fb98c3a152cc3e1c73c94c6b03c0611ed5c111c6d629fc8f608c192175aebf8e

Resubmissions

22/08/2026, 04:37

260822-e87qnavydt10

22/08/2026, 04:29

260822-e399laeq5v5

Analysis

user interaction
yes
max time kernel
372s
max time network
373s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-es
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-eslocale:es-esos:windows11-ltsc_2024-x64systemwindows
submitted
22/08/2026, 04:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.html
Size 326KB
Sample260822-e399laeq5v
SHA256 fb98c3a152cc3e1c73c94c6b03c0611ed5c111c6d629fc8f608c192175aebf8e
MD5 7a3449ceda5ba6a552e450525d626cd0
SHA1 e3c83263eaaf6685febeca108745bfd090614d54
SHA512 b425d5b75f3fba79a93c010856e8a8a1cb699f29070b127fbdb786e703476f383abba574380dcf78aa7762134494a76bcb0ee89f1b8392efba7f49ad4c2ae68c
SSDEEP 3072:XYigAkHnjzxQ6KSAiToH788aW+LN7uxRLlzglKrf250l:xgAkHnjzxQBSAVb88CN78Brf250l
TLSH
T1EE643C25E5D2607F682B8033F27F3318B73FA483A101C929BA1CC5D5AFD19866177B99
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery persistence ransomware

Malware Config

Signatures

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\LogFiles\WMI\FaceTelManually.etl	svchost.exe
File opened for modification	C:\WINDOWS\SYSTEM32\WINBIODATABASE\51F39552-1075-4199-B513-0C10EA185DB0.DAT	svchost.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4968	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134318466188260438"	chrome.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
4700	chrome.exe
4700	chrome.exe

Suspicious behavior: LoadsDriver 10 IoCs

pid
4
4
4
4
4
4
4
4
4
4

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 37 IoCs

pid	Process
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2864	chrome.exe
Token: SeCreatePagefilePrivilege	2864	chrome.exe
Token: SeShutdownPrivilege	2864	chrome.exe
Token: SeCreatePagefilePrivilege	2864	chrome.exe
Token: SeShutdownPrivilege	2864	chrome.exe
Token: SeCreatePagefilePrivilege	2864	chrome.exe
Token: SeShutdownPrivilege	2864	chrome.exe
Token: SeCreatePagefilePrivilege	2864	chrome.exe
Token: SeShutdownPrivilege	2864	chrome.exe
Token: SeCreatePagefilePrivilege	2864	chrome.exe
Token: SeShutdownPrivilege	2864	chrome.exe
Token: SeCreatePagefilePrivilege	2864	chrome.exe
Token: SeShutdownPrivilege	2864	chrome.exe
Token: SeCreatePagefilePrivilege	2864	chrome.exe
Token: SeShutdownPrivilege	2864	chrome.exe
Token: SeCreatePagefilePrivilege	2864	chrome.exe
Token: SeShutdownPrivilege	2864	chrome.exe
Token: SeCreatePagefilePrivilege	2864	chrome.exe
Token: SeShutdownPrivilege	2864	chrome.exe
Token: SeCreatePagefilePrivilege	2864	chrome.exe
Token: SeShutdownPrivilege	2864	chrome.exe
Token: SeCreatePagefilePrivilege	2864	chrome.exe
Token: SeShutdownPrivilege	2864	chrome.exe
Token: SeCreatePagefilePrivilege	2864	chrome.exe
Token: SeShutdownPrivilege	2864	chrome.exe
Token: SeCreatePagefilePrivilege	2864	chrome.exe
Token: SeShutdownPrivilege	2864	chrome.exe
Token: SeCreatePagefilePrivilege	2864	chrome.exe
Token: SeShutdownPrivilege	2864	chrome.exe
Token: SeCreatePagefilePrivilege	2864	chrome.exe
Token: SeShutdownPrivilege	2864	chrome.exe
Token: SeCreatePagefilePrivilege	2864	chrome.exe
Token: SeShutdownPrivilege	2864	chrome.exe
Token: SeCreatePagefilePrivilege	2864	chrome.exe
Token: SeShutdownPrivilege	2864	chrome.exe
Token: SeCreatePagefilePrivilege	2864	chrome.exe
Token: SeShutdownPrivilege	2864	chrome.exe
Token: SeCreatePagefilePrivilege	2864	chrome.exe
Token: SeShutdownPrivilege	2864	chrome.exe
Token: SeCreatePagefilePrivilege	2864	chrome.exe
Token: SeShutdownPrivilege	2864	chrome.exe
Token: SeCreatePagefilePrivilege	2864	chrome.exe
Token: SeShutdownPrivilege	2864	chrome.exe
Token: SeCreatePagefilePrivilege	2864	chrome.exe
Token: SeShutdownPrivilege	2864	chrome.exe
Token: SeCreatePagefilePrivilege	2864	chrome.exe
Token: SeShutdownPrivilege	2864	chrome.exe
Token: SeCreatePagefilePrivilege	2864	chrome.exe
Token: SeShutdownPrivilege	2864	chrome.exe
Token: SeCreatePagefilePrivilege	2864	chrome.exe
Token: SeShutdownPrivilege	2864	chrome.exe
Token: SeCreatePagefilePrivilege	2864	chrome.exe
Token: SeShutdownPrivilege	2864	chrome.exe
Token: SeCreatePagefilePrivilege	2864	chrome.exe
Token: SeShutdownPrivilege	2864	chrome.exe
Token: SeCreatePagefilePrivilege	2864	chrome.exe
Token: SeShutdownPrivilege	2864	chrome.exe
Token: SeCreatePagefilePrivilege	2864	chrome.exe
Token: SeShutdownPrivilege	2864	chrome.exe
Token: SeCreatePagefilePrivilege	2864	chrome.exe
Token: SeShutdownPrivilege	2864	chrome.exe
Token: SeCreatePagefilePrivilege	2864	chrome.exe
Token: SeShutdownPrivilege	2864	chrome.exe
Token: SeCreatePagefilePrivilege	2864	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe

