hxxps://www[.]mediafire[.]com/folder/n9inodnxeii4u/valhack

Resubmissions

09/09/2026, 09:10

260909-k49mcavvg13

09/09/2026, 09:05

260909-k2md2abf938

Analysis

user interaction
yes
max time kernel
248s
max time network
248s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/09/2026, 09:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.mediafire.com/folder/n9inodnxeii4u/valhack
Sample260909-k2md2abf93

Score

8^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
597	4756	chrome.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	winrar-x64-713.exe
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	winrar-x64-713.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 10 IoCs

pid	Process
6740	winrar-x64-713.exe
620	uninstall.exe
5940	winrar-x64-713.exe
7012	uninstall.exe
7248	WinRAR.exe
7400	WinRAR.exe
3756	installer1.exe
8480	installer1.exe
2040	installer1.exe
6932	installer1.exe

Loads dropped DLL 2 IoCs

pid	Process
3252	Process not Found
3252	Process not Found

Modifies system executable filetype association 2 TTPs 8 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	uninstall.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\WinRAR\License.txt	winrar-x64-713.exe
File created	C:\Program Files\WinRAR\RarFiles.lst	winrar-x64-713.exe
File opened for modification	C:\Program Files\WinRAR\Resources.pri	winrar-x64-713.exe
File opened for modification	C:\Program Files\WinRAR\Order.htm	winrar-x64-713.exe
File opened for modification	C:\Program Files\WinRAR\Rar.exe	winrar-x64-713.exe
File opened for modification	C:\Program Files\WinRAR\Default32.SFX	winrar-x64-713.exe
File opened for modification	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-32.png	winrar-x64-713.exe
File opened for modification	C:\Program Files\WinRAR\Rar.txt	winrar-x64-713.exe
File created	C:\Program Files\WinRAR\RarExt.dll	winrar-x64-713.exe
File opened for modification	C:\Program Files\WinRAR\RarExt.dll	winrar-x64-713.exe
File created	C:\Program Files\WinRAR\RarExt32.dll	winrar-x64-713.exe
File opened for modification	C:\Program Files\WinRAR\RarExtPackage.msix	winrar-x64-713.exe
File created	C:\Program Files\WinRAR\Default.SFX	winrar-x64-713.exe
File opened for modification	C:\Program Files\WinRAR\UnRAR.exe	winrar-x64-713.exe
File created	C:\Program Files\WinRAR\RarExt.dll	winrar-x64-713.exe
File opened for modification	C:\Program Files\WinRAR	winrar-x64-713.exe
File created	C:\Program Files\WinRAR\WhatsNew.txt	winrar-x64-713.exe
File created	C:\Program Files\WinRAR\7zxa.dll	winrar-x64-713.exe
File created	C:\Program Files\WinRAR\RarExtPackage.msix	winrar-x64-713.exe
File opened for modification	C:\Program Files\WinRAR\Default32.SFX	winrar-x64-713.exe
File created	C:\Program Files\WinRAR\RarExt32.dll	winrar-x64-713.exe
File opened for modification	C:\Program Files\WinRAR\WinCon.SFX	winrar-x64-713.exe
File opened for modification	C:\Program Files\WinRAR\Zip.SFX	winrar-x64-713.exe
File opened for modification	C:\Program Files\WinRAR\Order.htm	winrar-x64-713.exe
File opened for modification	C:\Program Files\WinRAR\License.txt	winrar-x64-713.exe
File opened for modification	C:\Program Files\WinRAR\WinRAR.exe	winrar-x64-713.exe
File created	C:\Program Files\WinRAR\Descript.ion	winrar-x64-713.exe
File created	C:\Program Files\WinRAR\Uninstall.lst	winrar-x64-713.exe
File opened for modification	C:\Program Files\WinRAR\Rar.exe	winrar-x64-713.exe
File opened for modification	C:\Program Files\WinRAR\RarExtInstaller.exe	winrar-x64-713.exe
File created	C:\Program Files\WinRAR\Zip.SFX	winrar-x64-713.exe
File created	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-48.png	winrar-x64-713.exe
File opened for modification	C:\Program Files\WinRAR\WhatsNew.txt	winrar-x64-713.exe
File created	C:\Program Files\WinRAR\rarnew.dat	uninstall.exe
File opened for modification	C:\Program Files\WinRAR\ReadMe.txt	winrar-x64-713.exe
File created	C:\Program Files\WinRAR\UnRAR.exe	winrar-x64-713.exe
File opened for modification	C:\Program Files\WinRAR\RarExt32.dll	winrar-x64-713.exe
File created	C:\Program Files\WinRAR\WinCon.SFX	winrar-x64-713.exe
File created	C:\Program Files\WinRAR\Zip32.SFX	winrar-x64-713.exe
File created	C:\Program Files\WinRAR\WinRAR.chm	winrar-x64-713.exe
File opened for modification	C:\Program Files\WinRAR\Rar.txt	winrar-x64-713.exe
File opened for modification	C:\Program Files\WinRAR\WhatsNew.txt	winrar-x64-713.exe
File created	C:\Program Files\WinRAR\Uninstall.exe	winrar-x64-713.exe
File created	C:\Program Files\WinRAR\WinRAR.exe	winrar-x64-713.exe
File opened for modification	C:\Program Files\WinRAR\WinRAR.exe	winrar-x64-713.exe
File created	C:\Program Files\WinRAR\Resources.pri	winrar-x64-713.exe
File opened for modification	C:\Program Files\WinRAR\WinCon32.SFX	winrar-x64-713.exe
File created	C:\Program Files\WinRAR\__tmp_rar_sfx_access_check_240707546	winrar-x64-713.exe
File opened for modification	C:\Program Files\WinRAR\WinCon32.SFX	winrar-x64-713.exe
File opened for modification	C:\Program Files\WinRAR\RarExt.dll	winrar-x64-713.exe
File created	C:\Program Files\WinRAR\ReadMe.txt	winrar-x64-713.exe
File opened for modification	C:\Program Files\WinRAR\Default.SFX	winrar-x64-713.exe
File created	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-64.png	winrar-x64-713.exe
File opened for modification	C:\Program Files\WinRAR\RarFiles.lst	winrar-x64-713.exe
File opened for modification	C:\Program Files\WinRAR\WinCon.SFX	winrar-x64-713.exe
File created	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-32.png	winrar-x64-713.exe
File opened for modification	C:\Program Files\WinRAR\License.txt	winrar-x64-713.exe
File opened for modification	C:\Program Files\WinRAR\Uninstall.exe	winrar-x64-713.exe
File opened for modification	C:\Program Files\WinRAR\RarExtPackage.msix	winrar-x64-713.exe
File created	C:\Program Files\WinRAR\__tmp_rar_sfx_access_check_240698484	winrar-x64-713.exe
File opened for modification	C:\Program Files\WinRAR\RarFiles.lst	winrar-x64-713.exe
File opened for modification	C:\Program Files\WinRAR\Uninstall.lst	winrar-x64-713.exe
File created	C:\Program Files\WinRAR\Rar.exe	winrar-x64-713.exe
File opened for modification	C:\Program Files\WinRAR\7zxa.dll	winrar-x64-713.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3424	msedge.exe
4756	chrome.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134334183668081136"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\DefaultIcon\ = "C:\\Program Files\\WinRAR\\WinRAR.exe,1"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\DropHandler	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.cab\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.001	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.txz	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell\open\command\ = "\"C:\\Program Files\\WinRAR\\WinRAR.exe\" \"%1\""	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.rar\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.cab	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.tar	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.tar\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.lha\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell\open\command\ = "\"C:\\Program Files\\WinRAR\\WinRAR.exe\" \"%1\""	uninstall.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	taskmgr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WinRAR32	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.tlz\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.bz	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.tbz	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell\open\command	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell\open\command	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\ = "RAR recovery volume"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.uu\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.xz\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR32	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.xxe	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\ = "WinRAR ZIP archive"	uninstall.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.lzh	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\DefaultIcon\ = "C:\\Program Files\\WinRAR\\WinRAR.exe,0"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rev	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\InProcServer32\ThreadingModel = "Apartment"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\DropHandler\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR32	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.zip\ShellNew\FileName = "C:\\Program Files\\WinRAR\\zipnew.dat"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.uue\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.tbz2	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.zst\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\DefaultIcon\ = "C:\\Program Files\\WinRAR\\WinRAR.exe,0"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\DefaultIcon	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.zip	uninstall.exe

Suspicious behavior: EnumeratesProcesses 58 IoCs

pid	Process
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
6948	msedge.exe
6948	msedge.exe
6268	chrome.exe
6268	chrome.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
4364	taskmgr.exe
4364	taskmgr.exe
4364	taskmgr.exe
4364	taskmgr.exe
4364	taskmgr.exe
4364	taskmgr.exe
4364	taskmgr.exe
4364	taskmgr.exe
4364	taskmgr.exe
4364	taskmgr.exe
4364	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 64 IoCs

pid	Process
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
6740	winrar-x64-713.exe
6740	winrar-x64-713.exe
5940	winrar-x64-713.exe
5940	winrar-x64-713.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1984 wrote to memory of 1368	1984	msedge.exe	84
PID 1984 wrote to memory of 3424	1984	msedge.exe	85
PID 1984 wrote to memory of 400	1984	msedge.exe	86
PID 1984 wrote to memory of 400	1984	msedge.exe	86
PID 1984 wrote to memory of 400	1984	msedge.exe	86
PID 1984 wrote to memory of 2688	1984	msedge.exe	87
PID 1984 wrote to memory of 2688	1984	msedge.exe	87
PID 1984 wrote to memory of 4716	1984	msedge.exe	88
PID 1984 wrote to memory of 4716	1984	msedge.exe	88
PID 1984 wrote to memory of 4716	1984	msedge.exe	88
PID 1984 wrote to memory of 3800	1984	msedge.exe	89
PID 1984 wrote to memory of 3800	1984	msedge.exe	89
PID 1984 wrote to memory of 3800	1984	msedge.exe	89
PID 1984 wrote to memory of 4228	1984	msedge.exe	91
PID 1984 wrote to memory of 4208	1984	msedge.exe	92
PID 1984 wrote to memory of 4228	1984	msedge.exe	91
PID 1984 wrote to memory of 4228	1984	msedge.exe	91
PID 1984 wrote to memory of 4208	1984	msedge.exe	92
PID 1984 wrote to memory of 4208	1984	msedge.exe	92
PID 1984 wrote to memory of 8	1984	msedge.exe	98
PID 1984 wrote to memory of 8	1984	msedge.exe	98
PID 1984 wrote to memory of 4432	1984	msedge.exe	99
PID 1984 wrote to memory of 4432	1984	msedge.exe	99
PID 1756 wrote to memory of 4884	1756	chrome.exe	100
PID 1984 wrote to memory of 2332	1984	msedge.exe	101
PID 1984 wrote to memory of 2332	1984	msedge.exe	101
PID 1984 wrote to memory of 2332	1984	msedge.exe	101
PID 1756 wrote to memory of 4756	1756	chrome.exe	103
PID 1756 wrote to memory of 2692	1756	chrome.exe	104
PID 1756 wrote to memory of 2692	1756	chrome.exe	104
PID 1756 wrote to memory of 1252	1756	chrome.exe	105
PID 1756 wrote to memory of 1252	1756	chrome.exe	105
PID 1756 wrote to memory of 4344	1756	chrome.exe	106
PID 1756 wrote to memory of 1116	1756	chrome.exe	107
PID 1756 wrote to memory of 4344	1756	chrome.exe	106
PID 1756 wrote to memory of 1116	1756	chrome.exe	107
PID 1756 wrote to memory of 4968	1756	chrome.exe	108
PID 1756 wrote to memory of 4968	1756	chrome.exe	108
PID 1756 wrote to memory of 1036	1756	chrome.exe	109
PID 1756 wrote to memory of 1036	1756	chrome.exe	109
PID 1984 wrote to memory of 5196	1984	msedge.exe	111
PID 1756 wrote to memory of 5640	1756	chrome.exe	114
PID 1756 wrote to memory of 5640	1756	chrome.exe	114
PID 1756 wrote to memory of 5664	1756	chrome.exe	127
PID 1756 wrote to memory of 5484	1756	chrome.exe	119
PID 1756 wrote to memory of 5484	1756	chrome.exe	119
PID 1756 wrote to memory of 4364	1756	chrome.exe	121
PID 1756 wrote to memory of 4364	1756	chrome.exe	121
PID 1756 wrote to memory of 2344	1756	chrome.exe	122
PID 1756 wrote to memory of 2344	1756	chrome.exe	122
PID 1756 wrote to memory of 4128	1756	chrome.exe	135
PID 1756 wrote to memory of 4128	1756	chrome.exe	135
PID 1756 wrote to memory of 5812	1756	chrome.exe	125
PID 1756 wrote to memory of 5812	1756	chrome.exe	125
PID 1756 wrote to memory of 5664	1756	chrome.exe	127
PID 1756 wrote to memory of 5664	1756	chrome.exe	127
PID 1756 wrote to memory of 3504	1756	chrome.exe	128
PID 1756 wrote to memory of 3504	1756	chrome.exe	128
PID 1756 wrote to memory of 5344	1756	chrome.exe	129
PID 1756 wrote to memory of 5344	1756	chrome.exe	129
PID 1756 wrote to memory of 5236	1756	chrome.exe	130
PID 1756 wrote to memory of 5236	1756	chrome.exe	130
PID 1756 wrote to memory of 5252	1756	chrome.exe	131
PID 1756 wrote to memory of 5252	1756	chrome.exe	131

