2371bd86b1c4fb678df5b575de843f7a215fec507c044efbd594f5dc08245e2a

Analysis

user interaction
yes
max time kernel
218s
max time network
408s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
05/09/2026, 18:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
822aebd111355addae93611a61a0524f791db31748fb507bfe7d5a7a0fdf5996.png
Size 2.2MB
Sample260905-wl2dssfr61
SHA256 2371bd86b1c4fb678df5b575de843f7a215fec507c044efbd594f5dc08245e2a
MD5 a63ee9923bbf7688c53cb5c70f0cf85c
SHA1 68fc105648f1d91adcae6a4fb45632077d13dd91
SHA512 1d836b8491a709b14279b4732ac0770486aa4c18da45f75b4e0c30feb0057c967c839395a616711cc4ada13aa7c01607569a8d4c66ebe2f55d45d8280386acdd
SSDEEP 49152:ecnkf2DGs2KfuG37wu8HylHcV7MR1kA6u+cFfy/faDqDq:AflKV37dZclQkPhckfa1
TLSH
T18FA533937B99DF02F90512F5F085E772852A3FBB2266270B8C52179D2A91F006F192F7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

bootkit defense_evasion discovery execution persistence ransomware

Malware Config

Signatures

Disables Task Manager via registry modification
defense_evasion

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	salinewin.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5136	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	salinewin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
548	chrome.exe

Checks processor information in registry 2 TTPs 32 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134331050507668418"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000_Classes\Local Settings	chrome.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
4328	reg.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4324	mspaint.exe
4324	mspaint.exe
6100	chrome.exe
6100	chrome.exe
6100	chrome.exe
6100	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 47 IoCs

pid	Process
6100	chrome.exe
6100	chrome.exe
6100	chrome.exe
6100	chrome.exe
6100	chrome.exe
6100	chrome.exe
6100	chrome.exe
6100	chrome.exe
6100	chrome.exe
6100	chrome.exe
6100	chrome.exe
6100	chrome.exe
6100	chrome.exe
6100	chrome.exe
6100	chrome.exe
6100	chrome.exe
6100	chrome.exe
6100	chrome.exe
6100	chrome.exe
6100	chrome.exe
6100	chrome.exe
6100	chrome.exe
6100	chrome.exe
6100	chrome.exe
6100	chrome.exe
6100	chrome.exe
6100	chrome.exe
6100	chrome.exe
6100	chrome.exe
6100	chrome.exe
6100	chrome.exe
6100	chrome.exe
6100	chrome.exe
6100	chrome.exe
6100	chrome.exe
6100	chrome.exe
6100	chrome.exe
6100	chrome.exe
6100	chrome.exe
6100	chrome.exe
6100	chrome.exe
6100	chrome.exe
6100	chrome.exe
6100	chrome.exe
6100	chrome.exe
6100	chrome.exe
6100	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3608	firefox.exe
Token: SeDebugPrivilege	3608	firefox.exe
Token: SeDebugPrivilege	3608	firefox.exe
Token: SeDebugPrivilege	3608	firefox.exe
Token: SeDebugPrivilege	3608	firefox.exe
Token: SeShutdownPrivilege	6100	chrome.exe
Token: SeCreatePagefilePrivilege	6100	chrome.exe
Token: SeShutdownPrivilege	6100	chrome.exe
Token: SeCreatePagefilePrivilege	6100	chrome.exe
Token: SeShutdownPrivilege	6100	chrome.exe
Token: SeCreatePagefilePrivilege	6100	chrome.exe
Token: SeShutdownPrivilege	6100	chrome.exe
Token: SeCreatePagefilePrivilege	6100	chrome.exe
Token: SeShutdownPrivilege	6100	chrome.exe
Token: SeCreatePagefilePrivilege	6100	chrome.exe
Token: SeShutdownPrivilege	6100	chrome.exe
Token: SeCreatePagefilePrivilege	6100	chrome.exe
Token: SeShutdownPrivilege	6100	chrome.exe
Token: SeCreatePagefilePrivilege	6100	chrome.exe
Token: SeShutdownPrivilege	6100	chrome.exe
Token: SeCreatePagefilePrivilege	6100	chrome.exe
Token: SeShutdownPrivilege	6100	chrome.exe
Token: SeCreatePagefilePrivilege	6100	chrome.exe
Token: SeShutdownPrivilege	6100	chrome.exe
Token: SeCreatePagefilePrivilege	6100	chrome.exe
Token: SeShutdownPrivilege	6100	chrome.exe
Token: SeCreatePagefilePrivilege	6100	chrome.exe
Token: SeShutdownPrivilege	6100	chrome.exe
Token: SeCreatePagefilePrivilege	6100	chrome.exe
Token: SeShutdownPrivilege	6100	chrome.exe
Token: SeCreatePagefilePrivilege	6100	chrome.exe
Token: SeShutdownPrivilege	6100	chrome.exe
Token: SeCreatePagefilePrivilege	6100	chrome.exe
Token: SeShutdownPrivilege	6100	chrome.exe
Token: SeCreatePagefilePrivilege	6100	chrome.exe
Token: SeShutdownPrivilege	6100	chrome.exe
Token: SeCreatePagefilePrivilege	6100	chrome.exe
Token: SeShutdownPrivilege	6100	chrome.exe
Token: SeCreatePagefilePrivilege	6100	chrome.exe
Token: SeShutdownPrivilege	6100	chrome.exe
Token: SeCreatePagefilePrivilege	6100	chrome.exe
Token: SeShutdownPrivilege	6100	chrome.exe
Token: SeCreatePagefilePrivilege	6100	chrome.exe
Token: SeShutdownPrivilege	6100	chrome.exe
Token: SeCreatePagefilePrivilege	6100	chrome.exe
Token: SeShutdownPrivilege	6100	chrome.exe
Token: SeCreatePagefilePrivilege	6100	chrome.exe
Token: SeShutdownPrivilege	6100	chrome.exe
Token: SeCreatePagefilePrivilege	6100	chrome.exe
Token: SeShutdownPrivilege	6100	chrome.exe
Token: SeCreatePagefilePrivilege	6100	chrome.exe
Token: SeShutdownPrivilege	6100	chrome.exe
Token: SeCreatePagefilePrivilege	6100	chrome.exe
Token: SeShutdownPrivilege	6100	chrome.exe
Token: SeCreatePagefilePrivilege	6100	chrome.exe
Token: SeShutdownPrivilege	6100	chrome.exe
Token: SeCreatePagefilePrivilege	6100	chrome.exe
Token: SeShutdownPrivilege	6100	chrome.exe
Token: SeCreatePagefilePrivilege	6100	chrome.exe
Token: SeShutdownPrivilege	6100	chrome.exe
Token: SeCreatePagefilePrivilege	6100	chrome.exe
Token: SeShutdownPrivilege	6100	chrome.exe
Token: SeCreatePagefilePrivilege	6100	chrome.exe
Token: SeShutdownPrivilege	6100	chrome.exe