Suspicious use of SendNotifyMessage 22 IoCs

pid	Process
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2928	SecHealthUI.exe
7072	SecHealthUI.exe
5756	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2864 wrote to memory of 2520	2864	chrome.exe	88
PID 2864 wrote to memory of 4968	2864	chrome.exe	91
PID 2864 wrote to memory of 2464	2864	chrome.exe	92
PID 2864 wrote to memory of 2464	2864	chrome.exe	92
PID 2864 wrote to memory of 4164	2864	chrome.exe	90
PID 2864 wrote to memory of 4164	2864	chrome.exe	90
PID 2864 wrote to memory of 4748	2864	chrome.exe	94
PID 2864 wrote to memory of 4748	2864	chrome.exe	94
PID 2864 wrote to memory of 4216	2864	chrome.exe	95
PID 2864 wrote to memory of 4216	2864	chrome.exe	95
PID 2864 wrote to memory of 3784	2864	chrome.exe	96
PID 2864 wrote to memory of 3784	2864	chrome.exe	96
PID 2864 wrote to memory of 6040	2864	chrome.exe	97
PID 2864 wrote to memory of 6040	2864	chrome.exe	97
PID 2864 wrote to memory of 4680	2864	chrome.exe	98
PID 2864 wrote to memory of 4680	2864	chrome.exe	98
PID 2864 wrote to memory of 3260	2864	chrome.exe	99
PID 2864 wrote to memory of 3260	2864	chrome.exe	99
PID 2864 wrote to memory of 3848	2864	chrome.exe	101
PID 2864 wrote to memory of 4080	2864	chrome.exe	102
PID 2864 wrote to memory of 4236	2864	chrome.exe	103
PID 2864 wrote to memory of 2600	2864	chrome.exe	104
PID 2864 wrote to memory of 2600	2864	chrome.exe	104
PID 2864 wrote to memory of 5804	2864	chrome.exe	105
PID 2864 wrote to memory of 5804	2864	chrome.exe	105
PID 2864 wrote to memory of 432	2864	chrome.exe	106
PID 2864 wrote to memory of 432	2864	chrome.exe	106
PID 2864 wrote to memory of 2532	2864	chrome.exe	107
PID 2864 wrote to memory of 4512	2864	chrome.exe	109
PID 2864 wrote to memory of 4512	2864	chrome.exe	109
PID 2864 wrote to memory of 5828	2864	chrome.exe	110
PID 2864 wrote to memory of 5828	2864	chrome.exe	110
PID 2864 wrote to memory of 1728	2864	chrome.exe	113
PID 2864 wrote to memory of 1728	2864	chrome.exe	113
PID 2864 wrote to memory of 1720	2864	chrome.exe	114
PID 2864 wrote to memory of 1720	2864	chrome.exe	114
PID 2864 wrote to memory of 5884	2864	chrome.exe	115
PID 2864 wrote to memory of 2876	2864	chrome.exe	116
PID 2864 wrote to memory of 5884	2864	chrome.exe	115
PID 2864 wrote to memory of 2876	2864	chrome.exe	116
PID 2864 wrote to memory of 4244	2864	chrome.exe	117
PID 2864 wrote to memory of 4244	2864	chrome.exe	117
PID 2864 wrote to memory of 2560	2864	chrome.exe	118
PID 2864 wrote to memory of 2560	2864	chrome.exe	118
PID 2864 wrote to memory of 3548	2864	chrome.exe	119
PID 2864 wrote to memory of 3548	2864	chrome.exe	119
PID 2864 wrote to memory of 5000	2864	chrome.exe	120
PID 2864 wrote to memory of 5000	2864	chrome.exe	120
PID 2864 wrote to memory of 4808	2864	chrome.exe	121
PID 2864 wrote to memory of 4808	2864	chrome.exe	121
PID 2864 wrote to memory of 1348	2864	chrome.exe	122
PID 2864 wrote to memory of 1348	2864	chrome.exe	122
PID 2864 wrote to memory of 2332	2864	chrome.exe	123
PID 2864 wrote to memory of 2332	2864	chrome.exe	123
PID 2864 wrote to memory of 3080	2864	chrome.exe	124
PID 2864 wrote to memory of 3080	2864	chrome.exe	124
PID 2864 wrote to memory of 3784	2864	chrome.exe	125
PID 2864 wrote to memory of 3784	2864	chrome.exe	125
PID 2864 wrote to memory of 5828	2864	chrome.exe	126
PID 2864 wrote to memory of 5200	2864	chrome.exe	127
PID 2864 wrote to memory of 5200	2864	chrome.exe	127
PID 2864 wrote to memory of 4140	2864	chrome.exe	130
PID 2864 wrote to memory of 4268	2864	chrome.exe	128
PID 2864 wrote to memory of 4140	2864	chrome.exe	130