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.mediafire.com/folder/n9inodnxeii4u/valhack
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffe8275c188,0x7ffe8275c194,0x7ffe8275c1a0
  2⤵
  PID:1368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1760,i,6931180647546262321,14078657470188457374,524288 --field-trial-handle=2284,i,17830923126179067039,7589314684192644948,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,16206732263739831578,9876153359247554537,262144 --field-trial-handle=2284,i,17830923126179067039,7589314684192644948,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:2
  2⤵
  PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2056,i,227202755087614561,16406859675049901604,524288 --field-trial-handle=2284,i,17830923126179067039,7589314684192644948,262144 --variations-seed-version --mojo-platform-channel-handle=2448 /prefetch:8
  2⤵
  PID:2688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,16718675136693274704,38350775388143651,2097152 --field-trial-handle=2284,i,17830923126179067039,7589314684192644948,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,18174769891042365077,15148014104460719483,2097152 --field-trial-handle=2284,i,17830923126179067039,7589314684192644948,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:3800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4196,i,16387425195807305739,13133307819186351660,2097152 --field-trial-handle=2284,i,17830923126179067039,7589314684192644948,262144 --variations-seed-version --mojo-platform-channel-handle=3424 /prefetch:2
  2⤵
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4184,i,5014310691264608779,5349132743698821920,2097152 --field-trial-handle=2284,i,17830923126179067039,7589314684192644948,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:1
  2⤵
  PID:4208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5364,i,12500807807029818544,7146046853138562490,524288 --field-trial-handle=2284,i,17830923126179067039,7589314684192644948,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:8
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5360,i,2047412258890503687,4157192124530195972,524288 --field-trial-handle=2284,i,17830923126179067039,7589314684192644948,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:8
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5444,i,17824402370040625085,6931810575861732731,2097152 --field-trial-handle=2284,i,17830923126179067039,7589314684192644948,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:1
  2⤵
  PID:2332
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6120,i,11541552088979622017,1618454348392089956,524288 --field-trial-handle=2284,i,17830923126179067039,7589314684192644948,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:8
  2⤵
  PID:5180
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6120,i,11541552088979622017,1618454348392089956,524288 --field-trial-handle=2284,i,17830923126179067039,7589314684192644948,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:8
  2⤵
  PID:5196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=760,i,10578940862198010005,16538987637500283434,524288 --field-trial-handle=2284,i,17830923126179067039,7589314684192644948,262144 --variations-seed-version --mojo-platform-channel-handle=4708 /prefetch:8
  2⤵
  PID:6964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=756,i,11460987420656644835,3129329731870563591,524288 --field-trial-handle=2284,i,17830923126179067039,7589314684192644948,262144 --variations-seed-version --mojo-platform-channel-handle=4640 /prefetch:8
  2⤵
  PID:7556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4620,i,5717392052986449748,10948213816748998717,524288 --field-trial-handle=2284,i,17830923126179067039,7589314684192644948,262144 --variations-seed-version --mojo-platform-channel-handle=4716 /prefetch:8
  2⤵
  PID:7676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5336,i,864414885520932565,5721947837692985682,524288 --field-trial-handle=2284,i,17830923126179067039,7589314684192644948,262144 --variations-seed-version --mojo-platform-channel-handle=6572 /prefetch:8
  2⤵
  PID:5952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=4748,i,4793353067330851915,7684947614320667867,2097152 --field-trial-handle=2284,i,17830923126179067039,7589314684192644948,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:1
  2⤵
  PID:7484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5564,i,10743391153192923149,10873328016333193037,2097152 --field-trial-handle=2284,i,17830923126179067039,7589314684192644948,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:7580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=4684,i,12078186011774842273,929752763818745356,2097152 --field-trial-handle=2284,i,17830923126179067039,7589314684192644948,262144 --variations-seed-version --mojo-platform-channel-handle=2816 /prefetch:1
  2⤵
  PID:7952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6684,i,9199608002719261321,15764361518617714293,2097152 --field-trial-handle=2284,i,17830923126179067039,7589314684192644948,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:8528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=4600,i,7652166451426843691,7659739020640608632,2097152 --field-trial-handle=2284,i,17830923126179067039,7589314684192644948,262144 --variations-seed-version --mojo-platform-channel-handle=4728 /prefetch:1
  2⤵
  PID:8344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=1668,i,14058682805377695694,12001120051427585325,2097152 --field-trial-handle=2284,i,17830923126179067039,7589314684192644948,262144 --variations-seed-version --mojo-platform-channel-handle=6760 /prefetch:1
  2⤵
  PID:9184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6932,i,7336725440982471892,11326629698423021515,2097152 --field-trial-handle=2284,i,17830923126179067039,7589314684192644948,262144 --variations-seed-version --mojo-platform-channel-handle=6896 /prefetch:1
  2⤵
  PID:32
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7028,i,5049928254259286516,16369937111097974756,2097152 --field-trial-handle=2284,i,17830923126179067039,7589314684192644948,262144 --variations-seed-version --mojo-platform-channel-handle=7044 /prefetch:1
  2⤵
  PID:9044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7076,i,4855458363351679262,12263708073501218601,2097152 --field-trial-handle=2284,i,17830923126179067039,7589314684192644948,262144 --variations-seed-version --mojo-platform-channel-handle=7176 /prefetch:1
  2⤵
  PID:4016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7372,i,13696365891638640568,8602940431965966773,2097152 --field-trial-handle=2284,i,17830923126179067039,7589314684192644948,262144 --variations-seed-version --mojo-platform-channel-handle=7352 /prefetch:1
  2⤵
  PID:6532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7552,i,14436324188742296141,13045973885738835292,2097152 --field-trial-handle=2284,i,17830923126179067039,7589314684192644948,262144 --variations-seed-version --mojo-platform-channel-handle=7716 /prefetch:1
  2⤵
  PID:6484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=7864,i,7780785863137995896,4144399883821086381,2097152 --field-trial-handle=2284,i,17830923126179067039,7589314684192644948,262144 --variations-seed-version --mojo-platform-channel-handle=7884 /prefetch:1
  2⤵
  PID:6880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7844,i,7300122808228488927,526871970702672053,524288 --field-trial-handle=2284,i,17830923126179067039,7589314684192644948,262144 --variations-seed-version --mojo-platform-channel-handle=7668 /prefetch:8
  2⤵
  PID:6308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8108,i,3027530215028232652,14598139880934233047,524288 --field-trial-handle=2284,i,17830923126179067039,7589314684192644948,262144 --variations-seed-version --mojo-platform-channel-handle=8144 /prefetch:8
  2⤵
  PID:6320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7656,i,3387402771347518187,9722688181038395640,262144 --field-trial-handle=2284,i,17830923126179067039,7589314684192644948,262144 --variations-seed-version --mojo-platform-channel-handle=7844 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6460,i,16341043679210207683,15584990355733778119,524288 --field-trial-handle=2284,i,17830923126179067039,7589314684192644948,262144 --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:8
  2⤵
  PID:2776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4832,i,15841283073231914228,13069993701198614399,524288 --field-trial-handle=2284,i,17830923126179067039,7589314684192644948,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:8
  2⤵
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8136,i,14109822557588288121,7788909359394170335,524288 --field-trial-handle=2284,i,17830923126179067039,7589314684192644948,262144 --variations-seed-version --mojo-platform-channel-handle=8000 /prefetch:8
  2⤵
  PID:9168

