55b43b6c0d9dc83edd61c145e30d3144d1183fad907b34ca8fb1e1c10163da96

Analysis

user interaction
yes
max time kernel
119s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/09/2026, 23:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SkyCode.dll
Size 30.2MB
Sample260912-3sraqsbh63
SHA256 55b43b6c0d9dc83edd61c145e30d3144d1183fad907b34ca8fb1e1c10163da96
MD5 9579f7c982c7dd4a37065180e92cbe08
SHA1 3444b9383118fb7423a0903cce869553c94e7f5c
SHA512 5378f5b4f073f38c66238b5b0e2bd6f8215d5c3f2de4a819d1ee2cafb06d7369312b6366e9e1d2ff7af860f0e54378fd7e2f9b7c19a5f14c061cd0b69f767985
SSDEEP 393216:yqMdw/nOTwR/t6UNUZpjCS2e5yzIOtWnoKDfc2KWBK5MoUxw+AiaWj0z:6dieZpjCS2ehOMnJ7Cf9iaWoz
TLSH
T11C67CF2A729C4084F0B6C17DCACBDA47E7B238050B219BDB1690575E1F7FFD84A79A21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
5	raw.githubusercontent.com
116	raw.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4772	chrome.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2714045687-1127350534-2056456672-1000\{E5569201-B59B-4737-9151-C8AD73004528}	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5940	chrome.exe
5940	chrome.exe
5940	chrome.exe
5940	chrome.exe

Suspicious behavior: LoadsDriver 3 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 46 IoCs