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\file.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff8a3e3c728,0x7ff8a3e3c734,0x7ff8a3e3c740
  2⤵
  PID:2520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1612,i,1297313652097893723,14825690494591818302,262144 --field-trial-handle=1896,i,8758915859369269625,11677723415688375651,262144 --variations-seed-version --mojo-platform-channel-handle=1600 /prefetch:2
  2⤵
  PID:4164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1464,i,11478427493484289105,12043733977588361460,524288 --field-trial-handle=1896,i,8758915859369269625,11677723415688375651,262144 --variations-seed-version --mojo-platform-channel-handle=2096 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2228,i,14563001714047115884,14728193484957062718,524288 --field-trial-handle=1896,i,8758915859369269625,11677723415688375651,262144 --variations-seed-version --mojo-platform-channel-handle=2384 /prefetch:13
  2⤵
  PID:2464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3196,i,11851664694467524903,13187473520679595324,2097152 --field-trial-handle=1896,i,8758915859369269625,11677723415688375651,262144 --variations-seed-version --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:4748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3200,i,1189735929053175923,16798373152925736273,2097152 --field-trial-handle=1896,i,8758915859369269625,11677723415688375651,262144 --variations-seed-version --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:4216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4632,i,9688003533615105551,6956448632300687949,2097152 --field-trial-handle=1896,i,8758915859369269625,11677723415688375651,262144 --variations-seed-version --mojo-platform-channel-handle=4604 /prefetch:1
  2⤵
  PID:3784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4748,i,12502055006058611362,5697708247628780461,2097152 --field-trial-handle=1896,i,8758915859369269625,11677723415688375651,262144 --variations-seed-version --mojo-platform-channel-handle=4764 /prefetch:1
  2⤵
  PID:6040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5564,i,332766304659036836,11411628818897228642,2097152 --field-trial-handle=1896,i,8758915859369269625,11677723415688375651,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:1
  2⤵
  PID:4680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5580,i,767848772385957484,15009315170643810355,2097152 --field-trial-handle=1896,i,8758915859369269625,11677723415688375651,262144 --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:1
  2⤵
  PID:3260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3296,i,9980673088507254671,4989022674804331594,524288 --field-trial-handle=1896,i,8758915859369269625,11677723415688375651,262144 --variations-seed-version --mojo-platform-channel-handle=3316 /prefetch:14
  2⤵
  PID:3848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3260,i,5771979708377071296,6682427219202037821,524288 --field-trial-handle=1896,i,8758915859369269625,11677723415688375651,262144 --variations-seed-version --mojo-platform-channel-handle=3388 /prefetch:14
  2⤵
  PID:4080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3252,i,5299078277228897236,5333826939310900211,524288 --field-trial-handle=1896,i,8758915859369269625,11677723415688375651,262144 --variations-seed-version --mojo-platform-channel-handle=3404 /prefetch:14
  2⤵
  PID:4236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=3228,i,6953626073601839639,3872154197782059731,2097152 --field-trial-handle=1896,i,8758915859369269625,11677723415688375651,262144 --variations-seed-version --mojo-platform-channel-handle=3800 /prefetch:1
  2⤵
  PID:2600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=4768,i,3272785871274390180,10430385035991990081,2097152 --field-trial-handle=1896,i,8758915859369269625,11677723415688375651,262144 --variations-seed-version --mojo-platform-channel-handle=4652 /prefetch:1
  2⤵
  PID:5804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=3376,i,6834854329408757050,11720276528396240633,2097152 --field-trial-handle=1896,i,8758915859369269625,11677723415688375651,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:1
  2⤵
  PID:432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6256,i,18292091966706864278,10085828985331918623,524288 --field-trial-handle=1896,i,8758915859369269625,11677723415688375651,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:14
  2⤵
  PID:2532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6332,i,8999968249754214850,12479980040116679002,2097152 --field-trial-handle=1896,i,8758915859369269625,11677723415688375651,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:1
  2⤵
  PID:4512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6364,i,14229813917005479186,5712950760886645678,2097152 --field-trial-handle=1896,i,8758915859369269625,11677723415688375651,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:1
  2⤵
  PID:5828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6648,i,6051305453458435148,13865962156327252321,2097152 --field-trial-handle=1896,i,8758915859369269625,11677723415688375651,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:1
  2⤵
  PID:1728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5364,i,6734194086010490184,7553870132696767395,2097152 --field-trial-handle=1896,i,8758915859369269625,11677723415688375651,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:1
  2⤵
  PID:1720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5276,i,18426915027544930423,12289135969867383,2097152 --field-trial-handle=1896,i,8758915859369269625,11677723415688375651,262144 --variations-seed-version --mojo-platform-channel-handle=6584 /prefetch:1
  2⤵
  PID:5884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6596,i,7171746952866315492,655215408600704411,2097152 --field-trial-handle=1896,i,8758915859369269625,11677723415688375651,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:1
  2⤵
  PID:2876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6312,i,3379961417274492033,11765345085249008369,2097152 --field-trial-handle=1896,i,8758915859369269625,11677723415688375651,262144 --variations-seed-version --mojo-platform-channel-handle=6492 /prefetch:1
  2⤵
  PID:4244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6468,i,11093171334598195164,3896336667247430366,2097152 --field-trial-handle=1896,i,8758915859369269625,11677723415688375651,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:1
  2⤵
  PID:2560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=6464,i,15080507484391322750,1087993562529316296,2097152 --field-trial-handle=1896,i,8758915859369269625,11677723415688375651,262144 --variations-seed-version --mojo-platform-channel-handle=1604 /prefetch:1