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2292

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffe801dc728,0x7ffe801dc734,0x7ffe801dc740
  2⤵
  PID:4884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2028,i,9296889296926110362,8893085329258381541,524288 --field-trial-handle=2164,i,5619850520091205242,12704053351736053134,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2192 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:4756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1696,i,16057014085789016768,12310602114892950027,262144 --field-trial-handle=2164,i,5619850520091205242,12704053351736053134,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2160 /prefetch:2
  2⤵
  PID:2692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2320,i,818184690939855786,11392554410223197280,524288 --field-trial-handle=2164,i,5619850520091205242,12704053351736053134,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2380 /prefetch:8
  2⤵
  PID:1252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3220,i,10687374997310889888,16483024772267824692,2097152 --field-trial-handle=2164,i,5619850520091205242,12704053351736053134,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:4344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3248,i,5382710089821985091,1730156624507972520,2097152 --field-trial-handle=2164,i,5619850520091205242,12704053351736053134,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:1116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4468,i,14604194779701509248,16835931958464379607,2097152 --field-trial-handle=2164,i,5619850520091205242,12704053351736053134,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4476 /prefetch:2
  2⤵
  PID:4968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4736,i,17772036365987771539,17052807401820726891,2097152 --field-trial-handle=2164,i,5619850520091205242,12704053351736053134,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4732 /prefetch:1
  2⤵
  PID:1036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5512,i,12999574392230656537,9502261627876473563,2097152 --field-trial-handle=2164,i,5619850520091205242,12704053351736053134,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5524 /prefetch:1
  2⤵
  PID:5640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5712,i,1958176977349098907,11836229413858743336,524288 --field-trial-handle=2164,i,5619850520091205242,12704053351736053134,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5692 /prefetch:8
  2⤵
  PID:5664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3368,i,4371802465601177993,9043712081575822030,2097152 --field-trial-handle=2164,i,5619850520091205242,12704053351736053134,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:5484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=3440,i,8484521510903523903,6062756881173430974,2097152 --field-trial-handle=2164,i,5619850520091205242,12704053351736053134,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5708 /prefetch:1
  2⤵
  PID:4364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5940,i,8481767535560129056,12537537713813860432,2097152 --field-trial-handle=2164,i,5619850520091205242,12704053351736053134,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5920 /prefetch:1
  2⤵
  PID:2344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6080,i,12881246579973919808,11748264494781931249,2097152 --field-trial-handle=2164,i,5619850520091205242,12704053351736053134,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6232 /prefetch:1
  2⤵
  PID:4128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6360,i,12024004051078096804,16517550217234136476,2097152 --field-trial-handle=2164,i,5619850520091205242,12704053351736053134,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6128 /prefetch:1
  2⤵
  PID:5812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6484,i,10485199185728594323,8794486768822250035,2097152 --field-trial-handle=2164,i,5619850520091205242,12704053351736053134,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6504 /prefetch:1
  2⤵
  PID:5664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=4664,i,9726276003442667045,7367949245023700805,2097152 --field-trial-handle=2164,i,5619850520091205242,12704053351736053134,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5868 /prefetch:1
  2⤵
  PID:3504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6252,i,12759502597398508663,14991920741640062741,2097152 --field-trial-handle=2164,i,5619850520091205242,12704053351736053134,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6668 /prefetch:1
  2⤵
  PID:5344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6324,i,15700774759801827817,14533056699399561095,2097152 --field-trial-handle=2164,i,5619850520091205242,12704053351736053134,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6888 /prefetch:1
  2⤵
  PID:5236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6816,i,658565658893947826,13516442841034413726,2097152 --field-trial-handle=2164,i,5619850520091205242,12704053351736053134,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7020 /prefetch:1
  2⤵
  PID:5252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6460,i,11269279207676323080,14407424444085880886,2097152 --field-trial-handle=2164,i,5619850520091205242,12704053351736053134,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7028 /prefetch:1
  2⤵
  PID:5200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6776,i,8738633594393942752,14388059743601983517,2097152 --field-trial-handle=2164,i,5619850520091205242,12704053351736053134,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6672 /prefetch:1
  2⤵
  PID:5572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=7176,i,16579005837447134994,744459869104217339,2097152 --field-trial-handle=2164,i,5619850520091205242,12704053351736053134,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7180 /prefetch:1
  2⤵
  PID:5564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=7312,i,14417465128774806641,13506470211072677368,2097152 --field-trial-handle=2164,i,5619850520091205242,12704053351736053134,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7056 /prefetch:1
  2⤵
  PID:4128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=7572,i,15235656565958585147,12831428656612641848,2097152 --field-trial-handle=2164,i,5619850520091205242,12704053351736053134,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7592 /prefetch:1
  2⤵
  PID:6164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=7692,i,85811062080166720,17629503464369014119,2097152 --field-trial-handle=2164,i,5619850520091205242,12704053351736053134,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7708 /prefetch:1
  2⤵
  PID:6172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=7832,i,8848783203245678260,4741429536227613232,2097152 --field-trial-handle=2164,i,5619850520091205242,12704053351736053134,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7840 /prefetch:1
  2⤵
  PID:6180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=8036,i,15464977029482102622,14899258859769294910,2097152 --field-trial-handle=2164,i,5619850520091205242,12704053351736053134,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7972 /prefetch:1
  2⤵
  PID:6296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=7616,i,5610965966752262879,9881352729765486179,2097152 --field-trial-handle=2164,i,5619850520091205242,12704053351736053134,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8376 /prefetch:1
  2⤵
  PID:6440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=8160,i,993471190724045173,17870236590171952234,2097152 --field-trial-handle=2164,i,5619850520091205242,12704053351736053134,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8508 /prefetch:1
  2⤵
  PID:6448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=8528,i,8275908078593453174,11023572516569016851,2097152 --field-trial-handle=2164,i,5619850520091205242,12704053351736053134,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8312 /prefetch:1
  2⤵
  PID:6456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=8348,i,12093289771286759087,6500496862297580157,2097152 --field-trial-handle=2164,i,5619850520091205242,12704053351736053134,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8364 /prefetch:1
  2⤵
  PID:6464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=8728,i,6449773078040959373,2455507339423473297,2097152 --field-trial-handle=2164,i,5619850520091205242,12704053351736053134,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8740 /prefetch:1
  2⤵
  PID:6472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --metrics-shmem-handle=8884,i,10206326282212999659,6511003321419577550,2097152 --field-trial-handle=2164,i,5619850520091205242,12704053351736053134,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8896 /prefetch:1
  2⤵
  PID:6480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --metrics-shmem-handle=9036,i,6111569482713252741,14593902264350930233,2097152 --field-trial-handle=2164,i,5619850520091205242,12704053351736053134,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=9040 /prefetch:1
  2⤵
  PID:6488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --metrics-shmem-handle=9172,i,14615321362321199377,14222955804453564419,2097152 --field-trial-handle=2164,i,5619850520091205242,12704053351736053134,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=9200 /prefetch:1
  2⤵
  PID:6500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --metrics-shmem-handle=9192,i,7427662088792213905,18214770839941690832,2097152 --field-trial-handle=2164,i,5619850520091205242,12704053351736053134,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=9240 /prefetch:1
  2⤵
  PID:6508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --metrics-shmem-handle=8024,i,15920539941928964780,15653418897561991697,2097152 --field-trial-handle=2164,i,5619850520091205242,12704053351736053134,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=9520 /prefetch:1
  2⤵
  PID:6536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --metrics-shmem-handle=9848,i,6667850461445378471,4886817982407939856,2097152 --field-trial-handle=2164,i,5619850520091205242,12704053351736053134,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=9976 /prefetch:1
  2⤵
  PID:6896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --metrics-shmem-handle=10028,i,5312123377348788334,8336345280163966647,2097152 --field-trial-handle=2164,i,5619850520091205242,12704053351736053134,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=9900 /prefetch:1
  2⤵
  PID:6904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --metrics-shmem-handle=7532,i,13473125879622307958,17926822641399449912,2097152 --field-trial-handle=2164,i,5619850520091205242,12704053351736053134,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=10056 /prefetch:1
  2⤵
  PID:6912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --metrics-shmem-handle=9148,i,2842175424979525235,1071898870011880528,2097152 --field-trial-handle=2164,i,5619850520091205242,12704053351736053134,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7544 /prefetch:1
  2⤵
  PID:6920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --metrics-shmem-handle=9080,i,13006391893924563536,3092016350427700474,2097152 --field-trial-handle=2164,i,5619850520091205242,12704053351736053134,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=9156 /prefetch:1
  2⤵
  PID:6928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --metrics-shmem-handle=9460,i,7342349600650106332,12946202170073913054,2097152 --field-trial-handle=2164,i,5619850520091205242,12704053351736053134,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=9424 /prefetch:1
  2⤵
  PID:6936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --metrics-shmem-handle=8812,i,7133547210140824285,6433140685348023589,2097152 --field-trial-handle=2164,i,5619850520091205242,12704053351736053134,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8848 /prefetch:1
  2⤵
  PID:6944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --metrics-shmem-handle=8736,i,6657433188496333070,12241046221688557712,2097152 --field-trial-handle=2164,i,5619850520091205242,12704053351736053134,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8584 /prefetch:1
  2⤵
  PID:6952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --metrics-shmem-handle=8544,i,2676902672265095439,12381983983473219519,2097152 --field-trial-handle=2164,i,5619850520091205242,12704053351736053134,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8564 /prefetch:1
  2⤵
  PID:6960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --metrics-shmem-handle=10408,i,13114240174837868693,2797564228921041363,2097152 --field-trial-handle=2164,i,5619850520091205242,12704053351736053134,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=10416 /prefetch:1
  2⤵
  PID:6968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --metrics-shmem-handle=10468,i,49722082367101267,5747630091767002602,2097152 --field-trial-handle=2164,i,5619850520091205242,12704053351736053134,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=10544 /prefetch:1
  2⤵
  PID:6976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --metrics-shmem-handle=10564,i,11240594167723970337,10763974604938330923,2097152 --field-trial-handle=2164,i,5619850520091205242,12704053351736053134,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=10712 /prefetch:1
  2⤵
  PID:6984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --metrics-shmem-handle=10596,i,13255466761790281050,16600211724990841234,2097152 --field-trial-handle=2164,i,5619850520091205242,12704053351736053134,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=10860 /prefetch:1
  2⤵
  PID:6992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --metrics-shmem-handle=10996,i,9716887428374438373,8821186343405755672,2097152 --field-trial-handle=2164,i,5619850520091205242,12704053351736053134,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=11004 /prefetch:1
  2⤵
  PID:7000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --metrics-shmem-handle=11144,i,14792618913386066018,1071156902937211482,2097152 --field-trial-handle=2164,i,5619850520091205242,12704053351736053134,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=11152 /prefetch:1
  2⤵
  PID:7008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --metrics-shmem-handle=11296,i,3696016209782551737,399578989821233489,2097152 --field-trial-handle=2164,i,5619850520091205242,12704053351736053134,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=11308 /prefetch:1
  2⤵
  PID:7016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --metrics-shmem-handle=11440,i,18246378183296922993,17895332911551045410,2097152 --field-trial-handle=2164,i,5619850520091205242,12704053351736053134,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=11448 /prefetch:1
  2⤵
  PID:7024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --metrics-shmem-handle=11588,i,7670261061200012009,18053566653544869113,2097152 --field-trial-handle=2164,i,5619850520091205242,12704053351736053134,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=11600 /prefetch:1
  2⤵
  PID:7032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --metrics-shmem-handle=11736,i,4856796669062946221,3890765980486667436,2097152 --field-trial-handle=2164,i,5619850520091205242,12704053351736053134,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=11748 /prefetch:1
  2⤵
  PID:7040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --metrics-shmem-handle=11756,i,1722582439143945513,14936009973251630620,2097152 --field-trial-handle=2164,i,5619850520091205242,12704053351736053134,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=11900 /prefetch:1
  2⤵
  PID:7048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --metrics-shmem-handle=11920,i,1322772233407979971,1403932931515781775,2097152 --field-trial-handle=2164,i,5619850520091205242,12704053351736053134,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=12052 /prefetch:1
  2⤵
  PID:7056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --metrics-shmem-handle=12192,i,17999867843839810434,11304395331219195539,2097152 --field-trial-handle=2164,i,5619850520091205242,12704053351736053134,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=12200 /prefetch:1
  2⤵
  PID:7064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --metrics-shmem-handle=12348,i,5201283456199393828,15039009306130462515,2097152 --field-trial-handle=2164,i,5619850520091205242,12704053351736053134,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=12352 /prefetch:1
  2⤵
  PID:7072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --metrics-shmem-handle=12224,i,12019080746632124128,46807402341784761,2097152 --field-trial-handle=2164,i,5619850520091205242,12704053351736053134,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=12868 /prefetch:1
  2⤵
  PID:7692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --metrics-shmem-handle=12820,i,6334318677960619560,491796622820764989,2097152 --field-trial-handle=2164,i,5619850520091205242,12704053351736053134,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8588 /prefetch:1
  2⤵
  PID:7868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --metrics-shmem-handle=9352,i,7264670344019613871,11603072139255447528,2097152 --field-trial-handle=2164,i,5619850520091205242,12704053351736053134,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=9208 /prefetch:1
  2⤵
  PID:7876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --metrics-shmem-handle=11128,i,10617736956799139854,14197371002002095574,2097152 --field-trial-handle=2164,i,5619850520091205242,12704053351736053134,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8320 /prefetch:1
  2⤵
  PID:7748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --metrics-shmem-handle=11792,i,18027750569656106672,11465283189234126714,2097152 --field-trial-handle=2164,i,5619850520091205242,12704053351736053134,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:6916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --metrics-shmem-handle=7588,i,12777531690063765312,13475488083901932837,2097152 --field-trial-handle=2164,i,5619850520091205242,12704053351736053134,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7000 /prefetch:1
  2⤵
  PID:7632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --metrics-shmem-handle=11740,i,18039497478513439367,9077080958368489053,2097152 --field-trial-handle=2164,i,5619850520091205242,12704053351736053134,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=9072 /prefetch:1
  2⤵
  PID:7256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --metrics-shmem-handle=11480,i,9438195292757962072,7205739650915354793,2097152 --field-trial-handle=2164,i,5619850520091205242,12704053351736053134,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=12028 /prefetch:1
  2⤵
  PID:7308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --metrics-shmem-handle=10264,i,6199254760934255249,15026856556749036611,2097152 --field-trial-handle=2164,i,5619850520091205242,12704053351736053134,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=10248 /prefetch:1
  2⤵
  PID:7988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --metrics-shmem-handle=7508,i,5224918647623919910,12778643661478681832,2097152 --field-trial-handle=2164,i,5619850520091205242,12704053351736053134,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=11364 /prefetch:1
  2⤵
  PID:7260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --metrics-shmem-handle=6480,i,2620074663383962713,18421504557372265116,2097152 --field-trial-handle=2164,i,5619850520091205242,12704053351736053134,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=11468 /prefetch:1
  2⤵
  PID:7744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --metrics-shmem-handle=6460,i,14401688935208861533,11760011169870857935,2097152 --field-trial-handle=2164,i,5619850520091205242,12704053351736053134,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=9528 /prefetch:1
  2⤵
  PID:4448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --metrics-shmem-handle=9592,i,2445201903932184477,10146642360948665267,2097152 --field-trial-handle=2164,i,5619850520091205242,12704053351736053134,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8532 /prefetch:1
  2⤵
  PID:7584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --metrics-shmem-handle=11876,i,4028884286320865694,14980200234544230334,2097152 --field-trial-handle=2164,i,5619850520091205242,12704053351736053134,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=9564 /prefetch:1
  2⤵
  PID:7996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=10316,i,18126516345552921499,18285727223837629073,524288 --field-trial-handle=2164,i,5619850520091205242,12704053351736053134,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=10324 /prefetch:8
  2⤵
  PID:6964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=10300,i,2693897783115756162,12568616098562434658,524288 --field-trial-handle=2164,i,5619850520091205242,12704053351736053134,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  PID:6264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=10312,i,5679518371385791790,2655473721997283608,524288 --field-trial-handle=2164,i,5619850520091205242,12704053351736053134,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8800 /prefetch:8
  2⤵
  PID:6944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --metrics-shmem-handle=10188,i,17118423357119500701,758620063604605316,2097152 --field-trial-handle=2164,i,5619850520091205242,12704053351736053134,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7576 /prefetch:1
  2⤵
  PID:8264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --metrics-shmem-handle=7652,i,18393290561327777151,5926812030121676285,2097152 --field-trial-handle=2164,i,5619850520091205242,12704053351736053134,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7528 /prefetch:1
  2⤵
  PID:8516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --metrics-shmem-handle=10672,i,17609941519088814264,13889578831351399805,2097152 --field-trial-handle=2164,i,5619850520091205242,12704053351736053134,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=9044 /prefetch:1
  2⤵
  PID:8640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --metrics-shmem-handle=10044,i,17170070133224706022,10406306448478857918,2097152 --field-trial-handle=2164,i,5619850520091205242,12704053351736053134,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=10608 /prefetch:1
  2⤵
  PID:8648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --metrics-shmem-handle=10316,i,10265201937997577124,13972490417793773387,2097152 --field-trial-handle=2164,i,5619850520091205242,12704053351736053134,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=10164 /prefetch:1
  2⤵
  PID:9156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=84 --metrics-shmem-handle=10352,i,1606753705420767509,4830708973833144223,2097152 --field-trial-handle=2164,i,5619850520091205242,12704053351736053134,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=10344 /prefetch:1
  2⤵
  PID:9176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=85 --metrics-shmem-handle=10648,i,9566775840164975647,9828966730176778923,2097152 --field-trial-handle=2164,i,5619850520091205242,12704053351736053134,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6480 /prefetch:1
  2⤵
  PID:4208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=86 --metrics-shmem-handle=12180,i,1418038330813423640,17231830733801291423,2097152 --field-trial-handle=2164,i,5619850520091205242,12704053351736053134,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=12980 /prefetch:1
  2⤵
  PID:8360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=87 --metrics-shmem-handle=13248,i,742104299173542409,6342961881499204516,2097152 --field-trial-handle=2164,i,5619850520091205242,12704053351736053134,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=13344 /prefetch:1
  2⤵
  PID:8416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=88 --metrics-shmem-handle=10304,i,16745795919772367094,12152081382005834553,2097152 --field-trial-handle=2164,i,5619850520091205242,12704053351736053134,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7648 /prefetch:1
  2⤵
  PID:7304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=89 --metrics-shmem-handle=10040,i,5793867147766760275,3191355402284714944,2097152 --field-trial-handle=2164,i,5619850520091205242,12704053351736053134,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7540 /prefetch:1
  2⤵
  PID:8364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=90 --metrics-shmem-handle=10644,i,17552725412593815153,17084382540072192776,2097152 --field-trial-handle=2164,i,5619850520091205242,12704053351736053134,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=240 /prefetch:1
  2⤵
  PID:8372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=91 --metrics-shmem-handle=6368,i,8836830918569952638,3625659378985846276,2097152 --field-trial-handle=2164,i,5619850520091205242,12704053351736053134,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=12044 /prefetch:1
  2⤵
  PID:8400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=92 --metrics-shmem-handle=6984,i,4327824004925592728,1050328527320880010,2097152 --field-trial-handle=2164,i,5619850520091205242,12704053351736053134,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6412 /prefetch:1
  2⤵
  PID:8172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=93 --metrics-shmem-handle=6428,i,17433089638692806296,13011062356299578685,2097152 --field-trial-handle=2164,i,5619850520091205242,12704053351736053134,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=12840 /prefetch:1
  2⤵
  PID:8452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=94 --metrics-shmem-handle=12456,i,852547277639456310,16348097041381722097,2097152 --field-trial-handle=2164,i,5619850520091205242,12704053351736053134,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=12424 /prefetch:1
  2⤵
  PID:768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=95 --metrics-shmem-handle=11980,i,13239559675479685619,287067011789711503,2097152 --field-trial-handle=2164,i,5619850520091205242,12704053351736053134,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=11996 /prefetch:1
  2⤵
  PID:5604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=96 --metrics-shmem-handle=11368,i,12017024925100347715,806840446189123246,2097152 --field-trial-handle=2164,i,5619850520091205242,12704053351736053134,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=11944 /prefetch:1
  2⤵
  PID:9084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=97 --metrics-shmem-handle=9580,i,4876421707855614473,3176112218128358878,2097152 --field-trial-handle=2164,i,5619850520091205242,12704053351736053134,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=9176 /prefetch:1
  2⤵
  PID:9100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=98 --metrics-shmem-handle=8868,i,17670656558018113225,15273133447584160443,2097152 --field-trial-handle=2164,i,5619850520091205242,12704053351736053134,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=10284 /prefetch:1
  2⤵
  PID:2596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=99 --metrics-shmem-handle=7996,i,12735817619464210684,16539634894944640780,2097152 --field-trial-handle=2164,i,5619850520091205242,12704053351736053134,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8372 /prefetch:1
  2⤵
  PID:5716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=100 --metrics-shmem-handle=4888,i,4010820246896148910,3630520126928690223,2097152 --field-trial-handle=2164,i,5619850520091205242,12704053351736053134,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=9480 /prefetch:1
  2⤵
  PID:5760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=11756,i,17510037791413653158,12838377731332702029,524288 --field-trial-handle=2164,i,5619850520091205242,12704053351736053134,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=12380 /prefetch:8
  2⤵
  PID:6580
- C:\Users\Admin\Downloads\winrar-x64-713.exe
  "C:\Users\Admin\Downloads\winrar-x64-713.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of SetWindowsHookEx
  PID:6740
- - C:\Program Files\WinRAR\uninstall.exe
    "C:\Program Files\WinRAR\uninstall.exe" /setup
    3⤵
    - Executes dropped EXE
    PID:620
- C:\Users\Admin\Downloads\winrar-x64-713.exe
  "C:\Users\Admin\Downloads\winrar-x64-713.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of SetWindowsHookEx
  PID:5940
- - C:\Program Files\WinRAR\uninstall.exe
    "C:\Program Files\WinRAR\uninstall.exe" /setup
    3⤵
    - Executes dropped EXE
    - Modifies system executable filetype association
    - Drops file in Program Files directory
    - Modifies registry class
    PID:7012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=102 --metrics-shmem-handle=7408,i,16191716663030041497,12755816341543992762,2097152 --field-trial-handle=2164,i,5619850520091205242,12704053351736053134,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7444 /prefetch:1
  2⤵
  PID:6980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=103 --metrics-shmem-handle=13132,i,1704288197523362083,8664032845026763858,2097152 --field-trial-handle=2164,i,5619850520091205242,12704053351736053134,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=13092 /prefetch:1
  2⤵
  PID:5184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5428,i,187393917777861868,4923942758294135331,262144 --field-trial-handle=2164,i,5619850520091205242,12704053351736053134,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=12912 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=3768,i,6403972314243673024,8625137970858625855,524288 --field-trial-handle=2164,i,5619850520091205242,12704053351736053134,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=13196 /prefetch:8
  2⤵
  PID:6568

