ZLW3Exg
TLSH
T153341332BFD21F354C87DE6832432D1A6FF689DD90B4A785E9687F4B2C47850A85389C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 8abf4f8ea053b0de7da82756b2b21a7464dcbdd9a1df566628c49aaf65538a8f
MD5 85f68e1a01697692047c9fdc37eea6ff
SHA1 5f7bd01c9a94bf7feefd9bf5c16f1425dc0fe69e
SHA512 9f0ccc7f7253c7487f4738db72f0729b0b64944ec91ac7a30d2e392498b7c8caab8f6c05afc55372f41fb993b9cb75ddf7df8551e6da7126d7709b0712d652f2
SSDEEP 3072:yLXQSg/TxNP9n3RM2usEnhdFaeqag2Y5ZUVncNBzIDqfd7NtZL8cHQRZEQ6Spsg:/hxNPRW2PYddqmY7U52F0qZ/ZLW3Exg
TLSH
T10C341222BFD61F354C86DE6832432D2A6FF68DD860B4A781EA697F4F2C43851645389C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Size 264KB
SHA256 f3429b577fc53c68670095c0a15f72fbe09b3bc52d9e64a4efcfbb9a13dcad72
MD5 3d90e6fcf21e2c451fcaf12efc2359a3
SHA1 421112fb1320f816bcfc2a4174a31dbdc1cf7993
SHA512 b76fef569c755b90db20959a0cdc376b4bfa34d79a34145b3d323c2cf64fabf4205d024218f2defaf60e241fe00379de927fd6d0c32fe9f3d2b7afa8a17166bc
SSDEEP 3:MsEllllkEthXllkl2zExllvK//l:/M/xT02zyK//l
TLSH
T18A440444FFC00405C5005030C013C3550770D5700715574334510C177CC55414D00100
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/700-26-0x000001D0A62B0000-0x000001D0A62B1000-memory.dmp

Download

memory/700-30-0x000001D0A6330000-0x000001D0A6331000-memory.dmp

Download

memory/700-28-0x000001D0A6330000-0x000001D0A6331000-memory.dmp

Download

memory/700-31-0x000001D0A63C0000-0x000001D0A63C1000-memory.dmp

Download

memory/700-32-0x000001D0A63C0000-0x000001D0A63C1000-memory.dmp

Download

memory/700-34-0x000001D0A63D0000-0x000001D0A63D1000-memory.dmp

Download

memory/700-15-0x000001D094FC0000-0x000001D094FD0000-memory.dmp

Download

memory/700-19-0x000001D095770000-0x000001D095780000-memory.dmp

Download

memory/700-33-0x000001D0A63D0000-0x000001D0A63D1000-memory.dmp

Download

memory/5008-0-0x00000163C13F0000-0x00000163C1434000-memory.dmp

Download

memory/5008-13-0x00000163DBB70000-0x00000163DBB82000-memory.dmp

Download

memory/5008-12-0x00000163DBBF0000-0x00000163DBC40000-memory.dmp

Download

memory/5008-1-0x00000163DB870000-0x00000163DB880000-memory.dmp

Download