pid	Process
5940	chrome.exe
5940	chrome.exe
5940	chrome.exe
5940	chrome.exe
5940	chrome.exe
5940	chrome.exe
5940	chrome.exe
5940	chrome.exe
5940	chrome.exe
5940	chrome.exe
5940	chrome.exe
5940	chrome.exe
5940	chrome.exe
5940	chrome.exe
5940	chrome.exe
5940	chrome.exe
5940	chrome.exe
5940	chrome.exe
5940	chrome.exe
5940	chrome.exe
5940	chrome.exe
5940	chrome.exe
5940	chrome.exe
5940	chrome.exe
5940	chrome.exe
5940	chrome.exe
5940	chrome.exe
5940	chrome.exe
5940	chrome.exe
5940	chrome.exe
5940	chrome.exe
5940	chrome.exe
5940	chrome.exe
5940	chrome.exe
5940	chrome.exe
5940	chrome.exe
5940	chrome.exe
5940	chrome.exe
5940	chrome.exe
5940	chrome.exe
5940	chrome.exe
5940	chrome.exe
5940	chrome.exe
5940	chrome.exe
5940	chrome.exe
5940	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5940	chrome.exe
Token: SeCreatePagefilePrivilege	5940	chrome.exe
Token: SeShutdownPrivilege	5940	chrome.exe
Token: SeCreatePagefilePrivilege	5940	chrome.exe
Token: SeShutdownPrivilege	5940	chrome.exe
Token: SeCreatePagefilePrivilege	5940	chrome.exe
Token: SeShutdownPrivilege	5940	chrome.exe
Token: SeCreatePagefilePrivilege	5940	chrome.exe
Token: SeShutdownPrivilege	5940	chrome.exe
Token: SeCreatePagefilePrivilege	5940	chrome.exe
Token: SeShutdownPrivilege	5940	chrome.exe
Token: SeCreatePagefilePrivilege	5940	chrome.exe
Token: SeShutdownPrivilege	5940	chrome.exe
Token: SeCreatePagefilePrivilege	5940	chrome.exe
Token: SeShutdownPrivilege	5940	chrome.exe
Token: SeCreatePagefilePrivilege	5940	chrome.exe
Token: SeShutdownPrivilege	5940	chrome.exe
Token: SeCreatePagefilePrivilege	5940	chrome.exe
Token: SeShutdownPrivilege	5940	chrome.exe
Token: SeCreatePagefilePrivilege	5940	chrome.exe
Token: SeShutdownPrivilege	5940	chrome.exe
Token: SeCreatePagefilePrivilege	5940	chrome.exe
Token: SeShutdownPrivilege	5940	chrome.exe
Token: SeCreatePagefilePrivilege	5940	chrome.exe
Token: SeShutdownPrivilege	5940	chrome.exe
Token: SeCreatePagefilePrivilege	5940	chrome.exe
Token: SeShutdownPrivilege	5940	chrome.exe
Token: SeCreatePagefilePrivilege	5940	chrome.exe
Token: SeShutdownPrivilege	5940	chrome.exe
Token: SeCreatePagefilePrivilege	5940	chrome.exe
Token: SeShutdownPrivilege	5940	chrome.exe
Token: SeCreatePagefilePrivilege	5940	chrome.exe
Token: SeShutdownPrivilege	5940	chrome.exe
Token: SeCreatePagefilePrivilege	5940	chrome.exe
Token: SeShutdownPrivilege	5940	chrome.exe
Token: SeCreatePagefilePrivilege	5940	chrome.exe
Token: SeShutdownPrivilege	5940	chrome.exe
Token: SeCreatePagefilePrivilege	5940	chrome.exe
Token: SeShutdownPrivilege	5940	chrome.exe
Token: SeCreatePagefilePrivilege	5940	chrome.exe
Token: SeShutdownPrivilege	5940	chrome.exe
Token: SeCreatePagefilePrivilege	5940	chrome.exe
Token: SeShutdownPrivilege	5940	chrome.exe
Token: SeCreatePagefilePrivilege	5940	chrome.exe
Token: SeShutdownPrivilege	5940	chrome.exe
Token: SeCreatePagefilePrivilege	5940	chrome.exe
Token: SeShutdownPrivilege	5940	chrome.exe
Token: SeCreatePagefilePrivilege	5940	chrome.exe
Token: SeShutdownPrivilege	5940	chrome.exe
Token: SeCreatePagefilePrivilege	5940	chrome.exe
Token: SeShutdownPrivilege	5940	chrome.exe
Token: SeCreatePagefilePrivilege	5940	chrome.exe
Token: SeShutdownPrivilege	5940	chrome.exe
Token: SeCreatePagefilePrivilege	5940	chrome.exe
Token: SeShutdownPrivilege	5940	chrome.exe
Token: SeCreatePagefilePrivilege	5940	chrome.exe
Token: SeShutdownPrivilege	5940	chrome.exe
Token: SeCreatePagefilePrivilege	5940	chrome.exe
Token: SeShutdownPrivilege	5940	chrome.exe
Token: SeCreatePagefilePrivilege	5940	chrome.exe
Token: SeShutdownPrivilege	5940	chrome.exe
Token: SeCreatePagefilePrivilege	5940	chrome.exe
Token: SeShutdownPrivilege	5940	chrome.exe
Token: SeCreatePagefilePrivilege	5940	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5940	chrome.exe
5940	chrome.exe
5940	chrome.exe
5940	chrome.exe
5940	chrome.exe
5940	chrome.exe
5940	chrome.exe
5940	chrome.exe
5940	chrome.exe
5940	chrome.exe
5940	chrome.exe
5940	chrome.exe
5940	chrome.exe
5940	chrome.exe
5940	chrome.exe
5940	chrome.exe
5940	chrome.exe
5940	chrome.exe
5940	chrome.exe
5940	chrome.exe
5940	chrome.exe
5940	chrome.exe
5940	chrome.exe
5940	chrome.exe
5940	chrome.exe
5940	chrome.exe
5940	chrome.exe
5940	chrome.exe
5940	chrome.exe
5940	chrome.exe
5940	chrome.exe
5940	chrome.exe
5940	chrome.exe
5940	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5940	chrome.exe
5940	chrome.exe
5940	chrome.exe
5940	chrome.exe
5940	chrome.exe
5940	chrome.exe
5940	chrome.exe
5940	chrome.exe
5940	chrome.exe
5940	chrome.exe
5940	chrome.exe
5940	chrome.exe
5940	chrome.exe
5940	chrome.exe
5940	chrome.exe
5940	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5940 wrote to memory of 3492	5940	chrome.exe	96
PID 5940 wrote to memory of 1856	5940	chrome.exe	97
PID 5940 wrote to memory of 4772	5940	chrome.exe	98
PID 5940 wrote to memory of 1856	5940	chrome.exe	97
PID 5940 wrote to memory of 1088	5940	chrome.exe	100
PID 5940 wrote to memory of 1088	5940	chrome.exe	100
PID 5940 wrote to memory of 5540	5940	chrome.exe	101
PID 5940 wrote to memory of 5540	5940	chrome.exe	101
PID 5940 wrote to memory of 2676	5940	chrome.exe	102
PID 5940 wrote to memory of 2676	5940	chrome.exe	102
PID 5940 wrote to memory of 4600	5940	chrome.exe	103
PID 5940 wrote to memory of 4600	5940	chrome.exe	103
PID 5940 wrote to memory of 6120	5940	chrome.exe	104
PID 5940 wrote to memory of 6120	5940	chrome.exe	104
PID 5940 wrote to memory of 5204	5940	chrome.exe	105
PID 5940 wrote to memory of 568	5940	chrome.exe	106
PID 5940 wrote to memory of 612	5940	chrome.exe	107
PID 5940 wrote to memory of 568	5940	chrome.exe	106
PID 5940 wrote to memory of 612	5940	chrome.exe	107
PID 5940 wrote to memory of 3160	5940	chrome.exe	108
PID 5940 wrote to memory of 3160	5940	chrome.exe	108
PID 5940 wrote to memory of 1924	5940	chrome.exe	110
PID 5940 wrote to memory of 1924	5940	chrome.exe	110
PID 5940 wrote to memory of 4744	5940	chrome.exe	111
PID 5940 wrote to memory of 4744	5940	chrome.exe	111
PID 5940 wrote to memory of 6084	5940	chrome.exe	114
PID 5940 wrote to memory of 4992	5940	chrome.exe	115
PID 5940 wrote to memory of 6084	5940	chrome.exe	114
PID 5940 wrote to memory of 4992	5940	chrome.exe	115
PID 5940 wrote to memory of 1320	5940	chrome.exe	116
PID 5940 wrote to memory of 1320	5940	chrome.exe	116
PID 5940 wrote to memory of 1236	5940	chrome.exe	117
PID 5940 wrote to memory of 1236	5940	chrome.exe	117
PID 5940 wrote to memory of 6128	5940	chrome.exe	118
PID 5940 wrote to memory of 6128	5940	chrome.exe	118
PID 5940 wrote to memory of 4508	5940	chrome.exe	119
PID 5940 wrote to memory of 4508	5940	chrome.exe	119
PID 5940 wrote to memory of 2532	5940	chrome.exe	120
PID 5940 wrote to memory of 2532	5940	chrome.exe	120
PID 5940 wrote to memory of 5076	5940	chrome.exe	121
PID 5940 wrote to memory of 3340	5940	chrome.exe	122
PID 5940 wrote to memory of 5076	5940	chrome.exe	121
PID 5940 wrote to memory of 3340	5940	chrome.exe	122
PID 5940 wrote to memory of 4540	5940	chrome.exe	124
PID 5940 wrote to memory of 4540	5940	chrome.exe	124
PID 5940 wrote to memory of 712	5940	chrome.exe	125
PID 5940 wrote to memory of 712	5940	chrome.exe	125
PID 5940 wrote to memory of 5376	5940	chrome.exe	126
PID 5940 wrote to memory of 5376	5940	chrome.exe	126
PID 5940 wrote to memory of 5892	5940	chrome.exe	127
PID 5940 wrote to memory of 1000	5940	chrome.exe	128
PID 5940 wrote to memory of 5220	5940	chrome.exe	129
PID 5940 wrote to memory of 2264	5940	chrome.exe	130
PID 5940 wrote to memory of 2264	5940	chrome.exe	130
PID 5940 wrote to memory of 5612	5940	chrome.exe	131
PID 5940 wrote to memory of 5612	5940	chrome.exe	131
PID 5940 wrote to memory of 1872	5940	chrome.exe	132
PID 5940 wrote to memory of 1872	5940	chrome.exe	132
PID 5940 wrote to memory of 5072	5940	chrome.exe	133
PID 5940 wrote to memory of 5072	5940	chrome.exe	133
PID 5940 wrote to memory of 2312	5940	chrome.exe	134
PID 5940 wrote to memory of 2312	5940	chrome.exe	134
PID 5940 wrote to memory of 5556	5940	chrome.exe	135
PID 5940 wrote to memory of 5556	5940	chrome.exe	135