Suspicious use of FindShellTrayWindow 49 IoCs

pid	Process
3608	firefox.exe
3608	firefox.exe
3608	firefox.exe
3608	firefox.exe
3608	firefox.exe
3608	firefox.exe
3608	firefox.exe
6100	chrome.exe
6100	chrome.exe
6100	chrome.exe
6100	chrome.exe
6100	chrome.exe
6100	chrome.exe
6100	chrome.exe
6100	chrome.exe
6100	chrome.exe
6100	chrome.exe
6100	chrome.exe
6100	chrome.exe
6100	chrome.exe
6100	chrome.exe
6100	chrome.exe
6100	chrome.exe
6100	chrome.exe
6100	chrome.exe
6100	chrome.exe
6100	chrome.exe
6100	chrome.exe
6100	chrome.exe
6100	chrome.exe
6100	chrome.exe
6100	chrome.exe
6100	chrome.exe
6100	chrome.exe
6100	chrome.exe
6100	chrome.exe
6100	chrome.exe
6100	chrome.exe
6100	chrome.exe
6100	chrome.exe
6100	chrome.exe
6100	chrome.exe
6100	chrome.exe
6100	chrome.exe
6100	chrome.exe
6100	chrome.exe
6100	chrome.exe
6100	chrome.exe
6100	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
6100	chrome.exe
6100	chrome.exe
6100	chrome.exe
6100	chrome.exe
6100	chrome.exe
6100	chrome.exe
6100	chrome.exe
6100	chrome.exe
6100	chrome.exe
6100	chrome.exe
6100	chrome.exe
6100	chrome.exe
6100	chrome.exe
6100	chrome.exe
6100	chrome.exe
6100	chrome.exe
6100	chrome.exe
6100	chrome.exe
6100	chrome.exe
6100	chrome.exe
6100	chrome.exe
6100	chrome.exe
6100	chrome.exe
6100	chrome.exe
6100	chrome.exe
6100	chrome.exe
6100	chrome.exe
6100	chrome.exe
6100	chrome.exe
6100	chrome.exe
6100	chrome.exe
6100	chrome.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4324	mspaint.exe
4324	mspaint.exe
4324	mspaint.exe
4324	mspaint.exe
3608	firefox.exe
560	salinewin.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3972 wrote to memory of 3608	3972	firefox.exe	90
PID 3972 wrote to memory of 3608	3972	firefox.exe	90
PID 3608 wrote to memory of 4284	3608	firefox.exe	91
PID 3608 wrote to memory of 4284	3608	firefox.exe	91
PID 3608 wrote to memory of 4284	3608	firefox.exe	91
PID 3608 wrote to memory of 4372	3608	firefox.exe	92
PID 3608 wrote to memory of 4372	3608	firefox.exe	92
PID 3608 wrote to memory of 4372	3608	firefox.exe	92
PID 3608 wrote to memory of 4372	3608	firefox.exe	92
PID 3608 wrote to memory of 3864	3608	firefox.exe	93
PID 3608 wrote to memory of 3864	3608	firefox.exe	93
PID 3608 wrote to memory of 3864	3608	firefox.exe	93
PID 3608 wrote to memory of 3864	3608	firefox.exe	93
PID 3608 wrote to memory of 2632	3608	firefox.exe	94
PID 3608 wrote to memory of 2632	3608	firefox.exe	94
PID 3608 wrote to memory of 2632	3608	firefox.exe	94
PID 3608 wrote to memory of 1136	3608	firefox.exe	95
PID 3608 wrote to memory of 1136	3608	firefox.exe	95
PID 3608 wrote to memory of 1136	3608	firefox.exe	95
PID 3608 wrote to memory of 1136	3608	firefox.exe	95
PID 3608 wrote to memory of 5340	3608	firefox.exe	96
PID 3608 wrote to memory of 5340	3608	firefox.exe	96
PID 3608 wrote to memory of 5340	3608	firefox.exe	96
PID 3608 wrote to memory of 5340	3608	firefox.exe	96
PID 3608 wrote to memory of 5364	3608	firefox.exe	97
PID 3608 wrote to memory of 5364	3608	firefox.exe	97
PID 3608 wrote to memory of 5364	3608	firefox.exe	97
PID 3608 wrote to memory of 5364	3608	firefox.exe	97
PID 3608 wrote to memory of 5376	3608	firefox.exe	98
PID 3608 wrote to memory of 5376	3608	firefox.exe	98
PID 3608 wrote to memory of 5376	3608	firefox.exe	98
PID 3608 wrote to memory of 5376	3608	firefox.exe	98
PID 3608 wrote to memory of 5388	3608	firefox.exe	99
PID 3608 wrote to memory of 5388	3608	firefox.exe	99
PID 3608 wrote to memory of 5388	3608	firefox.exe	99
PID 3608 wrote to memory of 5388	3608	firefox.exe	99
PID 3608 wrote to memory of 5304	3608	firefox.exe	107
PID 3608 wrote to memory of 5304	3608	firefox.exe	107
PID 3608 wrote to memory of 5304	3608	firefox.exe	107
PID 3608 wrote to memory of 5304	3608	firefox.exe	107
PID 3608 wrote to memory of 4860	3608	firefox.exe	108
PID 3608 wrote to memory of 4860	3608	firefox.exe	108
PID 3608 wrote to memory of 4860	3608	firefox.exe	108
PID 3608 wrote to memory of 4860	3608	firefox.exe	108
PID 3608 wrote to memory of 1540	3608	firefox.exe	109
PID 3608 wrote to memory of 1540	3608	firefox.exe	109
PID 3608 wrote to memory of 1540	3608	firefox.exe	109
PID 3608 wrote to memory of 1540	3608	firefox.exe	109
PID 3608 wrote to memory of 5092	3608	firefox.exe	110
PID 3608 wrote to memory of 5092	3608	firefox.exe	110
PID 3608 wrote to memory of 5092	3608	firefox.exe	110
PID 3608 wrote to memory of 5092	3608	firefox.exe	110
PID 6100 wrote to memory of 4692	6100	chrome.exe	112
PID 6100 wrote to memory of 3648	6100	chrome.exe	113
PID 6100 wrote to memory of 3648	6100	chrome.exe	113
PID 6100 wrote to memory of 548	6100	chrome.exe	114
PID 6100 wrote to memory of 3404	6100	chrome.exe	115
PID 6100 wrote to memory of 3404	6100	chrome.exe	115
PID 6100 wrote to memory of 5216	6100	chrome.exe	117
PID 6100 wrote to memory of 5228	6100	chrome.exe	118
PID 6100 wrote to memory of 5216	6100	chrome.exe	117
PID 6100 wrote to memory of 5228	6100	chrome.exe	118
PID 6100 wrote to memory of 1148	6100	chrome.exe	119
PID 6100 wrote to memory of 1148	6100	chrome.exe	119

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\822aebd111355addae93611a61a0524f791db31748fb507bfe7d5a7a0fdf5996.png"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4324

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:2160

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3972
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3608
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1996 -prefsLen 27100 -prefMapHandle 2000 -prefMapSize 270279 -ipcHandle 2072 -initialChannelId {e13ffeb5-f11b-48a5-894b-b6bafbf86952} -parentPid 3608 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3608" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:4284
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2452 -prefsLen 27136 -prefMapHandle 2456 -prefMapSize 270279 -ipcHandle 2464 -initialChannelId {96460aae-3d94-4cfb-8d2a-9c998e3c9ca4} -parentPid 3608 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3608" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:4372
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3824 -prefsLen 27277 -prefMapHandle 3828 -prefMapSize 270279 -jsInitHandle 3832 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3840 -initialChannelId {4fd4889f-9495-4b00-b786-929a38268e62} -parentPid 3608 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3608" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:3864
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3992 -prefsLen 27277 -prefMapHandle 3996 -prefMapSize 270279 -ipcHandle 4092 -initialChannelId {3cd0efc4-1f07-4a45-9852-458c35e2fb69} -parentPid 3608 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3608" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:2632
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4368 -prefsLen 34776 -prefMapHandle 4372 -prefMapSize 270279 -jsInitHandle 4376 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4384 -initialChannelId {07ca2a55-74cf-4d55-8416-fa8ef5e2ece0} -parentPid 3608 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3608" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:1136
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4976 -prefsLen 35013 -prefMapHandle 4980 -prefMapSize 270279 -ipcHandle 4988 -initialChannelId {8379d09f-6feb-4629-a9a2-685c72575866} -parentPid 3608 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3608" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:5340
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5132 -prefsLen 32900 -prefMapHandle 5136 -prefMapSize 270279 -jsInitHandle 5140 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5148 -initialChannelId {9559133d-7c5a-4b8b-ab78-0cf713b22f04} -parentPid 3608 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3608" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:5364
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5412 -prefsLen 32952 -prefMapHandle 5416 -prefMapSize 270279 -jsInitHandle 5420 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5428 -initialChannelId {0f436195-7d1b-433e-867c-8c85a1cf43f8} -parentPid 3608 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3608" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:5376
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5444 -prefsLen 32952 -prefMapHandle 5544 -prefMapSize 270279 -jsInitHandle 5548 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5612 -initialChannelId {f4272828-b0fe-4393-ada6-8a53b9a91b6c} -parentPid 3608 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3608" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:5388
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6184 -prefsLen 34110 -prefMapHandle 6172 -prefMapSize 270279 -jsInitHandle 6176 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6100 -initialChannelId {3f75a962-61cf-4026-93a0-c27878215d81} -parentPid 3608 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3608" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:5304
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5808 -prefsLen 36758 -prefMapHandle 4308 -prefMapSize 270279 -jsInitHandle 6056 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5440 -initialChannelId {39a9e69b-e748-4ed0-a54d-adeaf47d0d1c} -parentPid 3608 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3608" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:4860
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5748 -prefsLen 36758 -prefMapHandle 5752 -prefMapSize 270279 -jsInitHandle 5736 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5724 -initialChannelId {082dd3ff-c256-4889-a8d1-f04f07459f86} -parentPid 3608 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3608" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
    3⤵
    - Checks processor information in registry
    PID:1540
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1364 -prefsLen 36758 -prefMapHandle 6492 -prefMapSize 270279 -jsInitHandle 1264 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6496 -initialChannelId {aad65e70-8490-43d7-a2ca-4b6580a65256} -parentPid 3608 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3608" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
    3⤵
    - Checks processor information in registry
    PID:5092