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2140

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5956

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2872

C:\Program Files\WinRAR\WinRAR.exe
"C:\Program Files\WinRAR\WinRAR.exe" x -iext -ver -imon1 -- "C:\Users\Admin\Downloads\valhack!.rar" C:\Users\Admin\Downloads\
1⤵
- Executes dropped EXE
PID:7248

C:\Program Files\WinRAR\WinRAR.exe
"C:\Program Files\WinRAR\WinRAR.exe" x -iext -ver -imon1 -- "C:\Users\Admin\Downloads\New folder\valhack!.rar" "C:\Users\Admin\Downloads\New folder\"
1⤵
- Executes dropped EXE
PID:7400

C:\Users\Admin\Downloads\New folder\installer1.exe
"C:\Users\Admin\Downloads\New folder\installer1.exe"
1⤵
- Executes dropped EXE
PID:3756

C:\Users\Admin\Downloads\New folder\installer1.exe
"C:\Users\Admin\Downloads\New folder\installer1.exe"
1⤵
- Executes dropped EXE
PID:8480

C:\Users\Admin\Downloads\New folder\installer1.exe
"C:\Users\Admin\Downloads\New folder\installer1.exe"
1⤵
- Executes dropped EXE
PID:2040

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:5772

C:\Users\Admin\Downloads\New folder\installer1.exe
"C:\Users\Admin\Downloads\New folder\installer1.exe"
1⤵
- Executes dropped EXE
PID:6932

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
PID:4364

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Uninstall.exe

Path C:\Program Files\WinRAR\Uninstall.exe
Size 402KB
SHA256 39baa167de334fef185ae8b97e8c709a307eed08e80fe115577c59a05200a13a
MD5 7c7fadfc3884853fe0141609fdb1e624
SHA1 36261b2b3cdbce62b6a9d3139a6c239467a3006a
SHA512 1d868f5665f6ca182d07bd21ee0e2158cd00062e2633c4845eaf31a242d5868f79f833fd37f87b54f17adc63c7804b95c9d3bcf66c137484f2615992b69ec0d8
SSDEEP 12288:Kxytky4LvurgzH9C/2qCQW7oIIvS5ejcwU:Kqky4Lvurgz62t5cYwU
TLSH
T1CD949D19E7A455F9E5B7D23CC9924507E6723C51CB71D38F03A10A9A2E237D09E3EB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 7e0d5ec1d46346a0232dd84428ece62038098d5b625f85f16fadd46dc84bdc11
MD5 d7238b418ae8f793bcc6adfd7abef880
SHA1 6f62866ab49f159a09af59d1d641e7b4be836529
SHA512 d0a4209b4d14b5205cc6e618d2714da369b5d95c838a7c79dcdc03ee8e5d1b0907531cba715afc9a0251c50d37d18a5dec1f11831974d4700d01414a12f00647
TLSH
T154E02BA9DC21BC2708FD47186025064AFB51135B2B91550F7A3D910CCFB077A61CAC6C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000014

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000014
Size 25KB
SHA256 a2ed66f01753747ce359a8be0a9555b91e18d01c6bccf8e52a74078520d3720a
MD5 7077ccb28e70d467500f6994c16ea6b2
SHA1 b47c8f61db3e92fa3fd0ec2e5021b4ca3586a494
SHA512 aa84c24767a1aeaea11b48e2b8b4d10a9f668839030fe47d132a425dc5cc30954c7d6106ed1d6d1522d42266ff03c0b7be0f1b95861fba79b6073fc9b992ab62
SSDEEP 768:3lBWG2FODWjwQU5xhjsNxSyk879qB8RET4qR19ZB:vMFOKUhSxS1L86pPZB
TLSH
T1FCB2E1CAE9CAB097AF1FB05F48E22D256E77B20EF00AC57647A14DD4657E08345E232C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000015

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000015
Size 45KB
SHA256 86bf6ae0f148e05e0813aa966b613942c0ca4a0a57af956df452e6a84ca744e0
MD5 71c3a04686460e6c2abad77cd9123cf4
SHA1 6086fd8f3282705f4dbacd90c7982a88ccb2d1af
SHA512 86f7eb6f2a26c3c1e54ba11fbd7813ce5950e0e7374ee28a39f463eb8b91a80c73a6e17aff9f7f95cf4fa8a7579c065b1dd32793f9ecef04e68d404533f63e18
SSDEEP 768:9lVSXEVfNWkK1sMO5IwSunQL9VX8i6EDfdtVsY4F4cOHDH:9l9WkKLlFX8i6eTVsY4Ofb
TLSH
T19C23F1839A9B618CFBD63BD0FF1301FAABD303F188C1F5158D5C6595985809D7884E8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000016

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000016
Size 36KB
SHA256 f0c76ec0576599e4944312729bd42fd5c68ffa1a3351e222018eb950ff6514e6
MD5 81abf915f00fd899cd801122a75579ed
SHA1 0e82b7995377263e9df78f76bea48cdcc9a4d574
SHA512 1f6f09144195bcfd6c127ea8e1d94443836af519c3cd33de90b12a56429b2c72e8880d719557a62e7049cb7adcb436460866e38fcab650e3c20a272a00251168
SSDEEP 768:1dLfP4LTJKIWkf8F/JPdfVOz0TBdKWMLr9d+rccg2UH3OuLQyCRG:rLhI52/JleYpMLxcg2U+u0yF
TLSH
T15403F13F4916AEC3AC3F33F468ACA04502164A9DD2EABC1B4E614DFAB547863950B45B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000017

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000017
Size 57KB
SHA256 b8f827f0b91023e152e18e3128144751b7c8e0f68997b9b0c74fe10b3796219b
MD5 ff30baeadfac53599ef56f929fa36fb0
SHA1 7288c3546f152625caa1c30fec83ec1d0c49827e
SHA512 56906bd143e571c1f0102ae855bbc2f2d4651a2fd8d39bacc0ae4438ec51a6022e8ad0bd14dc6e8d532892eba8e9bdfeaa046fd9150666d305a9a85b6c217ab5
SSDEEP 768:OiZdZBoSI117T244Kzme/BlDMtMp70NoWeieVymoL8em3b2PvZTLrtbpfp1PY1cA:9ZDEQil4meNoWAYAQJtNhqr3inIN
TLSH
T15343021A7C555B813991CAA1F3CD1745D4092FB39C40B69A9C66FF4B0DF31CA51B881A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000018

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000018
Size 185KB
SHA256 1fb3b0f0236280bf68725410d354251712c7e4bc6e535d9455c7312f99f1b284
MD5 3339eceadad5acfd9eb9a47b64ebd57c
SHA1 72e92bd17a3f7f2139f36ba1c19606f3c1e4ae33
SHA512 c775e6ef6b05a597d116c89b32c30e1ec1a003bfc9b408f25087b27579dba72f5b56cb138700fd657383bbe8e04df1d3bfd1f58127a7f3e586a67858902b7fd0
SSDEEP 3072:mV55Kup1oxUUJNoGQ8gvGgXCQtpcQ8TfonIS5rDI/0iI6ljlx4BP1B1Uqc4Nk7ko:mJKup+xPN3ghCHW6x7IP13Url7Szo
TLSH
T18E04125E4B9938E4DDB256CFC1C4328255F20097C1E79EE8EEC64519382B288772B7C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000019

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000019
Size 114KB
SHA256 d3298ba800c80577c206b33ce9d90b07eb79a68bc98b1c7be473e19be69e54fd
MD5 23c70ed27ba1388f3374b6d7f2e2bf9d
SHA1 ac3e74029bdd04bd6ac3bd3a086976ce1cf73552
SHA512 933df11a077ee890b7ccbed9293023ef0b4984e878fe9ef76fea646f77d08bea1294edb4d44fc0c6f3cd62344cf0085f17b2dcdd2fce6274e4794a273cd0e0d9
SSDEEP 3072:mbbF1beWR+2ogFxYJ2mS4xBs4vSx7jzTbCIOM1:sFVeWlogjYJ2x4nsE67jjEK
TLSH
T135B3122C25BF4F1D2E11D374856E7E8C8B00A34974BBA7C7297FDC2206196122A5F66F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00001a

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001a
Size 16KB
SHA256 0364d368abf457d4e70dbc7a7a360f3486eaea2837b194915b23d4398bee91ac
MD5 68c477c4c76baab3a8d1ef6a55aa986f
SHA1 4af50379e13514558dd53d123db8ea101ec5e24c
SHA512 92b34fe3b7f82f10cf6de8027ac08f4a5b8764fb4e0b31c93da6e3d5bd08e0bc83b79fd70b8207a1066b689583e0b6976fa3c885b0c067ea343e6f2031d55d25
SSDEEP 384:Nd1nZ+hLc8g3/2AY8VL6UBP38Y1dDq6w9ZD:bJZpv3h1Z3x+9ZD
TLSH
T10572D092B7F2D6B84D28BDFE122B04099CA91D8729F113F25942362BA5B1C6484FD071
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00001b

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001b
Size 53KB
SHA256 fd3633b209241b7d3e2240e2fbad7e32e67bf718340260fa63b9395841139d79
MD5 d93500ae5e15e2e5c375fb21e40acea4
SHA1 4bd64fd3ef381464ad7e3129c2c4592e930f1d7d
SHA512 b8a68429a748e63cfff6d7d761a90dbd3d0bc60d50bb6bcf8664b0180fc8ee1e90ab591c2ca12368223629e5662737a78337f13af15eeb381fb176b1a597841d
SSDEEP 1536:8+smvjfgMB3Nam1aNM3XLQsMlXPbd4WxyyW1BmG3N:DWs3NLa6385byyuL
TLSH
T188330234E26CB738D6491313646F650CCE31B791D8B95BF8BAE80E1219AABCF79205D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00001c

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001c
Size 146KB
SHA256 b230cce3b2bf713048769366a304c26211839436222d7dab18e07f542fb0cec1
MD5 d8f55057f0a0f5e7596debe5f746156f
SHA1 a99583f54fceab97d352adacc7df1f0d70962f8d
SHA512 5d8f4dc0e148771b5ecddd1dfdafcdf408d09bd81f7a2707d6368534827446faa956a6487d92a09c0bf76bac6e69572877ba9bfab7b78b232202d0774b720d8e
SSDEEP 3072:Q+APGA+5gtb9mBWlRqfwyiefd3GhSGAQBTtuKT8m0pNdNqGg0W46e:0PN+5YZmWRqLiefmTBTtbYvfqGg0Vp
TLSH
T149E3125EDA74394D1ED6883ADF489A147A9E527059C3017A60B5862BF38F6FC0D5CC2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00001d