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SkyCode.dll,#1
1⤵
PID:4692

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7fff4e90c728,0x7fff4e90c734,0x7fff4e90c740
  2⤵
  PID:3492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1672,i,713007471943274267,17024640710674163873,262144 --field-trial-handle=1836,i,12371152785416425183,16666072892857263709,262144 --variations-seed-version --mojo-platform-channel-handle=1832 /prefetch:2
  2⤵
  PID:1856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1900,i,6722103037327004109,17837176092421383155,524288 --field-trial-handle=1836,i,12371152785416425183,16666072892857263709,262144 --variations-seed-version --mojo-platform-channel-handle=2128 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2320,i,578231598046472624,15541379768369737911,524288 --field-trial-handle=1836,i,12371152785416425183,16666072892857263709,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:13
  2⤵
  PID:1088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3320,i,6572342679794505651,15455533490192614532,2097152 --field-trial-handle=1836,i,12371152785416425183,16666072892857263709,262144 --variations-seed-version --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:5540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3264,i,3726578757263382122,7252386967493927731,2097152 --field-trial-handle=1836,i,12371152785416425183,16666072892857263709,262144 --variations-seed-version --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:2676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4720,i,18230335673445413760,3142666015962040128,2097152 --field-trial-handle=1836,i,12371152785416425183,16666072892857263709,262144 --variations-seed-version --mojo-platform-channel-handle=4732 /prefetch:1
  2⤵
  PID:4600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4860,i,4149996457965031391,8633919614073157770,524288 --field-trial-handle=1836,i,12371152785416425183,16666072892857263709,262144 --variations-seed-version --mojo-platform-channel-handle=4904 /prefetch:14
  2⤵
  PID:6120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5436,i,8345110293976075953,2748608564299155109,524288 --field-trial-handle=1836,i,12371152785416425183,16666072892857263709,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:14
  2⤵
  PID:5204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5524,i,7931347665846171902,9197889099150556922,2097152 --field-trial-handle=1836,i,12371152785416425183,16666072892857263709,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5536,i,17429367264620047471,9873112964222538747,2097152 --field-trial-handle=1836,i,12371152785416425183,16666072892857263709,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:1
  2⤵
  PID:612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5720,i,12020424885289608963,9352071793316942379,2097152 --field-trial-handle=1836,i,12371152785416425183,16666072892857263709,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:1
  2⤵
  PID:3160
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5944,i,12570487210564177310,15226082604231893692,2097152 --field-trial-handle=1836,i,12371152785416425183,16666072892857263709,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:1
  2⤵
  PID:1924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6120,i,9362940126316139608,3544586349844570090,2097152 --field-trial-handle=1836,i,12371152785416425183,16666072892857263709,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:1
  2⤵
  PID:4744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5832,i,16218640931811882643,1240459623860921450,2097152 --field-trial-handle=1836,i,12371152785416425183,16666072892857263709,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:1
  2⤵
  PID:6084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5988,i,11537579975793619524,8522513970523150839,524288 --field-trial-handle=1836,i,12371152785416425183,16666072892857263709,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:14
  2⤵
  PID:4992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6428,i,16352466128922588743,2638737960608903679,2097152 --field-trial-handle=1836,i,12371152785416425183,16666072892857263709,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:1
  2⤵
  PID:1320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5992,i,915666313208684658,10433634747957139236,2097152 --field-trial-handle=1836,i,12371152785416425183,16666072892857263709,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:1
  2⤵
  PID:1236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6884,i,1633301419572688306,14181410765122410105,2097152 --field-trial-handle=1836,i,12371152785416425183,16666072892857263709,262144 --variations-seed-version --mojo-platform-channel-handle=6928 /prefetch:1
  2⤵
  PID:6128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5788,i,8126310464220886319,14874056779576501168,524288 --field-trial-handle=1836,i,12371152785416425183,16666072892857263709,262144 --variations-seed-version --mojo-platform-channel-handle=6620 /prefetch:14
  2⤵
  PID:4508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6116,i,8532071881828681755,12832994426508963795,524288 --field-trial-handle=1836,i,12371152785416425183,16666072892857263709,262144 --variations-seed-version --mojo-platform-channel-handle=6576 /prefetch:14
  2⤵
  PID:2532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6908,i,17828953427177175213,18273303816517210724,2097152 --field-trial-handle=1836,i,12371152785416425183,16666072892857263709,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:9
  2⤵
  PID:5076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=3348,i,7282093869415587395,12377760519166647836,2097152 --field-trial-handle=1836,i,12371152785416425183,16666072892857263709,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:1
  2⤵
  PID:3340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=7036,i,17682479226744978760,6314388041909202450,2097152 --field-trial-handle=1836,i,12371152785416425183,16666072892857263709,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
  2⤵
  PID:4540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6120,i,11267739721256881837,1038090676553476916,2097152 --field-trial-handle=1836,i,12371152785416425183,16666072892857263709,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:1
  2⤵
  PID:712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=6660,i,3221360878802196484,5886444094772054394,2097152 --field-trial-handle=1836,i,12371152785416425183,16666072892857263709,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:1
  2⤵
  PID:5376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6252,i,11874406928204115432,820995227764560238,524288 --field-trial-handle=1836,i,12371152785416425183,16666072892857263709,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:14
  2⤵
  PID:5892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6208,i,8821088654515018577,17522553740732539647,524288 --field-trial-handle=1836,i,12371152785416425183,16666072892857263709,262144 --variations-seed-version --mojo-platform-channel-handle=4780 /prefetch:14
  2⤵
  PID:1000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5880,i,94347585367588757,5111511483169642149,524288 --field-trial-handle=1836,i,12371152785416425183,16666072892857263709,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:14
  2⤵
  PID:5220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=6132,i,3359849576336466651,9795149831439297526,2097152 --field-trial-handle=1836,i,12371152785416425183,16666072892857263709,262144 --variations-seed-version --mojo-platform-channel-handle=4720 /prefetch:1
  2⤵
  PID:2264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=6536,i,316843135150210573,5671065215568011006,2097152 --field-trial-handle=1836,i,12371152785416425183,16666072892857263709,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:1
  2⤵
  PID:5612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=6832,i,6062320985931956550,12076104033460545974,2097152 --field-trial-handle=1836,i,12371152785416425183,16666072892857263709,262144 --variations-seed-version --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:1872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=5880,i,18217579174633900998,16641854243109873462,2097152 --field-trial-handle=1836,i,12371152785416425183,16666072892857263709,262144 --variations-seed-version --mojo-platform-channel-handle=6620 /prefetch:1