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:6100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ffcff28c728,0x7ffcff28c734,0x7ffcff28c740
  2⤵
  PID:4692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1784,i,11212022858344816298,15212334821629085586,262144 --field-trial-handle=2044,i,7180485636767983581,13273434535243727157,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2040 /prefetch:2
  2⤵
  PID:3648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2308,i,15067688490241686621,9763368211591121413,524288 --field-trial-handle=2044,i,7180485636767983581,13273434535243727157,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2180 /prefetch:3
  2⤵
  - System Time Discovery
  PID:548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2436,i,1750611239509347216,3589114870025931345,524288 --field-trial-handle=2044,i,7180485636767983581,13273434535243727157,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2608 /prefetch:8
  2⤵
  PID:3404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3248,i,16934040483410743864,839486326680647158,2097152 --field-trial-handle=2044,i,7180485636767983581,13273434535243727157,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:5216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3252,i,14425886409580886293,10919311082299761275,2097152 --field-trial-handle=2044,i,7180485636767983581,13273434535243727157,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:5228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4492,i,15185314765492894555,4342071464575818367,2097152 --field-trial-handle=2044,i,7180485636767983581,13273434535243727157,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3940 /prefetch:2
  2⤵
  PID:1148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4516,i,11680657657632227950,16699596807341647940,2097152 --field-trial-handle=2044,i,7180485636767983581,13273434535243727157,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4752 /prefetch:1
  2⤵
  PID:5604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5344,i,11057834991151729520,13681061777983939631,524288 --field-trial-handle=2044,i,7180485636767983581,13273434535243727157,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5432 /prefetch:8
  2⤵
  PID:1016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5696,i,909783392981453462,11973957250357441290,2097152 --field-trial-handle=2044,i,7180485636767983581,13273434535243727157,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5656 /prefetch:1
  2⤵
  PID:1688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3968,i,5868749776485697384,15249675933249484600,2097152 --field-trial-handle=2044,i,7180485636767983581,13273434535243727157,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4644 /prefetch:1
  2⤵
  PID:5184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5928,i,3692692474936195824,5872507278418408045,2097152 --field-trial-handle=2044,i,7180485636767983581,13273434535243727157,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5948 /prefetch:1
  2⤵
  PID:4708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5880,i,462867449627134596,4434353516537968863,2097152 --field-trial-handle=2044,i,7180485636767983581,13273434535243727157,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:2260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6184,i,9607492702223775771,16300146166508782800,2097152 --field-trial-handle=2044,i,7180485636767983581,13273434535243727157,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6316 /prefetch:1
  2⤵
  PID:4804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6112,i,37628421247111261,9751294892533324102,2097152 --field-trial-handle=2044,i,7180485636767983581,13273434535243727157,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6188 /prefetch:1
  2⤵
  PID:1620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6400,i,9581335615663763707,5177474112655967187,2097152 --field-trial-handle=2044,i,7180485636767983581,13273434535243727157,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4788 /prefetch:1
  2⤵
  PID:1244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6420,i,5693652501260589995,16424069619742065118,2097152 --field-trial-handle=2044,i,7180485636767983581,13273434535243727157,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5736 /prefetch:1
  2⤵
  PID:2200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6504,i,17269357392654973936,14378874745487872726,2097152 --field-trial-handle=2044,i,7180485636767983581,13273434535243727157,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6516 /prefetch:1
  2⤵
  PID:1952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6652,i,12472728469367742154,11253930353461471939,2097152 --field-trial-handle=2044,i,7180485636767983581,13273434535243727157,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6664 /prefetch:1
  2⤵
  PID:5564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6808,i,7631475266761940632,1275647442485406031,2097152 --field-trial-handle=2044,i,7180485636767983581,13273434535243727157,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6812 /prefetch:1
  2⤵
  PID:416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6956,i,13068681510324363523,14847340928082066716,2097152 --field-trial-handle=2044,i,7180485636767983581,13273434535243727157,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6960 /prefetch:1
  2⤵
  PID:5764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=7096,i,9931880500761728477,17819367410113948645,2097152 --field-trial-handle=2044,i,7180485636767983581,13273434535243727157,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7100 /prefetch:1
  2⤵
  PID:4772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=7380,i,9212719278409189956,7425914927480635281,2097152 --field-trial-handle=2044,i,7180485636767983581,13273434535243727157,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7312 /prefetch:1
  2⤵
  PID:5732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=7500,i,9054219671079503114,11402662006986837801,2097152 --field-trial-handle=2044,i,7180485636767983581,13273434535243727157,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7516 /prefetch:1
  2⤵
  PID:5728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=7652,i,17002837710049560672,14528960514350514431,2097152 --field-trial-handle=2044,i,7180485636767983581,13273434535243727157,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7660 /prefetch:1
  2⤵
  PID:5736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=7796,i,2859065025236841700,1000206868168222615,2097152 --field-trial-handle=2044,i,7180485636767983581,13273434535243727157,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7812 /prefetch:1
  2⤵
  PID:5748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=7944,i,16516389857682463204,15457879207453824461,2097152 --field-trial-handle=2044,i,7180485636767983581,13273434535243727157,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7960 /prefetch:1
  2⤵
  PID:5188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=8092,i,14270477010332620056,6782129044878676360,2097152 --field-trial-handle=2044,i,7180485636767983581,13273434535243727157,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8108 /prefetch:1
  2⤵
  PID:2840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=8252,i,15577161428551740782,16869738605660967819,2097152 --field-trial-handle=2044,i,7180485636767983581,13273434535243727157,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8256 /prefetch:1
  2⤵
  PID:5460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=8312,i,1502866154930620419,8264526714633163142,2097152 --field-trial-handle=2044,i,7180485636767983581,13273434535243727157,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8320 /prefetch:1
  2⤵
  PID:5472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=8456,i,13387901563046903177,915186135841113482,2097152 --field-trial-handle=2044,i,7180485636767983581,13273434535243727157,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8468 /prefetch:1
  2⤵
  PID:5584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=8684,i,4394011544430049157,5399532200471178094,2097152 --field-trial-handle=2044,i,7180485636767983581,13273434535243727157,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8688 /prefetch:1
  2⤵
  PID:5596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=8748,i,7460929460376725661,14629221272805342786,2097152 --field-trial-handle=2044,i,7180485636767983581,13273434535243727157,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8720 /prefetch:1
  2⤵
  PID:4784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --metrics-shmem-handle=8864,i,12964869055658179884,18300195208115461658,2097152 --field-trial-handle=2044,i,7180485636767983581,13273434535243727157,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8856 /prefetch:1
  2⤵
  PID:4760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --metrics-shmem-handle=9048,i,11776977991455069546,2324791278045630421,2097152 --field-trial-handle=2044,i,7180485636767983581,13273434535243727157,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=9060 /prefetch:1
  2⤵
  PID:5256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --metrics-shmem-handle=9204,i,5720113340301202325,18031454433612367031,2097152 --field-trial-handle=2044,i,7180485636767983581,13273434535243727157,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=9208 /prefetch:1
  2⤵
  PID:5928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --metrics-shmem-handle=9440,i,14053819077941902966,2047288294193483574,2097152 --field-trial-handle=2044,i,7180485636767983581,13273434535243727157,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=9444 /prefetch:1
  2⤵
  PID:5920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --metrics-shmem-handle=9580,i,9441687085764015732,8745454669232371370,2097152 --field-trial-handle=2044,i,7180485636767983581,13273434535243727157,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=9596 /prefetch:1
  2⤵
  PID:1660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --metrics-shmem-handle=9736,i,12668769215226489618,3078678772460062115,2097152 --field-trial-handle=2044,i,7180485636767983581,13273434535243727157,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=9752 /prefetch:1
  2⤵
  PID:5364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --metrics-shmem-handle=9884,i,9450415223025092694,2436780437329836251,2097152 --field-trial-handle=2044,i,7180485636767983581,13273434535243727157,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=9888 /prefetch:1
  2⤵
  PID:3828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --metrics-shmem-handle=10024,i,15171068449250329346,9953116883709645712,2097152 --field-trial-handle=2044,i,7180485636767983581,13273434535243727157,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=10036 /prefetch:1
  2⤵
  PID:4724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --metrics-shmem-handle=10172,i,4199002864277485740,4526816550490134012,2097152 --field-trial-handle=2044,i,7180485636767983581,13273434535243727157,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=10184 /prefetch:1
  2⤵
  PID:5400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --metrics-shmem-handle=10220,i,10065229209409041212,6107050583845282246,2097152 --field-trial-handle=2044,i,7180485636767983581,13273434535243727157,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=10264 /prefetch:1
  2⤵
  PID:2328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --metrics-shmem-handle=10236,i,3168116139430235770,3587019930044393567,2097152 --field-trial-handle=2044,i,7180485636767983581,13273434535243727157,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=10320 /prefetch:1
  2⤵
  PID:3604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --metrics-shmem-handle=10268,i,17238119442423157015,14445342467799807301,2097152 --field-trial-handle=2044,i,7180485636767983581,13273434535243727157,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=10316 /prefetch:1
  2⤵
  PID:4188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --metrics-shmem-handle=5676,i,10747377207495528367,11506082460766109333,2097152 --field-trial-handle=2044,i,7180485636767983581,13273434535243727157,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6452 /prefetch:1
  2⤵
  PID:1772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5444,i,14999386990700983971,9838411058707119787,524288 --field-trial-handle=2044,i,7180485636767983581,13273434535243727157,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3280 /prefetch:8
  2⤵
  PID:1660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5656,i,6351201482375944230,1015885792065254323,524288 --field-trial-handle=2044,i,7180485636767983581,13273434535243727157,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8580 /prefetch:8
  2⤵
  PID:5728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3344,i,17671661845167142286,8860670647558634117,524288 --field-trial-handle=2044,i,7180485636767983581,13273434535243727157,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6484 /prefetch:8
  2⤵
  PID:4724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --metrics-shmem-handle=4600,i,14592679012892418616,14186785971793492969,2097152 --field-trial-handle=2044,i,7180485636767983581,13273434535243727157,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3936 /prefetch:1
  2⤵
  PID:4112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6464,i,3132523497179687808,12477412985798976784,524288 --field-trial-handle=2044,i,7180485636767983581,13273434535243727157,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8512 /prefetch:8
  2⤵
  PID:2444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --metrics-shmem-handle=8528,i,3466554003796867687,1321627297324130001,2097152 --field-trial-handle=2044,i,7180485636767983581,13273434535243727157,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=10464 /prefetch:1
  2⤵
  PID:2672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --metrics-shmem-handle=10400,i,8232418278330560337,7943396447644187958,2097152 --field-trial-handle=2044,i,7180485636767983581,13273434535243727157,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8280 /prefetch:1
  2⤵
  PID:1300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --metrics-shmem-handle=8924,i,3675932536364368937,13789814248685478652,2097152 --field-trial-handle=2044,i,7180485636767983581,13273434535243727157,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6424 /prefetch:1
  2⤵
  PID:5756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --metrics-shmem-handle=9956,i,8897530991499356220,11670971053625198599,2097152 --field-trial-handle=2044,i,7180485636767983581,13273434535243727157,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=10004 /prefetch:1
  2⤵
  PID:3964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --metrics-shmem-handle=6180,i,7976772295872647609,3013600942635307287,2097152 --field-trial-handle=2044,i,7180485636767983581,13273434535243727157,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=9304 /prefetch:1
  2⤵
  PID:4224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --metrics-shmem-handle=10520,i,13198573071903450641,2345780120916182601,2097152 --field-trial-handle=2044,i,7180485636767983581,13273434535243727157,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7144 /prefetch:1
  2⤵
  PID:6064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --metrics-shmem-handle=6924,i,9091189210265131649,15173639951933408494,2097152 --field-trial-handle=2044,i,7180485636767983581,13273434535243727157,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6884 /prefetch:1
  2⤵
  PID:2256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --metrics-shmem-handle=5724,i,1649384755847238639,2516340114986805905,2097152 --field-trial-handle=2044,i,7180485636767983581,13273434535243727157,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6532 /prefetch:1
  2⤵
  PID:5868