  2⤵
  PID:3548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=6448,i,6786839554062180319,7348467911597719680,2097152 --field-trial-handle=1896,i,8758915859369269625,11677723415688375651,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:1
  2⤵
  PID:5000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=5388,i,3407280200470440307,3463260487578955877,2097152 --field-trial-handle=1896,i,8758915859369269625,11677723415688375651,262144 --variations-seed-version --mojo-platform-channel-handle=4872 /prefetch:1
  2⤵
  PID:4808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=4936,i,8264369374275199578,14714866351594096131,2097152 --field-trial-handle=1896,i,8758915859369269625,11677723415688375651,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:1
  2⤵
  PID:1348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=4952,i,12629080353644251021,5386735009377364608,2097152 --field-trial-handle=1896,i,8758915859369269625,11677723415688375651,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:1
  2⤵
  PID:2332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=6344,i,17401224188942959486,7140988526113671736,2097152 --field-trial-handle=1896,i,8758915859369269625,11677723415688375651,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:1
  2⤵
  PID:3080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=5056,i,1727340837731300463,8902632939648907382,2097152 --field-trial-handle=1896,i,8758915859369269625,11677723415688375651,262144 --variations-seed-version --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:3784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=796,i,11118168427201653167,9906049384775874779,524288 --field-trial-handle=1896,i,8758915859369269625,11677723415688375651,262144 --variations-seed-version --mojo-platform-channel-handle=4956 /prefetch:14
  2⤵
  PID:5828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --metrics-shmem-handle=6696,i,6738950315212512098,11550143004053097655,2097152 --field-trial-handle=1896,i,8758915859369269625,11677723415688375651,262144 --variations-seed-version --mojo-platform-channel-handle=6712 /prefetch:1
  2⤵
  PID:5200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --metrics-shmem-handle=6908,i,10317046460545880186,6695907468926119517,2097152 --field-trial-handle=1896,i,8758915859369269625,11677723415688375651,262144 --variations-seed-version --mojo-platform-channel-handle=6924 /prefetch:1
  2⤵
  PID:4268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --metrics-shmem-handle=6972,i,7383007690035890845,1948236304643926872,2097152 --field-trial-handle=1896,i,8758915859369269625,11677723415688375651,262144 --variations-seed-version --mojo-platform-channel-handle=6900 /prefetch:1
  2⤵
  PID:4492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --metrics-shmem-handle=6948,i,11492260041932883716,13361068963418876981,2097152 --field-trial-handle=1896,i,8758915859369269625,11677723415688375651,262144 --variations-seed-version --mojo-platform-channel-handle=6840 /prefetch:1
  2⤵
  PID:4140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=7032,i,9016321659510635026,8906485953540442624,262144 --field-trial-handle=1896,i,8758915859369269625,11677723415688375651,262144 --variations-seed-version --mojo-platform-channel-handle=6916 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --metrics-shmem-handle=7172,i,16521654904385060357,2065699383226419911,2097152 --field-trial-handle=1896,i,8758915859369269625,11677723415688375651,262144 --variations-seed-version --mojo-platform-channel-handle=7180 /prefetch:1
  2⤵
  PID:2600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --metrics-shmem-handle=7420,i,7280745759871697753,18078103137747299936,2097152 --field-trial-handle=1896,i,8758915859369269625,11677723415688375651,262144 --variations-seed-version --mojo-platform-channel-handle=6960 /prefetch:1
  2⤵
  PID:6548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=es --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=6788,i,13080076083463190670,6379487421029395442,524288 --field-trial-handle=1896,i,8758915859369269625,11677723415688375651,262144 --variations-seed-version --mojo-platform-channel-handle=6740 /prefetch:14
  2⤵
  PID:7024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --metrics-shmem-handle=7692,i,5287469014230439535,861271026712953279,2097152 --field-trial-handle=1896,i,8758915859369269625,11677723415688375651,262144 --variations-seed-version --mojo-platform-channel-handle=7664 /prefetch:1
  2⤵
  PID:1744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --metrics-shmem-handle=7720,i,8737328198162321731,982461546322815711,2097152 --field-trial-handle=1896,i,8758915859369269625,11677723415688375651,262144 --variations-seed-version --mojo-platform-channel-handle=7684 /prefetch:1
  2⤵
  PID:3972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --metrics-shmem-handle=7580,i,17292709319953860329,4043505572794266462,2097152 --field-trial-handle=1896,i,8758915859369269625,11677723415688375651,262144 --variations-seed-version --mojo-platform-channel-handle=6892 /prefetch:1
  2⤵
  PID:6440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --metrics-shmem-handle=6888,i,17293384087372689494,3358898132571432165,2097152 --field-trial-handle=1896,i,8758915859369269625,11677723415688375651,262144 --variations-seed-version --mojo-platform-channel-handle=7212 /prefetch:1
  2⤵
  PID:4008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --metrics-shmem-handle=3916,i,16253397031783390852,10751293468975447496,2097152 --field-trial-handle=1896,i,8758915859369269625,11677723415688375651,262144 --variations-seed-version --mojo-platform-channel-handle=7772 /prefetch:1
  2⤵
  PID:4416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --metrics-shmem-handle=7744,i,11593565407937467924,984233290401995478,2097152 --field-trial-handle=1896,i,8758915859369269625,11677723415688375651,262144 --variations-seed-version --mojo-platform-channel-handle=7300 /prefetch:1
  2⤵
  PID:1476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --metrics-shmem-handle=4948,i,2154666086923105805,10229781733898800992,2097152 --field-trial-handle=1896,i,8758915859369269625,11677723415688375651,262144 --variations-seed-version --mojo-platform-channel-handle=4540 /prefetch:1
  2⤵
  PID:7072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=7280,i,4044378656394526624,12447712567032922436,524288 --field-trial-handle=1896,i,8758915859369269625,11677723415688375651,262144 --variations-seed-version --mojo-platform-channel-handle=7048 /prefetch:14
  2⤵
  PID:3780