  2⤵
  PID:5072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --metrics-shmem-handle=6168,i,15445071765861901325,15280781557156114415,2097152 --field-trial-handle=1836,i,12371152785416425183,16666072892857263709,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:2312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --metrics-shmem-handle=6180,i,12912012753923079265,14712063916117140922,2097152 --field-trial-handle=1836,i,12371152785416425183,16666072892857263709,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:1
  2⤵
  PID:5556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --metrics-shmem-handle=5456,i,8023813493329017170,2224699905527212459,2097152 --field-trial-handle=1836,i,12371152785416425183,16666072892857263709,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:1
  2⤵
  PID:4344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --metrics-shmem-handle=5716,i,11917405891494306427,8846205593461229467,2097152 --field-trial-handle=1836,i,12371152785416425183,16666072892857263709,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:1
  2⤵
  PID:2876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --metrics-shmem-handle=6540,i,14955376357030669604,16813313002698101072,2097152 --field-trial-handle=1836,i,12371152785416425183,16666072892857263709,262144 --variations-seed-version --mojo-platform-channel-handle=6468 /prefetch:1
  2⤵
  PID:4276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --metrics-shmem-handle=6008,i,8901780746298360521,6375690581150457607,2097152 --field-trial-handle=1836,i,12371152785416425183,16666072892857263709,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:1
  2⤵
  PID:880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --metrics-shmem-handle=5604,i,6169138800655748422,13206613951623848123,2097152 --field-trial-handle=1836,i,12371152785416425183,16666072892857263709,262144 --variations-seed-version --mojo-platform-channel-handle=6912 /prefetch:1
  2⤵
  PID:4660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --metrics-shmem-handle=7292,i,9186906337471291587,11800637284368920528,2097152 --field-trial-handle=1836,i,12371152785416425183,16666072892857263709,262144 --variations-seed-version --mojo-platform-channel-handle=7328 /prefetch:1
  2⤵
  PID:3080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --metrics-shmem-handle=7276,i,16315929796359830100,10313610869703842825,2097152 --field-trial-handle=1836,i,12371152785416425183,16666072892857263709,262144 --variations-seed-version --mojo-platform-channel-handle=7496 /prefetch:1
  2⤵
  PID:2988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --metrics-shmem-handle=7532,i,4725895044763407833,17156848994119581243,2097152 --field-trial-handle=1836,i,12371152785416425183,16666072892857263709,262144 --variations-seed-version --mojo-platform-channel-handle=7488 /prefetch:1
  2⤵
  PID:460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --metrics-shmem-handle=7568,i,11503016013219413743,85415753770412705,2097152 --field-trial-handle=1836,i,12371152785416425183,16666072892857263709,262144 --variations-seed-version --mojo-platform-channel-handle=7804 /prefetch:1
  2⤵
  PID:3344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --metrics-shmem-handle=7932,i,3834070264292155602,11677709767579764618,2097152 --field-trial-handle=1836,i,12371152785416425183,16666072892857263709,262144 --variations-seed-version --mojo-platform-channel-handle=7940 /prefetch:1
  2⤵
  PID:2660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --metrics-shmem-handle=8080,i,15800084656427489509,17371388616412087191,2097152 --field-trial-handle=1836,i,12371152785416425183,16666072892857263709,262144 --variations-seed-version --mojo-platform-channel-handle=7576 /prefetch:1
  2⤵
  PID:4092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --metrics-shmem-handle=8108,i,15583911594394225193,7205550869603501266,2097152 --field-trial-handle=1836,i,12371152785416425183,16666072892857263709,262144 --variations-seed-version --mojo-platform-channel-handle=8232 /prefetch:1
  2⤵
  PID:4284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --metrics-shmem-handle=8368,i,11785358411241279769,16017894322704915363,2097152 --field-trial-handle=1836,i,12371152785416425183,16666072892857263709,262144 --variations-seed-version --mojo-platform-channel-handle=8388 /prefetch:1
  2⤵
  PID:5048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --metrics-shmem-handle=7540,i,4413927999998069175,17107790243117429423,2097152 --field-trial-handle=1836,i,12371152785416425183,16666072892857263709,262144 --variations-seed-version --mojo-platform-channel-handle=7768 /prefetch:1
  2⤵
  PID:3296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --metrics-shmem-handle=7180,i,6282385128823443516,7878538112905147565,2097152 --field-trial-handle=1836,i,12371152785416425183,16666072892857263709,262144 --variations-seed-version --mojo-platform-channel-handle=5760 /prefetch:1
  2⤵
  PID:3008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --metrics-shmem-handle=8628,i,8506319908196876687,5391928957808695759,2097152 --field-trial-handle=1836,i,12371152785416425183,16666072892857263709,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:1
  2⤵
  PID:4820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --metrics-shmem-handle=7728,i,5095408853696019983,3563351911311737950,2097152 --field-trial-handle=1836,i,12371152785416425183,16666072892857263709,262144 --variations-seed-version --mojo-platform-channel-handle=7764 /prefetch:1
  2⤵
  PID:5480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --metrics-shmem-handle=8368,i,6692635408351990003,17000111008938064934,2097152 --field-trial-handle=1836,i,12371152785416425183,16666072892857263709,262144 --variations-seed-version --mojo-platform-channel-handle=4824 /prefetch:1
  2⤵
  PID:5116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --metrics-shmem-handle=7124,i,16547262069852447091,13409171603269621034,2097152 --field-trial-handle=1836,i,12371152785416425183,16666072892857263709,262144 --variations-seed-version --mojo-platform-channel-handle=7844 /prefetch:1
  2⤵
  PID:716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --metrics-shmem-handle=5640,i,13118000171232270835,12998658897171755196,2097152 --field-trial-handle=1836,i,12371152785416425183,16666072892857263709,262144 --variations-seed-version --mojo-platform-channel-handle=7868 /prefetch:1
  2⤵
  PID:5364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --metrics-shmem-handle=6048,i,2257304908347269609,3822027889744230691,2097152 --field-trial-handle=1836,i,12371152785416425183,16666072892857263709,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:1
  2⤵
  PID:4440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3616,i,13424393874889287629,13067608816357283413,524288 --field-trial-handle=1836,i,12371152785416425183,16666072892857263709,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:14
  2⤵
  PID:2680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --metrics-shmem-handle=5932,i,13919017657737737017,7561562116603846309,2097152 --field-trial-handle=1836,i,12371152785416425183,16666072892857263709,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:1
  2⤵
  PID:4320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5584,i,6374583778625624034,16136179990173693274,524288 --field-trial-handle=1836,i,12371152785416425183,16666072892857263709,262144 --variations-seed-version --mojo-platform-channel-handle=6848 /prefetch:14
  2⤵
  - Modifies registry class
  PID:472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=7320,i,4720283609278626969,9810950524121816979,524288 --field-trial-handle=1836,i,12371152785416425183,16666072892857263709,262144 --variations-seed-version --mojo-platform-channel-handle=3104 /prefetch:12
  2⤵
  PID:1904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --metrics-shmem-handle=6440,i,5016498835639772840,1448264720218865931,2097152 --field-trial-handle=1836,i,12371152785416425183,16666072892857263709,262144 --variations-seed-version --mojo-platform-channel-handle=7388 /prefetch:1
  2⤵
  PID:4888