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5128

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4120

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3836

C:\Users\Admin\AppData\Local\Temp\14fc6e6d-1635-4414-955e-38e3a65ec433_salinewin.zip.433\salinewin.exe
"C:\Users\Admin\AppData\Local\Temp\14fc6e6d-1635-4414-955e-38e3a65ec433_salinewin.zip.433\salinewin.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:560
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD hkcu\Software\Microsoft\Windows\CurrentVersion\policies\system /v DisableTaskMgr /t reg_dword /d 1 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5136
- - C:\Windows\SysWOW64\reg.exe
    REG ADD hkcu\Software\Microsoft\Windows\CurrentVersion\policies\system /v DisableTaskMgr /t reg_dword /d 1 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:4328

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x510 0x31c
1⤵
PID:5020

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 3281d9ff2e700cd7668afc4c54ef41f640f48aa9450a1821348c577c1b1c601f
MD5 42880f16b251c136c30a5c9ba58d7060
SHA1 9054759e83e770bfaccc5ced725eb7bb333c6953
SHA512 62ee8bc34b4984967d5641c3767cb945ee32966529733f8b3c7dd2149fc5917316b39341cd8458913cc1b3d91d4323997abd290cc94f8a0b799f5237dc79087f
TLSH
T189E022AAC922EC7718FC0B6950988B86E75013172B80894B7A3C910DCFB1B3E519685C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000006

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000006
Size 38KB
SHA256 7165713d3e1a610399471a5e93d5677508f62ef072c1151e72273bf4bd54f916
MD5 9436affc97843765a966b3568fa7e5ec
SHA1 7bfda74bb30589c75d718fbc997f18c6d5cc4a0b
SHA512 473ec3a843c33e18d6d194651fe11353fcd03a7959225faeabf8c77484155ea6a7bccb72dbaf2093ed53c408faa3be9f6fc907f7a5ddf8223375f9d09b504456
SSDEEP 768:eUEh2+iKBVQbBhu8vjenqz2Ez6Y/AxHLEaP72sV9qKYbDblXqhP8qwFSE3uk:eUEEoBVQDjeQaLnP2pfZTqgSEB
TLSH
T11703F112148F7FA1C244F224A4EFE416ACC3F565ABA15E6980B8B7C7010E3C657A46FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000052