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001d
Size 24KB
SHA256 def8db3d0393b41c222c29e372c8ce57f9696a7afd5e93ccbcb225e4277e6b96
MD5 1a8d2e6c071e6ebd41e2f8851dd4d912
SHA1 c12e0c8de14b218dac205bedec4500436238a31a
SHA512 4a304a05b7fc18c93ddfc3aa2a4473b7145163c756bcba010ec8549dce90993722841f41c465a1c0d717774a6e394322a949d78706c423a0a9ac87fdff175fe7
SSDEEP 768:C92mZJHiWE0Gw3PBSUA9Kxrtmejy2zsA0SOHQbXHAEO:CNLfp3PvA9KxxmUy2zASOwTHAEO
TLSH
T146B2F119CEE3B922ADB99F25EFA836D108F082547D7D6FDE8E19440C8F1243076BB056
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00001e

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001e
Size 110KB
SHA256 a0b123cd3dff872eaf20f7057ccfc41359649df5cb86864b8d7db7dd1225fb7c
MD5 e9deab4c3e0f5e87949c7db4ea6389e8
SHA1 7666988bba8bb3deb39428c9b1d633a4cee538f7
SHA512 bb73fc209658ccedbe50a94d5d7ec446d4d360ba29bc3d145529f69303503bff59d651dc88ef9f0d3e44c1965bbcdefe521d3ab3fd971549ef85f45b6ded4e6c
SSDEEP 3072:us//jtwHY9cH+7zRJ6AhJ7cuKtBOnQAswkkoJ47sAEG:7//hw49cH+7tJtAnwknJMZf
TLSH
T107B312CC96295F2E8BD8B6AE4C67370C00E5C78725E1B24E2B05C5C0E9BC67B3A52D57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000020

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000020
Size 211KB
SHA256 b915975bad04fcaf477f600d3666a097988903768dcdc2216f4cfc9a632c789e
MD5 b26e61d4335f336300776ed31b001dd5
SHA1 1675aa17149dc386ef98e9d52dbebe5fe1c68b5f
SHA512 1f64d53cb7319bc4be94f2c6ab79259222c8e7b8e0e32ed80afc4f83cf544af7fe517c980dc4944e70984defe8d2a44716ed4190fa4c64ecfc1945549832bdc7
SSDEEP 6144:T5hU4Vm3tzJb2TPDOsR994nUv3WRV0FllzMvq39hDv9p:/UCcwOub4nczRMcp
TLSH
T1162412FAB2DC4F08404ADD4864FA2BA5735A0D9DD29E377FF88D39ED491804B178590E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000021

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000021
Size 21KB
SHA256 631111b543714c174e3ae324475f2a7b9e041469c46a7684e59f4d2619147d77
MD5 8440f17f92a68731f18cc5b304abd65c
SHA1 3eb9bfe0f5f84ff396723a41e0b3753b93a30564
SHA512 c112eed456072f25aafed4e2f548975ce0cbcbad953bc0127bb7e75d6f3d830fdcdabadb9f8b070d7ab72fe83c785c0a09ce1563fcfbf2c0829c053f00eb405e
SSDEEP 384:lm/p5pArXnU8HrfYy3xyEt0c1t+qaRdbmr+ixvOhCqOIFdnFl6CsQWRO34Kuz5Vl:4rCrXU8HrRys0YtKzbHibIF569QWIuzd
TLSH
T176A2E0E83D2DCB8B24A98A123F7F98C4D1FD7307D2DDFD2112071A8CE570919A9807A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000022

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000022
Size 148KB
SHA256 859fe945a56271dce084a466e3a6f7c026f528b523474702a4e80a55d064f204
MD5 0a4bddb2df4518a92591ee4c3df4e239
SHA1 844489ee190ec4ae0da0ef9336aed063dfbb8326
SHA512 6ed9bca19788ea285f86644d4d5cef471669b68310fd26a9f1d90aa4c4899387d1031d0e83ff3fc3cf3c008d301bc27fb1df06fae5e3b05444256228d51f8dc5
SSDEEP 3072:WgTJXmS+a9aUuqgmoeVl5OSgzoFWlUnetFpxIm7nOzwG+X98R:RW+/uuomlYSe4UZOUG+k
TLSH
T17DE32311E0FFC014E827C88682FBB5608C51AB5348D7D4BDA7FD814A5E0952EE8A3E8D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000023

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000023
Size 92KB
SHA256 5247f72480052a28f75f81576841b99ddefdc8ebb1d1754c0675fb7860efd5e8
MD5 2c5ac9ad3d3660dd2a4a52e8d1ceb130
SHA1 a4006d93dbf8253a74b92f1d635617018032a04a
SHA512 05ba528e1e81c8405e9d8f36c72499b035a2c79c48f2ac4c0c6759c8b711d7e0074e8247673ddd4f7cd40051ad5b9ee70f340e7296ce6d11ea464deba3c9d0ee
SSDEEP 1536:9M6JwRMWNNJcQTARyNCIT91xwYsJPVY+9cm/VTILL8wRjkREm+iXGUj8NqnoeI+B:26JurcgTNCIT9zwYsJnKm/SL8MkRz+CZ
TLSH
T1B49312E259A7934E571AD0C2099B63FCE1535999E34D524EF56C6F2CEF20208A3CCB63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000024

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000024
Size 148KB
SHA256 0fdcc6779cca143ae44ee1466390e798d85d203158ef3875e6ff3c7de6b124b3
MD5 d31b4bbeb4739995e9a7a9ea6f44df61
SHA1 a762c91cc6a363e34677dbf2f433abce0e444093
SHA512 9d5c044b27f7e81638a40cb1ab244b256a9820ddf41ec3dfb4b98a2516c64c141c815d10c9b7d52a79fe3445be165e753cdd2e94c27f9016bd81d937e832d26c
SSDEEP 3072:eJXmgMKP0XX3kUlr8qNB9d+zW+P3yEJhwW6UnetFkJOSgI:YWgMvHUUl1NYzWr4FJL3
TLSH
T1F5E3126094F121386308DADBC5CE3707B5A2E341565F98B44D3796EB6B00D7AA4333ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000025

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000025
Size 31KB
SHA256 8fa07c10bd4ed6424526a9c11431a292aa2797eb5386e6eb28de5c63857b7d26
MD5 9aae733a24b93275b67132467004b026
SHA1 ef3d33674887a488998115771adf23ec1bedba26
SHA512 d91fb10aa3aebc1839f1ec9950cb3dba7c4583ec24339fe4bd697d8afe99bf72ead1421f8ea6feea4a332899560964e32f6f6a034fb4254120bb5f2f9b1f37ac
SSDEEP 768:dp5lsXwoNDlDIEkfF50HsvmJ3wQxjzLLHTp91b/tCNiIY1SN8Kz:dpyXDlOFCHs+JgQxjzLD93L5iNh
TLSH
T190E2F129F0E061A360D929378A715DBAC515B6293CFC0BB0E6F809F768A08ED6CD7711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000026

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000026
Size 24KB
SHA256 c7f1ab381d3c6f0c52968d2d14278c0b107b53a5e154b7381d2a46590e7d33f0
MD5 8b62cb77af08af8a3c92a15d0534ad07
SHA1 a7d15c6d6a8177b229297c54df57bd344b794513
SHA512 3ecf677f8eff0dfd5920b9d2ab8b8de21f7eee62ab429a033b0fae624a6a88718e595a81bfb5dac841f1d67bef8f0d786ba57a5096327cf959689dcecd16a823
SSDEEP 384:ziHP8fq520czx05WRFDagKW0LGE5zX9twpBqNuCxQSBx7eh9nAj751HDdg8Y:zcEfmY02FDagn0n5rbwvCCCo9o51+R
TLSH
T151B2E17C040ADC4CF924AD5E751C3B7B29349AB31FB4A499841A1F09612A0EE1ECB1B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000027

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000027
Size 34KB
SHA256 20932fec0bbda6310c8b59b9c740d3097461fcf84d559a33227d3c60cd3d4bd7
MD5 d1546561811c0be21edf019374fba8c0
SHA1 ae934992780f19b63bd9b9c83fa45003f1fa4f5b
SHA512 72598f794f06d22e06b34936c800a504eb90a2e8e0fdeaa7c97f70fb0beed473d09eb3db13e6a8f5491fb0c996fc884e000c641deb24bcae85d01d9f7a7dd2cb
SSDEEP 768:pr+7FsqT18YjEr/UZ5yq6F9laC42qlrUdsTmKmyl:4KqT18SMjqGaCCrCS
TLSH
T17DF2F1196FD66CF225EC985AC8271E83FE30D8D5A4603CCDA2CCB01354DB97C498ABA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000029

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000029
Size 176KB
SHA256 bf28dadfc6738a05813dd6b40701c6b3543defc834b39f3634f6dbc1e3aa6d33
MD5 d66f7aaa865ef59f61c2cc68ed6a2920
SHA1 dbbefac51c8dc7e8904921b81c25a527f7e3d920
SHA512 c1830176c4c465f866ad1af3f6f4f01b51fa2668c785c1eb7fa4eae974c8123fea3ace80e2d0c5c4e141bf1b0fc4f7da6a67f5af6a7e523168899b6c32cb22ae
SSDEEP 3072:xFihsJQleJkRx6M0UBZpQHuJlAFxwomzidEpeJjKPRrbnXL32JiM1gwHuCvY3gN0:xF0AJIb1hSI0wJmdfCrbnXLc1hHDvGlp
TLSH
T147041329C8F89AD8F9C7693CD6F109B19F015600BA05D1D02D2A74E966703E17F79FB1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00002b

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002b
Size 23KB
SHA256 7a3ed67c06bc7880ff541f213e1e9f408bb6ac9aea9f99baa04680aeb12e3596
MD5 5262bff061279e3eac139ecfd281433b
SHA1 33fe1dc567b20dd5e1fb6cf597f4bec8cfd384b7
SHA512 fc931d873be83d2ed946c23f42bc0fe2aabb73fc67e7243fb6c6e4e93398db9a3238a46c03e8b21435dfd0a767cb5ca88faff909e3f60d8bba9fb6316f9b0267
SSDEEP 384:HcVE5OuIFfu5aktpokTDMieO6mPQwhPCaWhc5g82DtfqISCGXnwkgoaY8lQ3mJ:8VE9yfCaktpo2DMiehmQwb0ce824l9Xe
TLSH
T1A7B2D1FB9B30D0C6B816BB86E1BAECDB115A34E3454B05F51AB970933853B32159E734
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00002c

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002c
Size 24KB
SHA256 aca258b3c6fa2f96b1884c6a132d66dbed3617192808555b7d22351c72788458
MD5 70eb4a2a57567da919393a5a0e3e9898
SHA1 edb383a77df21c939d94b432421c0e79ddbc4a68
SHA512 02ba5c6dc0b7824b6e7d140c891d912c8814d305978fa1db4946a9e78b9e93568ea2a4bddb5e836a1ee42d093819db825e751d1d3a305e8639decdfb15d52010
SSDEEP 768:tlHktgApm3ZDc+RqlN4S223Xk6Py1tZtNRJ:tMg++DdR+f3kTZbT
TLSH
T154B2E100CFBFC912F32CF7D64524FA2F0154D32E3227BF597295A0525992DA6CE54E62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00002d

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002d
Size 47KB
SHA256 c940764593d0fe5d596be327ca7558855e018039fb78509aa21921fd3644c3e4
MD5 65850a373e258f1c897a2b3d75eb74de
SHA1 1dc044f4824fd5af6bfed67fee48be70fa069f3f
SHA512 df2683f3dd9724de589451a47bc608c9925d54b874ad97b733dd465ef41f9db75e9e31604762415c2fc1433d050e45fdefc6ecd7ecadf58d1243d9ca5f4bf74b
SSDEEP 768:3IkDHBYoX5Pi4JxTGz9CDR0s1ROSsA8mF77YNt7wFhVq9oN2WfpdqWjBA:tNYoX53xTl/R8W77YNtUFrWoUWvdA
TLSH
T156230251F5F8624A7FC3003FBC317BD862909FE5996EE5D91288F30225611DD29EE017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00002e

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002e
Size 34KB
SHA256 6438d7b8ea9c7c3992d5e2fd2afdb1ff948570a3ef0bedae76247b51632960ba
MD5 c154477b9affa3a0a47f894c8b80c03c
SHA1 b6711decba0d571b538ca01de8a6e70ae4d219af
SHA512 4573c7b0c16c726dcccb6319d6e7fb0d163fb90e1fcfd4228f7c471d52dc4076a5a59b6516c5ab613eadd6cd269b327b3f2cb4f14c2b336c28d31b3809283df0
SSDEEP 768:/plpZnTpd3+CSeY9oJ/P17/4T1HHAG9i6XG2g4voyj2i2619EHGh:Rl/Z9d7/8v/mGCL6fEHGh
TLSH
T1B8F2F2C17E122F303604F5F6C0B653F67372E495EA5B8BC098A65576CB06F15DCD904A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00002f

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002f
Size 28KB
SHA256 5199d4e0c373218561a1666f0f86af3fca4430109c1d89f41d4a8777dcad19cf
MD5 a4625fbc6c3c4afc4c35e81f8fd07f9b
SHA1 b052fae65e9d03e114401fd2517b01f23101cda9
SHA512 9635b8c913028a5390b0d2924a315bc0d759973084cc15a026fb77d8a9c3eb9cdc3dfacffa498c615e63d50d843ceaa3ebd463ca807f8a2e394f235d27804a9a
SSDEEP 768:D7lABFYxHujtDAtwLvAZHqeRVVH/F/T5SjsJJjroRP1:DSBFKAOP/Ciri
TLSH
T14CD2E16FCA8EDADFE098129AFC4CB8D43E8713D8C21D657C8945EED4087A29045BC077
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000030