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4728

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4168

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:3680

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000005

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000005
Size 346KB
SHA256 06fb30c34e3d7cb64ec821dd7d1eee69613b4a84c3841c081dee7143c151555e
MD5 e4bc0d7ecc0b43b6b8bd71ed0d8e894a
SHA1 27776f4cfd2ff01e98221769cb4aa554a2670e6a
SHA512 4c0956fb89b264ceb8dcc20a8cf905a4ae784195e78c306d2c0577d2e4c0548b6058ecda0516a089dc97570864728ab60503bffd804af5d0934e5f9c8b1fa475
SSDEEP 6144:ZPNyy2q1x/xjj1YO1RKSXVSFAsamiA6r/dsaRDDQ9fSoA9pT1c/i:qy2qhGORKNARmiRRDkJIpv
TLSH
T1EB7423DE4C0A0C9960EAE1034BDF477B3A4A44E7E0C5EC52987C1DD26D9F2627CED688
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000009

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000009
Size 38KB
SHA256 7165713d3e1a610399471a5e93d5677508f62ef072c1151e72273bf4bd54f916
MD5 9436affc97843765a966b3568fa7e5ec
SHA1 7bfda74bb30589c75d718fbc997f18c6d5cc4a0b
SHA512 473ec3a843c33e18d6d194651fe11353fcd03a7959225faeabf8c77484155ea6a7bccb72dbaf2093ed53c408faa3be9f6fc907f7a5ddf8223375f9d09b504456
SSDEEP 768:eUEh2+iKBVQbBhu8vjenqz2Ez6Y/AxHLEaP72sV9qKYbDblXqhP8qwFSE3uk:eUEEoBVQDjeQaLnP2pfZTqgSEB
TLSH
T11703F112148F7FA1C244F224A4EFE416ACC3F565ABA15E6980B8B7C7010E3C657A46FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000b

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000b
Size 87KB
SHA256 38106711a3306af02257ac9e26038b6aa8b9445672d9e8a48de7ce96be1524ff
MD5 ca828b6a87f068a324b2cc84cc34c033
SHA1 ed7f841143ee782b7ba66c6ebcc15d1e90925de5
SHA512 d284831a68979f369258615fac773ee75c975a7a0e2f7052afb16e26c40d970e380cc570106005798cf0755e6e03878805f4870a75a75e307151ca094bdc55b5
SSDEEP 1536:uGvn8NqESBtMlcEqSbt68MRZYOEuVv3+fP+R4iIhwCow03RdKt:u88jSHMlBBAzEuh3sm3l/waO
TLSH
T148931239217FA2D2EB46BA4F55D57C358D363A40CCB0C2DB735AEF63B1981E66430088
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000d

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000d
Size 437KB
SHA256 a451b8791f9183f16a2b30959f9f69e20f35117f8ca6e34e463916869328f3c8
MD5 15d9ce7fe8b446c91cc0598983dde50a
SHA1 b2ad1e9b11a41f5176e3cc495dac68aa26e0955f
SHA512 39e14f23bbde8278b586057eeb648777afc1e6d11b71f3e5529688341f7868b61d0d7ef43cc925189a70def4a6b53e863a06fc8d36e7551c9a50745be6607529
SSDEEP 12288:9SyJNj5Vy52pw6eyroMIW3/dJhlzOH7pVUa0Uiku:9vJzV1pw/yroMfCIUfu
TLSH
T10B9423CFDB2108E7FE76C411CDAD9FE8049BA554056D8CB35BB6066D825A0808636FEF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000e

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000e
Size 547KB
SHA256 ec53b098190469e1ea7b2928a6e939c3fc66120c4239e9e24f68141ea0d93115
MD5 171d18bb5be84bcf9042270b662efbd7
SHA1 0851fc8b66e735c1b0e847bf8b31d774d645a447
SHA512 def7ad20ab622a23d805a4e14d2e864df749cb4276034cb16d1fb5bbb6697f211c1b09d055f806c8b464588b6bb24ee45a048bb70c25326f8144020278dc412f
SSDEEP 12288:TkZCrZkxH6Ps4V5e5R5dCOu8fOBmmOFjgXMbfP6UqbmaC0p97B:IZCNq6PsIW5LDgmmOS0fpqbcG9F
TLSH
T1F3C42355AFCDEBA7C37A800499B8283443681B7D306866518340D3B77A9F3ED9EACF45
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000015