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000052
Size 21KB
SHA256 b9e3d011c7087541d4918703e43435f9407b8113fef5bd6d60220438acb27210
MD5 ce8f091c5ea755b9c78dd50566e30240
SHA1 4483642b912a881350ce30b7f38f977a702b5bb2
SHA512 6d6a1a708d38d8caab4373e4e4b8eec25e7f816d530c832fcbb808e1ffa906dba65449c179a6d3f476d2e5a0015b521647256d2a96f068cf0f8f7d03e15de9fa
SSDEEP 384:k8n66HhfttS14euHakg0UlKBlHl3R3w/QfIOWPWEysKed7nFYg6gMzAz0R8F7rGF:k8bhft+uQ05FhAYAXuwxOgmArGF
TLSH
T188A2E1D1E0C64866E113015E7D9F57A7C5FAC8A13467C1E88F2978CADC563FD12B0832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 4KB
SHA256 1a8f0e56a02d7b080b2b943076993780c35f7a52488fc39e3f6169cf1be26e35
MD5 b271daa723d523be248098d3b6634f29
SHA1 5f325d4ae10304dc8907bae7aa2d730ceaa48bc2
SHA512 8ad3be48550b7e576dffc07b293e62f310515e0bd4e37763489fc3d5849f88e89e8cb0ac2a9ac19f94606ebd7324cbd86fea44f2e866891adf3cb60ca542d747
SSDEEP 96:Y/plQ88kDnZ/jA5jkMi4XbbWw0QRkjjTJBuHlH+h:w8kbZbA5jkMiObWw0QQTJBYH+h
TLSH
T11FA12841139A881BE73199F965F55853F372015E2B571F56BF1BF9B0D10A3AC940F300
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 05b71dc51aa0feb02c4cee827ce4d5839f76cc85c260b459c466ac2e93b0e070
MD5 506dcb96a43668bfad6a46bfb120e51d
SHA1 cca4d5522f23bee6154aa93893140e7b3fd3aa04
SHA512 15af40c5d5fd5bfc8981e07175130c33f0aaab3a9f1e69da5e949ffc92dd166ee0c05559c623d37044d7412ed01674fce41c17bdb29c6ab58737ba872cfd3ddd
SSDEEP 96:lplQ88kDnZ/jA5jkMi4VbbWw0Q7kjjTJBuHlHo/:b8kbZbA5jkMiIbWw0QaTJBYHo/
TLSH
T129A11641239A881BE7319AF965F48953F372015E2B971F967F2BFAB0D14A7AC940F300
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 31KB
SHA256 94376dc915068bd08059975e0e39a24f754fd21821ba26fb7324bf932045187e
MD5 9bb483bfab666f7b0e60929b3a0965ec
SHA1 d5470abd4c3b4ef73a7bc8667078eeda1724c25d
SHA512 5b02f2b9d70ae42cf6a667daa81752f84614ffc18c3bb8e7c5baf54e4a245dfd6f3671c404fa1f151698174da8176a42a881b35e377ee9f3081273add07b1972
SSDEEP 384:DMMtmoGJ9vJvJHwchgCex2ya5YBe8LAcj8jZ2JoejQjk/XjBeQa1jOJjwaIf3JL1:OvZYnj1mPKOPN1FI1DcgC4S
TLSH
T121E2B0F7C7F86A7DCD2196F46B152E1FCE1D0925532C3C1A89E4AF1A93E1871E201A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 3KB
SHA256 010e33be4010ebd398154be7b5ee36ab4d5aa601ec2b5fb2063a43860c5d2afa
MD5 b16399eeda2dfd65b476229dbb182a7a
SHA1 e5be78d1f007ed753e331b604116563e36f4511e
SHA512 11da2d20a7d9831a3f292e52578b49729b145ad30b654e9dbf20a94c21600dd060c05591a2602b233408bae00e78a41adc96663c162b795877b642405dc67639
TLSH
T140619D97D67EB85B913A5CBB0E04F809197AF83A477164F9EF53826C72C98F30A17412
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 da57f5b55d366215fa93a20bc5d517600a36e5d5116cbbf8c9e7a75ccef3eed2
MD5 2a1b96e55cb8ac2ef7b81bab57dffd7f
SHA1 6a3a62962d4ed7f8f71c480f291e4ac909e8ab34
SHA512 6dc75c1e103b4888ea0c31e61f55a2e3cc77e1a50bf07b2bde634dbea30ff833d1b7b4d9534c5781d0a50420c132c181f9d7eb9948e7cf579aa8dbb3883cd372
SSDEEP 192:DRFcBzskH/1wDWMv7PpAPRp2Iul9YHsb+WNnHU4pm2IvNoza0sgjVyIsnAUgtaJ:DRFmzssJYjUXYWw0D2WKao8
TLSH
T1E252D76EB918793B5DD7C329FA527797D7F6102221942EC0E6FC8A1C19EB9CC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 22d9bb10478f7da42a6608f78ea923d3b79b64dbb884eb50f2a97fe50d47653b
MD5 adb48bb5dd545933b2c0ab23bf8c739a
SHA1 fdabdff209b1e5662962cf7be648ee1886cef79f
SHA512 034c5e4f20aa071529350cf9a15aef61815d08053f728b7348e600fefb48a5b6c8e571b6bbc13f40d0ef7cc132b2605728fcdc79208c44cbc5295d7aa53f3f22
SSDEEP 192:DRFcBXckH/1wDWVv7PpAPRp2IgFy3lA9YHsb+WNJBFHUhnk+p+WDvNoza0sYjVyr:DRFmXcsJljUXqtWwK2tWpKaQe
TLSH
T1F952D96EB914793B5DD7C329FA527757D7F6202121902E80E7FC8A1C19EBACC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 84d95cb1ec31305faad5cc4095ee68215dacd7925ba16bf2e79898c83762d28e
MD5 63eac5271c37c869f1be4e5699edad42
SHA1 62bcc728c5cdd3b1c422c8ed3a2de74073c4e9d9
SHA512 b060a1b8a6605f2d7517e480f9664960eeaefb4409b96450047efc669e8d56626084988185246ded392fa491a581f1eeddb2dc5befede8e9bbbcdf4d8fc910cc
SSDEEP 192:DRFcBzskH/1wDWev7PpAPRp2IgFyl9YHsb+WNRgHU4pm2IvNoza0sgjVyIsnAUg8:DRFmzssJajUXq4Ww1D2WKao8
TLSH
T12D52E76AB918793B5DD7C32AFA527797D7F5102221942EC0E7FC8A1C19EB9CC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 48ce1406c527816a785a1be69e0dd7a9700aade953318d2bb560bb694571c78d
MD5 53f39da803134fbb015d8d45e17a792f
SHA1 5f8a8aab912b060cc14f97c5710fa2a80287b278
SHA512 5f2b0605d21ffd3bbb4571d270e1ba71d37d480bcc3ba88f54df45cfd8e8b27164e6e6f21bdaa98f4b8ceef94d71ab95172a93084d2e2a04423180ead85adf29
SSDEEP 192:2RFcBXckH/1wDWVv7PpqPRp8u+cgFy3lS89YHsb+WNJ0LS8eFQphnkYtC+p+WFvs:2RFmXcsJljaX6AWw42JtWPKahe
TLSH
T1A862E9ABB914297B5DD7C329F952775BD3F6202221D02E84A7FC8A1C19EBACC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 fdd7bcac41776a222f28596e0d96a0779185e523183af62141290c5c89140230
MD5 04b0cfd09379e49a7b5bff0875c465d0
SHA1 f15e1655b1b6699f1793af45e62d10dfbd34957c
SHA512 6df606a6e8139cfa9cce7690cf98f1a957416e5764d2f973f27155cca4ddd5340044d86d0c30825b1109ba795713b806548312e36b63c1273a3d03b41da5773e
SSDEEP 192:DRFcBXskH/1wDWVv7PpAPRp2IgFy3lA9YHsb+WNJBFHUhnk+p+WDvNoza0sYjVyr:DRFmXssJljUXqtWwK2tWpKaQe
TLSH
T1A152D96AB914393B5DD7C329FA527797D7F6202121902E80E7FC8A1C19EBACC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 4438812d966e1d11c2f4b4dcd5703934145668a842e5f18c309b93e6cd0ba09c
MD5 1386314059085d62a9101bbf1a039b65
SHA1 c0c9d9db0103f0aa592eb50b557e1c7af59924f0
SHA512 f7b9944b5b23df4170a875adebfb1950f8d576c4adda2b26467f584019e888c6a674a0a567adcf681cb9c5f7c120924ecf6d54fd0463d975b4fb31a520df19c2
SSDEEP 384:bxj3K7KxkXqKf/pUZNCgVLH2HfgslcP7pLuLcSjlAXOD3u+ErU3KMHGu/g2kRm:bR3K7KxkXqKf/pUZNCgVLH2HfgsmP7pS
TLSH
T1FF72F967784C9E370F94CACCD8177B4F9DB5015B65E9886483FA581903D8BDE11092FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 760038a344528e050be40a9ca58749156fcd9feeba8828b1c239c327216e6e45
MD5 33960cf928e2393586b1acc78b1ac000
SHA1 d35f142825ba79d58242b79083deb9647ad1fd9b
SHA512 5b71261e69d61013ea77c36b22b7420cdf371ee5e315f31a8a5a76b55a22d2ec07cf30b778001b877b248dec155b5d9dac2311613ca9a1f91907d8ad93dbdd74
TLSH
T1B9B012818002A142C40602F41983188C7125AF10960E170143F0E9778825590C024050
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a8454.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5a8454.TMP
Size 96B
SHA256 b36c6515b2d15a48c6e9d16a0bdad98dd8e5dd1b94ae45e69358d4dd7d20e38d
MD5 f58aa809b0c1f45a797027640b34035c
SHA1 3931efd4d33d3983bf5582da273e715a09a7255a
SHA512 6c889204ae54ca1e3ef2f8e738ccb8876e579ebeb142c9a1055384f74fea7e1cef63a04d0ee8db45ce2411612fcc13cf8e2b672dfa67c24abb3b5dcf7783a532
TLSH
T162B02202C002B302C0C303B02882CAC83020CF22CA03032A83E00A23CCF02200020820
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 120B
SHA256 1fde42ba2efeeafad8e4819c1e9cddfe60efde30afd47927ae396cbf183ed97b
MD5 26056b5ef22b89c6d743dda081c1d343
SHA1 16129fe5c75bafb8451e09714aa6d3436726befc
SHA512 a4134afae3a419a3b242a7ea31dc31426f1fe6cdb4b08a04b3aea1480f571be2bc7997887b8e0b9c039a74b62ff39bf5cf6772dd5099cc5ae96f124e2706b815
TLSH
T18AB012901241250ACA81D73047D001C033105A0403E10F0301D04048F0319C75943104
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 240KB
SHA256 74cec61aeabc6dd5eb8bbc7c72d28b8367f5603861533eeaee5535d8fa509640
MD5 cd2258ff14f2e37e742cb8e7d43e9077
SHA1 a32243b639c9ba5d598b0ce177a58df5e058821b
SHA512 384b1362026802d4bf942d7c73614f1c2a0ebc6b222fbe55db3deb195899b97221583893751267700dafda6387617e96769c899e91b0d0d333c4037dab1b8eb5
SSDEEP 6144:9v7gyHdua++A6CsEoU/+Zn26tbtrm7Rkm1tYpBeh2BAoL:hlHllCjWZNq9oBGcAoL
TLSH
T10C3423639CA45C37A95CA7EE354E464E5EF108E3E918E1E0C5D19908B7FAFCD1809E70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 241KB
SHA256 ebb31f0647289eef6613fe661975d42467ca30445b7393e5d68a5a5c900d7651
MD5 1427cfc5cbbd2d9834e75f2f44906cf5
SHA1 82670cb06eba26e32d909e556c49ab0585cfdb94
SHA512 75048c03e18a85c194a084296a89cb3a6ed33d0eac765ba55f1db9ab4e23b6f508c32884a71ef32fa819fff2ae737168c314559816cda821a485078ebab568cc
SSDEEP 6144:9hugyHdua++A6CsEoU/+Zn26tbtrm7Rkm1tYpBeh2BAoL:YHllCjWZNq9oBGcAoL
TLSH
T1EF3423739C945C36A969A7DD354E464A5DF118E3EE08F1A4C8D0AE04B7FAFCE1809E70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 241KB
SHA256 ac9f6bb005f53ea45d8488077fac44aeb1098bcf1947d6684c53d107268d74f6
MD5 350e61c1a7a55c4508bb4241dc8907de
SHA1 73867e7e23e0110a672837f2773caa33543d09ff
SHA512 b7b5cfff68b8a7d43a267920755e3cdab119cbfe6a18d72482bcb7fdf19612f3526c3d562182fd265c2f4f2cd0b970a606754c18239b44adb16b27f11328bc0e
SSDEEP 6144:9hhgyHdua++A6CsEoU/+Zn26tbtrm7Rkm1tYpBeh2BAoL:3HllCjWZNq9oBGcAoL
TLSH
T1913423739CA45C36AD69A7DD354E464A5DF108E3EE08F1A4C4D0AE44B7FAECE1809E70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 3f1e9f7f9dbf76d095cb8782a92357787565b8f40c339c4ceac5f2a295507cce
MD5 5ee9296fc590c94c651df18a320cd74b
SHA1 b03f5776cc216b5a97ccdef02b6f5253bd15a2bf
SHA512 abac451e7b8d56c136427178be22034cb3a4465d344b78b8a882392d6e1cb97ca4613f54840d8e851cec51ec064e4dce58ef604fcb5f71ce0a058094955ef01a
SSDEEP 3072:29Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMa:2Um7Rkm1tYpBeh2BAoa
TLSH
T19DC3123B5D75E9375978AB4EB08E0B1E1EF149A6D930DE92C8D85B0437FA7CC0A04934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 241KB
SHA256 c5490a7da831942247b3ce28ccdbd518caf2a0f1b768898dda39c561e6874794
MD5 45ad99b0ddf3cf8963e1c87195a0de0d
SHA1 71d66c5c3cb175e00d37a92920a76f4c70d8bbe6
SHA512 6572770588d0b9236c5324b5990e5436e1fdc2420428e63af57211e56c50714722f078e8dbdabea43d8d4e6b6c8d7c6c188ce95470becb0c53d4be21141b4fd5
SSDEEP 6144:9YugyHdua++A6CsEoU/+Zn26tbtrm7Rkm1tYpBeh2BAoL:xHllCjWZNq9oBGcAoL
TLSH
T1CA3423739CA45C36A969A7DD354E464A5DF118E3EE08F1A4C8D0AE04B7FAFCD1809E70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Size 264KB
SHA256 c56aaff2822afd77dcd80044a153a82d944cc071643cf57c1de8b9b86e14c356
MD5 0322f4b66432b0787a1e352970bcc943
SHA1 d66f895e314e3ec2ab7ac1e1ea386ebee6956025
SHA512 45f27b1a71624d627049f47168623f1294921264e94bee93c12170e899f403794ffef7c1fe71e32f5b4c2068bcd072724d4320cdcee82fb46fc9b8895aa51a24
SSDEEP 3:MsEllllkEthXllkl2zELzzl:/M/xT02zcXl
TLSH
T1CE4404047FD00C05CF4010304013C3500375D5100513D743347144135CC75D00C17000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5E43012191E7B1F510ACD5BF039D8BF1B9A277B2