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000030
Size 70KB
SHA256 49b66cbe8ded091f5c62d0c4081e7651724ba04c8a4a9b3115b5d0240ff2286d
MD5 7199e28c017de18ffafd0814e6eecb76
SHA1 6c1b64437b7ce87edd545ffa9e1a324e1cbd5356
SHA512 5ee55153e15c38a16293924cbbceeac1f3427af662127da8beeca3ac55cf436a856c19e5155f00fb127667911ba2ccd31ba64638aba0a293d97866ef3cf5302d
SSDEEP 1536:TMbVQLOXDD4w9aGZQdQjX8+7EiJIPxc8k1suOYLld+Jj3nQ:TuVQLOn0GZQq9IPxc8k1Gi+JjA
TLSH
T12B63022CCDEE8514159D627744BA79420EBB39EB6F2CD8ED7B0905E5CBB60B18300626
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000031

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000031
Size 99KB
SHA256 1db9abba29939d856e442044379add56cfd58520b7e67fe7ae0780e3157221c9
MD5 f86ed9d130fadea8fc376d32604806f0
SHA1 bfa5c6ff880a6f78ad8590712f9d64ce7322d66d
SHA512 a911e8cb24b93960666e60d5c8ddeb3ac469efc23073a6b1717808d0378a4be4e81f5177178da754bf9fc4cead6aaa4ec345100616d816bcb0ecc0e0544cb3de
SSDEEP 1536:2UncMNl04ky2067QCuX90QKtj6Cse40fihGHQuJWfEfWc2C5WbLwvDncfmMR3WBi:2UcD0eQClNtERs2TwbncOM1M79Y
TLSH
T15AA30250E885B84D123F613BCC7B3C799EBE53B56CA59032E47BEB368854D60FE20069
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000033

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000033
Size 54KB
SHA256 3a5bbccb2f278738452561e3b4b3bccbf71384e1d2576fc70a0b64809d5d2bd2
MD5 1820ce7beb66a265390a96e24ad12467
SHA1 8ca40c2336f3481d893652c2ef4523c96e3901ab
SHA512 1f7205f9e4658a8d61ab487c3858f8858b6e36e39bed0179bc9fc650063e9248f7215ba5d94059bac274199a8af76eb8a296b4e16cad8bafb8c8f4655120727e
SSDEEP 1536:EbBzjIw/yOdbTt/Ucd7YpcolICQukPd8XUJhV14lk6HCv:YjIwndbTt/UU7Y/CPJKe9v
TLSH
T1044302EF62B9450A5A459910E4B336FE7D5206ACC943F75F7C7036E6A335EC2193A00D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000034

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000034
Size 196KB
SHA256 65c816928156305444ddf0d1d9b98f5738a54565634b4c2ab543b5294f94d33c
MD5 9c7d1867483efdeb90e24813c70723bb
SHA1 caa33b99d01d70453ce945c423a537165ce38f4d
SHA512 4c1153a037eda7b55f63009fe6292aeb13405fc5f7c7b96bd6325e3857930b5645f9ed50fc62382530fafa6d6fcedd48dd5614bfa24f9c53c1613ab4e7a0a0d8
SSDEEP 3072:kPtWH5KavW7nNJTLuU/BAz08iUbHqEg0r6WLQbVhmZckxzDv/W26PgcL6u6z:60KagJTiU/Bx8dHqEg0rtLkkx/D6Pglz
TLSH
T1C91412359BF7618E1A08023830580B32E49AE85797C6D797F45A2F29FF941E0E777236
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000035

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000035
Size 28KB
SHA256 18f0069ff44075aef45a8c7005de405ac783951a09205ae4f7ba0081ba53fead
MD5 358af6c819f2ac05c9820e7380bd5757
SHA1 f2dd30712cdbdfd529ff5dc17c9c016d8ea30a05
SHA512 3123c5c1faad87c046d4e1331436e9112adc124bfb15c064641840505e0645c2d2747d9e6b47ea7bce3a86d23d2624de0ac298ff9f00189b2e1e05bc5b3492e7
SSDEEP 384:WAi8DTqHj7UC2lt1eziP+BWULkZyXn1bJ2E0J1hmptpwTrOfu7rdh9V3m6PL3X9L:li8D0j7UC2lCz2yWUNJQhi0V26PL3XF
TLSH
T1DBD2F11A55051D742F3F2AF0E5B7826D1EADE4849A82A0322DCE346C157A1BADFD8FC1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000049

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000049
Size 21KB
SHA256 b8accd21fa76060c7c0b4418fb1903a229099006a4070f8062751b4b80ad3b25
MD5 f7dde399b1bd4dcea6998eb867911137
SHA1 4e2a6727947502d42e6944fa3b3dd5a86dadb226
SHA512 0f2b5fcbbacb326b73f08b08a15276e2a21e5e545cb8f16469b41abfa170591ba6c5fb4a5ade5f07ddcad0c775eab420cb9ba446010bae0e25754b7f46ebccfc
SSDEEP 384:ZpZE4aJMWkOgvn6Akdi6J67tKfOO5dA6eHHrd3co0nMoDE1KPDPunY/uzL1fqynW:ZpZE4aSWkRUFfOSdAJHHx7oI0DPuYYzY
TLSH
T1C2A2D002D30037D1BD2182B2F692C55A688FB42DCBDB5CA637E849EB14535AEA0451BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 cb7aa1419cba3236e22bf8e671039be19e07557410e08c430d41ce4fa6617970
MD5 1c9fab438a3faf5ab7f1df68bfc7006e
SHA1 da64cf77c00f7f41bf7497fef3f83031ebb294b3
SHA512 3be436921ef10c995a9f8b2ac39afa7fad6431fe4e596c9ee49d5364d1116d4e31e3b606756a3eb743199e9bc2a26b4e7999de604fbc3ab650069b63bb301e52
SSDEEP 96:Uv4n1w4uBgzLYt6KxWxAPbuJBKTDlcV/9pne92d1Da42LkzM7AE:cfh6KVP9T4/9JiEzMz
TLSH
T161A15089DAC4FA96FFB408BE7EC65C33B63494B5058B8F46690AC4319546FB3289502C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 49KB
SHA256 182dfd411116671abc7f41fa9ac0a0ea02b7db964cb9af5138b51ff8cf4b3163
MD5 3c0f00e1cdcf8ed75b1dff975cec66b2
SHA1 04d6f21a0de2a706f928c3ae99c19f84946f42ab
SHA512 2981c215a3362f1d5fad9fb932abf88035e0240938927fad365f19e2c69f12793b50cd8e0eb870fbeed5e401abdac1972a37d7e9acf9aa85a69caabb287211aa
SSDEEP 384:DFXawH2XEoeMPZPeyLRjrSJuc9KteM0JG+BebOzoksfFSfBe9qjGY/GYQMn3/xhw:Ph9ZP3TTbtqxnyvLQ9LYWXSxNJ70
TLSH
T1EC338CF7C3F4666DCE2262F46A663E1FCD6E0814972C78AB85D87E1653E1470E201B1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 fa32f98bcea24a16cbfb863e3d902df4beded48dbe8e69ec7103be9486a4a9b9
MD5 af9c8b5b9657ab874312549b93cafe2d
SHA1 e49827c6d61ad229503272fa5c983dec622b9cea
SHA512 9007a30e690a6ea86963e92fb21f5bb08be8797c52f400a3d3f5a297dfc5e380cda705611661776ba58d9820930afb296dbbb69d2cf2fbefc0f66a95f41526c1
SSDEEP 192:/R0cBzU2rbD0Fv7spAPRp22m0W8/9wHsb+WNfO8f1z4oG23od8jXXaESVyIsnAU/:/R0mzU2o1YUX/RKwrm2iiaN8
TLSH
T1AA52B42AF928793B5CC6C31AFA227B57E7F5212121942E94E6FCC92C15D7ACC321741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 bc8202e07a1ff4e1b9e77098bc093747e9bebbcd31c992365ba2b09dc53c6485
MD5 d0c172e36ffd528e53dc81fc0d65140e
SHA1 ec495e9c84b5e3b7e708d55addb80bec84ef6b7f
SHA512 a4f5265b731a2f5fc88261940f50e0fa2226580a01a7b9686b0bb373c0a29b6125147821eded771b8c97e3e26ba4e86a6357c4d177e2ae1d9a7983a43f996fbf
SSDEEP 192:/R0cBzUQrbD0Fv7spAPRp22m0W8/9wHsb+WNfO8f1zjeU+oG2lod8jXXaESVyIsH:/R0mzUQo1YUX/RKwrlM2AiaN8
TLSH
T15252C42AF928793B5CC6C31AFA227757E7F5212121902E94E6FCC92C15D7ACC321741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 5883dec8ebc2e7e746e167c1f6d95c98b8d569f61ff28aca721e1dba2ae78bbd
MD5 c43828a9a30fdb92ce01754a5540c969
SHA1 0cb7620be71f79fa7ee7ea013b3e0540968d3e2b
SHA512 bc46e3306a0b70e586a0c48cc2c98458ef22a16543570396aed758a8905426acb797bdd4716f7b3845496b84e67f6267ae514c6de4c48143eed0f9bbed2d0820
SSDEEP 192:/R0cBzUJrbD0Fv7spAPRp22m0Wy9wHsb+WNsWpO8f1zjeU+oG2Wod8jXXaE8VyI6:/R0mzUJo1YUX/lKwPlM2biaPe
TLSH
T1FD62C42AE8282D7B5CD6C32AFA22B757E3F5212121D02E94E6FCC92C15D7ACC3217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 8b1d755d214116b30d274bc13af7bbca8c311cf726553e138ab4958886d2f73f
MD5 883b980f54256ff5180bb5aa2ac8e50a
SHA1 72c04fa6803d13590df45ae7d9bc0256c73c87ae
SHA512 26b8a174d41455e0c24fc173dfc4aba6170552f6c6f932e86b280565fe23ce924aa7f77592416c4ba2eb1f76f2d03a7444e7d07d53aeba845900440ac1804dc6
SSDEEP 192:/R0cBzUJ3bD0Fv7spAPRpE2m0Wy9wHsb+WNsWpO8f1zjeU+oG23od8jXXaE4VyI6:/R0mzUJs1YkX5lKwPlM2iiahe
TLSH
T13E62C62AE8256D7B5CD6C32AFA22BB57E3F5212121D02E94E6FCC92C15D7ACC3217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 379d96542283773f422c052abe7293924621df1604b63c9a59676e1514d2db6c
MD5 d066f854d368cbebca026e5da297c2c3
SHA1 4f2f84d54b0a8dfd273bbdb70bcde51ad5e2f12f
SHA512 613285c6b38983d33fb336394c5eff7edb692f60dfa433defdbf45524dd1c84cadfc8cba744a39b1c75482b318f7db6eaaae9842cfa8649a9ad00cece8442e41
SSDEEP 384:gCjUH7KxkXqKf/pUZNCgVLH2HfgslsZ7pLuLcSjCDXODUr+ErU3/NHGcmyqOqjmo:gCUH7KxkXqKf/pUZNCgVLH2Hfgs+Z7pF
TLSH
T15A7209676C4C9E370F94C6CCD8267F4F9DB5024B65E9886483FA9C2903D5ACB114A2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 47c68b4389c67433f8fe61ca4223a3df32b82f7abface85bf8eb56bdec870a91
MD5 fd703c5dea288996e9a6a8f26b8b14cf
SHA1 6a2c7fb6e865c88aec58c354c8b5b2c270348ab0
SHA512 54ca7369ae27490905259fe68044d30df9e19381bce4f52ed60e79216ac64d05dec415b7a0150cd7094fc3b31fcf59736b880cade321dfc98d1f2e998cc5a212
TLSH
T1F4B01240C0425501C05702F421931488B114AF249F1A2B0153F0E922D8362508218290
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe586349.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe586349.TMP
Size 96B
SHA256 3ff6c39d34f986fbe51a49646523e0eef1b4afbfd56828d8d10204ce4e0cc85c
MD5 43e5bb8fe6bf1a0703bcb049e03fc962
SHA1 8ab57ae85474d69dcdea415784c671782a812c54
SHA512 cde44b7d1a40a8d0296fc15d73cc696991f0062cd0ed6b53f4f68232b5b0e25133bf5b097e952758761c062e3739955e85efda682fb4b0c81aa71d7737aff98b
TLSH
T17CB02200C0023202C00203F0288083C832B0EF28CB23022282E82EA2FC282200E22030
MD5 SHA1 SHA512 TLSH