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000015
Size 114KB
SHA256 81fd5d8c7c26410a2b0b01dedb2f5583a62353f83d52a41b1569fdd022de22bb
MD5 779440ee81a17f2f53fee1cc0e417285
SHA1 0b82b7d98565b0b5a4e9d4d138b791bb35c63ecf
SHA512 dcca3fe785a20255d0f8e6eb45f27a8e86ab6f6f8b8ebfab456fa6e8acad227d4ec115b234df17ae4a702f8ddd183387e227f5234d159cedf63e9280a954df42
SSDEEP 1536:HiCPAzdvzHGJKUu96uw4eTQgfV1yrbQkPCFAuMmubzsEroUZOa/ZxYwhaG3PRHW6:HYa7tTff2b8WuMmGoUZtR5JWKbPBqXo
TLSH
T194B3124D888DB3F21A2C56121513A2F2A9ECDA1695B1FBB14E1487501CDF5B8A3BC1FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00004b

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00004b
Size 21KB
SHA256 3c44bd25ef53316c02b246511806d414ce835c67b32c2a971033d695664bdc1e
MD5 e768c7440956a7b143fbbd8c2db7db0f
SHA1 8c8bd1519771e3df2b54d61984a70df596959c77
SHA512 41cedd15820afff05fea6c317cbb41168ea49759c47cca55281ea2b69219c8247b419c0a92769d771cf74a049f6d67c563fc0082453f8505bfbcd9fd4b9d12dc
SSDEEP 384:YcafuFex2Uio/kgHFx85pDxRG0+PMT4/59iKUynT9Qae4/tDN6qtYEV/0MS:reTxQo/1HFMRG0WiGbuynSa3x6qDV/xS
TLSH
T166A2E19420926435DEF8037AB79DAB0C564915C4FB6B1FC6D2130CD0AEB7CA0A7B6852
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000cb

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0000cb
Size 16KB
SHA256 4bbce6440d7faf968a2052124b806d19cc43a4630e39fb4087fbb0d89f1da590
MD5 b9d34ad3c774033fecc6f1986695c65f
SHA1 27d4d308afe22f867c25aa9ef1443126d610ec2e
SHA512 83bb532284cfb780de7a7621fd800f37123b6e63a9d18721d6bcb9a6e623464cc5011ac0e2f6e08bd26b29069ccafc9278066a0009ad3f450288d6a5778ccd1a
SSDEEP 384:6bqo1/M5MSFnKSurwE8kX8J8ZwR+ocOzTBg8ZB7Nww:6bqo56FnfbkX8CZwotADSw
TLSH
T1D372D020667BC0D39A99FCA6090C297670332B2F5D7A070C6D72925EB107747422CEAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 816594e0657e26a3897dcd546bb6e25fe621fbed5f2128528e5d996e80016fbd
MD5 4a4fd23711fced5f4c9d3138a0d02c76
SHA1 6dd65da57e3b03d415d665e23da373806d07dbc6
SHA512 10f250458050bb9e5561bb5c0caef3aec78e48352c2b6f92f2b0ece6c815f65a2d9fd640a2738aa433aa28669dd0e76ee65f694edb4de9fe24f4aa6b244d1875
SSDEEP 96:f6bYrpF1XFUM+0aEhj/FhgIXXxKPJOp1qbHRySFp5qu7Rv7y:fYW1Tx/7n1p+RskE
TLSH
T125B12E828698FA62FB24057781E92FBF7136166DC27B1F0353A8F9347902397ED5D022
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 39KB
SHA256 e36aa7c605ef471fe76505f0e279bc2d37554bfab1a657feedcc62db5bceb94d
MD5 1331e95b66f011e04d0f71c6b0898a06
SHA1 0bf2f947ea7666e7a7d1cb9e4d79a85d2937e44a
SHA512 e8f507db5ce7cc6f7ffb58ff0d2a320b40ea37ba22a3e08473650b569bffbc5b7772e22636b3af84970082545dd8c4c52007ff2c18f06c60a7ce73172f95c2c5
SSDEEP 384:DFf/zFcRW241QoBQJeXHUwa6BeO//esWwbBeVPvJte4J939JcmBv9ac9o9W9uxVk:Z7olyjKYtRZ3eNhVIi98Q83wMqrFt
TLSH
T16703B1F3C3E8C63DD96111F19B146E1ACE5D096817693D6BC4E4EE8753E28B2E28074E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 58e2b0042971c7cb9ff69e475d80607b600a00d7a193fdfb8bbb29622b75536d
MD5 ab1f8cf0d8992a040726333810a92430
SHA1 b5f84ae48379aaeac06559dda766b179f3069b03
SHA512 f7fc10b17b5db97c7a24c8940440df01503a7109ccb7356b78475657d97747f2cc1b475b6b3b0797b9e90201c0a9515704990dd54247609c4ba010502d87d50a
SSDEEP 192:iRPswRg2bv7ivaAPRp2hRi9BHsb+WNnQf4ax2YR+VyIsnAUge:iREwR/jGvbXnDwk32c2e
TLSH
T1AA32912EAE147A3B9CDAD219FA627653D3F6102535913E80EAFC893C21E75DD2217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 29c02a9d823d89d326fe99f76a3db1786c875061c0446c0890ad9522aaf57d56
MD5 e1294178d8b2fbd9409cdf25fad68259
SHA1 b83fcff8504570a81820ffddbe1529446c70b373
SHA512 058114bf8cb223dc349153fad8ba51648bc95376a9ad84ee9f7f53ca91f56f63cb94da2513ad4c3b85e53a39127571642121905a80bedd575932e1510c706517
SSDEEP 192:mRPsYcBzRgDbv7ivaAPRp2bBafvlkX9BHsb+WNaXVcjBvMkcn+VyIsnAUgE:mREYmzRijGvbXMDwJWkW2E
TLSH
T10942966EAA207A7B9DDAD219F921B797E3F2102535C02E80E6FC8D3C21E75DD2217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 b6bf9887d538db5d1a7efbebba7e66848a3655d04a1b58fbd8a27cec2967a761
MD5 93fc91cfaa50f713283375c04ad61242
SHA1 3629b436136c4e528526d5b9c60397e5c98dce48
SHA512 8d13a0643e1974752a95a2c6c8e41da19159e35bb6c95ea37df4fc5618209fd12bc9d78549947a319e2ee5a05f234e8fd491b925a04c27ae9238e0f98e286558
SSDEEP 192:iRPsYcBzRgKbv7ivaAPRp2h8fWX9BHsb+WNYxGQf4kzePn+VyIsnAUgE:iREYmzRjjGvbXODwY3vev2E
TLSH
T19232932EAA107A3B9CDBD21AF96277A3E3F1102535852E84E6FC8D3C21E75DD2217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 366d0d8c38397c3b8324fef6218e47cf8b43ccd939ea3f691b19625b111b4bdc
MD5 4d4db1171c7a305c708a93998841dbd0
SHA1 d27f7190e61f2e703490fecaec0717673b2d7a3e
SHA512 c073632347e7fd1a489b885b12052fc4bda1434f1c9ced668c0d65df8195b9dca24b10e53422b80b3421512407ed4069ac14087f898b4df90a937503ae423611
SSDEEP 192:mRPsYcBzRgDbv7rvaVPRpjk2TBafvlkX9BHsb+WNaXVcjBYvE8j+VyIsnAUgE:mREYmzRijnv4X1tDwJWEg2E
TLSH
T1DF52A56BA910293B9CDAC21DF921B7A7E3F2102575D02E80E6FC8D3D25D76DD2217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 57a4846ecaf67dfb405915b77ca8376c4c1492fbfeaa611ecb678895e0ad3cf8
MD5 b4db0594b3cbc17d09fc47b1435ac311
SHA1 5b7c42b955abaffc6b05c7159fbfb969276ef9ca
SHA512 19494268188ff0322a61cb60673bd523c1c3a00e619830ccdcc9631adb6e3fb6255a17f2061e56a7f4668067e7a9552f84532d1e067cfcd057f509d604468eab
SSDEEP 192:iRPsYcBzRg2bv7ivaAPRp2h8fWS9BHsb+WNYxGQf4kzeKR+VyIsnAUge:iREYmzR/jGvbXTDwY3veO2e
TLSH
T13632932EAE207A3B9CDAD21AF9617793D3F2102535942E80E6FC8D3C11E75DD2217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 040ea7cf3033b16a0b9aeae2737afc9795b3b36d72fa964ce2ce5676e57da95c
MD5 c115d4f5529e1f83786e9e254296569a
SHA1 267350348b398e7b3feff0d99507edc228596e4c
SHA512 b2e55945a292e454e70450b70d6d6489222b93b80c8cf255c8d963ea724578fe7869323857242667f59ee7eabfc9c37b9cb79cabcac8ebe10b9054b41525e85b
SSDEEP 384:Y+jSx7KxkXqKf/pUZNCgVLH2Hfgsle3XODU3+ErU30koHGHnJnBbcAh:YOSx7KxkXqKf/pUZNCgVLH2HfgsMHOge
TLSH
T140520867688D9A3B0FC8D58CD8166F4FADB1025B76680D2453FA9C0803A97DB114A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\28da9c56fde4021055a681112c092453f74d8dd8\16a5344b-780a-4917-90d9-34cd5728df52\index-dir\the-real-index
Size 72B
SHA256 58aeed83ac84ff88b3d701018cd9f42ff0381190096f16192dec1d1635ab9886
MD5 653ce004319271729b34f9bff31528eb
SHA1 a6009ede9c1b8ef1f20e80519fc1d573e902a5aa
SHA512 ef92c2dc2d809bfca62e6c76988dc57743fb19204cfcf844a9bb649139c7a418177435020d37b64ab5f594b4bb34e9fda659ca1197d3189f2beaafbd15536afe
TLSH
T10EA0023251940122DD0826705452CA90632048104283125E44D892A69D61648D171834
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a19e2.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\28da9c56fde4021055a681112c092453f74d8dd8\16a5344b-780a-4917-90d9-34cd5728df52\index-dir\the-real-index~RFe5a19e2.TMP
Size 48B
SHA256 38f03eff48ff29a42e64652ee18d25d9a8b1dced3a31e1db635769d1c472cb9e
MD5 d092076d49e8784933002f7536cfbcc0
SHA1 a1dedbe0baf34473b28831b6ecad25600d6ff804
SHA512 0a4bb7f8655d504fc0281d1e829130d2c695ed9316527f17621dcf2dfe4087b01a95126c058234bd39f5a92a024fcc11bbd91f91ac9f33de1ba82a7978bf5386
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\28da9c56fde4021055a681112c092453f74d8dd8\index.txt
Size 135B
SHA256 d7b9ae68261a78ed122d267dbfef69a8bcb9a25fc1891b6881227876ad0ac99b
MD5 1da40f151951830de7ad3fea43179fa3
SHA1 c31e955da0900db88a905cb0eb6f42b5d1954790
SHA512 01654463072501d068ab19c64acc501806777b681c99297fe09e690ef692042df570e8f9c3f1961da8c870a9dc2d9b4094cca6a34ce737b7f2eca92a0133997e
TLSH
T109C09BDB965AD5011ED0D3D53635577C8D2B16D9C49C44D6C50458D663505B281438F6
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5a1a11.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\28da9c56fde4021055a681112c092453f74d8dd8\index.txt~RFe5a1a11.TMP
Size 141B
SHA256 8de22738b7f53bb266dddbdf7eaa2870f4f372714e58d5aa3cd86349a7dde762
MD5 45d29e49a3c1cfcb32ca03cc2e024b93
SHA1 b3a3492ff4e2cf91307c8ad3546c4ea14f743a7b
SHA512 f9d0f297cf6ae89d8964af15091cf51e189155fa7e5354f00503987ca76a6a83bd6edec681df9dafbdc9a42f0abc828f9093dc6013c45ab1c64167dbb6cde985
TLSH
T157C02BE79256A2012FC0C2D13134176C8C3B0ED4C88C44C5C00030F233709B3C2028F2
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 144B
SHA256 a5c955947656ffcb882c9aab70048c18f7f3f583f2c5cd8a2110a938c74b9b3f
MD5 75d5d6135e8e312826b4462fbb9f3168
SHA1 002294e1dced5dfbe0386fb66386ab38f12ccf52
SHA512 742bea14cefb2f4d10b2e9a395b8fabf6f5e95bae345f2990fe180906d8b4625426cd82c23aeb08e9f0c31a11cb769c3b29818323fb729411d8898d63714ce02
TLSH
T184C01201C80E1092C8404270D94B125D63118F32C5046513D3F0E6D9ACE73B19126525
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 120B
SHA256 e5eb7ffb07929783c90ec41de95c000e71d33fd83605018c1ad327ab80e6930e
MD5 15f8bccae0328fdf5581035cb986c116
SHA1 81cf680a4c0b3beeae84e6416cc4c622c0bec73b
SHA512 ba14dcce721fc85ee68d17dee32e289a9ca9d3909413ecd94968d4e5e773997757838ba32b8e62b9181d8b7d26d9e9cebcd49fe7008f841a8c05a3484dbfe08b
TLSH
T107B012B002B00605C516F634C3C712D423D2AC114323460B496840454C4225E4930559
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 57c1cd4f7731f17d35e954adfee9cdbd87c2ab447dfe65ad1dd132295ff05fd7
MD5 42d3f0b463ec04b5701dadf9086e77d0
SHA1 1d498690e8f9ff341e70737aff98f41d4716ea59
SHA512 36f5470674153230ee87c7c637e61df2262a6a7df419830eaf265f67f3ee68b4c757fba8ac24efdcf860465ceb3adcc9ff89bc4f8695ef13cff2cd4641f686df
TLSH
T12AA00273F5C11C15DD504374E2A90F796752485936F1D30B55D59584895B6C4C30D100
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5965c5.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe5965c5.TMP
Size 48B
SHA256 4745451bbff82d31e69a597e91fc38d7600bf71d74665379139c738ab64caf30
MD5 088721cbdc6da14490eb6567f37a7b43
SHA1 d4d467c4a4e5af0bb248cb84e9e0960214a7bb30
SHA512 39320dc6835bffb73f7cc8a7b43a501242aedfdfa931310bb9b8f219e8b3013f4596d8360ed64604d4771b4d7b0719c7c3c50cb4c5f911b06178d12e9966a2d7
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 133KB
SHA256 f9c45766a6532ed776b85dea4e83ffe737e872e1a8ae9e207ee071fd19fb1245
MD5 5f3faccbdaa55e6a47b5413d21392d58
SHA1 ffb1d15c716e54d5936ffa365cb4034a8c5f1de3
SHA512 31b6ed159ff3897a175d866260a988055416587a322d53a1a6078c1383f5d5c381ccfa8a9faa0717618a8a973610a9f38831cbda0a10df3e7fe9e1e1a0617889
SSDEEP 3072:GRh4di2XC4pU/jejEChAIeRsXSFSKWm7GGeQHo3qxmvwIt:GRaG4pEejPhAIuNWmTETIIt
TLSH
T1FBD312251F3D9639CEDED23DE257152A28184CB9848A0BC81ACD1EDF54EB5C85B3AF30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 134KB
SHA256 04662043202d4938354622f6ca8fe7a527024e4def24fc1222dedd4e69ad91d4
MD5 66101c1441c9d028ea25662d26af580a
SHA1 c48e392e6b77e813475aede7519abe5ce3fd2272
SHA512 dc28447d7fac4f7aacd86163adba30ae324039d3a19506c24b143ef0430c8e2ff4fff7ebe11a6aa80e1e6a4b12f259a65f408a7e05c11e3b572890f07fb98f58
SSDEEP 3072:oyh4di2XC4pU/jejEChAIeRsXSFSKWm7GGeQHo3qxmvwIt:oyaG4pEejPhAIuNWmTETIIt
TLSH
T1CFD312351E2D9639CEEED23C925735261C585DBAC48A1BC869CC2DCF94DF4885E2BE30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 133KB
SHA256 028bfb98ca56d337d96dde77388e4d43e700c82077e2b45cbd81b98a0f72b480
MD5 b0023ebc35127dc196b80d0f5977ca49
SHA1 425ac88a73c2b889e882bd28b35362437b79cdac
SHA512 e3509cddfd873838da6473945492f80af453590f6b6ca05d7fb18868594ba06408d568c299cb144055c477fbb1ae2a7b61a5a682f4f06f31081d6214b47b44cd
SSDEEP 3072:bRh4di2XC4pU/jejEChAIeRsXSFSKWm7GGeQHo3qxmvwIt:bRaG4pEejPhAIuNWmTETIIt
TLSH
T103D312251F3D9639CEDED23DE257152A28184CB9848A0BC81ACD1E9F54EF5885B3AF30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 cdf2fd8b8347c7ab433709691db293ebc077af4b23fcadcfedc9aef3f742bc10
MD5 40e75e3e253d922efd9e75713b3b31c2
SHA1 9e3a1a7d7b56b6eb4c4029457646a81d33ea5f97
SHA512 e74c5f9099dc218e0979bb950dc15b42fda28a3bfee3ea8ebcb1a53230b663d5d54e6918543ac4dc59aec96584b9fd03c3f2a7f1fbe5896808dea2425a77b0dc
SSDEEP 96:JC6VCd+cQXKGYXddbIfZMT4hJ+GexRDotok5nADrB6DGyvXi9afbPzv4a:JCSC/JXddkhVaDUD2VXb9afbP
TLSH
T135A1C771A9799D7B59B6C989FA433B03CFA8215FA551AFC4C9EC6E0C10EB1E81343613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 133KB
SHA256 b957b77696148e1a43599017246248fe71f281e2cf3dd62cd47ded54729bbe37
MD5 65e1a9824f122a72def2364f6a504452
SHA1 248c0aac6b9ce563371021a4d4898f4902d0b079
SHA512 d00ca43c9a6d4a6a85f4c4607e24eba4d16cd33ee0ca557917cc4811c3e2fdb6cab10b5a02429bccbe1f72fa1bd03cd3f85d99c5ee61a1587ad1bf0283d300ab
SSDEEP 3072:ARh4di2XC4pU/jejEChAIeRsXSFSKWm7GGeQHo3qxmvwIt:ARaG4pEejPhAIuNWmTETIIt
TLSH
T1B3D312251F7D9639CEDED23DE257152A28184CB9848A0BC81ACD1E9F54EB5845B3AF30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5940_342242523\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download