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\k6rjjdvz.default-release\cache2\entries\5E43012191E7B1F510ACD5BF039D8BF1B9A277B2
Size 16KB
SHA256 cccad4729b5279a2b885de566129ed42576a09eeeb45285dd4f02e48d210e471
MD5 85f16a5629d41ef7b3c992fe71a3a2eb
SHA1 762c4b026b97ecb120bf234d1bce82964025f38d
SHA512 9f8b800a6aff40eec3c00501ff4452f5183e9164d65747eb87c1743a1994766d565d75931e1d02d9896d052c49f9159c646fd9c4f5e25a4a838568d4350fa3fc
SSDEEP 384:HkCjiO024YZDL84KKDL849B7SOEAd9KVRaAcP+AWRMAMM:EzZYZDL8lKDL8CB7S/AmVAf+hRMq
TLSH
T118728D795F003CBC1597C0E8C5F9929A8D18B7A7CFE6806D21583D0DCAD8AA9B1F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k6rjjdvz.default-release\AlternateServices.bin
Size 10KB
SHA256 bb3d47f5229eae304491fd727e311d88c54f312aa8b58af517811a14f5d90a05
MD5 6fc3557e8759f8e1dc6048240ae8c7ec
SHA1 3042b1b3aaa1c4ae23c40d828aacd79b564822df
SHA512 1bf7c90a5ece3784f14e3bbd2bf8b7483c4228e3c2ba7801edd925a89ebccc84ef0dc92cd4c8402ac52ea3bbcc8eb071be6ff0bd9357ce87a476dae1f8a37064
SSDEEP 24:juhMZ/kx+lzU91H+9x/UfBS9BLUfBm9VvxUfBN5q9F55A5m+m9Fh+:a425EgAscBoDI56Pc6
TLSH
T1E32289F37B755462F0A28FF1C059318CCC3327265969D5D8CB5494E302C5AE9917EBE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k6rjjdvz.default-release\AlternateServices.bin
Size 17KB
SHA256 410c0b3e145b2cfe95b074d92d98be747a1bdf5c6311cf3f9a05134294f0692d
MD5 8f1ac2302f164b6b939c736336765ff1
SHA1 153090ffa17fdb9c732da6990d51248f2c2b9e8d
SHA512 6c10d18dee8794c8d94f20393a91aa2be76cb5f293a1149c6897ffeda7e4482d5c0c8c44f85abfa9c077bc050387d56b5bdcc8d65fd75a6bc3fd89e28aaa73a9
SSDEEP 96:q4+8+rYWj8W5BgWtI56NWsAuTDGM/pXByx2lmyuZQsy8tQ:sqQ/22MZZnFt
TLSH
T1A48273F77BB16462F1628FF18058708C8C332716586D95C8CB5494A703C5AA9917FBB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k6rjjdvz.default-release\AlternateServices.bin
Size 17KB
SHA256 d7899a5a2ce05bb9bdcad26c44a43d7a55162458254bb00f0bdbd5a7e396dccb
MD5 456d9546011c6d3a9abdbabf8b6afc3c
SHA1 bce3d6d03bb7a2556d84f848e553e4a403f28443
SHA512 ba5cc8cba679b166d6f71319103c2afcb7fdb5cbdd8460b4639a6fdafec113970f0ef295c14a335fa37f66ee0dbd6a6b35c1b8f03d63a1a50eab49fe7f3303bd
SSDEEP 96:q4uYWj8W5BgWtI56NWsKIgM/pN/yx2/8yuZrWdAy8trW:pQj22kZZrEAFtr
TLSH
T1558250F73BB264A2F1628FF1C0A8708C9C333626586D95C4CF5494A703C1A9D917FBA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k6rjjdvz.default-release\AlternateServices.bin
Size 17KB
SHA256 20b08abf184b36cd2e267cec681ffc2d58fb182439240c73de52af08d8f06df2
MD5 649d1f577f6a90c6fbea08282a276e3f
SHA1 32da3e22333a7cd0f16ea63272ed287db40dc896
SHA512 63dac4593c1323088f9852862bd4f9845590d0b89db505866673b8ca4d4df31576d9bf349cce20331cbbab1a4f6f332683d41516fdee47505625f1000621c22e
SSDEEP 48:q4NsgM/pNN1HSD1HWHf8HSuH5HLWddyyxytrW:q4NsgM/pN/yx2/8yuZrWdAy8trW
TLSH
T1B68252F73AB22462F2728FB19468704C8C333616895D95C88B5494A603C1ADCD07FFA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k6rjjdvz.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 4373b07d544c6c88308825feb33b4aa918ba2dd2bc1d015e06df7696af895504
MD5 cbd6eb1261ae05a8024fc20308fdb3f9
SHA1 1b9355952e9ef16b7887a1fac7b5c68972c1d85d
SHA512 ee57acd2986f9bb03c33d806e207f9d05dfad042c4a2c4d74133d8e1e3c68d52d90f3add29468982816f1eba937f0597e47a701cbc0ad1af6c87048073fb4a01
SSDEEP 192:w1d66Joz1zgCl6mc0dZOv5zboAc6pyjwcD:qd66Joz1zgC1j8bob6pyjN
TLSH
T1EEF12064F629863BC40402BBCCA51B450F39394BD84E7F2936DC61182C5B2ED7B9D2BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k6rjjdvz.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 5c1cd486a36c369140fbf4315a59864cb0ea70f7415330637c08c156a886af2c
MD5 6460b5d6ab7cdc2b987dd18a3e0e51e2
SHA1 459d29ac333663f20d94c44456feff2b92ce95e2
SHA512 fe3b6cc966c40a04f2263bd86489a02bcdb996809b964423d2c1ebc5d98b5e4817a816259185a2317648615ecbbd1ab7d17aa10e2f4984ba4f0a04ecc2850a21
SSDEEP 192:11d66Joz1zgCl6mc0dROv5zboBb6pyjwcw:zd66Joz1zgC1jEboBb6pyjm
TLSH
T175D12164E629863FC40453BBCCA11B454F3A355BD84E3F2936DC61082C5B2AE778D1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k6rjjdvz.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 a98895219baccd5a7a0bdb06cbb6d2f045a260c03cb0a48112fbde21f17655e8
MD5 f5e30f2b14f5c57cd62c7187af4336c9
SHA1 bb18e96a0c4103c493b8a3d466a50f6f13a1d69f
SHA512 11870c784cae59af84665943442315990e42894e11167e4a9fbdd917840a8abe7cbbbe1352f003cd03a6eff566891d8b9af07f7d025d25b1ab60f4dc9a8a13c3
SSDEEP 192:11d66Joz1zgCl6mc0dROv5zboBb6pyjwc:zd66Joz1zgC1jEboBb6pyj
TLSH
T140D12064F629863BC404427BCCA51B450F36395BD84E7F2936DC61082C5B2AE7B8D2BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k6rjjdvz.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 67e4b69a4150df2abdc58a1fade16ca250b7a9061d7e1eb2a05cf17abc192cc2
MD5 487c4249bab0059d4d058b893298a538
SHA1 291adbe4b591d3b659356c72d957e3a4268763a7
SHA512 5e9411ddd4fb7613b19033cd9136a24e2cd4a19f11e1e757287a875c2872caba221078286e55570e51fb5ceb7a2f08fef6f9359b15ba85563c39fbc848b283b0
SSDEEP 192:n1/66Joz1zgCl6mc0dyOv5zboA66pyjw51H:1/66Joz1zgC1jnboR6pyjS9
TLSH
T10CE11F64EA29863BC01443BBDCB51B450F39394A984E3F2935DC611C2D5B2EE7B8E1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k6rjjdvz.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 aac5ba6c8fa2ca9eb9dfa944a3b8c3da821f91126ca04e40eb0f7a885cf07689
MD5 8635974d8f6c70e2238be8e20c0625fb
SHA1 6fe1df2fb4b326d2523379300bbf7c6d7a714b58
SHA512 d3ca0b6600f65751bb8ee532a35990aa89e9380113013713b12fd64ee1f1ef52dc95dd5eaa8383920309dacc9471a6b9b364b3ace59356d6e6960163a2a9891f
SSDEEP 192:+1d66Joz1zgCl6mc0dyOv5zboAjZ6pyjwcD:Yd66Joz1zgC1jnboiZ6pyjN
TLSH
T115E12164E629863FC40402BBDCB11B450F39394AD84E7F2936DC61182C572ED7B9D2BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k6rjjdvz.default-release\datareporting\glean\events\events
Size 1KB
SHA256 06a428e12cd61b37444da80563e4a8d46dec5103c8a8f484542fde101900dbdb
MD5 fd1e7f84cfb374a2b5e017ac1824e496
SHA1 799ec48439f3865dd80d1677e3e7d9a58466f63b
SHA512 36e28719fb4bc1eb769223ba2b54a31e05c53299160c6ac7aa1d2f7ae318673ac335f3cabb6c90e8f81d1c04bcae9c18874c637fb0e02002554f8f03af9bc20d
TLSH
T1F9213A9C39F84DAAE9C7E29CB841018E57958E0718871D470F12FE8DCFD1ADD326A539
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k6rjjdvz.default-release\datareporting\glean\events\events
Size 4KB
SHA256 702ac498773cc34e2b70c5683a2a2255e6a78f65551f80acd119b66d40a7216b
MD5 532b1464d14abc87c7aca140dd6389a2
SHA1 90c7fed244264fab4149ce0db5501e411000ca11
SHA512 fae969a3bca1eeae5f35bb1f492d68930ba7ee337339f0dc258ec3871f6d81ed39abf36c1cb79469c4ac800b6e84c49336fa8dd6f9768abb5976957b4f468595
SSDEEP 48:Ypmk6ABbysxR0WxbBJptTotV1+IJEXHgfqCqhsi/hsaSHjjZrA4P3+b33ZfHC39x:k9FXG0ulAZfisfk4Pp/n2xdVp3
TLSH
T108A1001D75A90CFE79C7D29DF840028D46DD8B0398C71D874DABEE488E8665E321F62D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