Submit Download

3ed03f97af7b2a3a_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\3ed03f97af7b2a3a_0
Size 63KB
SHA256 e045a4af4c0fa015ff2c58f02f76a9e4d4e5b99503b09c7c627eef46424be7a6
MD5 f28931a70c83bc36ccda8af5af30f9c7
SHA1 4ecf80c77a77eae40827055964b3bd824c98cc75
SHA512 61e602c79e95dd1371f5a1616acbbf2451470e0ffd0094fcbaae75b200ecccd001c8a4995e0d2f38eef1159c89732d9d25350f9475d9cbf53a9f262f99a15d28
SSDEEP 1536:riF3WOjiEu5XhviJCtdyOx1yS8ot8/2NkYR3i6CzZ:riF3Pin5hVd51BCz
TLSH
T102536CD97721B0B7837B60F1505F1607B13AE5A7B008C4E4B198ECE15E64A6602BBFBC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 120B
SHA256 cd31b495987bc90cf5ffdc7e0cfa74d328f165464cf5fce6b901807f74025743
MD5 60171c99f749a6179017999d34c1ed59
SHA1 519bcd2ebcab7dea5b02a6dad8185a484ec5a414
SHA512 9674033848475521cfad0fd3ea08960132a1fd4760815645d2f68495f584e1013499b0319735dc1b16cd381f3b2e0abffd4bbdb124d67c97aca3d8971c0b62e3
TLSH
T110B012014341D320D801C370D7D306C833128D11062D0B834064AA809811542440230C
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 241KB
SHA256 2c0a8d1a46a0ec4fcea2811e4c5e259d278c66d5b90cc85ebae3d1f7237289e6
MD5 013311fec0c3dd83e57cfc0d14b05b79
SHA1 fb06f0055fd675d0838f435466cc1a7ed98831dc
SHA512 c7fc9be9f8c1d1863abb74a63f854d690012c4eb1bab31d1f8d10719a9446d742a473acdebc4fd1126105c697c206c9fbc33150c22c9954d5e9073dfd9536407
SSDEEP 6144:cGAgrcf75OcGgnmPxP4FO1+X++/7gm7Rkm1tYpBeh2BAog:+5jGAUgT9oBGcAog
TLSH
T1EA34123BED596D3A9D66F709600E7A2E1DE18E77C934D985D4863F0033EE3990908E78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 240KB
SHA256 9ad6b3f7a9e86740fb21ff2c59ff4a49bfc8879e934fc9ef6610739c16a0e138
MD5 e33493996e21140e4816c88a86e55b0a
SHA1 0c73c88b396afee5e08977c31c64861c6b3ce441
SHA512 a365d315074bebd5dcc17ff956babf7dea2adbf8b9b5bf129b333b24240f80c6f96be5bc50936aa4cb3ef81b9609a42712bb53b8adb9fa3f3500fc812fef7f71
SSDEEP 6144:SAgrcf75OcGgnmPxP4FO1+X++/7gm7Rkm1tYpBeh2BAog:x5jGAUgT9oBGcAog
TLSH
T1CF341237ED9DAD3A9955F709600E6A3E1EE18E778931D985C4D72F0033EA3990908E38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 241KB
SHA256 5d563e6081608284e089648d3d28e9e91bcd07fb01e116c4bbe372f9dc748927
MD5 1f607f75e831ec80d389d41e9add78d4
SHA1 43e91a77c5cd0369533356455035f7dc5a00ac73
SHA512 e3bfba457d33296f3f8cdd55ae0f7da491be083a3ff58a9de120769c52281a08a8709fd707059fc03b316258fba0899d84b3e4b5c9b797da99b6958b0b525d7a
SSDEEP 6144:a2Agrcf75OcGgnmPxP4FO1+X++/7gm7Rkm1tYpBeh2BAog:G5jGAUgT9oBGcAog
TLSH
T18B34123BED59A93A9D66F709600E7A2A1DF08E77C935D985D4C63F0033EE3950908E78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 2b264d7d1593288e032f7bc2562a31e0ddb2675c1e0b4562997e2e8fcbe800e7
MD5 a8bd2de7f83484f3c7a66f2084a46934
SHA1 6e656fda5a0a0a9f38455838f8197286f4fdde44
SHA512 b6533dcdaec122d83b1127d3a8af4d3be043d152546ae1d75d209fdef500b7f20dff0690c85d50239d4d6d2a3aa4d1886141fca87e08fa29f8716b468699fc4f
SSDEEP 3072:tGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMK:km7Rkm1tYpBeh2BAoK
TLSH
T117C3123B5D65E9779979B70EB08E0B1F1EF149A2D920DE92C8D85A0437EA7CD0A04D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 240KB
SHA256 cacaaad6b900c3aabfbb5d3992b02b7fd6ecf14ea2829ed83e0430b173464356
MD5 d79cc693d37e245d21c175598c54a0ba
SHA1 453243afa0a0b88a23489ccefd084f1f5aa61077
SHA512 60e19942ca0d62e706e5d43b2282dd7dc6f1244ffa83b226e4c42a68afbbdaa664e9eb3875a84888acad2a42821084a3eadedf634a207084959acb6c4ba05727
SSDEEP 6144:vAgrcf75OcGgnmPxP4FO1+X++/7gm7Rkm1tYpBeh2BAog:W5jGAUgT9oBGcAog
TLSH
T11E341237ED9DAD3A9955F709600E6A3E1EE18E778931D985C4D76F0033EA3990908E38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 241KB
SHA256 1ae23a31f37abb777f106048b04a29fe5d149f60187c034eb777a881f1fe416e
MD5 c22b25367eb9e5f0ebca1b54e2fad590
SHA1 b0c764b3cba5afe1c8dd280d9e959cf6c7d19b7d
SHA512 84bdf13731f4c7a5dc71a4642e685021768cde68132447e40f537200b3013c317a0829548e6789360a57b9d5be576af6c23d8b4d45087e5c485982f71ffa4c8b
SSDEEP 6144:m2Agrcf75OcGgnmPxP4FO1+X++/7gm7Rkm1tYpBeh2BAog:a5jGAUgT9oBGcAog
TLSH
T181341237ED59A93A9D66F709600E7A2A1DE08F77C935D985D4C63F0033EE3950908E78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 808672f14296b04df293c3e185a70b626c4f9187d586574837ffdcb84f0f83ed
MD5 99d365e71486a534b82180c5d6636c48
SHA1 815f2a2c6e02f3a3e4be1d48e83daed5a835def7
SHA512 66ca632e7baee0590eb9c37c4e509ee7e956b62e1c263a061700bb08942c34170fbd8a79b67dad2181a243235ae0462829561971a3fca809a755bf6414c31d49
TLSH
T104D02310B82CB7D2F123003D00304702344C8177B223B301B020040D8E300C3B2CA4E2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cc11c2ba3ec4cb292b61dd36af338e083bb0ce5868e654b17f3c58ecf3c8fdfb
MD5 22bfe5ff5070c92c37e54f6f278efd25
SHA1 2fc94025f3a738879f1fcececb95937cbaa0cdd1
SHA512 b57abd220e674cf733b39ea299fc66d6fe964ab448ae0758482efe80597e3678909cd989b9635acc0317001af0fe6dbbbccfd3cf110ec5ad1b9e4c084de22188
TLSH
T16FD09220B719A2C3E24704BA94A6AB52A916C57AA0B7F7017232640CAE65089F28F192
MD5 SHA1 SHA512 TLSH

Submit Download

1e1d9179-fcf9-4a34-ab08-b77a02d2d17e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1e1d9179-fcf9-4a34-ab08-b77a02d2d17e.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_00008e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008e
Size 42KB
SHA256 1404ca348bd75ef836f4dd8b6f2cc719458642d1237c368296b2fc652dca47dc
MD5 665db5e157d2138835c4037c971ff3a4
SHA1 41ca6b7e4818eb81531d8006ff7ddd971c640879
SHA512 6c999466673c9873b1b112d6ab95c7cecb99467ea156e3e046b54c5f3d109c3845b05cbb2a0245d178430c7b2ceacd5110f7d8faf7e041100f44852b0c29fe9a
SSDEEP 768:tMTmVhyXCrekkraPAjrWMMWD3UJmw0FRwoglekm+hQ7//geceSF/mEQBPMAmDu5:cmHkCrHvPAjrWMMI3UJswogl4j7/hSlW
TLSH
T1F9130231EB70EE59962C903454E7FDA9433B1457D731ACA80E99A1CE6F8103454FACEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

10897148f1c29a80_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\10897148f1c29a80_0
Size 258B
SHA256 d3b0e239a8fc08220a00cb07a6fe5fd505ce6a9b350aa6de2125ec4effaf0bcb
MD5 328ef4bc432bb01c914fa0a9fdeb0f9a
SHA1 96b73ed8a1389ee006357b4d96b0d7c6c2d45b29
SHA512 daae5ecce15435842b9842348bdb1a51d7fc845a93493e4e3afb4890f447464853caa0984c9ef082d068180899a5bea7fc9b41025ade6f16ab5134beda1e6af1
TLSH
T15FD097A348E8084DCD3C02F8CA7BA2CC461758C41468E2911B92C8B3E6010726880D25
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 fba3dcb8a1787517b0d7895eae06f7466f4dff1adc077af57ac2492dac913332
MD5 d0fec6ad8c4c7c2c4e3f847c655e2ae6
SHA1 39e2288edb45c5197df2911e37e27521c82a4274
SHA512 85ef0e498345cea5a5f2243036e117b448eaf2a198b4e6bb1150fd0aa9fe16f68a3bd2a9aac783d67300a272e242bc709583bf786e37c93c356d41693f608bfd
SSDEEP 96:B76ajUfbwWOB3v77H+4k7RTZRrTm7Hmn34e:BDjUjwLfW7zTWH03B
TLSH
T126C1ECB0049F9BB9F70A50B54FE2D44AB43280CEFD436E364369E7B6195534362C4B4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 cf36c1e4fbb935385c96f1b7e33683a83a466dc87508ed75ac30b235217018b8
MD5 f1fb69675072b5edda1071f07cc6d53c
SHA1 dd6139328a60f6b70222e9a214a96b78027d8b0e
SHA512 30f6a407d00ec539f45a7da5cc133b947646f324710e1cf30c655b2c2412b6f1812b4178044e97224ba579e723e5ffd596a6c0efecee9e4ee42c46963602d016
TLSH
T1137183B0488FA779F70A10F05BE22191383245DEFD432F34436AA9FA2D6430392D9F5A
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5389bdf9-c7ac-4bfa-980b-8dd32cd5fd80.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\5389bdf9-c7ac-4bfa-980b-8dd32cd5fd80.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 e0121f7cef9a3e1bfbb7a2993089f8c62e383e1d445f13d9223be35c24aba620
MD5 1e938ad9df35e912f0e5e11e37350ff6
SHA1 1a769e73ad2ac627a41efc249e43a50fb52f97f1
SHA512 5485dd89899792d9fd52488c4c8f09045450b59566b86efeb3ab7a8d3f2ee039d1ea49d9dd8fb9f3160b8da1b102f3ed5d7de649ea6c93ce91c1791a19b4b571
SSDEEP 192:DE97YCBujswfTCG0UnY2krl8eD4ZXgimNaIF24VRxx:DE97YCBujswfTCG0UnY2krl8eD4ZXgio
TLSH
T11FF178FBC2D5D66E89015BF49614AE1BCF1D0B1583283C1588D5FE8BE3E2072E16A64F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 28KB
SHA256 652751b2f9197e95539f2037997271e65a17c8007cba18812987dbdd437aa633
MD5 e8c7cfc20a60b196b8020566cc4793f3
SHA1 6d836dd439690cd9abd1325cb51a6c424710bfee
SHA512 c99c0e840b8eb9cd14a0881ecaee3731269088b818f22822ff43a839014a3b1895735a3a8c503d9f6408a608fc184e52e23502c07cca1d696c9ee3620bdde09f
SSDEEP 384:DE97YCBujswfTHwnwEKaP8A/eS7eMaNJn2iHtxpe964lEQJMqGhY/l8eXgA4VRuv:VMHdMi5Sp/hymoeZ1vYpL
TLSH
T117D278F782E5D62E89115BF856146E1BCF1D0725432C3C2688D5FE87E3E2072E16A64F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 b823a93e4742f0ddbd6e9f400a466fc85432403a20e66060b215bc0729bd865b
MD5 6a4bc0197adcf9075320dda12c6e2cd8
SHA1 6e52dd98da3962a02695117b09345776b769ba85
SHA512 e8ac6cbfe83972415046af0c636fae1b573ac2f0686514e79c298ca6f9c9458d0158b63fb23889dfacec72640c81a0228e3fac7f0e24e37a0c3e5b09a2021d3e
SSDEEP 192:sxZmRAWy/f0sFeIdp8zHW6+WNmR2/YI1aJ7IgrJ:sxZm5y/f0sFPqHbz/S9
TLSH
T10722B812AE38A97B8CC7D20DBA25BF53E6F9503291955E44B6FCCA1C04E76DD620780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 9b7c8382688bda558157169c161c946bb260ba01e71c767133d8c8cb992bb6a9
MD5 126b242f64b5e00c461a3f23a7742ed2
SHA1 b6b24cbbcd6ca5710c15a2bf9e244957d85c32c1
SHA512 6fb7d28a53ca9570d9fa245b55d95dc202a76393abfcc69960d27e827706277c0016ef1d1676abc986d79bdaf12ae59accbf1b3c69e861cf2cfcf4892838a93d
SSDEEP 192:sxZmRAWy/f0sweIdp8zHW6+WNmR2/YIkOJ7Ig5H0J:sxZm5y/f0swPqHbz/7t4
TLSH
T11822C952AE38697B8CC7E20DBA25BF43E6F9503291915E44B6FCCA1C05E76DD620780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 85962fc01d5346a17551d1189a672a022bc3c6d4658fef01648279e45b211fe7
MD5 fd340705618e023d7b3e252b65c45859
SHA1 ecf4b3c6a579995bc2a667b8d9dec58ac8e813be
SHA512 41ef646b350f4b5ea4c4bf1b20528db143a6d339da8d75a5c393ba663c21c361f859298b32322d908ae734f064eb269437c75e88fd61fa2b552e1064c98a9519
SSDEEP 192:sxZmRAPy/f0sw4IdpHj3nHyPHW6+WNM/CfJFXYIdJKk7Ig5H0J:sxZmyy/f0swJ4HbfX8It4
TLSH
T1C542A752A938697B8CC6D31DBA15BF53E2F9603191D05E44BAFCCA1C05EB7DD620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 7bc582f0f81844e377f4e5c048332db481c592c2189a5d1e716541ab65b91ee4
MD5 fd395844f34e22dfef2e6c2337c34c9a
SHA1 3e67fe99a48e1ccfd672db763bcebee79742086b
SHA512 9448a6606c4d835e43b4b91d53a12934c027abb5c595a8eeb8560c8157c49c07da692f55865bd5be98644fef6e3309194e555aa3c2e4bcf7eee4c153ef2dd6a5
SSDEEP 192:sxZmRAWy/f0sweIdpuzHW6+WNmJFXYIdxKk7Ig5H0J:sxZm5y/f0swPgHbyX0It4
TLSH
T1C932C852AE38697B8CC7E20DBA25BF53E2F9503291915E44B6FCCA1C05E76DD620780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 4c8f4633ce94e07284e0dde7499e0cf9986e1257a65b05b59a156b1b7c53cd4a
MD5 9c8c50475d4fc46ffb195f51476bb6fc
SHA1 cc5b603d168cf5d6d37d5e4b5328348bd75f2125
SHA512 403b63970fa89ebd8e44a3d42308cac09b56c8ae561776028074802111c483bee030227161061ea7c44ebfe959389a476fe361f6606a10a53ce8d40c75ab869d
SSDEEP 192:sxZmRAWy/f0sbeIdp8zHW6+WNmR2/YI1aJ7Ig5HeJ:sxZm5y/f0sbPqHbz/Stq
TLSH
T12022B812AE38A97B8CC7D20DBA25BF53E6F9503291955E44A6FCCA1C04E76DD620780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 7c7493d5766f903dac6888ef86de8d96462fd7a1401c777ce1702904f1153b27
MD5 33d13f78047175f43cd023dabafa1881
SHA1 248845fd541b2d2ac6f89a03f135c306ac842c47
SHA512 f61002288d797cdeb23ab524b5838cc7365ecc4cd9751fcb29a9433e0880d044f9d369e879780e50f10f60929af988b70adac927245bf204738fe34f17dfa8e4
SSDEEP 768:BwyqbblWvJDbT8F1+UoAYDCx9Tuqh0VfUC9xbog/OVE4Ll6AR7iro5mj:BwyqbblWvJDbTu1jah4LAs7550
TLSH
T112C2F93B654CCB7E4FC00A9DDD1A6FD73E9802CBA6588D4047FA994C02C77EA51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c108736964d038a0_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\c108736964d038a0_0
Size 63KB
SHA256 c4c7eb7501fdc8653500c6d15f606af187800dddf92609278bd9b70c7ec141e1
MD5 57bfaa9d71ffb5a157775181894d0a90
SHA1 d80110cbf9b0f799dd84e0f3038cc8197006e6a8
SHA512 d44ba6ffe6d54b0446f3d5c71e3fd084660de0cc21ecc82bfd0692392757d620dba83bc641e9e0f87f0b1c61f456850493f7b8a1881277af38bf2396586cc4a4
SSDEEP 1536:niF3WOjiEu5XhviJCtdyOx1yS8ot8/2NkYR3i6CzZ:niF3Pin5hVd51BCz
TLSH
T142536CD97721B4B7837B60F1905F1607B13AE5A7B004C4E4B198ECE15E64A6602BBFBC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 1df65aedd1574bbdbe36780f464d1c120494ddbb455054424cf7df789865cac5
MD5 c5a03d4f7ee5cbd5ec5f1ed0c84ed816
SHA1 728f66f19dfd99cd419151917a0f5206f0258084
SHA512 53fa7cd75737b9e0ace7add04a19c39ecae011cd09273630efa73257c58d5b9c08c31e8e62b7fe8da4b6328d94ec084dfb977eaee07f20228f204b72edeaad2f
TLSH
T15CA0029007414061D08182F0B492C3622360CD311532031783A08945CC982609A56404
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 c18d35ef907f925c9289716a5f4f873f92e2781797871c9b6a70b5dde0e48a08
MD5 647b475d9a566c23814c307b648239be
SHA1 50ca9c54a64339b7fe79180b9ceda226359bade4
SHA512 6073618475b36737165a326fa9df5c14385e91a1033a4b11145426a49b421dd92dceb7a21ba8ca7ff52221bcccd9fe695b3614ef5bbf47bee65770967a19e0b8
SSDEEP 48:KPYNs4iCiac6vpI9IaKGveOaS4K7H2oTyskHQE6SC2cS99IrE2KKTCm22smNFWkx:KYbaKYIKmdCK+wSOneK8Um
TLSH
T1FC91F50A723A0283393E6988B36A86770F4536633459A5AF3FB954714A6BD134CFCCDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe58e5d7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe58e5d7.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 ae2d7ae49d7c9e6fde7804b7c67ed4c3114f0aeb68f293d93c9bdc72451b2f8b
MD5 65200656cd1676a50d532942772dcc3c
SHA1 e9e8bc7dca2601d5d5de4778422cd90d063a398c
SHA512 d11ff025073d6173396570a01d76c61e7fad7f9b7818872cb33e2b3385ef3e604a73169fc9539be99ba500cbbed7e78b99aee709aa5e84cd7118c03f9651195c
SSDEEP 384:ZZcIysNeAfBSbfvah4VRNuOPxQ9eBtsa+VY2Gxo2:xyOzhuHuOS9eBthgPOl
TLSH
T1A9827D326D386CB759B6A645F58733079EB89067E6C9AF80C1DD9F0D01DE6DC1306C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 a2cc36a97ed556542b982c19b2dbf17225fd46cc01a1900051b957ae15d18846
MD5 543fe7a96a72661961239c42dd5b8a89
SHA1 2a735dd2d5263541a07382fe5604d1443bf3b0c3
SHA512 f487de2df675d32e6188abe854dfa8c1615c50c190b374327b3f818ebd45bdb1c8d6b29cc6ee825b147ef52347439c4d73339a4bd7d490c1ef4ac76e10cf49a9
SSDEEP 384:+ZcIysNeLfBSbfvah4VRNuOPxQ9eBtsa+VY2Gxo2:8yVzhuHuOS9eBthgPOl
TLSH
T105827D326D386CBB59B6A645F58732079EB89067E6C9AF80C1DC9F0D01DE6DC1306C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 42a6676ee0996d81182802bcf53329718b201b585be87993580847db4b086267
MD5 971ca9e15437695783f9892916afdec4
SHA1 9657954e725ec7ea516e4c117ca9ce70585507f8
SHA512 afe69cadcc0f35240d715d68f6ca92bfa58e1b49a2228488779940db60ad19846bb485d6835a62a1853676adefea395e4c58f42365e61afbc32edd0e9554a961
SSDEEP 384:giFPZcIlsNu8TUNTUlIlLfBSbP4ahJ2VRNuOPxQ9eotsa+VY2Gxo2:7FHlXwgdmhJUHuOS9eothgPOl
TLSH
T171C23BF259D79C7AD9AE5743A77E2E038DBCD053B585AA40B3C84A0CCC9A1BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 0aa5887d90213bba38a287852815611be7796f0131feb904f55a17e608e32fca
MD5 00c364ef57239b9e0e6c16d0880d5dfb
SHA1 855a2bff2ff864ee8c7d1b077cd92fc6c21efc6c
SHA512 e0084e321fe56ba3ae3a4b37acdb6dbea5a048dae5bc15ac8f74fcada3aa08d3360376986886061e64c436c7a299c36b0027dcb830eef152a930fa3d1bdb9d84
SSDEEP 192:tONW6JkRtQmiUyFXW+RNuOmYxBh33RTU6:tONW6UrWW+RNuOPxbNU6
TLSH
T1DD02E9357D382C7B9EE26E49B58B27135FA4207BF9956F80DAD81F0C01D765C2306936
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 656e30999c9a9df9c1a71c7ea71cb20e4b7035291643a4f631080eb3250ac09e
MD5 0e65bbb880b8ee835e5ca3662f9cd0b8
SHA1 622525acd5f10b10279ee4fcff33d01e517c4249
SHA512 93211935c34fcacbfe5d84edc45135f7afc04060518c7827016ceed64273f8ba6f9a2b74ac0a726fb8035052834fa771b6afab7481649b92ed0a3aeded3675ab
SSDEEP 384:giF5ZcIZsNd8TUNTUlIlDfBSbmDhJ+VRNuOPxQ9eG/tsa+VY2Gxo2:7FRZ2wgtthJ8HuOS9eG/thgPOl
TLSH
T195C24CF259D79876D9AE5743A77E2E038DBCD057B5849940B3C84A0DCC9A1BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 293cf3000ee792bb71814e8acd10559e3a02ea4a7b71db60cd3f865fa8a0968b
MD5 2e6c45ecad66be2ed7452f690215d8e9
SHA1 bd1701c2402d76d11347109c91df466722f6f9bb
SHA512 ae6973d222a673b8b7f3613b9628c732cd497e55b880f7df0cbb3266cfc74220652871505b3fb82af129571d1c64ab50bdc3baf2edb7df60c7f44ec335f0266f
SSDEEP 192:iONn6JkRHQmiUy0Xe+RNuOmYx2j9euVcNqsHU6:iONn6UpZe+RNuOPxQ9eZtU6
TLSH
T13B122B367D386C775EE26944F48736035EA85127EA89BF80D5DC1F0C02DFA9C230B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 03f48b060ef1c79fb8d2fbedccc51090fa695d79b5d1a3d639ea53d9354956c9
MD5 27e0bd9250eb926426c366d350ffea33
SHA1 49a53c627e3f689de8f279c9d3e714d25fb02bc1
SHA512 99430e8efc66eff3fcc85fd2924f565f1772ec369ec7c4ab7cc4ae34d20601a9d4b224cacfd6ee31707463168a06d724a51bff372082fdafc93006b2488f6ce7
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe5944df.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5944df.TMP
Size 392B
SHA256 715eca347d7e5286ae00243b72982a93d80482a5cc265d20863079fefff3daf6
MD5 ba230d3cc325f5339271dbbb5c76e47f
SHA1 fed310c93c29652ad3d93cf249a8f33b464a05db
SHA512 bc2dfcfbfe74cffe9c86dce6207b4c5f351bcaa6c6182d65bf13a3b1856bf3e0b27e72f26b2194bc690e050e4be966303f87718a3f634181cd70ead4e5032c75
MD5 SHA1 SHA512

Submit Download

ba71f22a-8bbb-4ca9-ba6d-207ff013ce2c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ba71f22a-8bbb-4ca9-ba6d-207ff013ce2c.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 5c2df41aed1324dfa3c1480ac0ddd814555c90f780582fe7205e3571206341e1
MD5 3ddaf0f1be0fa9398f34eb3bb50402f8
SHA1 c0c4738320b62d202db57170b923e9ea7274fbc3
SHA512 27cb590ad0b6e3c69afec933d10acf3834b80b9a709fecd29da1f3f41a24e0539b76c78285c0a57a15c01cb02fed87d5b2a33e168bf666cae9a94ce42640b373
TLSH
T168411858B6E91148B3B67E569BF6A86D487EB8372F06D49E00110E4F4B27B40C86173B
MD5 SHA1 SHA512 TLSH

Submit Download

Unconfirmed 320499.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 320499.crdownload
Size 3.6MB
SHA256 dbc951b4ab01646888b2a91da73a94dd920054c2f27c8cfeacae3eba298e71b0
MD5 53ef4972d65304468d2519aa692001c8
SHA1 095036f9669230cb69b42eb5e6d91fdbe46ab61e
SHA512 3be4a4f1715a06863d552d726549268ae38327023d92b43767c3f71bf34a8f1f46d3d2788218831716016438bedac057068dedf4698cfe6d7ad9024bba49c46a
SSDEEP 98304:cRZBAYtCkpjsMig0xgsXzQZ5exHkZfqXdl/X+S2H:6RM6S3LXzWexPX/X+R
TLSH
T17C06231DE79418F9E037D238CD934506EAB2BC9D9B71C68F23A515A92F237A09E3D311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unconfirmed 909231.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 909231.crdownload
Size 2.8MB
SHA256 023e54f1200d23718bbfcdce0afa69042312b8c12299254d8ce2ccdb5760ef47
MD5 379011bd8ba12ae3037840c0055378a9
SHA1 a02f6f25c8cac9976b6b19a989ee0b1a59f34e72
SHA512 cf319c26299a120f91419aa7bd4071d1f660fbff5c27dd3102cb3e26ca9607d306b964e12b7dfc9a664e040fb3391f9090493282b2e89c1d1597925cb463383b
SSDEEP 49152:KeuO7FzfE1NfOl8Gk+/xfY0N4mJfS8cQt1lXO+5YuaphhbVx2+zvW:KelF7E1xBGk+/95N4mle+5YuaphhbVx+
TLSH
T1E2D57C117A407077D56343709E2AF279E2AFB6710B3941DF93988EAD29311C29A3877F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5772-1815-0x0000029E601B0000-0x0000029E601B1000-memory.dmp

Download

memory/5772-1805-0x0000029E601B0000-0x0000029E601B1000-memory.dmp

Download

memory/5772-1817-0x0000029E601B0000-0x0000029E601B1000-memory.dmp

Download

memory/5772-1816-0x0000029E601B0000-0x0000029E601B1000-memory.dmp

Download

memory/5772-1813-0x0000029E601B0000-0x0000029E601B1000-memory.dmp

Download

memory/5772-1812-0x0000029E601B0000-0x0000029E601B1000-memory.dmp

Download

memory/5772-1811-0x0000029E601B0000-0x0000029E601B1000-memory.dmp

Download

memory/5772-1814-0x0000029E601B0000-0x0000029E601B1000-memory.dmp

Download

memory/5772-1806-0x0000029E601B0000-0x0000029E601B1000-memory.dmp

Download

memory/5772-1807-0x0000029E601B0000-0x0000029E601B1000-memory.dmp

Download