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2516

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4972

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:3676

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3288

C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\SecHealthUI.exe
"C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\SecHealthUI.exe" -ServerName:SecHealthUI.AppX8tam42xc7v2czs3s1nt0nkxvfjtepzp9.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:2928

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:5904

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {E041C90B-68BA-42C9-991E-477B73A75C90} -Embedding
1⤵
PID:4492

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:6200

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k WbioSvcGroup -s WbioSrvc
1⤵
- Drops file in System32 directory
- Checks processor information in registry
PID:6300

C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\SecHealthUI.exe
"C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\SecHealthUI.exe" -ServerName:SecHealthUI.AppX8tam42xc7v2czs3s1nt0nkxvfjtepzp9.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:7072

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {E041C90B-68BA-42C9-991E-477B73A75C90} -Embedding
1⤵
PID:7156

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {88866959-07B0-4ED8-8EF5-54BC7443D28C} -Embedding
1⤵
PID:6676

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:4328

C:\Windows\system32\CredentialEnrollmentManager.exe
C:\Windows\system32\CredentialEnrollmentManager.exe
1⤵
PID:4828

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5756

C:\Windows\System32\DataExchangeHost.exe
C:\Windows\System32\DataExchangeHost.exe -Embedding
1⤵
PID:2820

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 71c56c2da3ffafc58b1f9ac63f15cb6dac4fb1c8a79bff1256051cd303154397
MD5 6cc39d5307f7811ccb8fbf0ae6e905d0
SHA1 6e1f480619352392d31939f7da47f4d0ab05b678
SHA512 e57431313138020cbfad9b542f06329cc5ca06982d0e3aa7b1f35db81bc7c89d945c6de4b0b64332168aac077ed9ce59d0524e723369fe7784fbf6aba95444c1
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000024

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000024
Size 312KB
SHA256 0b6251fd38152a7a7319d54a8e993417dfe359650a9581c135c3950fe5704861
MD5 932d4b5eb7460fda1f102de6f7149790
SHA1 fadbac31c043b89a72bf3abf502f9ee53ccbf86c
SHA512 eaad89143b37482972189a3ff86698a7ae3332c42248d177fc74e0ec6aa9e1756a0699cb77d3b83cd815e2651df267c0cca4e9866d7a59a26d0dbeadb060189d
SSDEEP 6144:Y87U1JYBYrHsCcjPUrsgrwz9Ot6mjoSF7SI/5Czsl/sfz+IeJqJi:REJYqaQ8QN7p5Cz0jqJi
TLSH
T1786423C8B9A7916BD9F3FEECE0C64958B3FE733433C684798421915B87122D882E45D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000058