28beb38a-aa48-4714-94f6-6e41091af67d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k6rjjdvz.default-release\datareporting\glean\pending_pings\28beb38a-aa48-4714-94f6-6e41091af67d
Size 235B
SHA256 6182dcd7168d9b1942d6d8a69bb9f1ecb533de309f74b7b11fe5e7b1078a4b0a
MD5 3958ed64afeb475613bcd9be86d59555
SHA1 01d8a4d05453c0a41d059756790581b7b198e6c0
SHA512 9ab18657872932ef4bf59986fd2b94436a816ee9a830828f6ffc722984a78f9f09f13c1bb4b2f7a4f918c5e228693c6235fc062176ee7cf48bd79889f9427642
TLSH
T171D097802488371C48001F0BF4B02ACB30C44C332476A820DA9000B899BFEC40261807
MD5 SHA1 SHA512 TLSH

Submit Download

4e1d7794-bd80-4183-ad74-e50ba088f6d8

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k6rjjdvz.default-release\datareporting\glean\pending_pings\4e1d7794-bd80-4183-ad74-e50ba088f6d8
Size 2KB
SHA256 11462cb1f3818f68c96ca8a21619f44a9d47755a5f15db0ce9173268c5297bfb
MD5 eb3bfcd30d14e58de11f9803f61c66d4
SHA1 9d9b87083466aef9563c7d096c12de7005855a6b
SHA512 b3565b41465f85ec792f2e093a6c03a841170d2ff4a4b4c90db1b04a420863dfad5908e2f0346c35c34fd1973828d7fcb30fc2b2885289842f516e2200b79464
TLSH
T19641235C75785CB79CEBE1DDE482238E97704A0240C51C932E52EF0C8C9A6AD336A92A
MD5 SHA1 SHA512 TLSH

Submit Download

79014958-3e44-4e03-ba61-2c4fdf422018

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k6rjjdvz.default-release\datareporting\glean\pending_pings\79014958-3e44-4e03-ba61-2c4fdf422018
Size 235B
SHA256 762f9360db678e7e2992f93374a622fc2d8accfd48bed2831230b5615360d351
MD5 432ec50c995bc445eaaf22a160461aee
SHA1 9c67d3d174f4f7a0c2d3174fa339b9d130f5b093
SHA512 613f0cb0c2c813cc962ce9c770a22c58320c3fe28efb84fd4f46b2269ff5029e0dfab52ee8bc0c24456fe1f4dc881fd44b9dd362ca24a3272119403acb2f7a1b
TLSH
T166D0A79018A8675D0C154F1BB1E069E775948C3324A99850AA6145F4AEBD9C8526191A
MD5 SHA1 SHA512 TLSH

Submit Download

8535c50d-6485-47b4-89fb-b77d7462b042

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k6rjjdvz.default-release\datareporting\glean\pending_pings\8535c50d-6485-47b4-89fb-b77d7462b042
Size 883B
SHA256 819470cacc960f52f2483a30b7108246ae48f4aad7e9e51a6825f324c7d5157b
MD5 9e7877ac66d1a9994f3034c4f6b0c280
SHA1 633eeeb6b872b7bbb91fa7ea7196c7442e66e22c
SHA512 65caba109e11f7d6449af007a26301a51ba6f1d79b13026f811fdff1274ed3c2aabee362841064ad5fa3c6702ee3d4d8402e1fb38d52ce25528bd0caba8d619b
TLSH
T11E11C0819532B9B3CC68929BC56177068BE8762380C585183FA15A141C6F53DA77A70B
MD5 SHA1 SHA512 TLSH

Submit Download

91b2ff17-69d8-4ddb-bd3b-4cb2616d7533

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k6rjjdvz.default-release\datareporting\glean\pending_pings\91b2ff17-69d8-4ddb-bd3b-4cb2616d7533
Size 886B
SHA256 3095604c15aba782cf792f52b03ae078f63a76f77fc41d4ffc334dc164888219
MD5 f8e2090fa8e262853b890d5a9908f1bd
SHA1 c031ff4d88c90057ce32ac66f9cac5d801ee5ed0
SHA512 cdff4c6e3e982efcb764b53c174c193bc3b0bf01301d69d96d0178ea7c5a925b51e302467d51512406021ce548490f944421cc99ed94efd3d62762c38ae30d43
TLSH
T18F1104419633B8B3DC2891C795A0B7028BB53123D0C64D147F915B280DAF13EB37630B
MD5 SHA1 SHA512 TLSH

Submit Download

af997531-8c6f-4e78-81d8-db3d541fc569

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k6rjjdvz.default-release\datareporting\glean\pending_pings\af997531-8c6f-4e78-81d8-db3d541fc569
Size 14KB
SHA256 a675dd1733aa942cdb2e2cefa5aff7e39802388a129d1d74945884a2e14cbbfc
MD5 a756c1f3317777d18a78c7c05369311e
SHA1 3212b02b5e78a48336d7b0138fe97e0e5fadfaf1
SHA512 b4569f4ef1c1c71b99a301585211325c5b02bc5a35980d312e6043a1df8d47d736af312cc9728d8cfbffcb6eb2e98919b74f581d34cebdbf4485888b6559cdfc
SSDEEP 192:4jubQQosPOry7/2uOTThRNxuwJVVCRN2crvSFniBU1MhWC9wWFzpzxKbYSjxTc:dAsPO+7OuvRSioezplKbYSVTc
TLSH
T1F562D7566420487B8691E368D9EC7FC3E2F618CA8C419FCE9BE47E0859EE06D1127C4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cc36fe77-c31a-4500-a71b-9716335b0fef