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000058
Size 158KB
SHA256 60072b4eb6fc5f1f1214a34fcd55b3cbd1d05eddf778f85611f9b352c4c6452d
MD5 83266658f29f5cb762001d5d9f6985a7
SHA1 9ff52157193e1e798944e6a3172d938183f5e550
SHA512 60b2a8749bb597b71c6cb7113c4ea6c430ab90c6f6a5f78a36ab5fbd2676fbc173ade236be939e862569c786fbdc8e0aa984f1ae4263e91de2ba681cc8ce5d66
SSDEEP 3072:pqj6fcYjfI87fn/NWUEu+Y4rwgnWSPrrGh9SC2VRvkQdv45cf+Fg:pTvjg87fnVTEu+W3rSC2VRpBf+y
TLSH
T196F3232CABB1EF2298ADD32D789EF491C870553AC097303BB84FDF8575154348A7684E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 28a37b28569fb86fa7f5250c8cbf875f2bf3a3ac106cb29036178630e46db275
MD5 4277d0a183e2eef13c614c550116ac09
SHA1 82b7af67337cfb23a0bb4e376150e4cee83f88a4
SHA512 230ff0c89d65b94328aed4f1ec29e90a0fc6bf61b4bae462537f85d3b83559cc853576214c264dc2352854aec4403ac0156becaed983ff4dc532b6fa68b91eea
TLSH
T1EF51D09E5DEC3122DB506EF654E44CC3BA70042941B7AF8F68801A396C07FDB3416D7A
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 3a8914c0a9cb073cc3ae7093acdcc5cfb59695f7e76cd8bb15b52244ddfef531
MD5 1aaa23b5b195901e619a2f499c7afdba
SHA1 fb1e4ed16400944381e887130b54439a50033efd
SHA512 586f0e58283e50a88efc0a0578ef106d4efec4ee01040a935e6bdf3212f77c21614939047ee1eb06b9c51c7232efd3ec41d9106969c191d0a1dc1976582106a9
TLSH
T13C71FE5D8CEC3051DB606EF618E04CC3BE70442451B7EF8A6D90153A6C0BFEF34169AA
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 3f8f40fe0071d3fe6a1c4c4c5c11eb0a10c39b8733da7624beaec12cb4006e69
MD5 5ae2211b4f26cb87f18ff68210fe0608
SHA1 a7dfff56a6422ef94c9d32e7792283161b709024
SHA512 8cea7a6bdd0cf92053eb419258ac06690f84c8814676e49092fa9440ec26fa494c8ac44dd807d425d00427e4754628479da33bb7345f3a4da94342d178a39969
TLSH
T12161DE9E5CDC3162DB616EF614E04CC3BA71052941B7EF4A68C01A3A6C07FEF742697A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 126ca564fd8594f3026cef78f1a69783ea045365cdf585311bff0df8531f7bba
MD5 926fca396a32de946ffc833d8bf5305d
SHA1 6d619740f6da7f16014951783cccad79d46cefef
SHA512 bea38062d8b7859f74e24c69730dc1515499bdea6e4141818617137eb6171afcc22b219c767dce1eb3fb3f398e3da52e5c88de7f2e9377cc7d18a3fa3f708609
TLSH
T1C061BE5E4CDC3052DB616DF654E04CC3BA70052541B7EF4A68801A3A6C47FEB3426D7A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 78ab4f8ffd22090211be370bba10729efd2d0697d2823de52468e26ae547a77c
MD5 a576c8a06f1c5ada98c4b729399be650
SHA1 fcfa56eb18823e67b12c918e78a001024c3f0614
SHA512 61955737c4c20309564d85af800b4ea69774eaeb3e4e2e4b5a1d0f234c3f8ee26d8d138808e3c544a8cf8346c24f475e11def7fc9aa3fce40a06b9e756c00b3f
TLSH
T1F071BB9E4DDC3161DB616DF618E04CC3BF70442442BBAF4A6880153A6C0BFEF34269BA
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 03ef13bf085d4703e71ee4685ebc83c25e79ec1746f5ee039ad55979b7bae904
MD5 088bd021b7f01b13d757340fd3a4b2e4
SHA1 bd91caa83a1827774699080a24451f14ed3b525c
SHA512 fcefcc42145ce759261962438b8575bf6f4a7ee8d57922f333118ae89284d28f5a31459fe191717052996df7d0f4659245e8a81f5dbcbe2b56058c369478d009
TLSH
T1E571CE5D4CDC3162DBA15DF658E04CC3BA70052542BBEF8A6890153A6C4BFEF34169BA
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 13KB
SHA256 53e4d39321461b5ec6f962c087e1f2d075fd5b899d4059c2a83ad343b9417986
MD5 38b09ead3e176e426a5a5e49405bfcd3
SHA1 fa4387d16806fa09b269b67bcb113075935f2c01
SHA512 885e44a25fd2c76ba1413a9e2e4e961123658225a465accc2dfe34749be49d2eb59d5777b075cb893977420f70f73dee5440f52ef3b3e188f14af8141db23de3
SSDEEP 384:D89oXeFMhOb3hz8F6faIaEZEW1XZmuDZKQAZ7FM+jcAL/Ew7DLK4IRsw89IIU2Yw:aRHTifIrkV3
TLSH
T1D852CCF7C3E4C66E881156F49724AE1BCE1D161A832C3C268CE5AE4FA3E2472D25564F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 36KB
SHA256 4c7fc745be83cdcc26a8451198d394910e98d930a3e188df7b55e908ba6b1ca8
MD5 c8428c1aca448cec276707ccb04aa4b2
SHA1 2fe0456c3b70f37757da70e73d89e5b2da89018c
SHA512 35d3876eb7aba01b5d534b285b23c94a7fdc77cd35108016a9666aa7d85b5a99cdb6062729b4c74123e171ab647ae30f89e4ff3fa15f9a3d4de707c9f117abad
SSDEEP 384:D89oXeFMhOb3hz8F67GY9Y4MdVcjerx1eEJ3N4fBe73Jf69exJXJDaIaEZEW1XZn:Uy11RHTil9rh+cbugaS/lnuDNx
TLSH
T106F2BCF783E5C62E891157F896146E1BCE1C171A432C3C1688D5FE8BE3E2472E16A64F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 45KB
SHA256 6271aaa571e4c14d85c2705b34991f5c5545d3bc24ca2def2391680a39051cac
MD5 8db3a24ef677f559c6930467d1ef7e2b
SHA1 a1669eba254a95aa30ef9cf35ca1b7075615471d
SHA512 8dbef11802c9277904fb2b4951627119544006581600bd0dcf28d874ed3afbe369101b54a17f790595db81dcf743aebffb803bbd5bec173d828031ab8935edfc
SSDEEP 384:D8FoPeUMhOb3hz8F67GY9Y4MdVcjerx1eEJ3N4fBe73Jf69exJXJfrP+7Sez7C7V:vy10jwRHTiE9rhmcbuhaUu4CyrqpJX
TLSH
T19023CDF783E5D66E891117F85A146E1BCE1D171A432C3C1689D5FE8BE3E2032E16A60F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 44KB
SHA256 4c80af479e23db9029581bb5088561a95d0a2f52e928cbc18f3c862fa3a6e0f9
MD5 d454b5b283a55038166c37ba8629eaf7
SHA1 d54d319266ad7bb731f429523fc2824080e13ca7
SHA512 414a17611f0a0701c3e1d3c64597dc7b6191a33b093fb2402237d1ea5c22f1fcfc212613fbc3738728b8ab0382b8a552da7eaaafd87babed26216282efad8626
SSDEEP 384:D8FoPeUJjU5mRz8F67GY9Y4MdVcjerx1eEJ3N4fBe73Jf69exJXJfrP+7Sez7C7R:Vy10jwRHTi/mghmcb6aUu4CyrW9JU
TLSH
T13F23CDF783E5D66E891157F85A146E1BCE1C171A432C3C2689D5FE8BE3E2032D16A60F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 5KB
SHA256 ae02beb992666c31b5aa9bf031063cdfd7ef63701fc4f350ff81a58a9212d5c6
MD5 0b8e19f3ed550271069da00d27d0a79c
SHA1 09560e4b7de9f5e5012ce54243c3cb1c99736e7d
SHA512 753c38d457a214ddd22ab20ec209c3c3a2c89a3172c4953dd4636faad2e8fb7396faecb71b3b09a7fc5fbfe2348c96bd6046dc82ae41ca4bb7b718f94ee6ef00
SSDEEP 96:pUrPUgAUGUPyUL+UkieUnsUOUZUuUviULUrU2U3ULU/Uv9KUFHU7UFhUyxUHUjc4:pUrPUgAUGU6UqU0UnsUOUZUuU6ULUrUI
TLSH
T1DAB19AA7957FF81B107D586F0E46F80A19BAB8356252ACF6DF96D1ACB0C54F70B12023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 6d4d84d8f81a75d5ecddf5232322142ca82f9f379c2f3d0c2825cc99d6aba5c3
MD5 95a7e948157e7400db8887f2c5505aff
SHA1 b834615b043db797e101a8dbcf4ca8e98f603049
SHA512 eef616eec68d8bbe11be11c0d89984b4ed197fbe0aad4592469757628dd1b4cd1ff5dd0857123b7d25d89bfbdfeb034ef1f20af7b8314d8c10a0ed43792e6f3d
SSDEEP 192:+RYMYGLv7ivAPRp2X39rHsb+WNnuoMPchZbkz8IkwW/EVyIsnAUgR:+RYMtzm6XY5wujPc3kzv8AR
TLSH
T1DF32C62AA911787B5DCBD629FD217753E7F6102231E12E84E7FC892C15D75CC222B05B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 e768e9db3f846715254882899e27b66239eb8085a0242205a592ff7c7b0a563e
MD5 edd30512411648b84f70180bc2f79f81
SHA1 d00bc0146efc1d5048855edabcb9a02065247141
SHA512 d28f81da896ee3367d19035c783d6470ca5a2eed884a7491a0631bb6c3273cbeb82d94c79e1de0f2c17b618826fc8d4e2ce6ea00a8bf9ed269d2f2bf269afd27
SSDEEP 192:+RoMYGGv7iv9PRphLdN+JyU9rHsb+WN7Sm4uoMoXX21yZbkz8IkwW1EVyIsnAUg8:+RoMtym9Xy5wzjI212kzvAAvU
TLSH
T1C652D72AA9216DB75DDAE629F911B757E3F6103221E12E84FBFCC92C14DB5CC221704B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 fc27661a3fce3889bd5c45cd2cac09a296afd6d7701118f40aba06585cf4aedf
MD5 324ac491c5d0692345fc5a3034d13d49
SHA1 1758038509f99df674480a3ef38308ee04d45403
SHA512 c2a61300f2ea0ee597cdf1a6d6d367cb02eedf9bf4423e8fd635f933209a40591cf06f96b803abc93c8c1e1fdb243b8d7553a3970e8cf5419690a298d25160f5
SSDEEP 192:+RYMYGLv7isAPRp2X39rHsb+WNnuoMPchZbkz8IkwW/EVyIsnAUgR:+RYMtzmNXY5wujPc3kzv8AR
TLSH
T15332C62AA911787B5DCBD629FD217753E7F6102231E12E84E7FC892C15D75CC222B05B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 3759a1734f7e97a9ceb373c7e1a5dae08cdc3b7d806726a4ab9403bd62235ada
MD5 8400cdabd3a3e11b07b9558982a5b61d
SHA1 56a4563e80d2ae976b94c44f6fe846a614b5c604
SHA512 75fbf2ea98b550086c61415ef1a61746ceb4418c128807931aa35d375371b9bc39dac223eee1f0f2b8bb2ed76c88ac437fae6151c68a32a4454f095d65c643ac
SSDEEP 192:+RocYAswv7iv9PRphLdN+qyU9rHsb+WN7SmuF61uoMokIFoD/yZbkz8IkwW1EVyR:+RocKsm9Xl5wX0jD2oD/2kzvAAvU
TLSH
T13652D82AA9216DB79DDBD619F911B757E3F5203225E12E84EBFC892C11DB5CC221700B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 00d12daede3e2ef2bce0f3243b04b7d754a7649fe2c452403ae0dd5d3a35f2a1
MD5 6abbdb0ffb098618f9742b178e8be295
SHA1 1ff7d14dedefff68a9e30246e33786607e5435bc
SHA512 2f5f6bc518c266ca8e10629d1f2f662515ea7a289d00eaa13b4586eb43c1d9d32fcb7242c11fdb8f497bff54d7e212b4c2636544449c18c50c31f1c0c4d21699
SSDEEP 192:+RoRYAsYv7iv9PRphLdN+qyU9rHsb+WN7SmuiwACuoMokIFo8yZbkz8IkwW1EVyR:+RoRKEm9Xl5wIAhjD2o82kzvAAvU
TLSH
T1C052D82AA9216DB79DDBD619FD11B757E3F6203225E12E84EBFC892C11DB5CC221700B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 08098eb422640d66282a3b4e3012c4b4d3fde7b2ab769f60585bbf6c4904e2ed
MD5 32fd7b723f5c5dbb8ad470eb5dcde7eb
SHA1 ea3eb369d5f4c1eaf5657b87341383b94dddc339
SHA512 2ecc1cf5df219f8548abd524a09d71d168390020c13fb28e8050da5b12c354586f32e7b14178ad232a336e32b37523d9286ad1a54b163f09083d3aa810e8934f
SSDEEP 192:+RoMYGwv7iv9PRphLdN+qyU9rHsb+WN7Sm4uoMokIFoe0yZbkz8IkwW1EVyIsnAg:+RoMtsm9Xl5wzjD2oe02kzvAAvU
TLSH
T19A52E82AA9212DB79DDBD629F911B757E3F5203221E12E84EBFCC92C11DB5CC221740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 b26d2e9aa2d30c478382a70b72050cf012b142c3fffe02bf959fced27e54c5b2
MD5 7ec24bb904b440a35c297e04fbd68585
SHA1 d471e33775d74b2b9937a20e40d7991502fff733
SHA512 1491c17f7a86f1acf7592bf7bb01353ed739cda7bed903eac7dc0217e2af52558db8d50533ab23a656f439086a6e31d1c9cec4235dfd1af0acf78fb013a186c7
SSDEEP 192:+RoRYAswv7iv9PRphLdN+qyU9rHsb+WN7SmuEVtuoMokIFoo/yZbkz8IkwW1EVyR:+RoRKsm9Xl5wzsjD2oo/2kzvAAvU
TLSH
T1E352E82AA9216DB79DDBE619F911B757E3F5203225E12E84FBFC892C11DB5CC221700B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 f81588bd1a8bd375e1ec4ab151699cf89c48f0dbf6bd1efa6abaabdd99dd4670
MD5 9f7ed6dcfd12edfd02596759645cef6b
SHA1 02d6c347901b290bd3d4541b4cd02e25650f8d33
SHA512 12db5b372697ae59e7343f2c0320dfa88fa5e35b95e3b85dfba4e906ac96c2d18f464a41a85d9dda90d669df26d6bfdc3b00ac407e167b97c6f418c11fed09b1
SSDEEP 192:+RocYGwv7iv9PRphLdN+qyU9rHsb+WN7Sm4uoMokIFoe0yZbkz8IkwW1EVyIsnAg:+Roctsm9Xl5wzjD2oe02kzvAAvU
TLSH
T19C52E92AA9212DB79DDBD629F911B757E3F5203221E12E84EBFCC92C11DB5CC221740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 9a1b4fc0e61129ea3ef2ecffc32a12330f1c58cfff8cb147995f744fdf17b651
MD5 262d9734f174d1bcda1a49779b3fbf71
SHA1 ce9ffcea6dcdcc1fd5bd1d4ab7be3ff3621c96b9
SHA512 a1e80d0eaaca0da45e27f155ea0d788bb1d6aab8e31dcd623863d2839580c4c60404698d89a0a5a3d23e6cecadd97c9c70677ef9a665423ba5dbbd7df66fef73
SSDEEP 192:+RoMYGPv7ivAPRp2LdN+JyU9rHsb+WN7Sm4uoMPc+ZZbkz8IkwW/EVyIsnAUg5b:+RoMtHm6Xn5wzjPc+vkzv0A5b
TLSH
T19942C72AA9212CBB5DDBD62AFD117757E3FA103225E12E84EBFC892C10D75CC221744B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 377214f648d46362e6b3ba61a4a35f0b3ece9941968bbbba3d2ad7ec28b97d19
MD5 7474e77ec98ad67b1de76a2bcb904b87
SHA1 1fd8aba26460037ff3c385d81628b3b905985258
SHA512 67e346a0f8465ab666ae21bc92d69708d4d803b8aee3da848c9b2e2d8e52bc6b8a6f9afb8c8f23fb839086bb7a9d160a743e211c885cb1bea9822ce51f955664
SSDEEP 192:e6F4K6Em7KxkXqK4I40pUZNCgVLHrKHfFKslEVSsXzKD/Li+ErUkKN++2n7DTe2:vFjzm7KxkXqKf/pUZNCgVLH2HfgsllsP
TLSH
T15C32E827944E5E7F4FD8D51CDC126F8BADF5029673780D2892FBAD0803A578A114A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

457a466f905ef255_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\457a466f905ef255_0
Size 63KB
SHA256 241e155ef2e701634d1c7e2237f0e2fcb46c4441870c619c2456a191550f9d5c
MD5 c2c99991f151455be08b876494d8870d
SHA1 befff334720ab882f471f3a5b69b4d75bc70a42e
SHA512 bdb78c3c49433d355afd6de7de28ec21182770241637da8d0e559675fcfcc23d91438e129070d6ab6170503eb9248dc7560dd3f83c9e5452956a2ed5d9dacb76
SSDEEP 1536:8my3ZRaibi73bzuQ8iP3JCQvyqx0xE4swq4onGGVBw3i:8my3uibi73+nifvB4szB
TLSH
T15F535AAA337178B3827B61F1905F1307713EE1A7B40484F8A298EDF15A54AA94277F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 7a7b60d42573ad0f4336a563f39e54f037590ccb13e171a0691a6fe3a7846976
MD5 abc6995ac2bbb550bff97179861e0ace
SHA1 e0dd849bf2ecfc1a83eaee23311ae12f9ff9c8ea
SHA512 46b7ee17666f376dfb1fb7a052a14b96494f0158d14cd1b3716e29611d3afc4907635c6f404c4b5d5105d937279ea781a392ba4c8d91dab67130f43b60e83bc1
TLSH
T1BAA0022425800521D5450BB0128695822B55AD954912062170F11A469F655844A02054
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 4b52ddd3d398fa87ce04a1a7bd0856be6401c4544760c24c02f044bfcd4a67ba
MD5 8ce752bb50bfa54f09e17217bc7cb98b
SHA1 7e078bd355f9a5cf4bcff3485c2bbf2f1a93668d
SHA512 cfe1e132067026d2f7429a4f670ea38dc5a3f74b9d077149cabfa02a14468ce90d19004afbed014dfc2126a3a7f9568290ef560544673c1c9372be2e638578c9
SSDEEP 96:0bJ0d+PTkblaRZiIEby3rUfsfuZ8INXGGzSl8h4otop5BFIDwB6TGwv4Y+mE1I0r:0t0cTkJaRZi/CF2lxiU2r+03q+mEmWGS
TLSH
T13FC11931A469A87359A6E996B4033947CFBC326F7851AE54EFDA4F1D01EF19C2383027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 762e45bcec0cedcbcca762bede881d2f24c9e12dbeb35cc4115ef9fb386898da
MD5 f6c4f06fa8b977f2e1164e3f8ebf7365
SHA1 6361c1e5794175d74d52745e3610aae926001aaf
SHA512 8e479537ef18d64f91a9ef82a13b724eb5a0a10884b3ecc8f46aad1a59f39246b25271da125b8d3f151ab4687d44c4749ccc1880c7d44fb2f6e4b8ad662d53fe
SSDEEP 96:TC0d+PTkblaRZiIEby3rUfsfuZ8IKGGxRDotok5BFADwB6xGyv4YR5gZEObETev7:TC0cTkJaRZi/CF2lIDUDr20ZIR5gOObV
TLSH
T17CA1393264659DB76976D98AB4423A43CFBD722B7951BE84EADD0E0C18EB0EC1342027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 84ae9513879a3343e2e514ba74a37c3b43c3847c6fa0904b18a631d03b3dd66c
MD5 5aa3ca11b355ea5ab128efc2b1200581
SHA1 2398e10dd1f8274be35acad3483f35456648c457
SHA512 843d10cdd3ea21def653bcb9ef721d46f333798d5dcb666caf61d2f131aed3d94335b7940746f304d339e627a8b0f243956f94ee42fdffd5a7a8d55f729b95c2
SSDEEP 96:0bJod+PTkblaRZiIEby3rUfsfuZ8INXGGzSl8h4otop5BFIDwB6TGwv4Y+Uj2tcG:0tocTkJaRZi/CF2lxiU2r+03q+/tcxO/
TLSH
T14BC1F671946E987759B6A88AB0032D47CEBC326B7955BE54EEED4E0C00EB4DC038302B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 48517b4088622fbe506e66a61a401f9daf723b9cf6ba776796926f7dbcd4fdf0
MD5 46520f2bbe17eca09117cd7d23ac0a10
SHA1 ac185d08f4ee9079b9eb09ae3af4249823b9919b
SHA512 8a099af7df3e9e84f8034babc9b38fc9c4741f6f090620d7d6ea1f3ef68b7475636ea6976224906b75ad8259cd121e8dbcccc28f494cc2c70906db4dd0b79b03
SSDEEP 96:0bJod+PTkblaRZiIEby3rUfsfuZ8INXGGzSl8h4otop5BFjDwB6pGGwv4Y+Uj2t5:0tocTkJaRZi/CF2lxiU2rX0Mvq+/tcxc
TLSH
T1C3C1F671945E987759B6A88AB0032D47CEBC326B7955BE54EEED4E0C00EB4DC038302B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 6KB
SHA256 ce05d060e9afd59c7713cf533967fda98800795d38fddb492b25711982d457ff
MD5 f86c78a17cbe63eede6d251c0b340304
SHA1 3dc99ba702024cea0c3b1cd16dd07b9a350a294c
SHA512 3432d8ea53315fa70c0c05164cf92d7cfdc48d1305a8d8b7e150fbdc5aa667c02b16f3a44ccf4dc44c65a7cbdf709c1d6af9eaf6bd29dc07c5f078d0704f70f3
SSDEEP 192:0tocTkJaRZi/CF2lxiUDrd0Mvq+/tRxOju8x9tpJ:0t1TxZbF6xSMC+NOju8LXJ
TLSH
T1ABD1F871946E587759B6E889B0032D87CEBC716B7854BE58EEED4E0C01AB4DC1383537
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 dee8d62ddcb1c297ee9a126b5b17a831a505352746bdab9ea3d5639311182a08
MD5 9dd9d1706bb28b620d83164854f09fa3
SHA1 486dcab11bc245637ecc6237be08004ee68573cd
SHA512 1963d28a460fc26ce8b1486a2c051e836955669181dbe909573c7a2c92e17bf81337510fa791b74ca76a4e71abc5984e28591a5b59197413b9760128f9dda694
SSDEEP 96:0C0d+PTkblaRZiIEby3rUfsfuZ8INXGGzSl8h4otop5BFWDwB6TGyv4Y+mE1I07X:0C0cTkJaRZi/CF2lxiU2rQ03I+mEmWGS
TLSH
T1B6C10A31A469A87359A2E996B4433947CFBC326B7851AE54EFDA4F1C01EF1DC1383027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 26ef4e8582b9a20b181b334408c84cad31e4ae6c006bfd58a635a63a74cec27c
MD5 0d467145dc3be2b92247aad51fe63384
SHA1 c8f48a61be302310f2d450ea6aedd89245db4eb8
SHA512 80394e2322b860a0693e376589554be6fa48c21c9981bd04dd16172e23f951600a7b091e5d1fbbbdaaf9e00823971b0da7614ecfdb7b994b45f42239b4b484d5
SSDEEP 96:0bJ0d+PTkblaRZiIEby3rUfsfuZ8INXGGzSl8h4otop5BFIDwB6TGwv4Y+Uj2tcG:0t0cTkJaRZi/CF2lxiU2r+03q+/tcxO/
TLSH
T191C1E771946E986759B6E886B0032D47CEBC316B7955BE54EEE94E0C01AB4DC1383437
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Size 264KB
SHA256 869cebed6ee230affa26c2d5feb1f90354a9811f997e8286a2a2b720f2c1af87
MD5 9038b87844c9915e0a461b4b97679d27
SHA1 9f2c81ac09758976c55d034ea2585e39a3f3dd08
SHA512 93ff72b85a4e9a1135a7cad4640630acb8b0cf66ef5c3a4ad029c92a41c20d3f02dbc9943349bb14e270150c3cc4fa718fe63591e76bd75df7f0734780e58838
SSDEEP 3:MsEllllkEthXllkl2zEelHUY:/M/xT02zN0Y
TLSH
T1E244040D7FC41405C51430704011C3740371DC310511774734D354335CC7D401C01000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download