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k6rjjdvz.default-release\datareporting\glean\pending_pings\cc36fe77-c31a-4500-a71b-9716335b0fef
Size 12KB
SHA256 4d94bddec710b2f0b67b64292ce9f27e938f84011e3fe083b987f554ea82e7f8
MD5 a8d6adbed2a6b057aa80559bd78f9b97
SHA1 0d74f64dd1d07421865cb737118c2a6ae205aaee
SHA512 b5e951c376fe42aeb62488cf72d6bec5d7a9bcd2c1968d0775df348dd34b91923cdc8bab49a2d9ae67249a2166351061aacce6e9df73f3ecc970d0274a6abfd2
SSDEEP 96:/hvcNnU8Yd1Z/eXOsizdahB9fS2PoRz7kdqr9ScM9UEqBGhCcLYl7Of6e3iHo/K1:/hvnhCSmcD/LjoyDL1mkyA7R153MS
TLSH
T1DC42B7FDDD2340433A66F62DF5A9FEAB005A29314AC8C79C6AFC483A32D29B71117705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k6rjjdvz.default-release\extensions.json
Size 16KB
SHA256 0e84bb97e1abd286a4fb222d9c511e8577e716bcf606ed330792cc06a5040664
MD5 5267c9d40d263e8c45115645db0879e3
SHA1 2cf1024e73f97e896ac58eb14d2383b105a471cb
SHA512 ec52276b779081734ae9e9d958be022ca169dc6c861fd5dc66291b72c89046e84a41fa122164211e1d648bf1539c49bd130f26aed469ba15b3018722386ca5a1
SSDEEP 384:nkI4vQUmldvM8dhW4U94zu96oFL4HQL4PuL4HBL4H8L4HUWg4hP:kI44RfFXlO426m4y4M454240L4x
TLSH
T11172411545048E78298EA78BAA367E02C37D573B60855C78F4DD8FC802FA5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k6rjjdvz.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k6rjjdvz.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k6rjjdvz.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k6rjjdvz.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k6rjjdvz.default-release\prefs-1.js
Size 8KB
SHA256 c86584b5da0c37e8a716b6edf71faeb168980502731f3d320e850b29085a4173
MD5 bf1a8712da9758ee30df4fa252da3311
SHA1 b7108d4923c0136d1d054b367b6bbb842264085f
SHA512 b480916ae9a491b28c3aae4eeb6929f1bce93f708560a69b84d75d1b04db2e89f88f63bf532061fffaa70b1e5094b1a7c43e03505c1a9b0617652a5b84d222a8
SSDEEP 96:xHyFTUGqGqqfcRLNbzSfSSlVYdv9jBHnGWRUfGnBw88RLd8L4cnolOKNGS:AURqfcRL2SSMtR5Bw88xz
TLSH
T1540221386004CF7F75B6766CAC2489315AB2023BBABF68D715B954C5024CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k6rjjdvz.default-release\prefs-1.js
Size 6KB
SHA256 6d5c9e650f0f0847ca5d03af42472e11b9e8758a045c40904a701def6ca54c9d
MD5 f660743916d0f6562bd107dda0bcbcbc
SHA1 2a7bcd3595c2529aaff4a3f074b35b7f3553c91b
SHA512 f1dc8160b7a9ef3b888bd439e5a15d9aefe40e46c0694aaa2cb4f6f42955bb38ec9934de6c11bd5376d7cb00dfd863c9ecae48b4661325705dbc2c51548780a4
SSDEEP 96:xHyUTUGqGqqfBRL1zSfSSlVYdv9jBHnGHT+Bw88P8L4cnolOKQ:AhRqfBRLSSSMoCBw88S
TLSH
T1C0E121789418CF7F74B6766CAC6888716AB2013BBBBF68D710B95485014CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k6rjjdvz.default-release\prefs.js
Size 7KB
SHA256 f8835a25362a29842d67113c6f9a48b04eef587a24e45b606f045b62a50894c4
MD5 6538b47c2250b99dc659223f57cf5794
SHA1 0a6c945904931c9ed64dc971334f3debfefa325f
SHA512 a5ea37d24da3583d1c68f150dd36fdb64defe2ee0f179b5dc2a54f704c3d515a0ea88f1554b49cb82bfc867b6b7c0d5af1d2aa0be0ce81fa2912543daad04213
SSDEEP 96:xHyFTUGqGqqfcRLObzSfSSlVYdv9jBHnGHT+Bw88u8L4cnolOKNGS:AURqfcRLdSSMoCBw884
TLSH
T15BF11F785004CB7FB4B6766CAC2848315A72413BBABF68D711B954C5014CF3846F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k6rjjdvz.default-release\sessionstore-backups\recovery.baklz4
Size 4KB
SHA256 fccc3a72cdd6d7271f81d622795aaa81e3fcd16e88a1a96f473e79743d447f36
MD5 733e77de7e37f8a0165752d3f0cabe7d
SHA1 2bd9b8065a4f9575f564555472515c7597c875af
SHA512 82f80e925d9a1e98e50f72c98091832797f58a2b6676f50b36083c29c22149198de54041e70613262a069d49d58833c9e1eff45093cfcd06b6b9da7686ac323b
SSDEEP 96:R2yB7DQjX59LEmZIDCjCd01VrqM4EcZZi6rLKJyeFhn:RIt9jni0v/4En
TLSH
T166918DB3581AAC934971D854CCEF0F6842E2119069FC0244B96D4B33139C70EDD2878E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k6rjjdvz.default-release\sessionstore-backups\recovery.baklz4
Size 4KB
SHA256 84ee860fcb5a9554e2dd373f6eafb42c4dc0da7d93f3ed175ebe4db36fd4ccf9
MD5 b8ab2388688e2b75fd843084d0da8b4c
SHA1 51ad69a1ef7ed24af691a0907b9ad044c0383da0
SHA512 13a64383f494c53f8c991c59a06bea433fe56da901d8838bf5215873d9d848f872a885e33100520874609d3514424ffc6e8391f65c4684e1a3245a5ca638f416
SSDEEP 96:R2yB7DQjX59LEmZVDCjCd01VrqM4EcZZi6rLKJyeFhn:RIt9jki0v/4En
TLSH
T128918DB3581AAC9749B1D854CCEF0F6842E2119069FC0244B96D4B33139C70EDD2878E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k6rjjdvz.default-release\sessionstore-backups\recovery.baklz4
Size 922B
SHA256 7d240827229cb765afe8dde29f5df13e10116833b247f176e07bc77da2698ae8
MD5 638693c068590656f10cf9d28d60beb6
SHA1 85e9943693a0172104f28c0fd522e612c7aa9821
SHA512 f49fd3b033faafd5031252de57e490b6653634f5962df64991ea099273de034c3fea30dbb08200de3efae11827e4120468b57417b82df8bf668efb37b14982fa
TLSH
T1031184E3EE1A38631B919143E0C71BA986E9307203A918D0E94A5112564C14FAAAA387
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k6rjjdvz.default-release\sessionstore-backups\recovery.baklz4
Size 4KB
SHA256 07482544bbc4a3bafdd4d5d3d09cb7e7c448439387edc61518748d608e3d93be
MD5 2499b16df34a1414cab9c10a68275289
SHA1 615cb7747004c0f320d8c9957d9bf8b80a780e60
SHA512 a05d62c92257e0c0b5e50030f623a7d684f24f95ce45b3ec1918356065d6cc9e22ac0da7e5deaec24730ce3ef3c72f060764629523f3a9624ab6cc4625c53f1f
SSDEEP 96:s2yB7DQjX59LEmZOD+BCd01VrqM4EcZZi6rLKJy02x:sIt9jJBi0v/4Ko
TLSH
T139917DB3981BAD8745B6C994CCDF0F6802E212D46AFC0248796D4E33039C70BDD6869E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k6rjjdvz.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 6.7MB
SHA256 997abcfdc675bb82c290e2993e0f6a292f509d36e214fb37a2f630699619832a
MD5 8ddfc2be2750047f9279c73f928e1858
SHA1 058b19078633eacea6419c4d367ed7c0f42589be
SHA512 73e139e330195aa201f894b2dfebae80e4d884bde8235a0f6ac6cceb43530186576eba380b1c8de373a7523c8143c65fbadc43018370476588818646222c5a69
SSDEEP 49152:i9yWkzn/X1we4y2D3/YyEf4XTlYr3+XQklhd60UYeCJvZa6Htz6qCf7kusgn6wsK:Ftf7kSn6wsDLsjk/Xo
TLSH
T12D665CE420E29252F34140B3719953EB11EFC01CA077CE445B9896FAA5B8CEB4E977BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

salinewin.exe-Malware-main.zip

Path C:\Users\Admin\Downloads\salinewin.exe-Malware-main.zip
Size 13.2MB
SHA256 ad845ec76220d16eb54ceed420350b9067dee60dc7e6d490979b68930ec90277
MD5 54bbfcf9565f00e5e764c5d362311fed
SHA1 3dd8aa876e064230e2ff1754a368526beccb24f8
SHA512 c195fcb47c14d72bfa161ff37173a3c113a81997273c30049d3e4f90aca5e2b8f2fb6d71f348c572e8e92614c9f5a1b5534728f0b276019b8bc973c770ccbbe1
SSDEEP 393216:W8mQWK1J5ZA1mZ7oIWBb/P6VyeOgMt29aiGwLUd:Rh/V61mZUIWBbXkyeOh6a8LUd
TLSH
T1FDD6332582FA8CD2E164358B12F451A23F480AFFDB8DC856AB0D7AF5EDB564C1B52C07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads